NetSec-Pro Infrastructure Management And CDSS — Timed 30 Questions

Question 1

A network administrator needs to verify that the firewall is successfully communicating with the WildFire cloud service. Which CLI command provides the most relevant connectivity information?

Accepted Answer

show wildfire status. The 'test wildfire registration' command checks the current status of the connection to the WildFire cloud.

Answer

debug wildfire connectivity

Answer

show jobs id wildfire-sync

Answer

test wildfire cloud-reachability

Question 2

Which action is required to ensure that WildFire analysis results are applied to traffic as quickly as possible?

Accepted Answer

Configure the WildFire profile to use the 'Real-time' analysis mode.. The 'Real-time' analysis mode in a WildFire profile submits files to the WildFire cloud for immediate inspection and returns a verdict as soon as it is available, rather than waiting for the next scheduled signature update. This ensures that newly discovered malware is blocked on the firewall without delay. The other options do not affect the speed at which WildFire verdicts are applied to traffic.

Answer

Enable 'Packet Capture' for all security policies.

Answer

Increase the WildFire cloud region to the nearest geographic site.

Answer

Set the WildFire forwarding to 'Legacy' mode.

Question 3

An administrator needs to ensure that only specific subdomains are permitted under a top-level domain while blocking the rest using DNS Security. Which configuration approach is most effective?

Accepted Answer

Create a DNS Security policy rule using a Custom DNS Signature to match the specific subdomains.. Custom DNS signatures allow for granular control over subdomain access beyond basic category filtering.

Answer

Configure a URL Filtering profile to block the top-level domain.

Answer

Enable DNS Security and rely on the default 'Command and Control' category block.

Answer

Add the full domain to the DNS sinkhole whitelist.

Question 4

A company uses a proxy server. How must the Palo Alto Networks firewall be configured to ensure 'Threat Prevention' is effective?

Accepted Answer

Enable X-Forwarded-For header inspection in the Security Profile.. When traffic passes through a proxy, the firewall sees the proxy's IP, not the original client. The firewall must be configured to identify the traffic correctly.

Answer

Disable SSL decryption for the proxy traffic.

Answer

Create a specific 'Proxy' zone and apply an App-ID policy.

Answer

Configure the proxy as a 'Trusted' source in the Device > Setup menu.

Question 5

An administrator wants to audit all security policies to see which ones are not currently using a 'Security Profile'. Which tool is best for this?

Accepted Answer

Policy Optimizer. The 'Policy Optimizer' tool is designed to identify unused or misconfigured policies, including those missing security profiles.

Answer

Global Find

Answer

ACC (Application Command Center)

Answer

Threat Log viewer

Question 6

Where is the configuration located to enable the 'DNS Security' service on a specific security zone?

Accepted Answer

Policies > Security > [Rule Name] > Actions tab. DNS Security is enabled per security policy rule on the Actions tab, where the administrator attaches a DNS Security profile to the rule. This is the correct location because DNS Security is enforced as part of policy evaluation, not as a zone-level or global service setting.

Answer

Objects > Security Profiles > DNS Security

Answer

Network > Zones > [Zone Name]

Answer

Device > Setup > Services > DNS

Question 7

You need to ensure that files uploaded to a specific server are scanned by WildFire. Which setting ensures this?

Accepted Answer

Enable 'Upload' in the File Blocking profile for the specific file types.. WildFire forwarding is configured within the File Blocking profile, which is then attached to the security policy rule.

Answer

Enable 'WildFire' in the Antivirus profile.

Answer

Add the server's IP to the 'WildFire Analysis' whitelist.

Answer

Configure a 'Log Forwarding' profile for WildFire.

Question 8

When managing infrastructure, what is the best practice for handling 'Security Profile Groups'?

Accepted Answer

Use a common group for similar traffic types to ensure consistent security policy enforcement.. Using a common Security Profile Group for similar traffic types ensures consistent security policy enforcement across multiple rules, reducing administrative overhead and the risk of misconfiguration. This best practice aligns with the principle of least privilege while maintaining manageability, as profiles within the group (e.g., antivirus, anti-spyware, vulnerability protection) are applied uniformly.

Answer

Only apply groups to traffic destined for the Internet.

Answer

Avoid using groups and always apply individual profiles to rules.

Answer

Create a unique group for every single security policy rule.

Question 9

Which TWO criteria are used by the firewall to match a security policy rule?

