NetSec-Pro Infrastructure Management And CDSS Practice Test 2 — 15 Questions

Question 1

A security engineer is configuring a firewall to inspect traffic for threats. The engineer wants to ensure that the firewall performs antivirus scanning, anti-spyware scanning, and vulnerability protection on allowed traffic. Which two components must be configured and applied to the security policy rule to achieve this? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Antivirus security profile. To enable antivirus and anti-spyware scanning on allowed traffic, both an Antivirus security profile and an Anti-Spyware security profile must be configured and attached to the security policy rule. These profiles provide the necessary inspection to detect and block malware and spyware in allowed traffic.

Answer

Vulnerability Protection security profile

Answer

URL Filtering profile

Answer

File Blocking profile

Question 2

A security administrator is configuring a firewall to inspect traffic between two internal zones. The administrator wants to ensure that if the firewall's content inspection engines fail, traffic is blocked rather than passed uninspected. Which setting should be configured in the Security Profile Group?

Accepted Answer

Enable 'Fail Close' in the Security Profile Group.. The 'Fail Close' setting in a Security Profile Group is specifically designed to block traffic if the content inspection engines fail. This ensures that no uninspected traffic passes between zones, upholding the security policy. It is a critical configuration for environments that require strict security enforcement.

Answer

Configure a Decryption profile with 'Block Unsupported SSL' enabled.

Answer

Enable 'Fail Open' in the Security Profile Group.

Answer

Set the action to 'Reset Client' in the security policy rule.

Question 3

An administrator has configured a Decryption policy with a Forward Proxy profile to inspect outbound TLS traffic. Users report that connections to a partner's website fail with certificate errors, while all other HTTPS sites work normally. The partner's site presents a certificate signed by an internal CA that is not trusted by the firewall. What is the most appropriate action to resolve this while maintaining decryption for other traffic?

Accepted Answer

Create a Decryption policy rule that matches the partner's destination and set the action to 'No Decrypt' with a source user or URL category, placed above the decrypt rule.. When a specific destination presents a certificate chain the firewall cannot validate, the surgical fix is a no-decrypt rule scoped to that destination placed above the general decrypt rule. Traffic to the partner flows uninspected so the browser trusts the internal CA, while the rest of outbound TLS remains decrypted and inspected.

Answer

Add the partner's internal CA certificate to the firewall's trusted certificate authority list and enable it for the decryption profile.

Answer

Add the partner's domain to the SSL Decryption Exclusion list and remove the decryption rule that matches outbound HTTPS.

Answer

Disable the Forward Proxy profile on the decryption rule and rely on Forward Trust for all outbound TLS sessions.

Question 4

A network security team is deploying a CDSS (Cloud-Delivered Security Services) solution and must ensure that DNS-based command-and-control traffic is detected and blocked. Which TWO actions should the team perform? (Choose two.)

Accepted Answer

Enable 'DNS Sinkhole' and configure the sinkhole IP address to point to an internal server used for monitoring malicious resolutions.. Blocking DNS-based C2 requires a DNS Security profile attached to the DNS-permitting security rule plus a blocking action. Enabling the sinkhole action with a defined sinkhole IP, and pointing that IP at an internal monitoring host, both detects and blocks malicious resolutions while generating useful telemetry. Alert-only or custom allow-listing does not stop the channel.

Answer

Enable the DNS Security service in the security zone where the internal DNS servers reside and apply a DNS Rewrite profile.

Answer

Create a custom DNS Security category and add all internal domain names to it to prevent false positives.

Answer

Configure the DNS Security profile to use only the 'Alert' action so that all malicious domains are logged for later review.

Question 5

A NetSec-Pro administrator is configuring a Decryption profile to enforce best practices for SSL Forward Proxy. The organization wants to ensure that weak protocols and ciphers are blocked, and that untrusted certificates are not accepted. Which two settings should be enabled in the Decryption profile? (Choose two.)

