NetSec-Pro Connectivity And Security Practice Test 3 — 15 Questions

Question 1

Which TWO of the following steps are required to implement a successful Site-to-Site VPN with a third-party vendor?

Accepted Answer

Assign the tunnel interface to a security zone.. Option A is correct because a Palo Alto Networks tunnel interface must be assigned to a security zone before zone-based security policy can permit or inspect traffic traversing the Site-to-Site VPN. Option B is correct because the IKE Crypto Profile (Phase 1) must match the third-party vendor's encryption, hash, DH group, and lifetime values for the IKE SA to negotiate successfully. Option C is incorrect because disabling logging is not required and would hinder troubleshooting. Option D is incorrect because a tunnel interface is a virtual point-to-point interface and does not use DHCP. Option E is incorrect because a Site-to-Site VPN is routed (Layer 3) over a tunnel interface, not an L2 bridge.

Answer

Disable all logging on the tunnel interface.

Answer

Enable DHCP on the tunnel interface.

Answer

Configure the tunnel as an L2 bridge.

Question 2

Which feature would you use to verify that a specific interface is properly connected to the upstream ISP?

Accepted Answer

Enable Ping in the Interface Management Profile.. Enabling Ping in the Interface Management Profile allows ICMP echo requests to the interface IP, which can be used to verify Layer 3 connectivity to the upstream ISP. This is a common method to confirm the interface is reachable and properly connected.

Answer

Disable the interface.

Answer

Increase the ARP timeout value.

Answer

Change the interface speed to auto-negotiate.

Question 3

Which THREE tasks are performed by the Dataplane during traffic processing?

Accepted Answer

Session lookup.. The Dataplane performs Session lookup (A) because every packet must be matched against the existing session table to determine whether it belongs to an established flow before any further processing. Packet forwarding (B) is a core Dataplane function, as the Dataplane is responsible for the actual transmission of frames/packets out the egress interface based on the forwarding table and session information. Security policy evaluation (E) also occurs in the Dataplane, where the firewall enforces the security rules (App-ID, User-ID, content inspection, etc.) on the traffic as it traverses the device. Management interface updates (C) and User-ID mapping updates (D) are handled by the Management plane, not the Dataplane, since they involve configuration, control, and identity information rather than per-packet forwarding decisions.

Answer

Management interface updates.

Answer

User-ID mapping updates.

Question 4

Which THREE items must be verified when troubleshooting traffic that is not being correctly identified as the intended application?

Accepted Answer

Ensure the App-ID override policy is correctly configured for the traffic.. Option B is correct because an App-ID override policy forces traffic to be classified as a specific application, so if it is misconfigured or missing, the firewall will not identify the traffic as the intended application. Option D is correct because many applications use TLS/SSL, and without SSL decryption the firewall cannot inspect the encrypted payload and may only identify the traffic as ssl or web-browsing instead of the actual application. Option E is correct because App-ID relies on application signatures and behavior, and applications running on non-standard ports can be misidentified or fall back to a generic port-based or unknown-tcp/unknown-udp classification. Option A is not relevant because the MAC address table is a Layer 2 forwarding table and does not determine application identification. Option C is not relevant because system clock synchronization affects certificates, logs, and authentication, but not the App-ID signature matching process itself.

Answer

Verify the MAC address table.

Answer

Check the system clock synchronization.

Question 5

Which THREE criteria can be used to define a security policy for granular control?

Accepted Answer

App-ID.. App-ID (B) is correct because it lets the policy match traffic by the actual application regardless of port or protocol, enabling granular application-level control. User-ID (C) is correct because matching on user or group identity ties rules to who is generating the traffic, not just to IP addresses. Source and Destination Zones (E) are correct because zone-based matching defines where traffic enters and exits the firewall, which is a fundamental granular policy criterion. BGP peer status (A) and interface physical status (D) are not policy match criteria; they are routing and link-state conditions that do not define which traffic a security rule permits or denies.

Answer

BGP peer status.

Answer

Interface physical status.

Question 6

Which TWO methods can be used to ensure the firewall has the latest threat intelligence for blocking malicious traffic?

Accepted Answer

Dynamic Updates.. Dynamic Updates (D) are correct because firewall vendors such as Palo Alto Networks deliver signature, application, and threat databases through scheduled dynamic update subscriptions, ensuring the device automatically receives the newest threat intelligence without manual intervention. External Dynamic Lists (E) are correct because they let the firewall import continuously refreshed lists of malicious IPs, URLs, or domains from an external server (e.g., via HTTP/HTTPS), so threat intelligence stays current as the source list changes. VLAN tagging (A) is only a Layer 2 mechanism for segmenting traffic and carries no threat data. Manual IP entry (B) is static and quickly becomes outdated, so it cannot keep intelligence current. DHCP reservation (C) merely assigns a fixed IP address to a host and has no relation to threat intelligence feeds.