Accepted Answer

Source and Destination Zone.. Option D is correct because firewall security policy rules match traffic based on the source and destination security zones, which define the ingress and egress interfaces and are fundamental match criteria in the rulebase. Option E is correct because App-ID identifies the application regardless of port or protocol, and the identified application is a core match criterion used in security policy rules. Option A is not a match criterion, as packet count is a statistic used for logging, reporting, or threat detection rather than rule matching. Option B is not a match criterion, since session duration is a monitored metric, not a field evaluated when selecting a security policy rule. Option C is not a match criterion, because security policy rules match on IP addressing and zones rather than the physical MAC address of the source.

Answer

The number of packets in the flow.

Answer

The total duration of the session.

Answer

The physical MAC address of the source.

Question 10

Which THREE settings are required in a File Blocking profile to ensure that all executable files are blocked and submitted to WildFire?

Accepted Answer

Select the 'exe' file type.. To block and submit files, the action must be set correctly for the specific file type.

Answer

Enable 'Alert' as the only action.

Answer

Disable 'Session Log' in the Security Profile.

Question 11

When managing WildFire, how can you ensure that you are receiving the latest threat signatures as soon as they are generated?

Accepted Answer

Set the 'WildFire Update Schedule' to 'Every 1 minute'.. Setting the WildFire Update Schedule to 'Every 1 minute' configures the firewall to poll the WildFire cloud (or update server) at the shortest supported interval, ensuring newly generated signatures are retrieved almost immediately. This is the direct, supported mechanism for near-real-time signature delivery without deploying additional infrastructure. The other options either don't exist as described or don't address signature freshness.

Answer

Enable 'Push Notifications' in the Device > Setup menu.

Answer

Use a local WildFire appliance in 'Synchronous' mode.

Answer

Force a manual 'Check Now' every hour.

Question 12

Which THREE actions can be taken in a Vulnerability Protection profile?

Accepted Answer

Reset-Both. Vulnerability protection profiles allow for flexible handling of detected threats based on severity or type.

Answer

Block

Answer

Allow

Answer

Monitor

Question 13

Which TWO locations in the PAN-OS web interface are used to check the status of CDSS subscriptions?

Accepted Answer

Dashboard > Widgets > General Information.. Option B (Dashboard > Widgets > General Information) is correct because the General Information widget on the PAN-OS dashboard displays subscription status, including the CDSS (Cloud-Delivered Security Services) subscription state and its expiry date. Option C (Device > Licenses) is correct because the Licenses page under the Device tab lists all installed licenses and subscriptions, showing the status and expiration of the CDSS subscription. Option A (Network > Interfaces) is incorrect because it only shows interface configuration and status, not subscription information. Option D (Monitor > Logs) is incorrect because it displays traffic, threat, and system logs rather than license or subscription status. Option E (Policies > Security) is incorrect because it is used to configure security rules, not to verify subscription status.

Answer

Network > Interfaces.

Answer

Monitor > Logs.

Answer

Policies > Security.

Question 14

Which THREE types of information can be used to create a custom URL category?

Accepted Answer

IP addresses or subnets.. A custom URL category in PAN-OS (Palo Alto Networks) is built from URL matching criteria, and the three supported match types are IP addresses/subnets (option B), Fully Qualified Domain Names (option C), and URL patterns using regular expressions (option D). Option B is correct because you can list literal IPv4/IPv6 addresses or CIDR subnets as members of a custom URL category, which the firewall matches against the destination IP of the session. Option C is correct because exact FQDNs (for example, www.example.com) can be entered as members and are matched against the HTTP Host header or SNI. Option D is correct because URL patterns written as regular expressions (for example, .*\.example\.com/.*) are the primary way to match paths, wildcards, and subdomains within a custom URL category. Option A is incorrect because App-ID application names are used in security policy rules and application filters, not as members of a URL category. Option E is incorrect because threat signature IDs belong to the threat/vulnerability signature database and are referenced in anti-spyware or vulnerability protection profiles, not in URL filtering categories.

Answer

Application names (App-ID).

Answer

Threat signature IDs.

Question 15

A security administrator is configuring a firewall to decrypt outbound SSL traffic for inspection. After applying the decryption policy, users report that they cannot access their bank's website. The firewall logs show the connection is being decrypted. Which action should the administrator take to allow access while still inspecting other traffic?

Accepted Answer

Add a no-decryption rule for the financial category above the decryption rule.. The correct solution is to create a no-decryption rule for the financial category and place it above the decryption rule. This exempts banking traffic from decryption, allowing users to access the site, while other traffic continues to be decrypted and inspected. This balances security and usability.

Answer

Disable SSL decryption globally and rely on threat prevention without decryption.

