NetSec-Pro Multiple Select — 30 Questions

Question 1

A network security engineer is deploying Prisma Access to secure remote workers. The engineer needs to ensure that traffic from remote users is inspected for threats and that access to SaaS applications is controlled based on user identity and device posture. Which two components are required to achieve these goals? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

GlobalProtect app. The GlobalProtect app is necessary for remote users to connect and provide identity and posture information. Security policy rules with App-ID and User-ID are needed to enforce access control to SaaS applications based on user and application. Together, they enable threat inspection and identity-based control. The other options are either licensing, optional, or not applicable to mobile user connectivity.

Answer

Prisma Access service connection

Answer

Prisma Access mobile users license

Answer

Cloud Identity Engine

Question 2

A network security administrator is configuring a firewall to integrate with a cloud-based threat intelligence service. The administrator wants to automatically block traffic to known malicious IP addresses and domains. Which two actions are required to achieve this? (Choose two.)

Accepted Answer

Create an External Dynamic List (EDL) for IP addresses and domains.. To automatically block traffic to known malicious IPs and domains using a cloud-based threat intelligence service, you must first create External Dynamic Lists (EDLs) that contain the indicators. Then, you reference these EDLs in Security Policy rules to enforce blocking. This two-step process allows dynamic updates from the external source to be immediately enforced by the firewall.

Answer

Set up a DNS Security profile with a custom category for malicious domains.

Answer

Configure a Decryption policy to inspect SSL traffic to malicious sites.

Answer

Enable WildFire inline machine learning.

Question 3

Which THREE types of information are contained in the Panorama 'Device Health' report?

Accepted Answer

CPU utilization. The Panorama 'Device Health' report surfaces resource-level telemetry from managed firewalls, and it explicitly includes CPU utilization (A), disk space utilization (B), and memory usage (C) as its core metrics, since these three resource dimensions are what the report is designed to monitor for capacity and performance troubleshooting. CPU utilization (A) is correct because the report tracks processor load on the managed devices. Disk space utilization (B) is correct because the report shows storage consumption so administrators can detect low-disk conditions. Memory usage (C) is correct because the report monitors RAM consumption on the firewalls. Security policy hit counts (D) are not part of Device Health; that data appears in policy/rule usage and traffic logs, not the health report. Active user count (E) is also not included, as user/session information comes from other monitoring views such as the ACC or user activity logs rather than the Device Health report.

Answer

Security policy hit counts

Answer

Active user count

Question 4

A NetSec-Pro administrator is configuring a security policy to allow access to a web application. The administrator wants to ensure that the policy enforces least privilege by restricting access to only the necessary users and applications. Which two NetSec-Pro features should be used together to achieve this? (Choose two.)

Accepted Answer

App-ID. User-ID and App-ID together enable policies that allow only specific users to access only the required application. User-ID maps IP addresses to users, and App-ID identifies the application precisely. This combination enforces least privilege by ensuring that access is granted based on both user identity and application, rather than broad IP or port-based rules.

Answer

URL Filtering profile

Answer

Service objects

Answer

Security profile group

Question 5

Which TWO steps are involved in the process of replacing a failed firewall that is managed by Panorama?

Accepted Answer

Push the configuration to the new device using the existing Device Group.. Option A is correct because Panorama manages firewalls through Device Groups, so once the replacement firewall is added and its serial number is registered, the existing Device Group configuration can be pushed to it, restoring the same policy and object configuration without rebuilding anything. Option D is correct because Panorama identifies managed firewalls by serial number, so the failed device's serial number must be removed (or the device deleted) and the replacement firewall's serial number added so Panorama can manage and push policy to the new hardware. Option B is incorrect because licensing is tied to the firewall's serial number and is handled through the support/licensing portal, not by manually re-licensing every feature as a Panorama replacement step. Option C is incorrect because creating a new Device Group is unnecessary and would fragment policy; the replacement should join the existing Device Group. Option E is incorrect because a new or replacement firewall does not require a factory reset as part of the Panorama replacement workflow.

Answer

Re-license every feature manually.

Answer

Create a new Device Group for the replacement.

Answer

Reset the firewall to factory defaults.

