NetSec-Pro Infrastructure Management And CDSS Practice Test 3 — 15 Questions

Question 1

An administrator finds that the 'Threat Prevention' logs are not showing any data, despite having an active subscription. What is the most likely cause?

Accepted Answer

The security policy rules do not have an attached Security Profile Group.. Threat Prevention logs are only generated when traffic matches a security policy rule that has a Security Profile Group (or individual security profiles) attached. Without an attached profile group, the firewall performs only basic policy allow/deny and never invokes the threat engines, so no Threat log entries are produced even with a valid subscription. The subscription alone does not enable inspection — it only licenses the content updates.

Answer

The 'Threats' dynamic update is not scheduled.

Answer

The firewall is in 'Evaluation Mode'.

Answer

The log forwarding profile is missing the 'Global' setting.

Question 2

A user is blocked by a URL Filtering profile. Where can you find the specific log entry that explains why the block occurred?

Accepted Answer

Monitor > Logs > URL Filtering. The specific log entry explaining why a URL Filtering profile blocked a user is found in Monitor > Logs > URL Filtering. This log type records all URL filtering events, including the category, URL, and action taken (block, alert, continue), along with the reason for the block (e.g., category match, custom URL category).

Answer

Monitor > Logs > WildFire Submissions

Answer

Monitor > Logs > Traffic

Answer

Monitor > Logs > Threat

Question 3

What is the purpose of a 'Security Profile Group'?

Accepted Answer

To combine multiple security profiles into a single object for easier policy assignment.. A Security Profile Group in Palo Alto Networks firewalls is a logical container that bundles multiple security profiles (such as Antivirus, Anti-Spyware, Vulnerability Protection, URL Filtering, File Blocking, and WildFire Analysis) into a single referenced object. This allows administrators to apply a consistent set of security inspections to a security policy rule with one selection, rather than attaching each profile individually. It simplifies policy management and ensures uniform enforcement across rules that require the same security posture.

Answer

To organize firewall administrators by department.

Answer

To collect all logs from a specific security zone.

Answer

To group firewall interfaces for load balancing.

Question 4

Which feature allows you to block traffic based on a specific geographic region?

Accepted Answer

Policy-based filtering using 'Region' objects.. Palo Alto Networks firewalls support region-based filtering through Region objects, which are predefined or custom objects representing geographic locations based on IP address geolocation databases. Security policies can reference these Region objects to allow or block traffic from specific countries or regions, providing a straightforward way to enforce geographic access controls.

Answer

User-ID

Answer

DNS Security profile.

Answer

App-ID

Question 5

Which TWO actions should be performed when configuring a new DNS Security profile to protect against DNS-based malware?

Accepted Answer

Enable 'Sinkhole' and specify the IP address for the sinkhole.. Option A is correct because enabling the Sinkhole action in a DNS Security profile lets the firewall return a forged, administrator-specified IP address (the sinkhole IP) for DNS queries that match malicious domains, preventing clients from reaching malware command-and-control or payload servers. Option C is correct because the DNS Categories tab is where you select which URL/domain categories (e.g., malware, phishing, command-and-control) the profile should block or sinkhole, which is the core mechanism for filtering DNS-based threats. The other options do not belong: DNS over HTTPS (B) is a client-side encrypted transport that the firewall cannot simply 'force' via a DNS Security profile, a DNS Proxy object per zone (D) is not required for a DNS Security profile to function, and Packet Capture (E) is a troubleshooting/diagnostic feature, not a protection setting.

Answer

Configure 'DNS over HTTPS' to force all traffic through the firewall.

Answer

Create a 'DNS Proxy' object for every zone.

Answer

Enable 'Packet Capture' for all DNS traffic.

Question 6

You need to ensure that the firewall logs identify traffic by the actual application name, even if the traffic is running on a non-standard port. Which mechanism makes this possible?

Accepted Answer

App-ID content inspection.. App-ID performs deep packet inspection and behavioral analysis to identify the actual application regardless of the port or protocol used. It goes beyond port-based identification by examining payload signatures, protocol behavior, and heuristics, so an application running on a non-standard port is still correctly identified and logged.

