NetSec-Pro Network Security Fundamentals Practice Test 3 — 15 Questions

Question 1

Which of the following is an example of a Security Profile?

Accepted Answer

Vulnerability Protection. Anti-Virus, Anti-Spyware, Vulnerability Protection, and URL Filtering are all Security Profiles.

Answer

Policy Rule

Answer

Interface Configuration

Answer

Address Object

Question 2

What is the function of 'Application Default' in a service object?

Accepted Answer

It restricts the traffic to the standard ports defined for that application.. Selecting 'Application-Default' ensures that traffic is only allowed if it uses the port defined for that application in the App-ID database.

Answer

It assigns a random port to the traffic.

Answer

It forces the firewall to use port 80/443 only.

Answer

It automatically blocks all traffic.

Question 3

Why should you use an App-ID 'Group' in a security policy?

Accepted Answer

To reduce policy rule count and simplify management.. App-ID groups simplify policy management by allowing you to update the group once rather than individual policies.

Answer

To force traffic over specific ports.

Answer

To enable SSL decryption for those applications.

Answer

To increase security by blocking unknown traffic.

Question 4

Which TWO of the following are valid components of a PAN-OS Security Policy?

Accepted Answer

Source Zone. In PAN-OS, a Security Policy rule is defined by matching criteria that include the Source Zone (option A) and Destination Zone (option B), which specify the ingress and egress zones between which traffic flows and are fundamental to how the firewall evaluates and applies policy. These two fields are part of the standard rule definition alongside source/destination addresses, applications, users, and services, and they determine the direction and enforcement context of the rule. Options C (Fan speed), D (Management IP), and E (System BIOS version) are not Security Policy match or action components; fan speed and BIOS version are hardware/firmware attributes, and the management IP is a device interface configuration, none of which appear in a PAN-OS Security Policy rule.

Answer

Fan speed

Answer

Management IP

Answer

System BIOS version

Question 5

Which TWO settings are configurable within a URL Filtering profile?

Accepted Answer

Custom URL list (allow/block). Option B (Custom URL list (allow/block)) is correct because a URL Filtering profile lets you define custom URL categories/lists and set allow, block, alert, or continue actions for specific URLs or domains. Option D (Category-based blocking) is correct because URL Filtering profiles are built around predefined URL categories (e.g., social-networking, gambling) where you assign block/allow/alert actions per category. Option A is incorrect because application signature overrides belong to Application Override policy or App-ID configuration, not URL Filtering profiles. Option C is incorrect because SSL Decryption is configured in a Decryption policy/profile, not inside a URL Filtering profile. Option E is incorrect because User-ID mapping source is configured under User Identification (e.g., User-ID agents, terminal server agents, or XML API), not in a URL Filtering profile.

Answer

Application signature override

Answer

SSL Decryption mode

Answer

User-ID mapping source

Question 6

Which THREE items are necessary for a properly configured Security Policy rule?

Accepted Answer

Application. A Security Policy rule in Palo Alto Networks PAN-OS requires three mandatory match criteria to identify the traffic: Application (A), Source Zone (B), and Destination Zone (E). The Application field specifies which application or application group the rule matches (e.g., ssl, web-browsing), and it is required because PAN-OS uses App-ID to enforce policy. The Source Zone (B) defines the ingress zone from which traffic originates, and the Destination Zone (E) defines the egress zone to which traffic is destined; both are required because zone-based policy is fundamental to how PAN-OS evaluates sessions. Admin Role (C) is incorrect because it is an administrative RBAC construct for controlling who can manage the firewall, not a field in a Security Policy rule. Panorama Template (D) is incorrect because templates are used to push device and network configuration via Panorama, not to define Security Policy rule match conditions.

Answer

Admin Role

Answer

Panorama Template

Question 7

Which THREE of the following are valid Security Profile types?

Accepted Answer

URL Filtering. URL Filtering (B) is a valid Security Profile type because it enforces web access policy by categorizing URLs and applying allow/block/alert actions per category. Vulnerability Protection (D) is a valid Security Profile type that inspects traffic for exploits and applies signatures with actions such as block, alert, or reset. Anti-Spyware (E) is a valid Security Profile type that detects and blocks spyware, C2 callbacks, and other malicious traffic using signatures and DNS sinkholing. Zone Routing (A) is not a Security Profile type; it is a network configuration concept related to zones and routing. Policy Optimizer (C) is not a Security Profile type; it is a tool for reviewing and tightening security policy rules, not a profile applied to traffic inspection.

Answer

Zone Routing

Answer

Policy Optimizer

Question 8

Which THREE features are part of the Palo Alto Networks Single Pass Architecture?

Accepted Answer

App-ID. The Palo Alto Networks Single Pass Architecture performs all security processing in one pass through the dataplane, and its three core identifying technologies are App-ID, User-ID, and Content-ID. Option C (App-ID) is correct because it identifies the application regardless of port, protocol, or encryption, which is the foundation of the single-pass inspection. Option D (User-ID) is correct because it maps IP addresses to users and groups so policy can be enforced based on identity, feeding directly into the same single-pass evaluation. Option E (Content-ID) is correct because it applies threat prevention, URL filtering, file blocking, and data filtering to the identified flow within that same pass. Options A (Management interface) and B (Switching capacity) are not correct because they are platform/hardware characteristics rather than the security technologies that constitute the Single Pass Architecture.

Answer

Management interface

Answer

Switching capacity

Question 9

Which TWO items can be used as match criteria in a Security Policy rule?

