NetSec-Pro Timed Hard Questions — 25 Difficult Questions

Question 1

A network security engineer is deploying Prisma Access to secure remote workers. The engineer needs to ensure that traffic from remote users is inspected for threats and that access to SaaS applications is controlled based on user identity and device posture. Which two components are required to achieve these goals? (Choose two.)

15 minute time limit — choose an answer to begin.

Accepted Answer

GlobalProtect app. The GlobalProtect app is necessary for remote users to connect and provide identity and posture information. Security policy rules with App-ID and User-ID are needed to enforce access control to SaaS applications based on user and application. Together, they enable threat inspection and identity-based control. The other options are either licensing, optional, or not applicable to mobile user connectivity.

Answer

Prisma Access service connection

Answer

Prisma Access mobile users license

Answer

Cloud Identity Engine

Question 2

A security engineer is configuring a Security Policy rule on a Palo Alto Networks NGFW to block traffic and send a TCP reset to both the client and server. Which action should be selected?

Accepted Answer

Reset-Both. The Reset-Both action is designed to block traffic and send a TCP reset to both the client and the server. This immediately terminates the session on both ends. Deny sends a reset only to the client, Drop silently discards, and Reset-Client sends a reset only to the client. Therefore, Reset-Both is the correct action to meet the requirement of sending a TCP reset to both parties.

Answer

Drop

Answer

Deny

Answer

Reset-Client

Question 3

A network administrator is configuring a Site-to-Site VPN between two Palo Alto Networks firewalls. The administrator notices that the VPN tunnel is up, but traffic is not passing through it. The administrator checks the routing table and sees that the route to the remote network is pointing to the tunnel interface. What is the most likely reason for the traffic not passing?

Accepted Answer

The security policy does not allow traffic from the VPN zone to the internal zone.. When a Site-to-Site VPN tunnel is up and routing is correct, the most common reason for traffic not passing is a missing or incorrect security policy. The firewall must have a policy allowing traffic from the VPN zone to the internal zone (and possibly the reverse). The default security policy denies all traffic, so without an explicit allow rule, packets are dropped. Administrators should check the security policy and ensure it matches the source and destination addresses and zones.

Answer

The tunnel interface is not assigned to a security zone.

Answer

The IKE gateway is configured with the wrong pre-shared key.

Answer

The IPsec proposal is misconfigured, causing the tunnel to flap.

Question 4

An administrator needs to restrict administrative access to the firewall from only one specific subnet. Where should this be configured?

Accepted Answer

Network > Interface Management Profile. Management Profiles, applied to the physical interface, allow you to specify permitted IP addresses for administrative services.

Answer

Device > Administrators

Answer

Device > Setup > Session

Answer

Policies > Security

Question 5

A security engineer is configuring GlobalProtect on a Palo Alto Networks firewall. The engineer wants to ensure that users are authenticated before they can access internal resources. The engineer has configured the GlobalProtect portal and gateway, but users are able to connect without providing credentials. What is the most likely cause?

Accepted Answer

The GlobalProtect gateway is configured with the authentication method 'none' in the agent configuration.. In GlobalProtect gateway configuration, the authentication method is set per agent configuration under Client Settings. If it is set to 'none', users are not required to authenticate. This is a common misconfiguration when testing or when the engineer forgets to set the authentication method. To enforce authentication, the method must be set to a valid option like LDAP, RADIUS, or client certificate.

Answer

The GlobalProtect portal is configured with the authentication method 'client certificate' only, and users have valid certificates installed.

Answer

The GlobalProtect gateway is configured with the authentication method 'pre-logon' and the pre-logon tunnel is being used.

Answer

The GlobalProtect portal is configured with the authentication method 'LDAP' but the LDAP server is unreachable.

Question 6

An analyst is investigating why a server in the DMZ zone can reach an external update site on TCP 443 even though no security rule explicitly permits that server's traffic. The firewall uses a security rule with the application set to 'ssl' and the service set to 'application-default'. Which behaviour explains the observed connectivity?

Accepted Answer

The 'ssl' application inherently allows TCP 443, and 'application-default' resolves to that port, so the rule matches. The ssl application is tied to TCP 443, and setting the service to application-default makes the rule inherit that port from the application definition. The outbound session therefore matches the rule and is permitted, which is why the server reaches the update site without a port-specific rule.

Answer

The server is using a decryption profile that bypasses policy for trusted update sites

Answer

The firewall's content inspection engine automatically permits traffic to known software update repositories

Answer

The DMZ zone has an implicit rule that allows all outbound traffic to the Untrust zone

Question 7

Which THREE types of information are contained in the Panorama 'Device Health' report?

Accepted Answer

CPU utilization. The Panorama 'Device Health' report surfaces resource-level telemetry from managed firewalls, and it explicitly includes CPU utilization (A), disk space utilization (B), and memory usage (C) as its core metrics, since these three resource dimensions are what the report is designed to monitor for capacity and performance troubleshooting. CPU utilization (A) is correct because the report tracks processor load on the managed devices. Disk space utilization (B) is correct because the report shows storage consumption so administrators can detect low-disk conditions. Memory usage (C) is correct because the report monitors RAM consumption on the firewalls. Security policy hit counts (D) are not part of Device Health; that data appears in policy/rule usage and traffic logs, not the health report. Active user count (E) is also not included, as user/session information comes from other monitoring views such as the ACC or user activity logs rather than the Device Health report.

Answer

Security policy hit counts

Answer

Active user count

Question 8

A user is unable to access an application via GlobalProtect. The logs show the user is authenticated, but the session is reset. What should the administrator check first?