Question 6

Which of the following are types of Dynamic Updates? (Choose TWO)

Accepted Answer

Antivirus. In Palo Alto Networks PAN-OS, Dynamic Updates are the content and signature packages that the firewall downloads from the update server to keep its security engines current, and the two types asked for here are Antivirus (option B) and Applications and Threats (option C). Antivirus updates deliver the antivirus signature database used by the antivirus and WildFire security profiles to detect malware, so B is correct. Applications and Threats updates deliver the App-ID application signatures, threat signatures, and vulnerability protection content used by security policies, so C is correct. Firmware (A) is a PAN-OS software image upgrade rather than a Dynamic Update, External Dynamic Lists (D) are user-defined lists of IPs/domains/URLs imported for policy enforcement, and Certificate Revocation List (E) is a certificate-status mechanism, none of which are Dynamic Update types.

Answer

Firmware

Answer

External Dynamic Lists

Answer

Certificate Revocation List

Question 7

Which TWO pieces of information are displayed in the 'WildFire Analysis' log?

Accepted Answer

The final verdict (e.g., Malware, Benign).. Option C is correct because the WildFire Analysis log records the final verdict returned by WildFire for the submitted sample, such as Malware, Benign, Grayware, or Phishing, which is the primary purpose of the log. Option E is correct because the WildFire Analysis log includes the MD5 hash (and typically SHA-256) of the analyzed file, which uniquely identifies the sample and is used to correlate submissions and verdicts. Options A, B, and D are not part of the WildFire Analysis log: username attribution, total bandwidth consumed by the transfer, and the physical port number used for upload are not fields WildFire reports, since the log focuses on file identification and the malware verdict rather than user or transport-layer details.

Answer

The username of the person who downloaded the file.

Answer

The total bandwidth used by the file transfer.

Answer

The physical port number used for the upload.

Question 8

Which TWO logs are essential when troubleshooting a user who cannot connect to the internet?

Accepted Answer

System Logs.. System Logs (A) are essential because they record control-plane and system-level events such as interface up/down transitions, routing or DHCP failures, and daemon errors that directly explain why a user's traffic cannot reach the internet. Traffic Logs (C) are essential because they show the actual session-level flow of the user's packets—source/destination, port, application, and allow/deny disposition—revealing whether traffic is being dropped, misrouted, or never leaving the device. Together these two logs cover both the underlying system state and the live traffic behavior needed to isolate an internet-connectivity failure. Decryption Logs (B) only matter for inspecting encrypted sessions and are irrelevant when basic connectivity is broken, Config Logs (D) merely track configuration changes rather than runtime connectivity state, and Threat Logs (E) only show security-policy hits such as exploits or malware, which are not required to diagnose a simple inability to reach the internet.

Answer

Decryption Logs.

Answer

Config Logs.

Answer

Threat Logs.

Question 9

Which THREE items are included in a Panorama configuration 'Export'?

Accepted Answer

Security policy rules. Option A (Security policy rules) is correct because Panorama's Export function saves the device-group policy configuration, including security rules, as part of the exported XML/configuration bundle. Option B (Template network configurations) is correct because template stacks and their network settings (interfaces, zones, virtual routers, etc.) are part of the Panorama configuration and are included in the export. Option E (Address and Service objects) is correct because these are configuration objects stored in Panorama and referenced by policy, so they are exported along with the rest of the config. Option C (Log data files) is not included because logs reside in the logging storage and are not part of a configuration export. Option D (Historical threat reports) is not included because reports are generated data/artifacts, not configuration, and are not part of the export.

Answer

Log data files

Answer

Historical threat reports

Question 10

Which TWO of the following are benefits of using Strata Cloud Manager over traditional on-premises Panorama?

Accepted Answer

Automatic updates and feature availability.. SCM provides cloud-native benefits such as reduced infrastructure overhead and automated updates.

Answer

Direct root access to the management server.

Answer

Support for legacy PAN-OS versions 6.0 and below.

Answer

Ability to host custom local scripts.

Question 11

Which THREE components are involved in the Prisma Access architecture for protecting mobile users?

