NetSec-Pro NGFW And SASE Solution Functionality — All Questions With Answers

Question 1mediummultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

A administrator needs to ensure that users are authenticated before accessing a web-based internal application. Which User-ID method provides the most granular control by prompting users via a captive portal?

Question 2hardmultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

You are migrating an existing branch office to Prisma Access. Which component is required to allow the branch to communicate with your on-premises data center?

Question 3hardmultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

In a Prisma Access environment, how does the system ensure that a user always connects to the geographically nearest location?

Question 4mediummultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

You want to allow access to a specific SaaS application but block file uploads to that application. Which feature facilitates this?

Question 5easymultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

Which feature of Content-ID helps prevent the execution of malicious scripts on a web page?

Question 6mediummultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

What is the purpose of the 'Pre-Rule' and 'Post-Rule' sections in a Panorama-managed firewall?

Question 7easymultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

When a user connects via GlobalProtect, how does the firewall identify the user if they are not in the AD group?

Question 8mediummulti select

Read the full NGFW And SASE Solution Functionality explanation →

Which TWO of the following are valid ways to deploy GlobalProtect?

Question 9mediummulti select

Read the full NGFW And SASE Solution Functionality explanation →

Which TWO of the following are types of security policies supported by the NGFW?

Question 10mediummultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

A security administrator needs to allow employees to access a sanctioned SaaS application (e.g., Salesforce) while preventing them from uploading sensitive files to that same application. The administrator wants to enforce this directly on the NGFW without relying on endpoint agents or proxy re-encryption. Which Palo Alto Networks feature should be used to achieve this granular control?

Question 11hardmultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

A network security engineer is configuring a Security Policy rule to block traffic from a specific source IP address to a destination IP address. The engineer wants to ensure that the firewall does not send a TCP reset to the source and does not silently drop the packet, but instead sends an ICMP unreachable message. Which action should be configured in the Security Policy rule?

Question 12mediummultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

A network security engineer is configuring a Security Policy rule on a Palo Alto Networks NGFW to allow a specific SaaS application but block file uploads to it. The engineer wants to avoid blocking non-file-sharing functions of the application. Which feature should be used to meet this requirement?

Question 13mediummulti select

Read the full NGFW And SASE Solution Functionality explanation →

A security engineer is configuring a Security Policy rule to allow traffic from the 'Trust' zone to the 'Untrust' zone. The engineer wants to ensure that the rule only allows specific applications and that the traffic is inspected for threats. Which TWO of the following configurations are required to achieve this? (Choose two.)

Question 14mediummultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

A network security engineer is configuring a Security Policy rule to allow access to a specific SaaS application but wants to prevent users from uploading files to it. The application is identified by App-ID, and the engineer wants to enforce this restriction without blocking the entire application. Which Palo Alto Networks feature should be used to accomplish this?

Question 15mediummultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

A security administrator has configured a Security policy rule to allow traffic from the 'Trust' zone to the 'Untrust' zone. The rule includes an application group called 'web-browsing' and a URL Filtering profile that blocks the 'social-networking' category. Users report that they can access social media sites despite the URL Filtering profile. What is the most likely cause?

Question 16hardmulti select

Read the full NGFW And SASE Solution Functionality explanation →

A NetSec-Pro administrator is configuring a Security Policy rule to allow web traffic from the Trust zone to the Untrust zone. The administrator wants to ensure that the rule allows only HTTP and HTTPS traffic, and that the firewall logs the application and URL category for each session. Which two actions should the administrator take in the Security Policy rule configuration? (Choose two.)

Question 17mediummultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

An administrator is configuring a Security policy rule to allow access to a web application. The rule includes the application 'web-browsing' and a URL Filtering profile. Users report that they can access the site but the URL Filtering profile is not blocking a category that should be blocked. What is the most likely reason?

Question 18mediummultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

An engineer is configuring an NGFW to enforce least-privilege egress for SaaS traffic. The requirement is to allow access to a sanctioned SaaS application while blocking only file uploads to that same application, without disrupting normal browsing and API calls. Which Palo Alto Networks capability should the engineer use to meet this requirement?

Question 19mediummulti select

Read the full NGFW And SASE Solution Functionality explanation →

A network security administrator is configuring a Security policy rule on a Palo Alto Networks NGFW to allow access to a business-critical SaaS application. The rule must also ensure that only corporate tenants of that SaaS application are reachable, and that any attempt to access a personal tenant is logged and blocked. Which TWO actions should the administrator take to meet these requirements? (Choose two.)

