NetSec-Pro NGFW And SASE Solution Functionality — 30 Questions

Question 1

A administrator needs to ensure that users are authenticated before accessing a web-based internal application. Which User-ID method provides the most granular control by prompting users via a captive portal?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Captive Portal. Captive Portal is a User-ID method that intercepts HTTP/HTTPS requests from unauthenticated users and redirects them to a web page where they must enter credentials. This provides granular control because authentication is tied to the user session, and policies can be applied based on the authenticated user. It is ideal for scenarios where users need to authenticate before accessing internal web applications, as it directly prompts them via a browser.

Answer

IP-to-User Mapping via XML API

Answer

Clientless VPN

Answer

GlobalProtect Transparent Authentication

Question 2

You are migrating an existing branch office to Prisma Access. Which component is required to allow the branch to communicate with your on-premises data center?

Accepted Answer

Service Connection. A Service Connection is the specific component used to link the Prisma Access cloud infrastructure to on-premises resources.

Answer

Mobile User Connection

Answer

Prisma Access Insights

Answer

Remote Network Connection

Question 3

In a Prisma Access environment, how does the system ensure that a user always connects to the geographically nearest location?

Accepted Answer

Global DNS load balancing.. Prisma Access uses Global DNS load balancing to direct users to the nearest location. When a GlobalProtect agent resolves the portal or gateway FQDN, the authoritative DNS service returns the IP address of the closest Prisma Access location based on the user's source IP. This ensures optimal performance and low latency without user intervention.

Answer

The user's local ISP routing table.

Answer

Manual selection of gateways in the GlobalProtect agent.

Answer

Static configuration on the firewall.

Question 4

You want to allow access to a specific SaaS application but block file uploads to that application. Which feature facilitates this?

Accepted Answer

App-ID Features. App-ID allows you to use 'App-ID Features' (like file-upload) to create specific control policies within an application.

Answer

URL Filtering categories

Answer

Data Filtering Profiles

Answer

Security Zones

Question 5

Which feature of Content-ID helps prevent the execution of malicious scripts on a web page?

Accepted Answer

Anti-Spyware. The Anti-Spyware profile includes signatures that can detect and block malicious script execution patterns.

Answer

File Blocking

Answer

App-ID

Answer

URL Filtering

Question 6

What is the purpose of the 'Pre-Rule' and 'Post-Rule' sections in a Panorama-managed firewall?

Accepted Answer

To ensure global policies are enforced before local policies.. Pre-rules are evaluated before local rules, ensuring that global corporate policies override local branch configurations.

Answer

To speed up the policy lookup.

Answer

To provide backup for failed rules.

Answer

To organize rules by date.

Question 7

When a user connects via GlobalProtect, how does the firewall identify the user if they are not in the AD group?

Accepted Answer

It falls back to the IP-to-User mapping table.. The firewall can identify users via the GlobalProtect portal authentication logs or by falling back to the IP-to-User mapping.

Answer

It blocks the traffic by default.

Answer

It requests the MAC address.

Answer

It uses the machine name.

Question 8

Which TWO of the following are valid ways to deploy GlobalProtect?

Accepted Answer

Split Tunnel VPN. Split Tunnel VPN (C) is a valid GlobalProtect deployment because the GlobalProtect agent establishes an SSL/IPsec tunnel to the portal/gateway while only routing specific, administrator-defined destination subnets (via the split-tunnel access route and include/exclude lists) through the tunnel, leaving other traffic to go directly out the local internet connection. Full Tunnel VPN (D) is also valid because GlobalProtect can be configured so that all client traffic (0.0.0.0/0) is forced through the gateway, typically enforced with the no-split-tunnel option and security policy applied to the tunnel interface. Physical wire mode (A) is a Palo Alto Networks firewall interface deployment mode (TAP/vwire), not a GlobalProtect client deployment method. Local Bridge Mode (B) is not a GlobalProtect deployment option — it is not a supported agent/gateway mode. Static VPN (E) is not a GlobalProtect deployment type; GlobalProtect uses portal/gateway configurations with SSL or IPsec, not a 'static VPN' mode.

Answer

Physical wire mode

Answer

Local Bridge Mode

Answer

Static VPN

Question 9

Which TWO of the following are types of security policies supported by the NGFW?

Accepted Answer

Security. In Palo Alto Networks NGFW terminology, the firewall supports three policy types: Security, NAT, and Decryption (plus Policy-Based Forwarding in some versions), so option D (Security) is correct because Security policies define the allow/deny/scan rules that match traffic by zone, address, application, user, and service and then apply security profiles. Option E (NAT) is also correct because NAT policies are a distinct, separately configured policy type that handles source and destination address translation (and port translation) independently of the Security policy that permits the translated session. Options A (Application-Allow) and B (Bandwidth-Limit) are not policy types — application control is enforced inside a Security policy via the Application field and App-ID, and bandwidth limiting is done with QoS policy or traffic shaping, not a dedicated policy type. Option C (Device-Management) is also not a policy type; management access is controlled through interface management profiles and administrative roles, not a firewall policy rulebase.