Answer

Service-based policy enforcement.

Answer

SSL Decryption.

Answer

Port-mapping configuration.

Question 7

Which THREE components are required to successfully deploy and use Advanced URL Filtering?

Accepted Answer

An active Advanced URL Filtering subscription.. Option B is correct because Advanced URL Filtering is a licensed cloud-delivered service, so an active Advanced URL Filtering subscription must be present on the firewall to enable the advanced categories, inline ML-based classification, and cloud lookups. Option E is correct because the firewall must have a URL Filtering profile that defines the desired actions (allow, block, alert, continue, override) for URL categories before any traffic can be filtered. Option C is correct because the profile only takes effect when it is attached to a Security Policy rule that matches the traffic, so an enabled rule referencing the URL Filtering profile is required for enforcement. Option A is not required because Advanced URL Filtering runs on the Palo Alto Networks firewall itself and does not need an endpoint agent on user devices. Option D is not required because URL database and cloud updates are delivered through the existing management/dataplane infrastructure, not a dedicated management interface.

Answer

An endpoint agent installed on all user devices.

Answer

A dedicated management interface for URL updates.

Question 8

Which TWO pieces of information are displayed in the 'WildFire Analysis' log?

Accepted Answer

The final verdict (e.g., Malware, Benign).. Option C is correct because the WildFire Analysis log records the final verdict returned by WildFire for the submitted sample, such as Malware, Benign, Grayware, or Phishing, which is the primary purpose of the log. Option E is correct because the WildFire Analysis log includes the MD5 hash (and typically SHA-256) of the analyzed file, which uniquely identifies the sample and is used to correlate submissions and verdicts. Options A, B, and D are not part of the WildFire Analysis log: username attribution, total bandwidth consumed by the transfer, and the physical port number used for upload are not fields WildFire reports, since the log focuses on file identification and the malware verdict rather than user or transport-layer details.

Answer

The username of the person who downloaded the file.

Answer

The total bandwidth used by the file transfer.

Answer

The physical port number used for the upload.

Question 9

Which TWO steps are necessary to ensure that 'Threat Prevention' is protecting traffic against known vulnerabilities?

Accepted Answer

Ensure the 'Threats' dynamic update is downloaded and installed.. Option B is correct because Threat Prevention relies on the Applications and Threats content database, which is delivered through the 'Threats' dynamic update; without downloading and installing the latest content package, the firewall cannot recognize newly disclosed vulnerabilities and their signatures. Option E is correct because signatures alone do not act on traffic—a Vulnerability Protection profile (containing vulnerability signatures and actions) must be attached to the security policy rule so that matching traffic is inspected and blocked or alerted. Option A is wrong because App-ID is fundamental to identifying applications and is not disabled for Threat Prevention; disabling it would undermine policy enforcement rather than help. Option C is wrong because content updates do not require a manual reboot; the firewall applies new content dynamically. Option D is wrong because SSL decryption is only needed to inspect encrypted sessions and is not a general requirement for vulnerability protection of all traffic.

Answer

Disable 'App-ID' to prevent interference.

Answer

Manually restart the firewall after every update.

Answer

Enable SSL Decryption for all traffic.

Question 10

A network security administrator is configuring a firewall to forward traffic to a sandboxing service for analysis. The administrator wants to ensure that any file determined to be malicious by the sandbox is automatically blocked in real time on subsequent attempts. Which feature should be enabled on the firewall to achieve this?

Accepted Answer

WildFire inline cloud analysis. WildFire inline cloud analysis enables the firewall to submit files to the WildFire cloud and, upon receiving a malicious verdict, immediately block the file for subsequent download attempts. This provides real-time protection without waiting for a periodic signature update, directly satisfying the requirement.

Answer

DNS Security

Answer

File Blocking profile

Answer

URL Filtering

Question 11

A network security engineer is configuring a firewall to protect against brute force attacks on the web server. The engineer wants to limit the number of concurrent connections from a single IP address to the web server to 50. Which feature should be configured?

