NetSec-Pro Network Security Fundamentals Practice Test 4 — 15 Questions

Question 1

A junior administrator is reviewing how a PAN-OS firewall handles a brand-new TCP session between a client in the Trust zone and a web server in the Untrust zone. They want to confirm which component performs the actual security policy lookup for that first packet before any session entry exists. Which component is responsible?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The dataplane, using the first packet to perform the policy lookup and create a session entry. When a session does not yet exist in the session table, the initial packet is delivered to the dataplane, which performs the security policy lookup, applies the matching rule, and installs a session entry. Later packets in the same flow hit that session entry directly, so the full policy lookup happens only once per session.

Answer

The control plane, which runs routing protocols and therefore decides policy for each packet

Answer

The management plane, which logs in and performs the policy lookup on behalf of the dataplane

Answer

The external authentication server, which validates the user before any packet is allowed

Question 2

A security team is deploying a new internal application that uses a proprietary protocol over TCP port 8443. The team wants the firewall to inspect the application and enforce policy based on the application rather than just the port. Which Palo Alto Networks feature should be used to identify and control this application?

Accepted Answer

Application Override policy. Application Override policies let administrators define custom applications by specifying the port and protocol, enabling the firewall to identify and apply security policies to traffic that standard App-ID cannot recognize. This is the correct approach for a proprietary protocol on TCP port 8443, whereas URL, Data, and File Blocking profiles address different security functions.

Answer

Data Filtering profile

Answer

File Blocking profile

Answer

URL Filtering profile

Question 3

A security administrator is troubleshooting why a web server in the DMZ zone cannot be reached by external clients even though the inbound security policy permits the traffic. The administrator confirms that the DMZ interface has an IP address, the external interface has an IP address, and static routes exist in both directions. The web server's default gateway points to the firewall's DMZ interface. Which additional configuration is required for the firewall to translate the public destination address to the web server's private address?

Accepted Answer

A destination NAT policy that maps the external address and port to the web server's private address and port. Inbound access to a privately addressed server requires destination NAT so the firewall rewrites the public destination address and port to the server's private values. Security policy permits the session, and routing delivers it to the firewall, but without the translation the server receives a packet addressed to an address it does not own and silently discards it.

Answer

A dynamic routing protocol adjacency between the external router and the firewall

Answer

A policy-based forwarding rule that redirects inbound traffic to the DMZ interface

Answer

A source NAT policy that translates the web server's outbound traffic to the external interface address

Question 4

A network engineer is designing a zero-trust micro-segmentation architecture for an east-west data center. The requirement is to enforce security policy between workloads on the same VLAN without routing traffic through a physical firewall appliance. Which technology should the engineer implement?

Accepted Answer

Software-defined networking with a distributed virtual firewall. Micro-segmentation for east-west traffic without routing through a physical appliance is achieved with a distributed virtual firewall tied to SDN. This enforces policy at the workload's virtual interface, supports identity and application context, and centralizes management. The other choices either operate only at the access edge, lack centralized policy, or provide only static Layer 2 isolation.

Answer

Host-based firewall rules on each workload's operating system

Answer

802.1X port-based network access control on the data center switches

Answer

Private VLANs configured on the top-of-rack switches

Question 5

An analyst is investigating why a server in the DMZ zone can reach an external update site on TCP 443 even though no security rule explicitly permits that server's traffic. The firewall uses a security rule with the application set to 'ssl' and the service set to 'application-default'. Which behaviour explains the observed connectivity?

Accepted Answer

The 'ssl' application inherently allows TCP 443, and 'application-default' resolves to that port, so the rule matches. The ssl application is tied to TCP 443, and setting the service to application-default makes the rule inherit that port from the application definition. The outbound session therefore matches the rule and is permitted, which is why the server reaches the update site without a port-specific rule.

