NetSec-Pro Network Security Fundamentals Practice Test 1 — 15 Questions

Question 1

Which component of the Palo Alto Networks architecture is responsible for the 'Single Pass' processing engine?

Accepted Answer

Data Plane. The Single Pass Parallel Processing (SP3) architecture integrates networking, security, and management on the dataplane.

Answer

Panorama

Answer

Management Plane

Answer

Control Plane

Question 2

A administrator notices traffic is being dropped by the 'intrazone-default' policy. What is the most likely cause?

Accepted Answer

The source and destination zones are the same, and no explicit allow policy exists.. Intrazone traffic is implicitly denied by default on PAN-OS firewalls unless a specific policy is created.

Answer

The traffic is coming from a zone with no security profile assigned.

Answer

The firewall is in Layer 2 mode and the MAC address table is full.

Answer

The App-ID is unidentified, causing a drop by the default cleanup rule.

Question 3

Which interface type is used to connect the firewall to a switch for management or routing?

Accepted Answer

Layer 3. A Layer 3 interface on a Palo Alto Networks firewall is a routed interface with an IP address, used to connect the firewall to a switch for management access or for routing traffic between subnets. It supports features like DHCP, virtual routers, and zone assignment, making it the correct choice for management or routing connectivity. Layer 2, Virtual Wire, and Tap interfaces serve different deployment modes and do not provide the routed IP connectivity required for management or inter-subnet routing.

Answer

Virtual Wire

Answer

Tap

Answer

Layer 2

Question 4

Which TWO of the following are types of User-ID mapping methods?

Accepted Answer

Syslog Parsing. Syslog Parsing (B) is a valid User-ID mapping method because Palo Alto Networks firewalls can ingest syslog messages from sources such as wireless controllers and parse them to extract username-to-IP mappings. Active Directory (Domain Controller) Mapping (E) is also correct because the firewall can query AD domain controllers via the User-ID Agent or XML API to retrieve logged-in user and IP address information. SNMP Traps (A) are used for network monitoring and device health alerts, not for building user-to-IP mappings. BGP Peer discovery (C) is a routing protocol mechanism for exchanging network reachability information, not a User-ID mapping method. DHCP Server lease logs (D) provide IP-to-MAC bindings, not username-to-IP mappings, so they are not a User-ID mapping method.

Answer

SNMP Traps

Answer

BGP Peer discovery

Answer

DHCP Server lease logs

Question 5

Which THREE are types of security policies that can be configured on a Palo Alto Networks firewall?

Accepted Answer

Decryption Policy. Palo Alto firewalls support Security, NAT, and Decryption policies.

Answer

Firmware update policy

Answer

User mapping policy

Question 6

A NetSec-Pro administrator is deploying a pair of firewalls at the perimeter. The design requires that a session already permitted by policy continues to be forwarded even if the routing table changes because a different path becomes preferred during a failover event. Which configuration supports this requirement?

Accepted Answer

Enable session preservation so that existing sessions keep using their original forwarding decision and are not re-processed by the dataplane.. Session preservation is the mechanism that keeps established sessions bound to their original forwarding decision, so a change in the routing table does not re-route or re-evaluate an already-permitted flow. This is exactly what the design requires during failover: continuity for existing sessions. Session ownership, asymmetric routing tolerance, and longer timeouts address different concerns and do not prevent disruption from a routing change.

Answer

Increase the TCP session timeout values in the security policy so that flows remain active longer during failover.

Answer

Configure a Policy-Based Forwarding (PBF) rule that pins matching traffic to a specific egress interface and next hop.

Answer

Enable session ownership and asymmetric routing tolerance so established flows are not re-evaluated against the routing table.

Question 7

A network engineer is documenting the trust boundaries of a small office network that uses a single Palo Alto Networks firewall. The ISP-provided router connects directly to the firewall's ethernet1/1 interface, and the internal user VLAN connects to ethernet1/2. The engineer must assign the correct zone type to ethernet1/1 so that the default security policy posture protects internal hosts from unsolicited inbound sessions. Which zone type should be assigned to ethernet1/1?

Accepted Answer

Untrust zone. The trust boundary of a perimeter firewall is expressed through zone assignment. The ISP-facing interface carries traffic from outside the organization's administrative control, so it belongs in an untrust zone. This causes default interzone handling to treat sessions from that link as originating from a lower-trust segment, which is the intended posture for protecting internal hosts.

Answer

Tap zone

Answer

Trust zone

Answer

Layer 3 zone

Question 8

A network engineer is designing zone assignments for a new PAN-OS deployment. The requirement states that traffic between two interfaces assigned to the same zone must still be inspected by security policy rather than being implicitly allowed. Which action should the engineer take?

Accepted Answer

Place the two interfaces in different zones and create an explicit rule permitting the traffic. Same-zone interfaces are covered by the implicit intrazone-default rule, which allows the traffic without a policy lookup. To force inspection, the interfaces must reside in different zones so that the interzone behaviour applies and an explicit rule is required to permit the flow.

Answer

Enable the 'inspect intrazone traffic' checkbox in the zone protection profile for that zone

Answer

Configure a policy-based forwarding rule that redirects same-zone traffic through the firewall's inspection engine

Answer

Create a security rule with the source and destination zones both set to the same zone and attach an application filter

Question 9

A network architect is designing segmentation for a new data center. The requirement is that east-west traffic between two server VLANs must be inspected by a next-generation firewall, but the firewall must NOT be the default gateway for either VLAN. Which deployment method best meets this requirement?