Accepted Answer

GlobalProtect App. The GlobalProtect App (B) is the endpoint client installed on mobile users' laptops and devices; it initiates the tunnel and enforces security policy on the endpoint, making it a core component of Prisma Access mobile user protection. The GlobalProtect Gateway (D) is the Prisma Access service infrastructure that terminates the GlobalProtect tunnels from mobile users and applies security policy in the cloud. The Identity Provider (E), using SAML or LDAP, is required to authenticate mobile users and enable identity-based policy enforcement before access is granted. Service Connection (A) is used to connect remote networks and data centers to Prisma Access, not mobile users, and a Local Branch Firewall (C) is a remote network component rather than part of the mobile user architecture.

Answer

Service Connection

Answer

Local Branch Firewall

Question 12

Which TWO actions should be performed when configuring a new DNS Security profile to protect against DNS-based malware?

Accepted Answer

Enable 'Sinkhole' and specify the IP address for the sinkhole.. Option A is correct because enabling the Sinkhole action in a DNS Security profile lets the firewall return a forged, administrator-specified IP address (the sinkhole IP) for DNS queries that match malicious domains, preventing clients from reaching malware command-and-control or payload servers. Option C is correct because the DNS Categories tab is where you select which URL/domain categories (e.g., malware, phishing, command-and-control) the profile should block or sinkhole, which is the core mechanism for filtering DNS-based threats. The other options do not belong: DNS over HTTPS (B) is a client-side encrypted transport that the firewall cannot simply 'force' via a DNS Security profile, a DNS Proxy object per zone (D) is not required for a DNS Security profile to function, and Packet Capture (E) is a troubleshooting/diagnostic feature, not a protection setting.

Answer

Configure 'DNS over HTTPS' to force all traffic through the firewall.

Answer

Create a 'DNS Proxy' object for every zone.

Answer

Enable 'Packet Capture' for all DNS traffic.

Question 13

Which THREE features are part of the Palo Alto Networks Single Pass Architecture?

Accepted Answer

App-ID. The Palo Alto Networks Single Pass Architecture performs all security processing in one pass through the dataplane, and its three core identifying technologies are App-ID, User-ID, and Content-ID. Option C (App-ID) is correct because it identifies the application regardless of port, protocol, or encryption, which is the foundation of the single-pass inspection. Option D (User-ID) is correct because it maps IP addresses to users and groups so policy can be enforced based on identity, feeding directly into the same single-pass evaluation. Option E (Content-ID) is correct because it applies threat prevention, URL filtering, file blocking, and data filtering to the identified flow within that same pass. Options A (Management interface) and B (Switching capacity) are not correct because they are platform/hardware characteristics rather than the security technologies that constitute the Single Pass Architecture.

Answer

Management interface

Answer

Switching capacity

Question 14

Which TWO actions should an administrator perform to prepare for a large-scale firmware upgrade across an enterprise using Panorama?

Accepted Answer

Upload the firmware images to Panorama.. Option B is correct because Panorama must have the target PAN-OS firmware images uploaded to it (via Device > Software or the Panorama software manager) so they can be pushed to managed firewalls during a large-scale upgrade. Option C is correct because the Compatibility Matrix must be verified to confirm that each firewall model supports the target PAN-OS release and that the required base image and upgrade path are valid before deploying enterprise-wide. Option A is wrong because deleting logs does not prepare firmware images or validate upgrade paths and could destroy audit data. Option D is wrong because disabling security policies is unnecessary and would create a security gap during the upgrade. Option E is wrong because manually SSHing into every firewall is not scalable or required; Panorama can check and report disk space and readiness across managed devices.

Answer

Delete all old logs to free up space.

Answer

Disable all security policies.

Answer

Manually SSH into every firewall to check disk space.

Question 15

An administrator is configuring a SASE solution with Palo Alto Networks Prisma Access. The goal is to ensure that traffic from remote users to SaaS applications is inspected for threats while optimizing performance. Which two components are required to achieve this? (Choose two.)

Accepted Answer

Prisma Access security processing node (SPN) in the closest region. To secure remote user traffic to SaaS applications with Prisma Access, a GlobalProtect app on user devices establishes the connection, and a Security Processing Node (SPN) in the closest region performs security inspection and optimizes routing. These two components are essential for SASE security and performance.

Answer

A dedicated VPN concentrator in the data center

Answer

Explicit proxy configuration on the remote user's device

Answer

SD-WAN devices at branch offices

Question 16

Which THREE of the following are valid Security Profile types?