Answer

The server is using a decryption profile that bypasses policy for trusted update sites

Answer

The firewall's content inspection engine automatically permits traffic to known software update repositories

Answer

The DMZ zone has an implicit rule that allows all outbound traffic to the Untrust zone

Question 6

A network security team is designing segmentation for a new data center. They want to ensure that east-west traffic between application tiers is inspected and that any compromised host cannot freely reach other tiers. They plan to use security zones and security policies on their Palo Alto Networks firewalls. Which TWO design elements are required to enforce least-privilege east-west segmentation? (Choose two.)

Accepted Answer

Create explicit allow rules between tiers that specify only the required applications and services. Least-privilege east-west segmentation requires that traffic between tiers crosses a policy enforcement point and that only approved flows are allowed. Placing each tier in its own zone forces interzone evaluation, and explicit allow rules limited to required applications and services ensure that a compromised host cannot move laterally to unrelated tiers.

Answer

Enable a single any-any allow rule between all internal zones to simplify management

Answer

Rely on the default intrazone allow behavior to permit necessary tier communication

Answer

Configure all tiers to use the same subnet and VLAN to reduce routing complexity

Question 7

A security analyst is reviewing a packet capture and notices that a single TCP session to a web server is being inspected, logged, and policy-checked only once, even though the session carries thousands of packets. Which security architecture principle does this behavior illustrate?

Accepted Answer

Stateful inspection with session-based policy enforcement. The behavior described is session-based, stateful enforcement: the first packet creates a session, the policy is evaluated once, and subsequent packets are matched to that session. Stateless filtering would check every packet, while DPI and proxying describe inspection depth or connection handling rather than the single policy evaluation per session.

Answer

Stateless packet filtering with per-packet access control lists

Answer

Proxy-based inspection that terminates and re-originates each connection

Answer

Deep packet inspection that reassembles and scans every payload

Question 8

A security architect is hardening a PAN-OS firewall that protects a data center. The architect wants to reduce the attack surface exposed by the firewall's own management and control functions. Which TWO measures directly harden the management plane? (Choose two.)

Accepted Answer

Enforce multi-factor authentication for administrator logins to the web interface and CLI. Hardening the management plane means limiting who can reach it and strengthening how they prove identity. Restricting permitted source addresses and services on the management interface reduces exposure, while enforcing multi-factor authentication protects against stolen credentials. Both target the firewall's administrative access directly, unlike dataplane controls.

Answer

Enable a zone protection profile on the Untrust zone to block reconnaissance scans

Answer

Configure Quality of Service to prioritize management traffic over user data

Answer

Apply a URL filtering profile to the outbound security rule used by internal users

Question 9

A security analyst is reviewing a packet capture and observes that a single TCP SYN packet sent to a closed port on an internal server elicits a TCP RST response, while the same SYN sent to a filtered port receives no response at all. Which statement best describes what the analyst is observing?

Accepted Answer

The RST means the port is closed, and the silent drop indicates the port is filtered by a device. In TCP scanning semantics, a RST reply to a SYN means the port is closed because the host is up but no listener exists. A complete absence of any reply indicates a filtering device dropped the packet, classifying the port as filtered. The combination of one closed and one filtered port confirms the host is online behind a filtering control.

Answer

The RST indicates the port is open and the service is accepting connections

Answer

Both responses indicate the ports are open but the services are misconfigured

Answer

The lack of response to the filtered port proves the host is offline

Question 10

A security operations analyst notices that a workstation in the trust zone is repeatedly attempting connections to an external IP address on TCP port 4444, a port commonly associated with remote access trojans. The security policy currently allows the workstation to reach any external destination on any port because of a legacy any-any outbound rule. The analyst wants to block this specific behavior without disrupting legitimate business traffic. Which action should the analyst take first?

Accepted Answer

Create a security policy rule above the legacy rule that denies the specific external IP address and port combination. Security policy rules are evaluated in order, so inserting a specific deny rule above the broad legacy allow rule stops the malicious flow before the permissive rule can match. This containment action addresses the immediate threat while preserving existing business connectivity, and it can be followed later by a broader policy cleanup.