Answer

Application-Allow

Answer

Bandwidth-Limit

Answer

Device-Management

Question 10

A security administrator needs to allow employees to access a sanctioned SaaS application (e.g., Salesforce) while preventing them from uploading sensitive files to that same application. The administrator wants to enforce this directly on the NGFW without relying on endpoint agents or proxy re-encryption. Which Palo Alto Networks feature should be used to achieve this granular control?

Accepted Answer

SaaS Inline App-ID with SaaS Tenant Restrictions. SaaS Inline App-ID is designed to provide granular control over SaaS applications by identifying specific actions within the application, such as upload, download, and view. This allows the firewall to block file uploads to a sanctioned SaaS app while still allowing other activities. The other options either lack inline enforcement, operate at a different layer, or cannot distinguish between upload and download actions.

Answer

SaaS Security API

Answer

URL Filtering with custom URL categories

Answer

App-ID with File Blocking profile

Question 11

A network security engineer is configuring a Security Policy rule to block traffic from a specific source IP address to a destination IP address. The engineer wants to ensure that the firewall does not send a TCP reset to the source and does not silently drop the packet, but instead sends an ICMP unreachable message. Which action should be configured in the Security Policy rule?

Accepted Answer

Deny. The Deny action in a Security Policy rule sends an ICMP unreachable message to the source, which fulfills the requirement of notifying the source that the destination is unreachable without sending a TCP reset or silently dropping the packet. The other actions either silently drop (Drop) or send TCP resets (Reset-Both, Reset-Client), which do not meet the specified criteria.

Answer

Drop

Answer

Reset-Client

Answer

Reset-Both

Question 12

A network security engineer is configuring a Security Policy rule on a Palo Alto Networks NGFW to allow a specific SaaS application but block file uploads to it. The engineer wants to avoid blocking non-file-sharing functions of the application. Which feature should be used to meet this requirement?

Accepted Answer

App-ID with a Security Policy rule that uses Application Filters to select the SaaS application and then applies a File Blocking profile for upload direction. The requirement is to allow a SaaS application while blocking only its file upload capability. App-ID identifies the application, and Application Filters enable selection of that application. A File Blocking profile applied to the rule can block uploads based on file type and direction, while other functions remain allowed. This granular control is achieved by combining App-ID, Application Filters, and File Blocking, ensuring that only file uploads are blocked without affecting other application features.

Answer

SaaS Application Policy with a specific application and action set to 'block file uploads'

Answer

App-ID with a Security Profile Group that includes a File Blocking profile

Answer

URL Filtering profile with a custom URL category for the SaaS application and action set to 'block' for upload URLs

Question 13

A security engineer is configuring a Security Policy rule to allow traffic from the 'Trust' zone to the 'Untrust' zone. The engineer wants to ensure that the rule only allows specific applications and that the traffic is inspected for threats. Which TWO of the following configurations are required to achieve this? (Choose two.)

Accepted Answer

Attach a Security Profile Group to the rule. To allow specific applications and inspect traffic for threats, the rule must specify the desired applications (not 'any') and have a Security Profile Group attached to enable threat inspection. The action 'Allow' and zone definitions are basic and already implied, but the two specific configurations needed are application specification and Security Profile Group attachment.

Answer

Define the source and destination zones

Answer

Specify the application as 'any' in the rule

Answer

Set the action to 'Allow'

Question 14

A network security engineer is configuring a Security Policy rule to allow access to a specific SaaS application but wants to prevent users from uploading files to it. The application is identified by App-ID, and the engineer wants to enforce this restriction without blocking the entire application. Which Palo Alto Networks feature should be used to accomplish this?

Accepted Answer

SaaS Security profile with the appropriate data filtering and file policy settings. The requirement is to allow access to a SaaS application but block file uploads to it. This is precisely the function of a SaaS Security profile, which provides application-specific controls for SaaS environments. By associating the profile with the Security Policy rule that permits the application, the firewall can inspect the traffic and enforce the upload restriction. Other options either do not target SaaS uploads or are too broad, making the SaaS Security profile the correct choice.

Answer

URL Filtering profile with a custom URL category for the application's upload endpoints

Answer

Data Filtering profile with a custom pattern for file contents

Answer

File Blocking profile configured to block all file types

Question 15

A security administrator has configured a Security policy rule to allow traffic from the 'Trust' zone to the 'Untrust' zone. The rule includes an application group called 'web-browsing' and a URL Filtering profile that blocks the 'social-networking' category. Users report that they can access social media sites despite the URL Filtering profile. What is the most likely cause?

Accepted Answer

The application group 'web-browsing' does not include SSL, so the firewall cannot inspect the encrypted traffic.. The correct answer is that the application group 'web-browsing' does not include SSL, so the firewall cannot inspect encrypted traffic. Social media sites use HTTPS, and if the Security policy rule does not allow the 'ssl' application and decryption is not configured, the firewall cannot identify the URL or enforce the URL Filtering profile. The profile itself is correctly configured, and zone or rule order issues are not indicated.