Accepted Answer

DoS Protection profile with a concurrent connection limit.. A DoS Protection profile is designed to detect and mitigate various denial-of-service attacks, including limiting concurrent connections per source IP. By applying a DoS Protection profile to the security rule that permits traffic to the web server, the engineer can enforce the 50-connection limit, protecting the server from brute force or connection exhaustion.

Answer

Zone Protection profile with SYN flood protection.

Answer

QoS profile with a maximum connection rate.

Answer

Security policy rule with an application filter for web-browsing.

Question 12

A network administrator is configuring a Palo Alto Networks firewall and wants to ensure that security policy rules are evaluated in the correct order. They have created several rules with different source and destination zones. Which factor determines the order in which security policy rules are evaluated?

Accepted Answer

The rule's position in the security policy rulebase, from top to bottom.. Security policy rules are evaluated from top to bottom in the rulebase. The first rule that matches the traffic is enforced, and no further rules are checked. This sequential evaluation means that rule order directly affects security outcomes. Other factors such as creation time, priority values, or zone pairs do not influence evaluation order. Administrators must carefully order rules to achieve the desired allow or deny behavior.

Answer

The rule's priority value, which is set in the rule's advanced settings.

Answer

The rule's creation timestamp, with older rules evaluated first.

Answer

The rule's zone pair, with intra-zone rules evaluated before inter-zone rules.

Question 13

A security engineer is deploying a new Palo Alto Networks firewall pair in an active/passive high availability configuration. The requirement is that if the active device's link to the upstream core switch fails, the passive device must take over immediately, even if the passive device's own link to that same switch is still up. Which HA configuration satisfies this requirement?

Accepted Answer

Configure a Link Monitoring group on both peers containing the upstream interface, set the Failure Condition to 'any', and assign a matching Link Monitoring group ID on both devices.. Immediate takeover on an upstream link failure requires Link Monitoring, not preemption or HA1 tuning. The monitored interface must be defined in a Link Monitoring group on both peers with a matching group ID and Failure Condition 'any', so the active device relinquishes the active role the moment that link drops while the passive device's matching link remains healthy.

Answer

Enable HA Link Monitoring on the active device only, with Failure Condition set to 'any'.

Answer

Set the HA1 control link to use a dedicated interface and enable HA1 encryption between the peers.

Answer

Enable preemption and set the active device's priority lower than the passive device's priority.

Question 14

A NetSec-Pro administrator is configuring a firewall to inspect traffic between an internal trusted zone and an external untrusted zone. The security policy allows the traffic, and a security profile group is applied. However, the administrator notices that SSL decryption is not occurring, and encrypted threats are passing uninspected. Which configuration step is required to enable SSL forward proxy decryption?

Accepted Answer

Create a decryption policy rule with the action 'ssl-forward-proxy' and attach a decryption profile.. SSL forward proxy decryption is enabled by creating a decryption policy rule with the action 'ssl-forward-proxy' and attaching a decryption profile. This rule allows the firewall to act as a proxy, decrypting outbound SSL traffic, inspecting it, and re-encrypting it. Without such a rule, encrypted traffic is not decrypted, regardless of security profiles applied to the security policy.

Answer

Enable SSL decryption globally under Device > Setup > Session.

Answer

Configure a URL filtering profile with the 'decrypt' action for SSL traffic.

Answer

Add an application override for SSL to force traffic through the decryption engine.

Question 15

A security operations team is investigating a series of alerts indicating that the firewall is not blocking known malicious files. They have a WildFire license and a File Blocking profile attached to a security policy. However, users are still able to download and execute malicious executables. Which configuration issue is most likely causing this failure?

Accepted Answer

The File Blocking profile is configured to alert instead of block for the executable file type.. The File Blocking profile action determines whether a file is blocked or simply logged. If the action for the executable file type is set to 'alert', the firewall allows the download and generates a log. To block malicious executables, the action must be set to 'block'. Other factors like license expiration, direction, or decryption may affect inspection, but the most direct cause for not blocking is the profile action set to alert.

Answer

The security policy rule does not have the File Blocking profile applied to the correct direction (download).

Answer

The firewall is not configured to decrypt SSL traffic, so it cannot inspect the files.

Answer

The WildFire license is expired, so the firewall cannot query the WildFire cloud.