A NetSec-Pro administrator is deploying a pair of firewalls at the perimeter. The design requires that a session already permitted by policy continues to be forwarded even if the routing table changes because a different path becomes preferred during a failover event. Which configuration supports this requirement?
A network engineer is documenting the trust boundaries of a small office network that uses a single Palo Alto Networks firewall. The ISP-provided router connects directly to the firewall's ethernet1/1 interface, and the internal user VLAN connects to ethernet1/2. The engineer must assign the correct zone type to ethernet1/1 so that the default security policy posture protects internal hosts from unsolicited inbound sessions. Which zone type should be assigned to ethernet1/1?
A network engineer is designing zone assignments for a new PAN-OS deployment. The requirement states that traffic between two interfaces assigned to the same zone must still be inspected by security policy rather than being implicitly allowed. Which action should the engineer take?
A network architect is designing segmentation for a new data center. The requirement is that east-west traffic between two server VLANs must be inspected by a next-generation firewall, but the firewall must NOT be the default gateway for either VLAN. Which deployment method best meets this requirement?
A network engineer is deploying a NetSec-Pro compliant firewall between the corporate LAN and the internet. The security policy requires that all outbound web traffic be inspected for malicious content and that certain file types be blocked. Which NetSec-Pro feature should be configured to meet these requirements?
An engineer is setting up a new branch office firewall. The branch has a single flat Layer 2 subnet for all users, servers, and printers, and the engineer wants to enforce different security policies for each device type without adding VLANs or changing the existing switch configuration. Which zone design should the engineer implement?
A network security engineer is hardening a switch infrastructure against Layer 2 attacks. The requirement is to prevent an attacker from connecting a rogue switch and becoming the root bridge, which would allow traffic to be redirected through the attacker's device. Which control should be enabled?
A security operations analyst is investigating a series of alerts indicating that an internal host is communicating with a known malicious IP address. The analyst wants to quickly block all future traffic to that IP address at the perimeter firewall without creating a new security policy for each affected internal host. Which Palo Alto Networks feature should the analyst use?
A network security engineer is designing a security policy for a Palo Alto Networks firewall. The policy must allow only specific applications for the finance department while ensuring that all other traffic is logged. The engineer wants to leverage App-ID and User-ID to meet these requirements. Which two actions should the engineer take to achieve this? (Choose two.)
You are troubleshooting a connection that is being blocked despite a matching policy. Which tool is best for determining which specific rule is hitting the traffic?
You are configuring a new Security Policy on a PAN-OS firewall. To adhere to the principle of least privilege, which configuration approach should you take for the destination zone and address?
A security engineer at a financial services company is designing segmentation for a new data center. The requirement is that the web tier (VLAN 20) must never initiate connections to the database tier (VLAN 30), but the database tier must be able to initiate connections to the web tier for replication. Which security policy configuration on a Palo Alto Networks firewall best enforces this requirement?
A network administrator is reviewing the TCP/IP model layers while troubleshooting a connectivity issue. The administrator needs to identify which layer is responsible for logical addressing and routing of packets across multiple networks. Which layer of the TCP/IP model performs this function?
A security analyst is investigating a series of alerts indicating that an internal host is communicating with a known malicious IP address. The analyst wants to verify whether the traffic was allowed by a specific security policy rule and determine the exact rule name that permitted the session. Which Palo Alto Networks feature should the analyst use to identify the rule that allowed the traffic?
A network security administrator is implementing a defense-in-depth strategy and needs to select controls that operate at the network layer to protect against IP spoofing and to segment traffic between VLANs. Which two controls should the administrator implement? (Choose two.)
A junior administrator is reviewing how a PAN-OS firewall handles a brand-new TCP session between a client in the Trust zone and a web server in the Untrust zone. They want to confirm which component performs the actual security policy lookup for that first packet before any session entry exists. Which component is responsible?
A security team is deploying a new internal application that uses a proprietary protocol over TCP port 8443. The team wants the firewall to inspect the application and enforce policy based on the application rather than just the port. Which Palo Alto Networks feature should be used to identify and control this application?
A security administrator is troubleshooting why a web server in the DMZ zone cannot be reached by external clients even though the inbound security policy permits the traffic. The administrator confirms that the DMZ interface has an IP address, the external interface has an IP address, and static routes exist in both directions. The web server's default gateway points to the firewall's DMZ interface. Which additional configuration is required for the firewall to translate the public destination address to the web server's private address?
A network engineer is designing a zero-trust micro-segmentation architecture for an east-west data center. The requirement is to enforce security policy between workloads on the same VLAN without routing traffic through a physical firewall appliance. Which technology should the engineer implement?
An analyst is investigating why a server in the DMZ zone can reach an external update site on TCP 443 even though no security rule explicitly permits that server's traffic. The firewall uses a security rule with the application set to 'ssl' and the service set to 'application-default'. Which behaviour explains the observed connectivity?
A network security team is designing segmentation for a new data center. They want to ensure that east-west traffic between application tiers is inspected and that any compromised host cannot freely reach other tiers. They plan to use security zones and security policies on their Palo Alto Networks firewalls. Which TWO design elements are required to enforce least-privilege east-west segmentation? (Choose two.)
