NetSec-Pro NGFW And SASE Solution Functionality — 25 Questions

Question 1

You want to allow access to a specific SaaS application but block file uploads to that application. Which feature facilitates this?

Accepted Answer

App-ID Features. App-ID allows you to use 'App-ID Features' (like file-upload) to create specific control policies within an application.

Answer

URL Filtering categories

Answer

Data Filtering Profiles

Answer

Security Zones

Question 2

Which feature of Content-ID helps prevent the execution of malicious scripts on a web page?

Accepted Answer

Anti-Spyware. The Anti-Spyware profile includes signatures that can detect and block malicious script execution patterns.

Answer

File Blocking

Answer

App-ID

Answer

URL Filtering

Question 3

You have a Security Policy rule allowing 'web-browsing' and 'ssl'. A user cannot access a specific site, and the logs show the traffic as 'web-browsing' but failing a specific Security Profile. Which action is most appropriate?

Accepted Answer

Check the logs for the specific Security Profile trigger.. If traffic is identified correctly as the app, but the security profile fails, you must check the Security Profile attached to the policy rule.

Answer

Disable App-ID for this rule.

Answer

Increase the timeout settings on the zone.

Answer

Change the application to 'any'.

Question 4

You are troubleshooting a performance issue in Prisma Access. Users report slow access to SaaS applications. You suspect the issue is related to the path selection. Which tool should you use to analyze the latency between the user's mobile client and the Service Connection?

Accepted Answer

Prisma Access Insights. The Prisma Access Insights tool provides detailed telemetry regarding user latency and path performance.

Answer

Traffic Logs in Panorama

Answer

GlobalProtect App logs

Answer

ACC (Application Command Center)

Question 5

When using User-ID with Active Directory, what is the primary purpose of the User-ID Agent?

Accepted Answer

To query domain controllers for IP-to-User mapping.. The Agent monitors logs on domain controllers to map IP addresses to usernames in real-time.

Answer

To cache user credentials for SSO.

Answer

To encrypt traffic for GlobalProtect.

Answer

To push security policies to clients.

Question 6

Which Content-ID component specifically prevents the exfiltration of sensitive data like credit card numbers?

Accepted Answer

Data Filtering. Data Filtering profiles scan traffic for specific patterns, such as regular expressions for credit card numbers.

Answer

Vulnerability Protection

Answer

URL Filtering

Answer

Antivirus

Question 7

A administrator needs to ensure that users are authenticated before accessing a web-based internal application. Which User-ID method provides the most granular control by prompting users via a captive portal?

Accepted Answer

Captive Portal. Captive portal provides explicit authentication for users accessing specific web resources, ensuring positive identification.

Answer

IP-to-User Mapping via XML API

Answer

Clientless VPN

Answer

GlobalProtect Transparent Authentication

Question 8

You are migrating an existing branch office to Prisma Access. Which component is required to allow the branch to communicate with your on-premises data center?

Accepted Answer

Service Connection. A Service Connection is the specific component used to link the Prisma Access cloud infrastructure to on-premises resources.

Answer

Mobile User Connection

Answer

Prisma Access Insights

Answer

Remote Network Connection

Question 9

What is the effect of setting a Security Policy rule action to 'Drop' versus 'Reset-Both'?

Accepted Answer

Reset-Both informs the client and server that the connection is closed.. 'Drop' silently discards the packet, while 'Reset-Both' actively informs the sender and receiver that the connection is terminated.

Answer

Reset-Both is only for TCP, while Drop is only for UDP.

Answer

Drop is only available for inter-zone traffic.

Answer

Drop consumes more firewall CPU cycles.

Question 10

You are configuring App-ID for an application that uses non-standard ports. You have created a custom application object, but the traffic is still being identified as 'incomplete'. What is the most likely reason?

Accepted Answer

The custom application lacks a defined signature to identify the application flow.. When using custom applications, if the traffic does not match the signature or the default port is not defined correctly, the firewall marks it as incomplete.

Answer

The security policy has not been committed to the Data Plane.