Answer

VLAN tagging.

Answer

Manual IP entry.

Answer

DHCP reservation.

Question 7

Which TWO logs are essential when troubleshooting a user who cannot connect to the internet?

Accepted Answer

System Logs.. System Logs (A) are essential because they record control-plane and system-level events such as interface up/down transitions, routing or DHCP failures, and daemon errors that directly explain why a user's traffic cannot reach the internet. Traffic Logs (C) are essential because they show the actual session-level flow of the user's packets—source/destination, port, application, and allow/deny disposition—revealing whether traffic is being dropped, misrouted, or never leaving the device. Together these two logs cover both the underlying system state and the live traffic behavior needed to isolate an internet-connectivity failure. Decryption Logs (B) only matter for inspecting encrypted sessions and are irrelevant when basic connectivity is broken, Config Logs (D) merely track configuration changes rather than runtime connectivity state, and Threat Logs (E) only show security-policy hits such as exploits or malware, which are not required to diagnose a simple inability to reach the internet.

Answer

Decryption Logs.

Answer

Config Logs.

Answer

Threat Logs.

Question 8

Which THREE components are involved in configuring an IKE Gateway for a VPN?

Accepted Answer

Local interface.. An IKE Gateway configuration requires a Local interface (A), which specifies the physical or logical interface (e.g., ethernet1/1) on the firewall that terminates the VPN tunnel and sources IKE negotiations. It also requires a Peer IP address (C), the static IP of the remote IKE peer used to identify and reach the remote gateway during Phase 1 negotiation. A Pre-Shared Key (D) is also required as the authentication credential exchanged during IKE Phase 1 to authenticate both peers when using PSK-based authentication. VLAN ID (B) is a Layer 2 segmentation parameter not part of IKE gateway settings, and DHCP server scope (E) relates to address assignment for clients, not to IKE gateway configuration.

Answer

VLAN ID.

Answer

DHCP server scope.

Question 9

An administrator notices that a firewall is not blocking traffic that matches a security profile group configured with anti-spyware and vulnerability protection. The traffic log shows the session is allowed, but no threat logs are generated. What is the most likely cause?

Accepted Answer

The security profile group is not attached to the security policy rule that allows the traffic.. The firewall will only enforce security profiles if they are attached to the security policy rule that permits the traffic. Even if profiles are configured globally, they must be referenced in the rule's 'Actions' tab. Without attachment, the firewall performs no threat inspection, resulting in allowed traffic without threat logs. Other options either contradict the observed log behavior or are less likely given the scenario.

Answer

The traffic is SSL encrypted and cannot be inspected without decryption.

Answer

The firewall is in tap mode and cannot block traffic.

Answer

The security profiles are configured with 'alert' instead of 'block' actions.

Question 10

A security administrator is configuring a Site-to-Site VPN with a partner organization. The partner uses a policy-based VPN, while your organization uses a route-based VPN with a tunnel interface. The tunnel is up, but traffic is not passing. The administrator confirms that the proxy IDs match on both sides. What is the most likely cause of the issue?

Accepted Answer

The route-based VPN requires a static route pointing to the tunnel interface for the remote subnet.. When interconnecting a policy-based VPN with a route-based VPN, the route-based side must have a route that directs traffic for the remote subnet out the tunnel interface. Without this route, the firewall will use its default route and send traffic unencrypted, or drop it. The policy-based side may still initiate the tunnel based on proxy IDs, but return traffic will not find its way back. Adding a static route for the remote subnet with the tunnel interface as the next hop resolves the issue.

Answer

The tunnel interface is not assigned to a security zone.

Answer

The IKE gateway is configured with the wrong pre-shared key.

Answer

The proxy IDs are not configured correctly on the route-based VPN.

Question 11

An engineer is deploying a new Palo Alto Networks firewall and needs to enable DNS sinkholing for malware command-and-control domains. The firewall must respond to internal clients with a sinkhole IP address when they query known malicious domains. Which configuration step is required to make the firewall perform DNS sinkholing?