Answer

Modify the decryption profile to allow weak protocols and ciphers for the bank's site.

Answer

Import the bank's certificate into the firewall's trusted CA list and enable decryption.

Question 16

A security engineer is configuring a firewall to inspect traffic for threats. The engineer wants to ensure that the firewall performs antivirus scanning, anti-spyware scanning, and vulnerability protection on allowed traffic. Which two components must be configured and applied to the security policy rule to achieve this? (Choose two.)

Accepted Answer

Antivirus security profile. To enable antivirus and anti-spyware scanning on allowed traffic, both an Antivirus security profile and an Anti-Spyware security profile must be configured and attached to the security policy rule. These profiles provide the necessary inspection to detect and block malware and spyware in allowed traffic.

Answer

Vulnerability Protection security profile

Answer

URL Filtering profile

Answer

File Blocking profile

Question 17

A security administrator is configuring a firewall to inspect traffic between two internal zones. The administrator wants to ensure that if the firewall's content inspection engines fail, traffic is blocked rather than passed uninspected. Which setting should be configured in the Security Profile Group?

Accepted Answer

Enable 'Fail Close' in the Security Profile Group.. The 'Fail Close' setting in a Security Profile Group is specifically designed to block traffic if the content inspection engines fail. This ensures that no uninspected traffic passes between zones, upholding the security policy. It is a critical configuration for environments that require strict security enforcement.

Answer

Configure a Decryption profile with 'Block Unsupported SSL' enabled.

Answer

Enable 'Fail Open' in the Security Profile Group.

Answer

Set the action to 'Reset Client' in the security policy rule.

Question 18

An administrator has configured a Decryption policy with a Forward Proxy profile to inspect outbound TLS traffic. Users report that connections to a partner's website fail with certificate errors, while all other HTTPS sites work normally. The partner's site presents a certificate signed by an internal CA that is not trusted by the firewall. What is the most appropriate action to resolve this while maintaining decryption for other traffic?

Accepted Answer

Create a Decryption policy rule that matches the partner's destination and set the action to 'No Decrypt' with a source user or URL category, placed above the decrypt rule.. When a specific destination presents a certificate chain the firewall cannot validate, the surgical fix is a no-decrypt rule scoped to that destination placed above the general decrypt rule. Traffic to the partner flows uninspected so the browser trusts the internal CA, while the rest of outbound TLS remains decrypted and inspected.

Answer

Add the partner's internal CA certificate to the firewall's trusted certificate authority list and enable it for the decryption profile.

Answer

Add the partner's domain to the SSL Decryption Exclusion list and remove the decryption rule that matches outbound HTTPS.

Answer

Disable the Forward Proxy profile on the decryption rule and rely on Forward Trust for all outbound TLS sessions.

Question 19

A network security team is deploying a CDSS (Cloud-Delivered Security Services) solution and must ensure that DNS-based command-and-control traffic is detected and blocked. Which TWO actions should the team perform? (Choose two.)

Accepted Answer

Enable 'DNS Sinkhole' and configure the sinkhole IP address to point to an internal server used for monitoring malicious resolutions.. Blocking DNS-based C2 requires a DNS Security profile attached to the DNS-permitting security rule plus a blocking action. Enabling the sinkhole action with a defined sinkhole IP, and pointing that IP at an internal monitoring host, both detects and blocks malicious resolutions while generating useful telemetry. Alert-only or custom allow-listing does not stop the channel.

Answer

Enable the DNS Security service in the security zone where the internal DNS servers reside and apply a DNS Rewrite profile.

Answer

Create a custom DNS Security category and add all internal domain names to it to prevent false positives.

Answer

Configure the DNS Security profile to use only the 'Alert' action so that all malicious domains are logged for later review.

Question 20

A NetSec-Pro administrator is configuring a Decryption profile to enforce best practices for SSL Forward Proxy. The organization wants to ensure that weak protocols and ciphers are blocked, and that untrusted certificates are not accepted. Which two settings should be enabled in the Decryption profile? (Choose two.)

Accepted Answer

Block sessions with untrusted issuers. The Decryption profile includes settings to block sessions with expired certificates and untrusted issuers, which directly address the requirement to not accept untrusted certificates and to enforce certificate validity. These settings help prevent users from connecting to potentially malicious sites and ensure that only trusted, valid certificates are accepted during SSL Forward Proxy decryption.

Answer

Block sessions with weak ciphers

Answer

Block sessions with client authentication

Answer

Block TLS 1.0 and TLS 1.1