Accepted Answer

Verify the Security Policy to ensure traffic is allowed from the GlobalProtect zone to the internal zone.. When GlobalProtect authentication succeeds but the session is reset, the most likely cause is that the decrypted tunnel traffic is being denied by a Security Policy rule. The GlobalProtect zone (tunnel interface) must have an explicit allow rule to the internal/trust zone for the user's applications. Checking the Security Policy first confirms whether the reset is a policy drop rather than an authentication or client issue.

Answer

Check the client's OS version.

Answer

Check the authentication server status.

Answer

Restart the GlobalProtect service.

Question 9

An administrator is implementing PBF (Policy Based Forwarding). What is a requirement for PBF to function correctly?

Accepted Answer

The PBF rule must be placed in the policy and reference a valid egress interface or next hop.. Policy-Based Forwarding (PBF) requires a rule that specifies a valid egress interface or next hop for matching traffic. Without a properly defined forwarding action (interface or next hop), the PBF rule cannot direct traffic, and it will not function. The rule must also be placed in the policy correctly and match the desired traffic.

Answer

The destination must always be an IP address object.

Answer

PBF must be enabled at the global configuration level.

Answer

PBF can only be used on Layer 2 interfaces.

Question 10

You are configuring an SD-WAN path for a branch office. Which metric does the firewall use to determine the best path when multiple paths are available?

Accepted Answer

Performance metrics (latency, jitter, loss).. The SD-WAN policy uses Performance Probes to measure latency, jitter, and packet loss to select the best path.

Answer

Source IP address.

Answer

Static cost metrics.

Answer

Interface priority only.

Question 11

A company uses a proxy server. How must the Palo Alto Networks firewall be configured to ensure 'Threat Prevention' is effective?

Accepted Answer

Enable X-Forwarded-For header inspection in the Security Profile.. When traffic passes through a proxy, the firewall sees the proxy's IP, not the original client. The firewall must be configured to identify the traffic correctly.

Answer

Disable SSL decryption for the proxy traffic.

Answer

Create a specific 'Proxy' zone and apply an App-ID policy.

Answer

Configure the proxy as a 'Trusted' source in the Device > Setup menu.

Question 12

A network engineer needs to monitor traffic between two zones using a specific interface. Which feature must be enabled to view application-level traffic details without affecting the traffic flow?

Accepted Answer

Enable Log Forwarding on the security policy.. Virtual Wire or tapping configurations allow traffic visibility, but within a routed environment, enabling App-ID and proper logging on security policies is the standard method for monitoring traffic details.

Answer

Disable the security policy.

Answer

Implement a Decryption Policy.

Answer

Create a mirror port on the switch.

Question 13

Which THREE actions can be taken in a Vulnerability Protection profile?

Accepted Answer

Reset-Both. Vulnerability protection profiles allow for flexible handling of detected threats based on severity or type.

Answer

Block

Answer

Allow

Answer

Monitor

Question 14

A administrator notices traffic is being dropped by the 'intrazone-default' policy. What is the most likely cause?

Accepted Answer

The source and destination zones are the same, and no explicit allow policy exists.. Intrazone traffic is implicitly denied by default on PAN-OS firewalls unless a specific policy is created.

Answer

The traffic is coming from a zone with no security profile assigned.

Answer

The firewall is in Layer 2 mode and the MAC address table is full.

Answer

The App-ID is unidentified, causing a drop by the default cleanup rule.

Question 15

You are migrating an existing branch office to Prisma Access. Which component is required to allow the branch to communicate with your on-premises data center?

Accepted Answer

Service Connection. A Service Connection is the specific component used to link the Prisma Access cloud infrastructure to on-premises resources.

Answer

Mobile User Connection

Answer

Prisma Access Insights

Answer

Remote Network Connection

Question 16

A security policy with a 'Log at Session End' setting is missing log entries for long-lived sessions. Why might this happen?

Accepted Answer

The session has not yet terminated.. By default, logs are generated when the session ends. If a session is very long, it may need a log interval configured to generate interim logs.

Answer

The 'Log at Session Start' option was not checked.

Answer

The log buffer is full.

Answer

The session is being decrypted.

Question 17

An administrator needs to prevent a specific file type (e.g., .exe) from being downloaded. Which profile is used?

Accepted Answer

File Blocking Profile. File Blocking Profiles allow administrators to filter files by type and direction.

Answer

URL Filtering Profile

Answer

Data Filtering Profile

Answer

Vulnerability Protection Profile

Question 18

You need to perform a firmware upgrade on 100 firewalls via Panorama. You want to ensure the firewalls don't reboot simultaneously. How do you achieve this?

Accepted Answer

Use the 'Batch Upgrade' feature with 'Staged Deployment' enabled.. Using the Panorama Software tab, you can schedule installations and perform staged upgrades to control downtime.

Answer

Execute 'request system software upgrade' on each firewall sequentially via CLI.

Answer

Use an external script to trigger reboots.

Answer

Set the 'Maintenance Window' in Device Group settings.

Question 19

Which THREE settings are required in a File Blocking profile to ensure that all executable files are blocked and submitted to WildFire?

Accepted Answer

Select the 'exe' file type.. To block and submit files, the action must be set correctly for the specific file type.

Answer

Enable 'Alert' as the only action.

Answer

Disable 'Session Log' in the Security Profile.

Question 20

You are migrating a physical firewall to a SASE (Prisma Access) environment. Which component is responsible for managing the security policies in the SASE model?

Accepted Answer

Panorama.. In the SASE/Prisma Access model, Panorama is used as the centralized management plane to push configurations to the cloud-delivered firewalls.

Answer

The local WebUI of the Prisma Access compute node.

Answer

The Cloud Service Plugin.

Answer

The Cloud Identity Engine.