Question 20easymultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

A security engineer is troubleshooting why a Security policy rule that allows a specific SaaS application is not matching traffic from a remote user connected through Prisma Access. The engineer confirms the user is authenticated and the application is recognized. Which factor is most likely preventing the rule from matching?

Question 21mediummultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

A security administrator at a manufacturing company is configuring a Security policy rule to allow contractors to access a web-based ERP application hosted on an internal server in the DMZ. The administrator wants to ensure that contractors cannot use the same rule to access any other internal web applications. Which feature should be used in the Security policy rule to enforce this restriction?

Question 22mediummultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

A network security engineer is configuring a Security policy rule to allow access to a business-critical SaaS application. The engineer wants to ensure that the application is allowed only for users in the 'Finance' group and that file uploads to the application are blocked. Which two configurations are needed to achieve this? (Choose two.)

Question 23mediummultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

A network security engineer is configuring a Security Policy rule to allow only specific applications for a group of users. The engineer wants to ensure that the rule matches traffic based on the application's underlying protocol and port, regardless of the application's behavior. Which App-ID technique should be used?

Question 24mediummulti select

Read the full NGFW And SASE Solution Functionality explanation →

A security engineer is configuring SSL decryption on an NGFW. The engineer needs to exclude certain traffic from decryption to comply with privacy regulations. Which two methods can be used to exclude traffic from SSL decryption? (Choose two.)

Question 25mediummultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

You have a Security Policy rule allowing 'web-browsing' and 'ssl'. A user cannot access a specific site, and the logs show the traffic as 'web-browsing' but failing a specific Security Profile. Which action is most appropriate?

Question 26hardmultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

You are troubleshooting a performance issue in Prisma Access. Users report slow access to SaaS applications. You suspect the issue is related to the path selection. Which tool should you use to analyze the latency between the user's mobile client and the Service Connection?

Question 27easymultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

When using User-ID with Active Directory, what is the primary purpose of the User-ID Agent?

Question 28easymultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

Which Content-ID component specifically prevents the exfiltration of sensitive data like credit card numbers?

Question 29mediummultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

What is the effect of setting a Security Policy rule action to 'Drop' versus 'Reset-Both'?

Question 30mediummultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

You are configuring App-ID for an application that uses non-standard ports. You have created a custom application object, but the traffic is still being identified as 'incomplete'. What is the most likely reason?

Question 31easymultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

What happens when a security policy rule is set to 'Log at Session End'?

Question 32mediummultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

An administrator wants to categorize traffic based on the 'Server' role in the network. Which feature should be used to tag this traffic for policy grouping?

Question 33mediummultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

If a packet matches a Security Policy rule, but the application is not identified yet, what action does the firewall take?

Question 34easymultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

Which NGFW feature allows for the inspection of files for malicious content based on signatures and heuristic analysis?

Question 35hardmultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

When configuring SSL Forward Proxy, which step is mandatory for the firewall to successfully inspect encrypted traffic?

Question 36mediummultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

You are configuring a 'Strict' security profile for a web server. Which profile action is best suited to block known exploit patterns while allowing the traffic?

Question 37easymultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

Which command is used to display the current User-ID mapping information on the CLI?

Question 38hardmultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

You are setting up an SSL Decryption policy. If you want to exclude traffic to financial websites to comply with privacy laws, how do you configure it?

Question 39mediummultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

You need to ensure that traffic between two internal zones is inspected for threats. What must be configured on the Security Policy?

Question 40hardmultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

In Prisma Access, what is the role of the 'Compute Location' setting?

Question 41hardmultiple choice

Study the full SD-WAN breakdown →

You are configuring an SD-WAN path for a branch office. Which metric does the firewall use to determine the best path when multiple paths are available?

Question 42mediummulti select

Read the full NGFW And SASE Solution Functionality explanation →

Which TWO of the following are valid log types available on the Palo Alto Networks firewall?

Question 43mediummulti select

Read the full NGFW And SASE Solution Functionality explanation →

Which TWO of the following are valid methods for mapping IP addresses to usernames in a Palo Alto Networks NGFW?

Question 44mediummultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

Which action in a Security Profile allows you to permit traffic but generate an alert in the logs?

Question 45mediummulti select

Read the full NGFW And SASE Solution Functionality explanation →

Which TWO of the following are benefits of using App-ID over port-based security policies?

Question 46hardmulti select

Read the full NGFW And SASE Solution Functionality explanation →

Which THREE of the following are considered 'App-ID' identification techniques?

