NetSec-Pro Connectivity And Security Practice Test 2 — 15 Questions

Question 1

An administrator is configuring a GlobalProtect portal and wants to ensure that users are authenticated using a certificate before they can download the GlobalProtect agent. Which setting should be configured in the portal?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Authentication Profile with Certificate. In a GlobalProtect portal configuration, the authentication method for users is defined in an Authentication Profile. To require certificate-based authentication before agent download, the administrator must create an Authentication Profile that uses a certificate method and assign it to the portal. This enforces that users present a valid certificate during portal login, ensuring only authorized users can download the agent.

Answer

Certificate Profile

Answer

Client Certificate

Answer

Portal Authentication with SAML

Question 2

A network engineer is configuring a Palo Alto Networks firewall to route traffic between two virtual routers. The engineer wants to ensure that if one virtual router fails, traffic is automatically rerouted through the other. Which feature should be configured to achieve this?

Accepted Answer

Dynamic routing with OSPF or BGP. Dynamic routing protocols such as OSPF or BGP enable automatic route exchange and failover between virtual routers. When a link or router fails, the protocol reconverges and routes traffic through an alternate path, ensuring continuous connectivity without manual intervention.

Answer

Virtual Router Redundancy Protocol (VRRP)

Answer

Static routes with backup paths

Answer

Policy-Based Forwarding (PBF)

Question 3

An administrator notices intermittent packet loss in a GlobalProtect deployment where users connect via IPv6. Which configuration change is likely to resolve the issue if MTU fragmentation is suspected?

Accepted Answer

Decrease the MTU size on the tunnel interface.. Intermittent packet loss in IPv6 GlobalProtect tunnels is often caused by MTU fragmentation issues because IPv6 does not allow routers to fragment packets. Decreasing the MTU size on the tunnel interface reduces the packet size, preventing fragmentation and the resulting drops. This is a common fix for MTU-related connectivity problems.

Answer

Increase the GlobalProtect timeout value.

Answer

Disable hardware offloading for IPv6.

Answer

Enable IPv6 transition mechanisms on the external interface.

Question 4

An administrator wants to use DHCP to assign IP addresses to GlobalProtect clients. Where is this setting configured?

Accepted Answer

Network > GlobalProtect > Gateways > Client Settings. In Palo Alto Networks GlobalProtect, DHCP address assignment for clients is configured under Network > GlobalProtect > Gateways > [Gateway] > Client Settings, where the administrator specifies the IP pool and can select DHCP as the address assignment method. This is where the gateway tells connecting clients how to obtain their tunnel IP, so it is the correct location for this setting.

Answer

Objects > Addresses

Answer

Network > DHCP > Server

Answer

Device > Setup > Management

Question 5

Which CLI command is most effective for verifying if a specific packet is being blocked by a security policy in real-time?

Accepted Answer

test security-policy-match source destination protocol . The 'test security-policy-match' command simulates a packet against the current security policy and shows which rule would match, including whether it would be allowed or denied. It is the most direct CLI tool for verifying real-time policy enforcement for a specific flow.

Answer

debug dataplane packet-diag

Answer

show running security-policy

Answer

show session all filter source <ip>

Question 6

When troubleshooting a BGP peering issue between a Palo Alto Networks firewall and an ISP, which log should be reviewed to see state changes and neighbor messages?

Accepted Answer

System logs. BGP peering state changes (Idle, Connect, Active, OpenSent, OpenConfirm, Established) and neighbor messages such as OPEN, KEEPALIVE, NOTIFICATION, and UPDATE are logged in the System logs on Palo Alto Networks firewalls. Reviewing System logs is the correct way to diagnose why a BGP session is flapping or failing to establish.

Answer

Traffic logs

Answer

Threat logs

Answer

Config logs

Question 7

An administrator is configuring a Site-to-Site VPN and needs to ensure that the tunnel interface is included in the routing table. What must be done to ensure traffic can be routed across the tunnel?

Accepted Answer

Add a static route in the Virtual Router pointing to the remote subnet using the tunnel interface as the next hop.. For a route-based Site-to-Site VPN, the tunnel interface must be reachable via the routing table. Adding a static route in the Virtual Router that points to the remote subnet with the tunnel interface as the next hop ensures traffic destined for the remote network is directed into the VPN tunnel. Without this route, the firewall has no path to send encrypted traffic.

Answer

Configure the tunnel interface in a separate security zone.

Answer

Change the tunnel interface type to Layer 3.

Answer

Enable Proxy-ID settings on the tunnel interface.

Question 8

Which log type should be filtered if you are searching for specific firewall configuration changes made by an administrator?