A security analyst is reviewing a packet capture and notices that a single TCP session to a web server is being inspected, logged, and policy-checked only once, even though the session carries thousands of packets. Which security architecture principle does this behavior illustrate?
A security architect is hardening a PAN-OS firewall that protects a data center. The architect wants to reduce the attack surface exposed by the firewall's own management and control functions. Which TWO measures directly harden the management plane? (Choose two.)
A security analyst is reviewing a packet capture and observes that a single TCP SYN packet sent to a closed port on an internal server elicits a TCP RST response, while the same SYN sent to a filtered port receives no response at all. Which statement best describes what the analyst is observing?
A security operations analyst notices that a workstation in the trust zone is repeatedly attempting connections to an external IP address on TCP port 4444, a port commonly associated with remote access trojans. The security policy currently allows the workstation to reach any external destination on any port because of a legacy any-any outbound rule. The analyst wants to block this specific behavior without disrupting legitimate business traffic. Which action should the analyst take first?
A network security engineer is troubleshooting an intermittent issue where some users lose access to an internal application after a firewall policy change. Logs show the traffic is being dropped with a session end reason indicating the application was not identified. The rule in question uses App-ID with a specific application, and the service is application-default. Which condition most likely explains the drop?
A security team is deploying a new internal certificate authority for TLS inspection. They want to ensure that compromised private keys can be traced and that certificate issuance is cryptographically bound to a public, append-only log that monitors can audit. Which mechanism should they implement?
A company wants to prevent users from resolving domain names for known malicious command-and-control servers. The security team already subscribes to a threat intelligence feed that publishes malicious domains. Which control should be implemented to block DNS resolutions for those domains at the network level?
A NetSec-Pro administrator is configuring a new security policy to allow internal users to access a web server in a DMZ. The administrator wants to ensure that only HTTP and HTTPS traffic is allowed, and that all other traffic is blocked. Which NetSec-Pro feature should be used to identify and control the application?
A security architect is reviewing a design where a Palo Alto Networks firewall will inspect traffic between two internal segments that are both connected to the same firewall. The architect wants to ensure that traffic between the segments is subject to security policy and threat inspection rather than being allowed implicitly. The two segments are currently assigned to different subnets but the same security zone. Which change is required to ensure interzone policy enforcement between the segments?
A network security administrator is hardening a new layer 2 switching infrastructure against common attacks. Which two measures should be implemented to prevent MAC flooding and DHCP spoofing attacks? (Choose two.)
A NetSec-Pro administrator is troubleshooting why a user cannot access a specific SaaS application. The security policy allows the application, but traffic is being denied. The administrator suspects that the application is being identified incorrectly. Which NetSec-Pro feature can be used to verify the application identification and take corrective action?
A network architect must choose an encryption mode for securing site-to-site traffic over an untrusted provider network. The requirement is to provide confidentiality and integrity for each packet independently, allow parallel processing, and avoid the need for sequential block chaining. Which mode should be selected?
A security team wants to detect command-and-control traffic that uses domain generation algorithms (DGAs) and DNS tunnelling. The firewall already performs DNS sinkholing for known malicious domains. Which two additional capabilities should the team enable to improve detection of these DNS-based threats? (Choose two.)
A NetSec-Pro administrator is configuring a security policy to allow access to a web application. The administrator wants to ensure that the policy enforces least privilege by restricting access to only the necessary users and applications. Which two NetSec-Pro features should be used together to achieve this? (Choose two.)
A network architect is designing segmentation for a data centre that hosts web, application, and database tiers. The requirement is to enforce policy based on workload identity that can move between hypervisors and physical hosts, without relying on IP addresses that change during live migration. Which segmentation approach best meets this requirement?
A NetSec-Pro administrator is configuring a security policy to allow inbound access to a web server in the DMZ. The administrator wants to ensure that the policy is as restrictive as possible. Which combination of settings should be used?
A security team is evaluating controls to detect and prevent IP spoofing at the network edge. Which TWO mechanisms are designed to validate the source address of packets and reduce spoofing? (Choose two.)
A security operations team notices that outbound sessions from internal hosts are being allowed to an external server on TCP port 443, but the firewall's threat logs show no inspection of the application data inside those sessions. The team confirms the traffic is not using a protocol that the firewall cannot decrypt. Which action should the team take to gain visibility into the content of these sessions?
A firewall administrator needs to allow a specific set of external partners to reach a web application while blocking all other internet sources. The partners' addresses change periodically, and the administrator wants to update the permitted list from a central management platform without editing the security rule each time. Which object type should the administrator use?
A network security engineer is configuring a Palo Alto Networks firewall to enforce least-privilege access for a group of contractors. The contractors must be able to reach only an internal web application over HTTPS. The engineer wants to avoid creating a new security policy that allows any other application. Which Palo Alto Networks feature should the engineer use to identify and control the HTTPS application?
A network security engineer is troubleshooting why a user cannot access a web application. The engineer checks the traffic logs and sees that the session is being denied by a security policy. The engineer suspects that the application is being identified incorrectly. Which tool should the engineer use to verify how the firewall is classifying the application in real time?