NetSec-Pro Connectivity And Security — 20 Questions

Question 1

A network engineer needs to monitor traffic between two zones using a specific interface. Which feature must be enabled to view application-level traffic details without affecting the traffic flow?

Accepted Answer

Enable Log Forwarding on the security policy.. Virtual Wire or tapping configurations allow traffic visibility, but within a routed environment, enabling App-ID and proper logging on security policies is the standard method for monitoring traffic details.

Answer

Disable the security policy.

Answer

Implement a Decryption Policy.

Answer

Create a mirror port on the switch.

Question 2

A firewall is experiencing high CPU usage on the management plane. Which command can identify if specific logging tasks are consuming excessive resources?

Accepted Answer

show system statistics. The 'debug software log-receiver' commands and 'show system statistics' are essential for checking management plane utilization by specific processes.

Answer

debug dataplane packet-diag

Answer

show running config

Answer

show session all

Question 3

When using OSPF with a Palo Alto Networks firewall, which area type would you configure to ensure the firewall does not receive external routing information while still maintaining connectivity to the backbone?

Accepted Answer

Totally Stubby Area. A Totally Stubby Area (TSA) is a Cisco/PAN-OS supported OSPF area type that blocks Type 3 (inter-area), Type 4, and Type 5 LSAs from entering the area, while the ABR injects a single default route. This means the firewall receives no external routing information but still has connectivity to the backbone via the default route. It is the most restrictive stub variant and is ideal for edge devices that should not carry external routes.

Answer

NSSA

Answer

Backbone Area (Area 0)

Answer

Standard Area

Question 4

Which tab in the Palo Alto Networks GUI displays the current session table?

Accepted Answer

Network > Runtime Stats > Session Browser. The 'Runtime Stats' section under 'Network' displays the active session table, which is essential for real-time monitoring of active flows.

Answer

Policies > Security

Answer

Device > Setup > Management

Answer

Monitor > Logs > Traffic

Question 5

You are troubleshooting a scenario where internal users cannot access an external server. The traffic log shows the traffic is 'allowed', but the byte count is 0. What is the most likely cause?

Accepted Answer

MTU mismatch causing packet drops in the return path.. When the traffic log shows 'allowed' but the byte count is 0, it indicates that the firewall allowed the session but no packets were actually transmitted or received. A common cause is an MTU mismatch, where large packets are dropped in the return path due to fragmentation issues, leading to zero bytes being counted.

Answer

The NAT policy is missing.

Answer

The Security Policy is misconfigured.

Answer

App-ID is failing to identify the traffic.

Question 6

Which type of VPN tunnel configuration is required for a Palo Alto Networks firewall to act as a client connecting to a third-party VPN gateway?

Accepted Answer

Route-based VPN. For a Palo Alto Networks firewall to act as a VPN client connecting to a third-party VPN gateway, a route-based VPN (also called a policy-based VPN in some vendor terminology, but in PAN-OS specifically route-based) is required. Route-based VPNs use a tunnel interface (tunnel.x) and static or dynamic routing to direct traffic into the tunnel, which is necessary when the remote peer is not a PAN-OS device and cannot negotiate policy-based selectors in the same way.

Answer

Policy-based VPN

Answer

SSL VPN

Answer

L2TP VPN

Question 7

Which TWO settings are configured within a GlobalProtect Gateway to manage user access?

Accepted Answer

Authentication profile.. In a Palo Alto Networks GlobalProtect Gateway, the Authentication profile (option B) is a required setting that defines how users are authenticated (e.g., against LDAP, RADIUS, SAML, or local databases) before access is granted, directly governing user access. The Tunnel interface selection (option C) is also configured on the gateway and determines which tunnel interface terminates the GlobalProtect SSL/IPsec tunnels, tying user sessions to a specific security zone and policy enforcement point. Options A, D, and E are incorrect because interface speed settings, SNMP community strings, and global NTP server configuration are general device/network management settings and play no role in authenticating or authorizing GlobalProtect user access.

Answer

Interface speed settings.

Answer

SNMP community strings.

Answer

Global NTP server configuration.

Question 8

A NetSec-Pro administrator has deployed a Palo Alto Networks firewall with two ISP links and wants to ensure that outbound web traffic fails over to the secondary ISP only when the primary path's latency exceeds 200 ms, while preserving existing sessions during the transition. Which configuration should the administrator implement?

Accepted Answer

Policy-Based Forwarding with a PBF rule that references a link-monitoring profile bound to the primary egress interface.. The requirement is to fail over based on latency and preserve sessions. Policy-Based Forwarding with a link-monitoring profile can monitor latency and trigger failover when the threshold is exceeded. Existing sessions are preserved because the firewall maintains session state and can re-route packets without tearing down the session. Other options lack latency-based monitoring or session preservation.

Answer

A static route with a lower metric on the secondary ISP and a floating static route on the primary ISP.

Answer

A virtual router with OSPF configured on both ISP interfaces and cost manipulation based on interface bandwidth.