Accepted Answer

Block sessions with untrusted issuers. The Decryption profile includes settings to block sessions with expired certificates and untrusted issuers, which directly address the requirement to not accept untrusted certificates and to enforce certificate validity. These settings help prevent users from connecting to potentially malicious sites and ensure that only trusted, valid certificates are accepted during SSL Forward Proxy decryption.

Answer

Block sessions with weak ciphers

Answer

Block sessions with client authentication

Answer

Block TLS 1.0 and TLS 1.1

Question 6

A security administrator is configuring a Palo Alto Networks firewall to perform decryption of inbound SSL traffic to a web server. The administrator wants to ensure that the firewall can decrypt the traffic without installing certificates on external clients. Which certificate should be used for SSL Forward Proxy decryption?

Accepted Answer

A CA certificate and private key installed on the firewall to sign dynamically generated certificates.. SSL Forward Proxy decryption requires the firewall to act as a man-in-the-middle for outbound SSL connections. It generates a certificate for each connection, signed by a CA certificate installed on the firewall. External clients must trust this CA. The web server's certificate is not used. A self-signed certificate is not trusted. A trusted CA-signed certificate is for inbound decryption. Therefore, a CA certificate and private key on the firewall is the correct choice.

Answer

A self-signed certificate generated on the firewall.

Answer

The web server's certificate and private key imported onto the firewall.

Answer

A certificate signed by a trusted Certificate Authority (CA) installed on the firewall.

Question 7

A security administrator is configuring a Palo Alto Networks firewall to apply Security Profiles to traffic. The administrator wants to ensure that the firewall inspects traffic for threats and takes action based on the profiles. Which two actions can be configured in a Security Profile Group to apply multiple profiles to a security policy? (Choose two.)

Accepted Answer

Antivirus. A Security Profile Group can contain multiple security profiles, including Antivirus, Anti-Spyware, Vulnerability Protection, URL Filtering, File Blocking, and Data Filtering. The question asks for two actions that can be configured in a Security Profile Group. Antivirus and Anti-Spyware are both valid profiles that can be included. QoS and Decryption are not part of Security Profile Groups. Data Filtering is valid but not among the two correct answers because the question specifies two, and the most common primary profiles are Antivirus and Anti-Spyware.

Answer

Quality of Service (QoS)

Answer

Decryption

Answer

Data Filtering

Question 8

A security administrator is configuring a Palo Alto Networks firewall to block traffic from known malicious IP addresses. The administrator wants to automate the process of updating the firewall with a list of malicious IPs from an external threat intelligence feed. Which feature should be used to dynamically update a block list?

Accepted Answer

Dynamic Address Group. External Dynamic Lists (EDLs) are the standard feature for importing lists of IP addresses, URLs, or domains from external sources. The firewall periodically retrieves the list and can use it in security policies to block or allow traffic. This automates the process of updating block lists from threat intelligence feeds. Dynamic Address Groups are for tag-based dynamic membership, not for direct external list import. Static Address Groups and Custom URL Categories do not provide automated external list updates. Therefore, EDL is the correct answer.

Answer

Custom URL Category

Answer

Static Address Group

Answer

External Dynamic List (EDL)

Question 9

What is the primary function of the 'DNS Sinkhole' feature in a DNS Security profile?

Accepted Answer

To redirect requests for malicious domains to a specific IP address to alert the administrator.. A DNS sinkhole works by intercepting DNS responses for domains that the security profile has flagged as malicious (based on threat signatures, PAN-DB/Advanced DNS categories, or DNS Security feeds). Instead of returning the real IP, the firewall rewrites the response to point to a sinkhole IP (typically 72.5.65.111 or a configured internal address). This blocks the connection and generates a log entry so the administrator can see which internal host attempted to reach the malicious domain.

Answer

To encrypt DNS traffic between the firewall and the ISP.

Answer

To allow a firewall to act as a DNS server for internal clients.

Answer

To cache DNS queries to improve network performance.

Question 10

You are configuring Advanced URL Filtering. Users report that a site is being blocked, but the category is 'Newly Registered Domains'. How can you allow access to this specific site while keeping the policy for other newly registered domains?

