NetSec-Pro Network Security Fundamentals Practice Test 2 — 15 Questions

Question 1

An administrator wants to ensure that only 'web-browsing' traffic is allowed on port 80. Which feature allows this enforcement?

Accepted Answer

App-ID. App-ID is Palo Alto Networks' Layer 7 application identification engine that inspects traffic to determine the actual application regardless of port or protocol. By creating a security policy that allows only the 'web-browsing' App-ID on port 80, the administrator ensures that any other application attempting to use port 80 (such as a tunneled protocol or peer-to-peer app) is denied. This is the core value of App-ID over port-based enforcement.

Answer

Zone Protection Profiles

Answer

Service Objects

Answer

Log Forwarding

Question 2

Which object type in PAN-OS should be used to group multiple IP addresses for use in a security policy?

Accepted Answer

Address Group. An Address Group in PAN-OS is a named object that contains multiple IP addresses, IP ranges, or subnets, and can also include other Address Groups. It is used in security policies to simplify management when the same set of addresses needs to be referenced in multiple rules. This directly matches the requirement to group multiple IP addresses.

Answer

Application Group

Answer

Tag

Answer

Service Group

Question 3

You have a policy matching 'web-browsing' but traffic is being denied. What is the most likely cause?

Accepted Answer

The dependent application, such as 'ssl', is not allowed in the policy.. If the App-ID is correct but traffic is denied, the dependent application (like ssl) might be missing.

Answer

The source zone is incorrect.

Answer

The firewall is in transparent mode.

Answer

The security profile is missing.

Question 4

When deploying a firewall in a Zero Trust environment, what is the recommended stance for the default interzone policy?

Accepted Answer

Deny all traffic by default.. In a Zero Trust environment, the principle of least privilege is paramount. The default interzone policy should deny all traffic by default, and then explicit rules should be created to allow only necessary traffic based on identity, context, and other factors. This ensures that no traffic is implicitly trusted.

Answer

Allow all internal traffic, deny external.

Answer

Allow traffic based on source IP only.

Answer

Allow all traffic to simplify configuration.

Question 5

You are configuring a new Security Policy on a PAN-OS firewall. To adhere to the principle of least privilege, which configuration approach should you take for the destination zone and address?

Accepted Answer

Define a specific Address Object for the destination server and bind it to the correct zone.. The principle of least privilege requires that a Security Policy rule permit only the specific traffic needed. Defining a specific Address Object for the destination server and binding it to the correct destination zone ensures the rule matches only that server, not an entire subnet or any address. This is the correct approach for a least-privilege policy. Using 'any' for zone or address, or relying on the intrazone-default rule, violates least privilege by allowing broader traffic than necessary.

Answer

Use the 'intrazone-default' policy to automatically allow traffic to all servers.

Answer

Set destination zone to 'any' and destination address to 'any' to ensure traffic flow.

Answer

Configure the security policy to reference the interface IP rather than an Address Object.

Question 6

Where do you configure a URL Filtering profile?

Accepted Answer

Objects > Security Profiles. URL Filtering profiles in Palo Alto Networks PAN-OS are configured under Objects > Security Profiles, alongside other security profiles like Antivirus, Anti-Spyware, Vulnerability Protection, and WildFire Analysis. Once created there, the profile is applied to a Security policy rule. This location is consistent across PAN-OS versions and is where all reusable security profile objects live.

Answer

Policies > Security

Answer

Network > Profiles

Answer

Device > Setup

Question 7

An administrator wants to use User-ID. What is the primary benefit of mapping IP addresses to usernames?

Accepted Answer

To enable policy enforcement based on user or group membership.. User-ID allows security policies to be based on identities rather than IP addresses.

Answer

To increase firewall throughput.

Answer

To reduce the number of address objects.

Answer

To bypass the need for SSL decryption.

Question 8

An administrator needs to restrict access to a specific website. Which profile should be modified?

Accepted Answer

URL Filtering. URL Filtering is the security profile that categorizes and controls web destinations, allowing administrators to block or allow specific websites, URL categories, or custom URL lists. To restrict access to a specific website, you modify the URL Filtering profile attached to the relevant security policy rule.