Question 47hardmulti select

Read the full NGFW And SASE Solution Functionality explanation →

Which THREE components are involved in the Prisma Access architecture for protecting mobile users?

Question 48hardmulti select

Read the full NGFW And SASE Solution Functionality explanation →

Which THREE of the following are actions that can be taken when a file is detected by a File Blocking Profile?

Question 49mediummulti select

Read the full NGFW And SASE Solution Functionality explanation →

Which TWO of the following are features of Content-ID?

Question 50hardmulti select

Read the full NGFW And SASE Solution Functionality explanation →

Which THREE of the following are settings that can be configured in a URL Filtering profile?

Question 51hardmulti select

Read the full NGFW And SASE Solution Functionality explanation →

Which THREE of the following items are required to successfully deploy a Prisma Access Service Connection?

Question 52hardmultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

A NetSec-Pro administrator is configuring a Palo Alto Networks NGFW for a SASE deployment. Remote users connect through Prisma Access, and the security team wants to enforce consistent security policies that inspect traffic based on application identity rather than just port and protocol. The administrator needs to ensure that the firewall can identify applications even when they use non-standard ports or encryption. Which Palo Alto Networks technology should the administrator rely on to achieve this?

Question 53easymultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

A security analyst is reviewing logs and notices that a user's traffic to a known malicious domain is being allowed. The analyst checks the URL Filtering profile and sees that the domain is categorized as 'malware' and the action is set to 'alert'. The analyst wants to block this traffic immediately. What should the analyst change in the URL Filtering profile?

Question 54hardmulti select

Read the full NGFW And SASE Solution Functionality explanation →

A security administrator is deploying Prisma Access for mobile users and needs to ensure that traffic from remote users is inspected for threats and sensitive data. The administrator wants to leverage the Prisma Access architecture to apply security policies consistently. Which TWO of the following components are essential for enforcing security policies on mobile user traffic in Prisma Access? (Choose two.)

Question 55easymultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

A network security engineer is configuring a Security Policy rule on a Palo Alto Networks NGFW. The engineer wants to allow traffic but generate an alert in the logs for auditing purposes. Which action should be selected in the Security Policy rule?

Question 56easymultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

A NetSec-Pro administrator is configuring a Security Policy rule to allow HTTP traffic from the Trust zone to the Untrust zone. The administrator wants to ensure that the firewall identifies the application as web-browsing regardless of the port used. Which Security Policy rule component should be used to achieve this requirement?

Question 57mediummultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

A security administrator is deploying Prisma Access for a branch office. The branch office needs to access internal applications hosted in the corporate data center. Which Prisma Access component should be configured to enable this connectivity?

Question 58mediummultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

A security administrator is deploying Prisma Access for mobile users. The administrator wants to ensure that traffic from mobile users is inspected for threats and that access to certain applications is controlled based on user identity. Which component of Prisma Access is responsible for enforcing security policies and inspecting traffic?

Question 59mediummultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

A security engineer is deploying a SASE solution to protect remote users accessing SaaS applications. The engineer needs to ensure that traffic from remote users is inspected for threats and that access to sanctioned SaaS applications is controlled based on user identity. Which SASE component should the engineer configure to achieve these goals?

Question 60hardmultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

A security engineer is configuring a Security Policy rule on a Palo Alto Networks NGFW to block traffic and send a TCP reset to both the client and server. Which action should be selected?

Question 61hardmultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

A NetSec-Pro administrator is configuring a Security Profile to block malicious files. The administrator wants to ensure that files are analyzed for zero-day exploits and that a verdict is returned to the firewall to block malicious files. Which Palo Alto Networks service should be enabled to achieve this?

Question 62mediummultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

A security administrator is configuring a Security Policy rule to allow web traffic but wants to ensure that users cannot download executable files. The administrator decides to attach a File Blocking profile to the rule. Which action should be set in the File Blocking profile to prevent the download of executable files while still allowing other file types?

Question 63mediummultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

A network security administrator is configuring a Security Policy rule to allow access to a specific SaaS application, but wants to block file uploads to that application. Which Palo Alto Networks feature should the administrator use to achieve this granular control?

Question 64hardmulti select

Read the full NGFW And SASE Solution Functionality explanation →

A network security engineer is configuring a Security Policy rule to allow access to a specific SaaS application but wants to enforce data loss prevention by blocking the upload of files containing credit card numbers. The engineer also wants to ensure that the application is identified correctly even if it uses non-standard ports. Which two Palo Alto Networks features should be used together to achieve these goals? (Choose two.)