Accepted Answer

Configure a DNS Sinkhole action in the Anti-Spyware security profile and set the sinkhole IPv4 address to a dedicated internal IP that clients can reach.. DNS sinkholing is a feature of the Anti-Spyware security profile. When the firewall detects a DNS query for a known malicious domain, it can respond with a sinkhole IP address instead of the real IP. This prevents clients from reaching command-and-control servers. The sinkhole IP must be reachable by clients, often an internal server or a firewall data-plane interface, to redirect and potentially quarantine the client.

Answer

Enable DNS sinkholing globally under Device > Setup > Session and specify a sinkhole IP address that the firewall will use for all DNS responses.

Answer

Enable DNS sinkholing in the Security Profile's Antivirus profile and set the sinkhole IP address to the firewall's management interface IP.

Answer

Create a custom URL Filtering profile that blocks all DNS queries and redirects them to a captive portal for user authentication.

Question 12

A network security engineer is configuring a Palo Alto Networks firewall to inspect traffic between two internal zones. The engineer wants to ensure that the firewall performs application identification and applies security profiles to the traffic. The traffic is currently being allowed by a security policy, but no security profiles are being applied. What is the most likely cause?

Accepted Answer

The security policy is configured with the action 'Allow' but the profile setting is set to 'None'.. Security profiles are applied to traffic only if they are attached to the matching security policy rule. In the rule's Actions tab, the Profile Setting must be configured with a Security Profile Group or individual profiles. If it is left as 'None', the firewall allows the traffic but does not inspect it with any profiles. This is a common oversight when creating new rules.

Answer

The security policy is configured with a source and destination zone that do not match the traffic.

Answer

The security policy is using the 'Application Default' action instead of 'Allow'.

Answer

The security policy is set to 'Allow' but the 'Log at Session End' is disabled, which also disables security profile inspection.

Question 13

A security administrator is troubleshooting why a user's GlobalProtect connection is failing. The user can authenticate successfully, but the GlobalProtect client shows 'Connected' yet cannot access internal resources. The administrator checks the GlobalProtect Gateway configuration and sees that the tunnel interface is configured with an IP address and the client IP pool is set. What is the most likely cause of the issue?

Accepted Answer

The security policy allowing traffic from the GlobalProtect zone to the internal zone is missing or misconfigured.. When a GlobalProtect user connects successfully but cannot access internal resources, the most common cause is a missing or incorrect security policy. The firewall must have a policy allowing traffic from the GlobalProtect zone to the internal zones. The default security policy denies all traffic not explicitly allowed. Administrators should check the policy rules and ensure the source zone is the GlobalProtect tunnel zone and the destination zone is the internal resource zone.

Answer

The firewall's management interface is not configured to allow GlobalProtect connections.

Answer

The GlobalProtect client is not receiving a DNS server address from the gateway.

Answer

The GlobalProtect Gateway is not configured with a certificate for SSL/TLS.

Question 14

A network engineer is setting up a new Security Zone on a Palo Alto Networks firewall. The engineer wants to ensure that traffic entering this zone from any other zone is denied by default. Which action should be taken?

Accepted Answer

Ensure that no security policy rules exist that allow traffic to this zone from other zones.. Palo Alto Networks firewalls employ a default-deny security posture for inter-zone traffic. When a new zone is created, no traffic is allowed to or from it until a security policy rule explicitly permits it. Therefore, to ensure traffic entering the zone from other zones is denied, the engineer only needs to avoid creating allow rules. The default behavior takes care of the rest, making it a simple and secure starting point.

Answer

Create a security policy rule with source zone 'any' and destination zone 'any' with action 'deny'.

Answer

Set the zone's type to 'External' and enable 'Deny' in the zone properties.

Answer

Configure a Deny rule at the top of the security policy with source zone 'any' and destination zone 'any'.

Question 15

A network administrator is configuring a Site-to-Site VPN between two Palo Alto Networks firewalls. The administrator notices that the VPN tunnel is up, but traffic is not passing through it. The administrator checks the routing table and sees that the route to the remote network is pointing to the tunnel interface. What is the most likely reason for the traffic not passing?

Accepted Answer

The security policy does not allow traffic from the VPN zone to the internal zone.. When a Site-to-Site VPN tunnel is up and routing is correct, the most common reason for traffic not passing is a missing or incorrect security policy. The firewall must have a policy allowing traffic from the VPN zone to the internal zone (and possibly the reverse). The default security policy denies all traffic, so without an explicit allow rule, packets are dropped. Administrators should check the security policy and ensure it matches the source and destination addresses and zones.

Answer

The tunnel interface is not assigned to a security zone.

Answer

The IKE gateway is configured with the wrong pre-shared key.

Answer

The IPsec proposal is misconfigured, causing the tunnel to flap.