Accepted Answer

Source Zone. In a Security Policy rule, the Source Zone (option B) is a valid match criterion because it identifies the ingress security zone from which traffic originates, allowing the firewall to apply policy based on the zone the packet enters. The Application (option D) is also a valid match criterion because next-generation firewalls can identify the application via App-ID and enforce policy based on that identification, rather than relying solely on port or protocol. Options A (Hardware Temperature), C (Management Plane Load), and E (Interface Speed) are not match criteria in a Security Policy rule; they are operational or performance metrics of the device and have no role in classifying or matching traffic flows.

Answer

Hardware Temperature

Answer

Management Plane Load

Answer

Interface Speed

Question 10

Which TWO of the following are required to enable full visibility into threats inside SSL traffic?

Accepted Answer

Security Profile (e.g., Anti-Virus). Option D, SSL Decryption Policy, is required because Palo Alto Networks firewalls cannot inspect the contents of TLS/SSL-encrypted sessions unless a decryption policy matches the traffic and instructs the firewall to decrypt it (using forward proxy or inbound inspection), thereby exposing the plaintext for inspection. Option B, Security Profile (e.g., Anti-Virus), is required because once the SSL session is decrypted, a security profile such as Anti-Virus, Anti-Spyware, Vulnerability Protection, or URL Filtering must be attached to the allowing security rule to actually detect and block threats in that now-visible traffic. Option A, GlobalProtect Portal, is not required—it provides remote user VPN connectivity and configuration, not SSL decryption or threat inspection. Option C, Device Certificate, is not required—a forward trust/forward untrust certificate (or a CA certificate for inbound inspection) is used for decryption, but the device certificate itself is not a prerequisite for SSL visibility. Option E, External Logging server, is not required—logging destinations such as Panorama, syslog, or Cortex Data Lake are optional for retention and analysis, not for enabling visibility into SSL traffic.

Answer

GlobalProtect Portal

Answer

Device Certificate

Answer

External Logging server

Question 11

Which THREE of the following are consequences of enabling 'Log at Session End'?

Accepted Answer

Provides accurate session duration.. Option A is correct because 'Log at Session End' writes the session's start and end timestamps to the traffic log only when the session closes, yielding an accurate session duration rather than an estimate from an interim log. Option C is correct because the end-of-session log captures the final cumulative bytes sent and received (bytes_client and bytes_server) for the entire session, giving accurate byte counts. Option E is correct because the session-end log includes the full App-ID result, including comprehensive application details such as the identified application, category, subcategory, and risk, which may not be fully resolved in a session-start log. Option B is wrong because 'Log at Session End' is purely a logging behavior and does not force session termination. Option D is wrong because this setting only writes a log entry at session close; it does not generate an immediate notification to the administrator.

Answer

Forces the session to terminate.

Answer

Immediately notifies the administrator.

Question 12

A security engineer at a financial services company is designing segmentation for a new data center. The requirement is that the web tier (VLAN 20) must never initiate connections to the database tier (VLAN 30), but the database tier must be able to initiate connections to the web tier for replication. Which security policy configuration on a Palo Alto Networks firewall best enforces this requirement?

Accepted Answer

Create a security policy from the web zone to the database zone with the action set to deny, and a separate policy from the database zone to the web zone with the action set to allow.. PAN-OS security policies are unidirectional: each new session is matched against rules based on its source and destination zones. To allow database-initiated replication while blocking web-initiated access, you need a deny rule for the web-to-database direction and an allow rule for the database-to-web direction. Authentication or DoS profiles do not replace this zone-based directional control.

Answer

Create a single security policy between the web zone and the database zone with the action set to allow, and rely on the application's authentication to prevent unauthorized access.

Answer

Create a security policy from the web zone to the database zone with the action set to allow, and apply a Denial-of-Service protection profile to the database zone to block web-initiated connections.

Answer

Create a security policy from the web zone to the database zone with the action set to deny, and configure the database zone as a 'sinkhole' zone to drop all traffic.

Question 13

A network administrator is reviewing the TCP/IP model layers while troubleshooting a connectivity issue. The administrator needs to identify which layer is responsible for logical addressing and routing of packets across multiple networks. Which layer of the TCP/IP model performs this function?

Accepted Answer

Internet layer. In the TCP/IP model, the Internet layer is responsible for logical addressing and routing. It uses IP addresses to identify hosts and routers, and routing protocols to determine paths across networks. The Transport layer handles end-to-end connections, while the Network Access layer deals with local link delivery, and the Application layer supports user-facing protocols.

Answer

Transport layer

Answer

Application layer

Answer

Network Access layer

Question 14

A security analyst is investigating a series of alerts indicating that an internal host is communicating with a known malicious IP address. The analyst wants to verify whether the traffic was allowed by a specific security policy rule and determine the exact rule name that permitted the session. Which Palo Alto Networks feature should the analyst use to identify the rule that allowed the traffic?

Accepted Answer

Traffic log. The Traffic log on Palo Alto Networks firewalls captures detailed information about every session, including the name of the security policy rule that allowed or denied it. By filtering for the malicious IP address, the analyst can pinpoint the rule responsible for permitting the traffic, which is essential for remediation and policy tuning.

Answer

System log

Answer

Threat log

Answer

Session Browser

Question 15

A network security administrator is implementing a defense-in-depth strategy and needs to select controls that operate at the network layer to protect against IP spoofing and to segment traffic between VLANs. Which two controls should the administrator implement? (Choose two.)

Accepted Answer

Access Control Lists (ACLs) on routers. Unicast Reverse Path Forwarding (uRPF) validates source IP addresses to mitigate spoofing, and router ACLs filter traffic between VLANs based on network-layer criteria. Both operate at the network layer and directly address the administrator's goals. A WAF, HIPS, and email spam filter work at higher layers or on endpoints and do not provide these network-layer protections.

Answer

Web Application Firewall (WAF)

Answer

Email spam filter

Answer

Host-based intrusion prevention system (HIPS)