Answer

Enable DNS sinkholing for the external IP address in the anti-spyware profile

Answer

Delete the legacy any-any outbound rule and replace it with a default deny rule

Answer

Add the external IP address to a URL Filtering profile applied to the workstation's outbound rule

Question 11

A network security engineer is troubleshooting an intermittent issue where some users lose access to an internal application after a firewall policy change. Logs show the traffic is being dropped with a session end reason indicating the application was not identified. The rule in question uses App-ID with a specific application, and the service is application-default. Which condition most likely explains the drop?

Accepted Answer

The application identification did not complete within the allowed number of packets, so the session was denied. App-ID requires enough packets to positively identify an application. When identification does not complete within the configured threshold, the firewall can deny the session, producing the unidentified-application drop reason. The intermittent pattern fits flows where identification timed out or was inconclusive.

Answer

The users are authenticating to the application with credentials that are not mapped by User-ID

Answer

The application is using a port that is not included in the application's default port list

Answer

The security rule's service was set to application-default, which disables App-ID inspection entirely

Question 12

A security team is deploying a new internal certificate authority for TLS inspection. They want to ensure that compromised private keys can be traced and that certificate issuance is cryptographically bound to a public, append-only log that monitors can audit. Which mechanism should they implement?

Accepted Answer

Certificate Transparency logs with signed certificate timestamps. Certificate Transparency is the mechanism that publishes issued certificates to append-only public logs and returns signed certificate timestamps. This gives monitors the ability to detect unauthorized issuance and provides an auditable trail. OCSP stapling, EV vetting, and pinning address revocation performance, identity assurance, and client trust respectively, but none creates the public issuance log required.

Answer

Extended Validation certificate policy with organizational vetting

Answer

Certificate pinning of the internal root within client applications

Answer

Online Certificate Status Protocol stapling on all issued certificates

Question 13

A company wants to prevent users from resolving domain names for known malicious command-and-control servers. The security team already subscribes to a threat intelligence feed that publishes malicious domains. Which control should be implemented to block DNS resolutions for those domains at the network level?

Accepted Answer

DNS sinkholing that returns a non-routable address for malicious domains. DNS sinkholing consults a threat intelligence list and returns a non-routable or controlled address for malicious domains, preventing clients from reaching command-and-control infrastructure. DNSSEC, DoH, and Response Rate Limiting address integrity, privacy, or volumetric abuse respectively, but none of them block resolution based on a malicious domain feed.

Answer

Response Rate Limiting on the authoritative DNS servers

Answer

DNS over HTTPS to encrypt all client DNS queries

Answer

DNSSEC validation on the internal recursive resolver

Question 14

A NetSec-Pro administrator is configuring a new security policy to allow internal users to access a web server in a DMZ. The administrator wants to ensure that only HTTP and HTTPS traffic is allowed, and that all other traffic is blocked. Which NetSec-Pro feature should be used to identify and control the application?

Accepted Answer

App-ID. App-ID enables the firewall to identify applications accurately, even when they use non-standard ports or encryption. By using App-ID in the security policy, the administrator can allow only HTTP and HTTPS applications and block all others, ensuring precise control based on the actual application rather than just ports or services.

Answer

Application Override policy

Answer

URL Filtering profile

Answer

Service objects

Question 15

A security architect is reviewing a design where a Palo Alto Networks firewall will inspect traffic between two internal segments that are both connected to the same firewall. The architect wants to ensure that traffic between the segments is subject to security policy and threat inspection rather than being allowed implicitly. The two segments are currently assigned to different subnets but the same security zone. Which change is required to ensure interzone policy enforcement between the segments?

Accepted Answer

Assign each segment to a separate security zone so traffic between them is treated as interzone. To subject traffic between two internal segments to explicit policy and inspection, the segments must be placed in different zones. Interzone traffic is denied by default and requires an explicit allow rule, which is where security profiles and application restrictions can be applied. Keeping them in one zone leaves the traffic permitted by default.

Answer

Enable application inspection on the intrazone-default rule

Answer

Attach a Vulnerability Protection profile to the intrazone-default rule

Answer

Create a security policy rule with source and destination zones both set to the shared zone