Accepted Answer

Config Logs. Config Logs in Palo Alto Networks firewalls record configuration changes made by administrators, including who made the change, what was modified, and when. When investigating firewall configuration modifications, Config Logs are the authoritative source because they capture the commit history and administrative actions on the device.

Answer

System Logs

Answer

Threat Logs

Answer

Traffic Logs

Question 9

A user is unable to access an application via GlobalProtect. The logs show the user is authenticated, but the session is reset. What should the administrator check first?

Accepted Answer

Verify the Security Policy to ensure traffic is allowed from the GlobalProtect zone to the internal zone.. When GlobalProtect authentication succeeds but the session is reset, the most likely cause is that the decrypted tunnel traffic is being denied by a Security Policy rule. The GlobalProtect zone (tunnel interface) must have an explicit allow rule to the internal/trust zone for the user's applications. Checking the Security Policy first confirms whether the reset is a policy drop rather than an authentication or client issue.

Answer

Check the client's OS version.

Answer

Check the authentication server status.

Answer

Restart the GlobalProtect service.

Question 10

An administrator needs to restrict access to a specific internal server to only one remote VPN user. What is the most secure method?

Accepted Answer

Create a security policy with a Source User-ID for the VPN user and a Destination Object for the server.. The most secure method is to create a security policy that uses a Source User-ID for the specific VPN user and a Destination Object for the internal server, which enforces least-privilege access based on identity rather than IP. This ties the policy to the authenticated user, so only that user can reach the server, regardless of which IP the VPN assigns.

Answer

Set the user to 'Any' in the security policy.

Answer

Create a NAT policy to map the user's IP to the server.

Answer

Assign the VPN user a unique IP pool.

Question 11

An administrator observes that traffic is being correctly identified by App-ID, but the firewall is not applying the expected security profile. What is the most likely reason?

Accepted Answer

The Security Policy is missing an attached Security Profile Group.. App-ID correctly identifying traffic only proves that the firewall's identification engine is working; it does not mean any action will be taken. In Palo Alto Networks PAN-OS, a Security Policy rule must have a Security Profile Group (or individual profiles) attached to enforce antivirus, anti-spyware, vulnerability protection, URL filtering, or file blocking. Without an attached profile group, the rule simply allows or denies traffic based on App-ID and user/zone matching, but no content inspection is applied.

Answer

The Zone protection profile is misconfigured.

Answer

App-ID is disabled globally.

Answer

Decryption is not enabled.

Question 12

When troubleshooting a site-to-site VPN that is stuck in 'INIT' status, what is the most likely cause?

Accepted Answer

Incorrect peer IP address or network connectivity blocking UDP 500/4500.. A site-to-site VPN stuck in 'INIT' status means IKE Phase 1 has not completed — the firewall has not received a valid IKE response from the peer. The most common causes are an incorrect peer IP address (so IKE packets go nowhere) or network connectivity blocking UDP 500 (IKE) and UDP 4500 (NAT-T), preventing the IKE exchange from completing.

Answer

Mismatched DH Group in Phase 2.

Answer

Incorrect Proxy-ID settings.

Answer

Expired certificate on the peer.

Question 13

An administrator is implementing PBF (Policy Based Forwarding). What is a requirement for PBF to function correctly?

Accepted Answer

The PBF rule must be placed in the policy and reference a valid egress interface or next hop.. Policy-Based Forwarding (PBF) requires a rule that specifies a valid egress interface or next hop for matching traffic. Without a properly defined forwarding action (interface or next hop), the PBF rule cannot direct traffic, and it will not function. The rule must also be placed in the policy correctly and match the desired traffic.

Answer

The destination must always be an IP address object.

Answer

PBF must be enabled at the global configuration level.

Answer

PBF can only be used on Layer 2 interfaces.

Question 14

What is the result of having two security policies with the same source, destination, and service, but different applications?

Accepted Answer

The first policy in the list that matches the traffic will be enforced.. When two security policies have the same source, destination, and service but different applications, the first policy in the list that matches the traffic will be enforced. Firewalls evaluate policies top-down and stop at the first match, so the order of policies is critical.

Answer

The last rule in the list is always preferred.

Answer

The traffic is dropped by default.

Answer

The firewall merges the two policies.

Question 15

Which object type allows you to group multiple IP addresses into a single entity for use in security policies?

Accepted Answer

Address Group. An Address Group is a named collection of IP addresses (individual hosts, subnets, or ranges) that can be referenced as a single source or destination in security policies. This simplifies policy management by allowing you to apply rules to multiple addresses without listing each one individually. Other object types serve different purposes: Service Objects define ports/protocols, Application Groups categorize applications, and Region Objects represent geographic locations.

Answer

Service Object

Answer

Application Group

Answer

Region Object