Accepted Answer

Add the site to the 'Allow List' in the URL Filtering profile object assigned to the security policy.. The URL Filtering profile supports an Allow List that overrides category-based blocking for specific URLs or domains. Adding the site to the Allow List in the profile attached to the relevant security policy permits that specific site while the 'Newly Registered Domains' category continues to block all other newly registered domains, preserving the intended security posture.

Answer

Move the security policy to the top of the policy list.

Answer

Add the site to the 'Blocked' list in the URL Filtering profile.

Answer

Create a new URL category and add the domain to it, then block that category.

Question 11

A company is experiencing high false-positive rates with WildFire for custom proprietary executable files. What is the recommended configuration to minimize these while maintaining security?

Accepted Answer

Create a WildFire analysis profile and add the proprietary file hashes to the WildFire File Exclusion list.. The WildFire File Exclusion list allows administrators to specify file hashes that should not be forwarded for WildFire analysis. By adding the proprietary executable hashes to this list, the firewall will skip analysis for these known-good files, reducing false positives while still analyzing all other files. This maintains security because only explicitly trusted files are excluded, and all other files continue to be inspected.

Answer

Lower the threat prevention action from block to alert for all executables.

Answer

Disable WildFire on the specific security policy rule.

Answer

Change the WildFire forwarding location to a local WildFire appliance.

Question 12

An administrator needs to enable Threat Prevention to protect against a specific zero-day exploit. How are the signatures for these new threats delivered to the firewall?

Accepted Answer

Through the scheduled 'Threats' dynamic update package.. The 'Threats' dynamic update package is the mechanism that delivers new and updated threat signatures (antivirus, anti-spyware, vulnerability protection) to the firewall. It is scheduled via Device > Dynamic Updates and can be set to download and install automatically. This package contains the signatures needed to detect and block zero-day exploits, as long as the firewall has a valid Threat Prevention license.

Answer

By manually downloading the threat signature database from the Customer Support Portal.

Answer

Through the daily WildFire update package.

Answer

By enabling the 'Automatic Update' feature in the Device > Software menu.

Question 13

You are deploying Advanced URL Filtering. How does the 'Credential Phishing' prevention feature operate?

Accepted Answer

It detects and blocks the submission of enterprise credentials to untrusted or newly registered websites.. Credential Phishing prevention in Advanced URL Filtering detects when a user submits enterprise credentials to an untrusted or newly registered website, even if the site is not yet on a known-malicious URL list. It uses heuristics and site-reputation signals to identify credential submission to suspicious destinations and blocks it. This is behavior-based rather than purely signature-based.

Answer

It analyzes the URL to determine if it is a known malicious site.

Answer

It requires an agent installed on the endpoint to monitor browser activity.

Answer

It monitors all inbound traffic for known phishing signatures.

Question 14

How does the 'Advanced URL Filtering' subscription improve upon standard URL Filtering?

Accepted Answer

It provides real-time, cloud-based analysis of unknown or newly registered domains.. Advanced URL Filtering adds real-time, cloud-based inline analysis of unknown or newly registered domains, using machine learning and threat intelligence to categorize and block malicious sites that signature-based URL filtering would miss. Standard URL filtering relies on a static, periodically updated database, so zero-day or newly registered malicious domains can slip through until the next update.

Answer

It allows the firewall to bypass SSL decryption for certain categories.

Answer

It includes an integrated VPN client for remote workers.

Answer

It allows for more custom URL categories.

Question 15

What is the impact of selecting 'Action: Reset-Both' in a Threat Prevention profile for a detected vulnerability?

Accepted Answer

It sends a TCP RST to both the client and the server to terminate the connection.. In a PAN-OS Threat Prevention profile, the 'Reset-Both' action sends a TCP RST packet to both the client and the server, immediately terminating the connection. This is a stronger action than 'Drop' or 'Alert' and is used when the administrator wants to actively sever a session that triggered a vulnerability signature. It ensures neither side continues the communication.

Answer

It triggers an alert but does not interfere with the traffic flow.

Answer

It blocks the source IP address for a specified duration.

Answer

It drops the packet but allows the TCP session to continue.