Question 65hardmulti select

Read the full NGFW And SASE Solution Functionality explanation →

A company is deploying Prisma Access for remote users. The security team wants to ensure that all traffic from remote users is inspected by the full security stack, including threat prevention and URL filtering, while also providing optimal performance for SaaS applications. Which two components are required to achieve this? (Choose two.)

Question 66hardmultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

A network security engineer is troubleshooting a Security policy rule that is supposed to block traffic to a known malicious IP address. The rule is configured with the action 'deny' and is placed at the top of the rulebase. However, traffic to that IP is still being allowed. What is the most likely cause?

Question 67hardmultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

A security team is deploying Prisma Access for remote users and wants to ensure that traffic to sanctioned SaaS applications is inspected for data loss while traffic to unsanctioned SaaS is blocked. They also need to apply different inspection profiles based on user group. Which combination of Prisma Access and NGFW features should they use to meet these requirements?

Question 68hardmultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

A multinational company uses Prisma Access to secure remote workers. They want to ensure that employees can access only approved SaaS applications and that any attempt to use unsanctioned SaaS is blocked and logged for compliance. They also need to apply different policies based on the user's department. Which Prisma Access feature should they use to enforce application-level access control with department-based granularity?

Question 69hardmulti select

Read the full NGFW And SASE Solution Functionality explanation →

A network security engineer is deploying Prisma Access to secure remote workers. The engineer needs to ensure that traffic from remote users is inspected for threats and that access to SaaS applications is controlled based on user identity and device posture. Which two components are required to achieve these goals? (Choose two.)

Question 70easymultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

A security administrator is configuring a Security Profile to protect against unknown threats. The administrator wants to ensure that files downloaded from the internet are analyzed for malicious behavior and that zero-day exploits are detected. Which Security Profile component should be configured?

Question 71hardmultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

A security administrator is troubleshooting why a Security policy rule that allows access to a specific SaaS application is not working for some users. The rule uses App-ID and User-ID, and the users are authenticated via GlobalProtect. The administrator notices that the rule matches for some users but not others, even though they are in the same User-ID group. What is the most likely cause?

Question 72hardmultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

A security administrator is configuring a Security Policy rule to allow access to a sanctioned SaaS application. The administrator wants to ensure that the rule only allows the specific SaaS application and not other applications that might use the same underlying protocol. Which App-ID characteristic should be used to achieve this?

Question 73easymultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

A network administrator is configuring a Security Policy rule to block traffic from a specific IP address. The administrator wants to ensure that the rule is evaluated before other rules that might allow the traffic. What should be configured to achieve this?

Question 74hardmultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

A network security administrator is configuring a Security Policy rule to allow access to a web application. The rule includes the application 'web-browsing' and 'ssl'. Users report that they cannot access the application, and the traffic logs show the application as 'incomplete'. What is the most likely cause?

Question 1mediummultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

A administrator needs to ensure that users are authenticated before accessing a web-based internal application. Which User-ID method provides the most granular control by prompting users via a captive portal?

Question 2hardmultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

You are migrating an existing branch office to Prisma Access. Which component is required to allow the branch to communicate with your on-premises data center?

Question 3hardmultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

In a Prisma Access environment, how does the system ensure that a user always connects to the geographically nearest location?

Question 4mediummultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

You want to allow access to a specific SaaS application but block file uploads to that application. Which feature facilitates this?

Question 5easymultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

Which feature of Content-ID helps prevent the execution of malicious scripts on a web page?

Question 6mediummultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

What is the purpose of the 'Pre-Rule' and 'Post-Rule' sections in a Panorama-managed firewall?

Question 7easymultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

When a user connects via GlobalProtect, how does the firewall identify the user if they are not in the AD group?

Question 8mediummulti select

Read the full NGFW And SASE Solution Functionality explanation →

Which TWO of the following are valid ways to deploy GlobalProtect?

Question 9mediummulti select

Read the full NGFW And SASE Solution Functionality explanation →

Which TWO of the following are types of security policies supported by the NGFW?

Question 10mediummultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

A security administrator needs to allow employees to access a sanctioned SaaS application (e.g., Salesforce) while preventing them from uploading sensitive files to that same application. The administrator wants to enforce this directly on the NGFW without relying on endpoint agents or proxy re-encryption. Which Palo Alto Networks feature should be used to achieve this granular control?