Answer

Data Filtering

Answer

Anti-Spyware

Answer

Vulnerability Protection

Question 9

Which feature allows the firewall to inspect encrypted traffic for threats?

Accepted Answer

SSL Decryption. SSL Decryption (also called SSL Forward Proxy) allows the firewall to decrypt outbound and inbound SSL/TLS traffic, inspect it for threats using security profiles, and then re-encrypt it before forwarding. Without decryption, encrypted traffic bypasses threat inspection, so SSL Decryption is the required feature to inspect encrypted traffic for threats.

Answer

Threat Prevention

Answer

App-ID

Answer

User-ID

Question 10

Which action should be taken if you want to log traffic matching a specific policy?

Accepted Answer

Enable logging in the 'Actions' tab of the Security Policy.. In Palo Alto Networks firewalls, logging is configured per security policy rule, not globally or on zones/interfaces. The 'Actions' tab of a Security Policy rule contains the Log Setting options (e.g., Log at Session End, Log at Session Start). Enabling logging there ensures that only traffic matching that specific policy is logged, which is exactly what the question asks for.

Answer

Enable logging in the Zone object.

Answer

Enable logging in the Device settings.

Answer

Enable logging in the Interface settings.

Question 11

What does the 'Zone Protection Profile' protect against?

Accepted Answer

Denial of Service (DoS) and reconnaissance attacks.. Zone Protection Profiles in PAN-OS are designed to protect a zone's ingress against flood-based Denial of Service attacks (SYN, UDP, ICMP floods) and reconnaissance attacks such as port scans and host sweeps. They apply before security policy evaluation and use thresholds and actions to mitigate volumetric threats. This makes them the correct answer for protection against DoS and reconnaissance.

Answer

Unauthorized user access.

Answer

Malware downloads.

Answer

Application-specific exploits.

Question 12

You have a security policy that allows 'any' application. What is the security risk of this configuration?

Accepted Answer

Increased risk of hidden threats using allowed ports.. Allowing 'any' application bypasses the granular control of App-ID, potentially allowing malicious traffic through common ports like 80/443.

Answer

The firewall will drop all traffic.

Answer

Performance overhead.

Answer

The firewall cannot log the traffic.

Question 13

When using App-ID, what happens if traffic matches a policy allowing 'web-browsing' but the application is actually 'facebook-base'?

Accepted Answer

The traffic is dropped because it does not match the allowed application.. App-ID identifies the actual application, not just the port or protocol. If a policy allows 'web-browsing' but the traffic is identified as 'facebook-base', it does not match the allowed application. By default, the firewall denies traffic that does not match any rule, so the traffic is dropped. This enforces application-level control.

Answer

The traffic is allowed because Facebook uses HTTP.

Answer

The firewall allows it but flags the log as 'unknown'.

Answer

The firewall automatically updates the policy.

Question 14

An administrator wants to block a specific file type from being uploaded. Which profile is required?

Accepted Answer

File Blocking. File Blocking profiles are specifically designed to detect and block file transfers based on file type, direction (upload/download), and application. To block a specific file type from being uploaded, the administrator configures a File Blocking profile with the target file type set to 'block' for the upload direction and attaches it to the Security Policy rule. URL Filtering, Vulnerability Protection, and Anti-Virus serve different purposes and cannot enforce file-type-based upload blocking.

Answer

URL Filtering

Answer

Vulnerability Protection

Answer

Anti-Virus

Question 15

Which plane on a Palo Alto Networks firewall is responsible for the web interface and CLI?

Accepted Answer

Management Plane. The Management Plane on a Palo Alto Networks firewall is responsible for the web interface (GUI), CLI, configuration management, logging, and administrative functions. It is separate from the data plane, which handles actual traffic forwarding and security processing. The management plane runs on the management interface and controls the device's configuration and monitoring.

Answer

Forwarding Plane

Answer

Security Plane

Answer

Data Plane