Accepted Answer

Policy-Based Forwarding that redirects inter-VLAN flows to the firewall. The design requires inspection of inter-VLAN traffic without changing the default gateway. Policy-Based Forwarding on the Layer 3 switches redirects selected flows to the firewall, which inspects and returns them, so the switches remain the gateways. Transparent and virtual wire modes do not route between the VLANs, and making the firewall the gateway violates the requirement.

Answer

Layer 2 transparent mode with the firewall bridging the two VLANs

Answer

Layer 3 deployment where the firewall is the default gateway for both VLANs

Answer

Virtual wire deployment between a pair of Layer 3 switches

Question 10

A network engineer is deploying a NetSec-Pro compliant firewall between the corporate LAN and the internet. The security policy requires that all outbound web traffic be inspected for malicious content and that certain file types be blocked. Which NetSec-Pro feature should be configured to meet these requirements?

Accepted Answer

Security profile group. The requirement is to inspect outbound web traffic for malicious content and block certain file types. A Security profile group aggregates multiple security profiles, including Antivirus, Anti-Spyware, Vulnerability Protection, URL Filtering, and File Blocking, and applies them collectively to a security policy rule. This ensures all necessary inspections occur without configuring each profile individually.

Answer

File Blocking profile

Answer

URL Filtering profile

Answer

Antivirus profile

Question 11

An engineer is setting up a new branch office firewall. The branch has a single flat Layer 2 subnet for all users, servers, and printers, and the engineer wants to enforce different security policies for each device type without adding VLANs or changing the existing switch configuration. Which zone design should the engineer implement?

Accepted Answer

Create multiple Layer 2 zones and assign a different physical interface to each zone.. Layer 2 zones on distinct physical interfaces provide policy separation for devices that share a single subnet and a non-VLAN-capable switch. Because each zone is a separate security boundary, interzone rules can enforce least privilege between users, servers, and printers while the existing flat Layer 2 topology and addressing stay unchanged.

Answer

Create multiple Layer 2 zones, each containing a different subinterface with VLAN tags.

Answer

Create one Layer 3 zone and place all interfaces in it, then use application-based policy rules.

Answer

Create separate Layer 3 zones and assign each device type a different IP subnet.

Question 12

A network security engineer is hardening a switch infrastructure against Layer 2 attacks. The requirement is to prevent an attacker from connecting a rogue switch and becoming the root bridge, which would allow traffic to be redirected through the attacker's device. Which control should be enabled?

Accepted Answer

BPDU Guard on all access ports. BPDU Guard is designed for access ports and disables them upon receiving BPDUs, which stops rogue switches from participating in Spanning Tree and becoming the root bridge. Root Guard is for downstream designated ports, while DAI and DHCP snooping address ARP and DHCP threats rather than STP topology manipulation.

Answer

Dynamic ARP Inspection on all VLANs

Answer

DHCP snooping with trusted uplink ports

Answer

Root Guard on the uplink ports toward the distribution layer

Question 13

A security operations analyst is investigating a series of alerts indicating that an internal host is communicating with a known malicious IP address. The analyst wants to quickly block all future traffic to that IP address at the perimeter firewall without creating a new security policy for each affected internal host. Which Palo Alto Networks feature should the analyst use?

Accepted Answer

Add the malicious IP to a dynamic block list (DBL) and enable it in the security policy.. A dynamic block list (DBL) is designed to block traffic to or from IP addresses, URLs, or domains that are on a list. By adding the malicious IP to a DBL and referencing it in a security policy, the analyst can block all future traffic to that IP without creating individual rules for each internal host. This is scalable and immediate.

Answer

Enable DNS sinkholing for the malicious IP.

Answer

Configure a URL filtering profile to block the IP address.

Answer

Create a security policy rule that denies traffic from any source to the malicious IP.

Question 14

A network security engineer is designing a security policy for a Palo Alto Networks firewall. The policy must allow only specific applications for the finance department while ensuring that all other traffic is logged. The engineer wants to leverage App-ID and User-ID to meet these requirements. Which two actions should the engineer take to achieve this? (Choose two.)

Accepted Answer

Create a security policy rule that denies all other traffic and enable logging on that rule.. To allow only specific applications for the finance group and log all other traffic, the engineer must create an allow rule for the finance group with logging enabled, and a subsequent deny rule that matches all other traffic with logging enabled. This ensures both allowed and denied traffic are logged appropriately. The allow rule should be placed above the deny rule.

Answer

Create a security policy rule that allows the required applications for the finance group and attach a security profile group to the rule.

Answer

Create a security policy rule that allows the required applications for the finance group and enable logging at the start of the session.

Answer

Create a security policy rule that allows the required applications for the finance group and place it above a rule that denies all other traffic.

Question 15

You are troubleshooting a connection that is being blocked despite a matching policy. Which tool is best for determining which specific rule is hitting the traffic?

Accepted Answer

Policy Test Tool (test security-policy-match). The Policy Test Tool (test security-policy-match) is purpose-built to simulate a flow against the current rulebase and report exactly which Security Policy rule matches or whether the default deny is hit. It lets you specify source zone, destination zone, source/destination IP, user, application, and service to see the rule evaluation result. This directly answers which rule is hitting the traffic.

Answer

Packet Capture (pcap)

Answer

GlobalProtect logs

Answer

Traffic Monitor