NetSec-Pro Network Security Fundamentals — 10 Questions

Question 1

Which component of the Palo Alto Networks architecture is responsible for the 'Single Pass' processing engine?

Accepted Answer

Data Plane. The Single Pass Parallel Processing (SP3) architecture integrates networking, security, and management on the dataplane.

Answer

Panorama

Answer

Management Plane

Answer

Control Plane

Question 2

A administrator notices traffic is being dropped by the 'intrazone-default' policy. What is the most likely cause?

Accepted Answer

The source and destination zones are the same, and no explicit allow policy exists.. Intrazone traffic is implicitly denied by default on PAN-OS firewalls unless a specific policy is created.

Answer

The traffic is coming from a zone with no security profile assigned.

Answer

The firewall is in Layer 2 mode and the MAC address table is full.

Answer

The App-ID is unidentified, causing a drop by the default cleanup rule.

Question 3

Which interface type is used to connect the firewall to a switch for management or routing?

Accepted Answer

Layer 3. A Layer 3 interface on a Palo Alto Networks firewall is a routed interface with an IP address, used to connect the firewall to a switch for management access or for routing traffic between subnets. It supports features like DHCP, virtual routers, and zone assignment, making it the correct choice for management or routing connectivity. Layer 2, Virtual Wire, and Tap interfaces serve different deployment modes and do not provide the routed IP connectivity required for management or inter-subnet routing.

Answer

Virtual Wire

Answer

Tap

Answer

Layer 2

Question 4

Which TWO of the following are types of User-ID mapping methods?

Accepted Answer

Syslog Parsing. Syslog Parsing (B) is a valid User-ID mapping method because Palo Alto Networks firewalls can ingest syslog messages from sources such as wireless controllers and parse them to extract username-to-IP mappings. Active Directory (Domain Controller) Mapping (E) is also correct because the firewall can query AD domain controllers via the User-ID Agent or XML API to retrieve logged-in user and IP address information. SNMP Traps (A) are used for network monitoring and device health alerts, not for building user-to-IP mappings. BGP Peer discovery (C) is a routing protocol mechanism for exchanging network reachability information, not a User-ID mapping method. DHCP Server lease logs (D) provide IP-to-MAC bindings, not username-to-IP mappings, so they are not a User-ID mapping method.

Answer

SNMP Traps

Answer

BGP Peer discovery

Answer

DHCP Server lease logs

Question 5

Which THREE are types of security policies that can be configured on a Palo Alto Networks firewall?

Accepted Answer

Decryption Policy. Palo Alto firewalls support Security, NAT, and Decryption policies.

Answer

Firmware update policy

Answer

User mapping policy

Question 6

A NetSec-Pro administrator is deploying a pair of firewalls at the perimeter. The design requires that a session already permitted by policy continues to be forwarded even if the routing table changes because a different path becomes preferred during a failover event. Which configuration supports this requirement?

Accepted Answer

Enable session preservation so that existing sessions keep using their original forwarding decision and are not re-processed by the dataplane.. Session preservation is the mechanism that keeps established sessions bound to their original forwarding decision, so a change in the routing table does not re-route or re-evaluate an already-permitted flow. This is exactly what the design requires during failover: continuity for existing sessions. Session ownership, asymmetric routing tolerance, and longer timeouts address different concerns and do not prevent disruption from a routing change.

Answer

Increase the TCP session timeout values in the security policy so that flows remain active longer during failover.

Answer

Configure a Policy-Based Forwarding (PBF) rule that pins matching traffic to a specific egress interface and next hop.

Answer

Enable session ownership and asymmetric routing tolerance so established flows are not re-evaluated against the routing table.

Question 7

A network engineer is documenting the trust boundaries of a small office network that uses a single Palo Alto Networks firewall. The ISP-provided router connects directly to the firewall's ethernet1/1 interface, and the internal user VLAN connects to ethernet1/2. The engineer must assign the correct zone type to ethernet1/1 so that the default security policy posture protects internal hosts from unsolicited inbound sessions. Which zone type should be assigned to ethernet1/1?

Accepted Answer

Untrust zone. The trust boundary of a perimeter firewall is expressed through zone assignment. The ISP-facing interface carries traffic from outside the organization's administrative control, so it belongs in an untrust zone. This causes default interzone handling to treat sessions from that link as originating from a lower-trust segment, which is the intended posture for protecting internal hosts.

Answer

Tap zone

Answer

Trust zone

Answer

Layer 3 zone

Question 8

A network engineer is designing zone assignments for a new PAN-OS deployment. The requirement states that traffic between two interfaces assigned to the same zone must still be inspected by security policy rather than being implicitly allowed. Which action should the engineer take?

Accepted Answer

Place the two interfaces in different zones and create an explicit rule permitting the traffic. Same-zone interfaces are covered by the implicit intrazone-default rule, which allows the traffic without a policy lookup. To force inspection, the interfaces must reside in different zones so that the interzone behaviour applies and an explicit rule is required to permit the flow.

Answer

Enable the 'inspect intrazone traffic' checkbox in the zone protection profile for that zone

Answer

Configure a policy-based forwarding rule that redirects same-zone traffic through the firewall's inspection engine

Answer

Create a security rule with the source and destination zones both set to the same zone and attach an application filter

Question 9

A network architect is designing segmentation for a new data center. The requirement is that east-west traffic between two server VLANs must be inspected by a next-generation firewall, but the firewall must NOT be the default gateway for either VLAN. Which deployment method best meets this requirement?

Accepted Answer

Policy-Based Forwarding that redirects inter-VLAN flows to the firewall. The design requires inspection of inter-VLAN traffic without changing the default gateway. Policy-Based Forwarding on the Layer 3 switches redirects selected flows to the firewall, which inspects and returns them, so the switches remain the gateways. Transparent and virtual wire modes do not route between the VLANs, and making the firewall the gateway violates the requirement.

Answer

Layer 2 transparent mode with the firewall bridging the two VLANs

Answer

Layer 3 deployment where the firewall is the default gateway for both VLANs

Answer

Virtual wire deployment between a pair of Layer 3 switches

Question 10

A network engineer is deploying a NetSec-Pro compliant firewall between the corporate LAN and the internet. The security policy requires that all outbound web traffic be inspected for malicious content and that certain file types be blocked. Which NetSec-Pro feature should be configured to meet these requirements?

Accepted Answer

Security profile group. The requirement is to inspect outbound web traffic for malicious content and block certain file types. A Security profile group aggregates multiple security profiles, including Antivirus, Anti-Spyware, Vulnerability Protection, URL Filtering, and File Blocking, and applies them collectively to a security policy rule. This ensures all necessary inspections occur without configuring each profile individually.

Answer

File Blocking profile

Answer

URL Filtering profile

Answer

Antivirus profile