Answer

ECMP with maximum path count set to two and a static route to 0.0.0.0/0 with equal metrics.

Question 9

A network security engineer is configuring a Policy-Based Forwarding (PBF) rule to redirect HTTP traffic from the guest VLAN to a web proxy. After committing, the engineer notices that the traffic is still following the default route to the internet. The PBF rule is enabled, and the source zone and source address are correct. What is the most likely reason the PBF rule is not being matched?

Accepted Answer

The PBF rule's source address is specified as a subnet, but the guest VLAN uses DHCP and the actual IP is not in that subnet.. Policy-Based Forwarding (PBF) allows forwarding decisions based on criteria beyond the routing table. For a PBF rule to match, all specified criteria must be met, including source address. If the guest VLAN clients have IP addresses outside the configured source subnet, the rule is bypassed. Verifying the actual source IP and adjusting the PBF rule's source address to match the DHCP scope resolves the issue.

Answer

The PBF rule does not have a 'negate' option enabled, so it only matches traffic that does not match the criteria.

Answer

The PBF rule is evaluated after the security policy, and the security policy is allowing the traffic without forwarding.

Answer

The PBF rule requires a destination zone to be specified, and it is currently set to 'any'.

Question 10

A security engineer is configuring a Site-to-Site VPN between two Palo Alto Networks firewalls. After committing the configuration, the tunnel status shows 'red' and no traffic passes. The engineer confirms that the IKE Phase 1 and Phase 2 settings match on both peers. Which additional configuration is required on both firewalls to allow the tunnel to establish?

Accepted Answer

A static route pointing to the tunnel interface for the remote network.. For a route-based VPN to establish, the firewall must have a route that directs remote subnet traffic to the tunnel interface. Without it, the firewall cannot send encapsulated packets to the peer, and the tunnel remains down. IKE and IPsec settings matching is necessary but not sufficient; routing is a critical piece that is often overlooked.

Answer

A security policy allowing traffic from the VPN zone to the VPN zone.

Answer

A management profile allowing IKE and IPsec on the external interface.

Answer

A NAT policy exempting traffic between the local and remote networks.

Question 11

A network security engineer is configuring a Palo Alto Networks firewall to enforce security profiles on decrypted traffic. After applying a Decryption policy, the engineer notices that the firewall is not decrypting traffic to a specific website because the certificate is signed by an untrusted CA. The engineer wants to allow decryption while avoiding certificate errors for users. What should the engineer configure?

Accepted Answer

Configure SSL Forward Proxy with a Decryption profile that allows untrusted certificates and enable the firewall to forward the untrusted certificate to the client.. SSL Forward Proxy decryption allows the firewall to inspect outbound SSL traffic. When the external server uses a certificate signed by an untrusted CA, the firewall's Decryption profile can be set to allow untrusted certificates and forward the original certificate to the client. This enables decryption without blocking the session, though the client may still see a warning. This configuration balances security inspection with user access.

Answer

Enable SSL Forward Proxy and configure a Decryption profile to block sessions with untrusted certificates.

Answer

Add the website's CA certificate to the firewall's trusted certificate authorities list and enable SSL Forward Proxy decryption.

Answer

Configure SSL Inbound Inspection to decrypt traffic to the internal web server and apply security profiles.

Question 12

An administrator is configuring a Security Profile Group to apply to a security policy rule. The goal is to inspect traffic for threats and block malicious files. Which TWO security profiles are mandatory to include in the group to achieve this? (Choose two.)

Accepted Answer

Antivirus. To inspect traffic for threats and block malicious files, the Security Profile Group must include Antivirus and Vulnerability Protection. Antivirus scans for malware, while Vulnerability Protection blocks exploits. These two profiles together provide the core threat prevention capabilities. Other profiles like URL Filtering, File Blocking, and Data Filtering serve different purposes and are not mandatory for this specific objective.

Answer

File Blocking

Answer

URL Filtering

Answer

Data Filtering

Question 13

A network security engineer is configuring a Site-to-Site VPN between a Palo Alto Networks firewall and a third-party VPN gateway. The engineer wants to ensure that the tunnel interface is included in the routing table so that traffic destined for the remote network is routed correctly. Which action must the engineer take?

Accepted Answer

Create a static route for the remote network with the tunnel interface as the next hop.. To include the tunnel interface in the routing table, a static route must be created that points to the tunnel interface for the remote network. This ensures that traffic destined for the remote subnet is sent through the tunnel. Assigning an IP address and enabling the interface are prerequisites but do not add routes; dynamic routing is an alternative but not required.

Answer

Enable RIP or OSPF on the tunnel interface.

Answer

Assign an IP address to the tunnel interface and enable it.

Answer

Configure a policy-based VPN instead of a route-based VPN.

Question 14

A security administrator is configuring a new security policy on a Palo Alto Networks firewall. The administrator wants to ensure that the policy only allows traffic from the 'Trust' zone to the 'Untrust' zone for web browsing (HTTP and HTTPS) and blocks all other applications. Which type of security policy rule should the administrator create?