Answer

The Security policy rule is placed after a more permissive rule that allows all traffic.

Answer

The URL Filtering profile is not applied to the correct zone.

Answer

The URL Filtering profile is misconfigured because it does not include the 'social-networking' category.

Question 16

A NetSec-Pro administrator is configuring a Security Policy rule to allow web traffic from the Trust zone to the Untrust zone. The administrator wants to ensure that the rule allows only HTTP and HTTPS traffic, and that the firewall logs the application and URL category for each session. Which two actions should the administrator take in the Security Policy rule configuration? (Choose two.)

Accepted Answer

Set the Application to 'web-browsing' and 'ssl'.. To allow only HTTP and HTTPS traffic and log application and URL category, the administrator must set the Application to 'web-browsing' and 'ssl' to identify the applications, and set the Service to 'application-default' to restrict to default ports. These actions ensure that the rule matches the intended traffic and that the firewall can log the application and URL category at session end by default. The other options are either unnecessary or not directly related to the requirement.

Answer

Enable logging at session start.

Answer

Attach a URL Filtering profile to the rule.

Answer

Enable logging at session end.

Question 17

An administrator is configuring a Security policy rule to allow access to a web application. The rule includes the application 'web-browsing' and a URL Filtering profile. Users report that they can access the site but the URL Filtering profile is not blocking a category that should be blocked. What is the most likely reason?

Accepted Answer

The application 'web-browsing' does not include SSL, so the firewall cannot inspect encrypted traffic.. The correct answer is that the application 'web-browsing' does not include SSL, so the firewall cannot inspect encrypted traffic. Most web applications use HTTPS, and if the Security policy rule does not allow the 'ssl' application and decryption is not configured, the firewall cannot identify the URL or enforce the URL Filtering profile. The profile itself is correctly configured, and zone or rule order issues are not indicated.

Answer

The URL Filtering profile is not applied to the correct zone.

Answer

The Security policy rule is placed after a more permissive rule that allows all traffic.

Answer

The URL Filtering profile is misconfigured because it does not include the category to block.

Question 18

An engineer is configuring an NGFW to enforce least-privilege egress for SaaS traffic. The requirement is to allow access to a sanctioned SaaS application while blocking only file uploads to that same application, without disrupting normal browsing and API calls. Which Palo Alto Networks capability should the engineer use to meet this requirement?

Accepted Answer

Security policy rule with App-ID and a File Blocking profile that blocks uploads. The requirement is to permit a SaaS application while preventing file uploads to it. That is achieved by matching the application with App-ID in a Security policy rule and attaching a File Blocking profile that blocks the upload direction. This gives granular, application-aware control without blocking legitimate browsing or API calls. URL Filtering, QoS, and generic data filtering do not provide the same precise, direction-aware enforcement for a specific SaaS application's file transfers.

Answer

SaaS Security Inline policy with a Data Filtering profile

Answer

URL Filtering profile set to block the SaaS application's file upload path

Answer

QoS profile that rate-limits the SaaS application's upload traffic

Question 19

A network security administrator is configuring a Security policy rule on a Palo Alto Networks NGFW to allow access to a business-critical SaaS application. The rule must also ensure that only corporate tenants of that SaaS application are reachable, and that any attempt to access a personal tenant is logged and blocked. Which TWO actions should the administrator take to meet these requirements? (Choose two.)

Accepted Answer

Enable SaaS tenant restrictions in the Security policy rule for the application. To allow only corporate tenants and log blocked attempts, the administrator should enable SaaS tenant restrictions in the Security policy rule and ensure the rule allows and logs sessions. Tenant restrictions enforce the corporate tenant requirement, while logging provides the required visibility. URL Filtering, custom signatures, and QoS do not provide tenant-level control or the needed logging behavior for this scenario.

Answer

Attach a URL Filtering profile that blocks the SaaS application's login page

Answer

Create a custom application signature for the SaaS application

Answer

Apply a QoS profile to limit bandwidth for the SaaS application

Question 20

A security engineer is troubleshooting why a Security policy rule that allows a specific SaaS application is not matching traffic from a remote user connected through Prisma Access. The engineer confirms the user is authenticated and the application is recognized. Which factor is most likely preventing the rule from matching?

Accepted Answer

The rule is placed after a more general deny rule that matches the traffic. Security policy rules are evaluated in order, and the first matching rule is applied. If a general deny rule precedes the specific allow rule, the deny rule will match and block the traffic, preventing the allow rule from ever being evaluated. The engineer should reorder the rules so the specific allow rule is above the general deny rule. Other factors like port, decryption, or zone mismatch are less likely given the application is recognized and the user is connected.

Answer

The user's traffic is being decrypted and then re-encrypted, causing a session mismatch

Answer

The rule is configured with a source zone that does not include the Prisma Access tunnel zone

Answer

The application is using a non-standard port that the rule does not include