Accepted Answer

URL Filtering. URL Filtering (B) is a valid Security Profile type because it enforces web access policy by categorizing URLs and applying allow/block/alert actions per category. Vulnerability Protection (D) is a valid Security Profile type that inspects traffic for exploits and applies signatures with actions such as block, alert, or reset. Anti-Spyware (E) is a valid Security Profile type that detects and blocks spyware, C2 callbacks, and other malicious traffic using signatures and DNS sinkholing. Zone Routing (A) is not a Security Profile type; it is a network configuration concept related to zones and routing. Policy Optimizer (C) is not a Security Profile type; it is a tool for reviewing and tightening security policy rules, not a profile applied to traffic inspection.

Answer

Zone Routing

Answer

Policy Optimizer

Question 17

Which THREE of the following are settings that can be configured in a URL Filtering profile?

Accepted Answer

Category-based blocking. In a Palo Alto Networks URL Filtering profile, category-based blocking (B) is a core setting that lets you set actions (allow, block, alert, continue, override) per URL category, so it is correct. Block/Allow lists (D) are also configurable in the URL Filtering profile, allowing specific URLs or domains to be explicitly permitted or denied regardless of category. Credential phishing protection (E) is a URL Filtering profile setting that blocks phishing sites attempting to steal credentials, making it correct. Antivirus scanning (A) belongs to the Antivirus security profile, and File blocking (C) belongs to the File Blocking profile, so neither is configured within a URL Filtering profile.

Answer

Antivirus scanning

Answer

File blocking

Question 18

Which THREE of the following items are required to successfully deploy a Prisma Access Service Connection?

Accepted Answer

Service connection name. When configuring a Prisma Access Service Connection, you must provide a Service connection name (B) to uniquely identify the connection within the Prisma Access infrastructure, as it is a mandatory field in the service connection configuration workflow. You must also specify the Destination IP range (D), which defines the internal/on-premises networks that Prisma Access should route traffic to through the service connection. Additionally, a BGP or Static Route configuration (E) is required because the service connection needs a routing method to exchange or define routes between Prisma Access and the customer's network (BGP peering or static routes). The other options are not required: a user authentication list (A) is unrelated to service connection deployment (it pertains to user identification/authentication policies), and the Prisma Access Gateway IP (C) is not a value you supply for a service connection; gateway IPs are assigned by Prisma Access rather than being an input requirement.

Answer

User authentication list

Answer

Prisma Access Gateway IP

Question 19

Which THREE components are involved in configuring an IKE Gateway for a VPN?

Accepted Answer

Local interface.. An IKE Gateway configuration requires a Local interface (A), which specifies the physical or logical interface (e.g., ethernet1/1) on the firewall that terminates the VPN tunnel and sources IKE negotiations. It also requires a Peer IP address (C), the static IP of the remote IKE peer used to identify and reach the remote gateway during Phase 1 negotiation. A Pre-Shared Key (D) is also required as the authentication credential exchanged during IKE Phase 1 to authenticate both peers when using PSK-based authentication. VLAN ID (B) is a Layer 2 segmentation parameter not part of IKE gateway settings, and DHCP server scope (E) relates to address assignment for clients, not to IKE gateway configuration.

Answer

VLAN ID.

Answer

DHCP server scope.

Question 20

Which TWO steps are necessary to ensure that 'Threat Prevention' is protecting traffic against known vulnerabilities?

Accepted Answer

Ensure the 'Threats' dynamic update is downloaded and installed.. Option B is correct because Threat Prevention relies on the Applications and Threats content database, which is delivered through the 'Threats' dynamic update; without downloading and installing the latest content package, the firewall cannot recognize newly disclosed vulnerabilities and their signatures. Option E is correct because signatures alone do not act on traffic—a Vulnerability Protection profile (containing vulnerability signatures and actions) must be attached to the security policy rule so that matching traffic is inspected and blocked or alerted. Option A is wrong because App-ID is fundamental to identifying applications and is not disabled for Threat Prevention; disabling it would undermine policy enforcement rather than help. Option C is wrong because content updates do not require a manual reboot; the firewall applies new content dynamically. Option D is wrong because SSL decryption is only needed to inspect encrypted sessions and is not a general requirement for vulnerability protection of all traffic.

Answer

Disable 'App-ID' to prevent interference.

Answer

Manually restart the firewall after every update.

Answer

Enable SSL Decryption for all traffic.