Accepted Answer

A rule with source zone 'Trust', destination zone 'Untrust', application 'web-browsing' and 'ssl', and action 'Allow'.. To allow only web browsing (HTTP and HTTPS) and block other applications, the security policy must use application filters that match those protocols. The 'web-browsing' application covers HTTP, and the 'ssl' application covers HTTPS. Specifying both ensures that only web traffic is allowed. Using service ports instead of applications would allow any application on those ports, which is less secure. Using 'any' application is too permissive.

Answer

A rule with source zone 'Trust', destination zone 'Untrust', application 'web-browsing', and action 'Allow'.

Answer

A rule with source zone 'Trust', destination zone 'Untrust', service 'service-http' and 'service-https', and action 'Allow'.

Answer

A rule with source zone 'Trust', destination zone 'Untrust', application 'any', and action 'Allow'.

Question 15

A security administrator is configuring a Site-to-Site VPN between two Palo Alto Networks firewalls. The administrator needs to ensure that the tunnel interface is included in the routing table so that traffic destined for the remote network is routed through the VPN tunnel. Which two configurations are required to achieve this? (Choose two.)

Accepted Answer

Add the tunnel interface to a virtual router and assign it an IP address.. To route traffic through a route-based VPN tunnel, the tunnel interface must be part of a virtual router and have a static route pointing to it for the remote network. The virtual router holds the routing table, so the interface must be assigned to it. A static route with the tunnel interface as the next hop ensures that traffic destined for the remote network is directed into the tunnel. These two steps are essential for proper routing.

Answer

Configure a policy-based VPN instead of a route-based VPN.

Answer

Enable OSPF on the tunnel interface to dynamically learn routes.

Answer

Assign the tunnel interface to a security zone.

Question 16

An administrator is configuring a GlobalProtect portal and wants to ensure that users are authenticated using a certificate before they can download the GlobalProtect agent. Which setting should be configured in the portal?

Accepted Answer

Authentication Profile with Certificate. In a GlobalProtect portal configuration, the authentication method for users is defined in an Authentication Profile. To require certificate-based authentication before agent download, the administrator must create an Authentication Profile that uses a certificate method and assign it to the portal. This enforces that users present a valid certificate during portal login, ensuring only authorized users can download the agent.

Answer

Certificate Profile

Answer

Client Certificate

Answer

Portal Authentication with SAML

Question 17

A network engineer is configuring a Palo Alto Networks firewall to route traffic between two virtual routers. The engineer wants to ensure that if one virtual router fails, traffic is automatically rerouted through the other. Which feature should be configured to achieve this?

Accepted Answer

Dynamic routing with OSPF or BGP. Dynamic routing protocols such as OSPF or BGP enable automatic route exchange and failover between virtual routers. When a link or router fails, the protocol reconverges and routes traffic through an alternate path, ensuring continuous connectivity without manual intervention.

Answer

Virtual Router Redundancy Protocol (VRRP)

Answer

Static routes with backup paths

Answer

Policy-Based Forwarding (PBF)

Question 18

An administrator notices intermittent packet loss in a GlobalProtect deployment where users connect via IPv6. Which configuration change is likely to resolve the issue if MTU fragmentation is suspected?

Accepted Answer

Decrease the MTU size on the tunnel interface.. Intermittent packet loss in IPv6 GlobalProtect tunnels is often caused by MTU fragmentation issues because IPv6 does not allow routers to fragment packets. Decreasing the MTU size on the tunnel interface reduces the packet size, preventing fragmentation and the resulting drops. This is a common fix for MTU-related connectivity problems.

Answer

Increase the GlobalProtect timeout value.

Answer

Disable hardware offloading for IPv6.

Answer

Enable IPv6 transition mechanisms on the external interface.

Question 19

An administrator wants to use DHCP to assign IP addresses to GlobalProtect clients. Where is this setting configured?

Accepted Answer

Network > GlobalProtect > Gateways > Client Settings. In Palo Alto Networks GlobalProtect, DHCP address assignment for clients is configured under Network > GlobalProtect > Gateways > [Gateway] > Client Settings, where the administrator specifies the IP pool and can select DHCP as the address assignment method. This is where the gateway tells connecting clients how to obtain their tunnel IP, so it is the correct location for this setting.

Answer

Objects > Addresses

Answer

Network > DHCP > Server

Answer

Device > Setup > Management

Question 20

Which CLI command is most effective for verifying if a specific packet is being blocked by a security policy in real-time?

Accepted Answer

test security-policy-match source destination protocol . The 'test security-policy-match' command simulates a packet against the current security policy and shows which rule would match, including whether it would be allowed or denied. It is the most direct CLI tool for verifying real-time policy enforcement for a specific flow.

Answer

debug dataplane packet-diag

Answer

show running security-policy

Answer

show session all filter source <ip>