Answer

Content-ID is disabled on the Security Policy rule.

Answer

User-ID is not enabled on the ingress interface.

Question 11

In a Prisma Access environment, how does the system ensure that a user always connects to the geographically nearest location?

Accepted Answer

Global DNS load balancing.. The GlobalProtect Cloud Service uses a global DNS load balancing mechanism to direct users to the optimal portal/gateway.

Answer

The user's local ISP routing table.

Answer

Manual selection of gateways in the GlobalProtect agent.

Answer

Static configuration on the firewall.

Question 12

What happens when a security policy rule is set to 'Log at Session End'?

Accepted Answer

The log is generated only when the session terminates.. The log entry is generated only after the session has been closed, providing a summary of the total bytes and duration.

Answer

The log is generated at the start of the session only.

Answer

The log is triggered by a threat detection event.

Answer

The log is sent to the management plane every 10 seconds.

Question 13

An administrator wants to categorize traffic based on the 'Server' role in the network. Which feature should be used to tag this traffic for policy grouping?

Accepted Answer

Dynamic Address Groups. Dynamic Address Groups (DAGs) allow administrators to use tags to group objects dynamically based on attributes, such as server roles.

Answer

Device Groups

Answer

Static Address Groups

Answer

Security Profiles

Question 14

If a packet matches a Security Policy rule, but the application is not identified yet, what action does the firewall take?

Accepted Answer

It allows the packet based on the port-based match.. The firewall waits for enough packets to identify the application. If it matches a rule, it keeps the session open; otherwise, it may drop it.

Answer

It drops the packet immediately.

Answer

It buffers the packet until identification is complete.

Answer

It rejects the packet and sends a TCP Reset.

Question 15

Which NGFW feature allows for the inspection of files for malicious content based on signatures and heuristic analysis?

Accepted Answer

WildFire. WildFire is the cloud-based analysis engine used to identify malware via behavior and signature inspection.

Answer

URL Filtering

Answer

App-ID

Answer

User-ID

Question 16

When configuring SSL Forward Proxy, which step is mandatory for the firewall to successfully inspect encrypted traffic?

Accepted Answer

Install the firewall's Forward Trust Certificate on all client devices.. The firewall must be able to present a certificate that the client trusts, which requires the firewall's CA certificate to be installed on the client machine.

Answer

Enable SSH decryption on the management interface.

Answer

Configure a static IP address for the Decryption Broker.

Answer

Disable Certificate Revocation List (CRL) checks.

Question 17

You are configuring a 'Strict' security profile for a web server. Which profile action is best suited to block known exploit patterns while allowing the traffic?

Accepted Answer

Vulnerability Protection. Vulnerability Protection profiles allow you to set actions like 'drop' or 'reset' for specific threat signatures.

Answer

Anti-Spyware

Answer

URL Filtering

Answer

File Blocking

Question 18

Which command is used to display the current User-ID mapping information on the CLI?

Accepted Answer

show user ip-user-mapping all. The command 'show user ip-user-mapping all' provides the current IP to username mapping table.

Answer

show logging user-id

Answer

test user-id

Answer

show system user-id

Question 19

You are setting up an SSL Decryption policy. If you want to exclude traffic to financial websites to comply with privacy laws, how do you configure it?

Accepted Answer

Add a 'No Decrypt' rule matching the 'financial-services' URL category.. You create a 'No Decrypt' rule in the Decryption Policy, using URL categories to match financial sites.

Answer

Configure a separate decryption broker.

Answer

Disable decryption for the entire zone.

Answer

Delete the financial sites from the allowed list.

Question 20

You need to ensure that traffic between two internal zones is inspected for threats. What must be configured on the Security Policy?

Accepted Answer

Apply Security Profiles to the inter-zone policy rule.. To inspect inter-zone traffic, you must explicitly define a policy rule between the zones and attach the necessary Security Profiles.

Answer

Enable inter-zone routing.

Answer

Configure a virtual wire.

Answer

Change the zones to a single zone.