Question 11hardmultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

A network security engineer is configuring a Security Policy rule to block traffic from a specific source IP address to a destination IP address. The engineer wants to ensure that the firewall does not send a TCP reset to the source and does not silently drop the packet, but instead sends an ICMP unreachable message. Which action should be configured in the Security Policy rule?

Question 12mediummultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

A network security engineer is configuring a Security Policy rule on a Palo Alto Networks NGFW to allow a specific SaaS application but block file uploads to it. The engineer wants to avoid blocking non-file-sharing functions of the application. Which feature should be used to meet this requirement?

Question 13mediummulti select

Read the full NGFW And SASE Solution Functionality explanation →

A security engineer is configuring a Security Policy rule to allow traffic from the 'Trust' zone to the 'Untrust' zone. The engineer wants to ensure that the rule only allows specific applications and that the traffic is inspected for threats. Which TWO of the following configurations are required to achieve this? (Choose two.)

Question 14mediummultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

A network security engineer is configuring a Security Policy rule to allow access to a specific SaaS application but wants to prevent users from uploading files to it. The application is identified by App-ID, and the engineer wants to enforce this restriction without blocking the entire application. Which Palo Alto Networks feature should be used to accomplish this?

Question 15mediummultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

A security administrator has configured a Security policy rule to allow traffic from the 'Trust' zone to the 'Untrust' zone. The rule includes an application group called 'web-browsing' and a URL Filtering profile that blocks the 'social-networking' category. Users report that they can access social media sites despite the URL Filtering profile. What is the most likely cause?

Question 16hardmulti select

Read the full NGFW And SASE Solution Functionality explanation →

A NetSec-Pro administrator is configuring a Security Policy rule to allow web traffic from the Trust zone to the Untrust zone. The administrator wants to ensure that the rule allows only HTTP and HTTPS traffic, and that the firewall logs the application and URL category for each session. Which two actions should the administrator take in the Security Policy rule configuration? (Choose two.)

Question 17mediummultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

An administrator is configuring a Security policy rule to allow access to a web application. The rule includes the application 'web-browsing' and a URL Filtering profile. Users report that they can access the site but the URL Filtering profile is not blocking a category that should be blocked. What is the most likely reason?

Question 18mediummultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

An engineer is configuring an NGFW to enforce least-privilege egress for SaaS traffic. The requirement is to allow access to a sanctioned SaaS application while blocking only file uploads to that same application, without disrupting normal browsing and API calls. Which Palo Alto Networks capability should the engineer use to meet this requirement?

Question 19mediummulti select

Read the full NGFW And SASE Solution Functionality explanation →

A network security administrator is configuring a Security policy rule on a Palo Alto Networks NGFW to allow access to a business-critical SaaS application. The rule must also ensure that only corporate tenants of that SaaS application are reachable, and that any attempt to access a personal tenant is logged and blocked. Which TWO actions should the administrator take to meet these requirements? (Choose two.)

Question 20easymultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

A security engineer is troubleshooting why a Security policy rule that allows a specific SaaS application is not matching traffic from a remote user connected through Prisma Access. The engineer confirms the user is authenticated and the application is recognized. Which factor is most likely preventing the rule from matching?

Question 21mediummultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

A security administrator at a manufacturing company is configuring a Security policy rule to allow contractors to access a web-based ERP application hosted on an internal server in the DMZ. The administrator wants to ensure that contractors cannot use the same rule to access any other internal web applications. Which feature should be used in the Security policy rule to enforce this restriction?

Question 22mediummultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

A network security engineer is configuring a Security policy rule to allow access to a business-critical SaaS application. The engineer wants to ensure that the application is allowed only for users in the 'Finance' group and that file uploads to the application are blocked. Which two configurations are needed to achieve this? (Choose two.)

Question 23mediummultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

A network security engineer is configuring a Security Policy rule to allow only specific applications for a group of users. The engineer wants to ensure that the rule matches traffic based on the application's underlying protocol and port, regardless of the application's behavior. Which App-ID technique should be used?

Question 24mediummulti select

Read the full NGFW And SASE Solution Functionality explanation →

A security engineer is configuring SSL decryption on an NGFW. The engineer needs to exclude certain traffic from decryption to comply with privacy regulations. Which two methods can be used to exclude traffic from SSL decryption? (Choose two.)

Question 25mediummultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

You have a Security Policy rule allowing 'web-browsing' and 'ssl'. A user cannot access a specific site, and the logs show the traffic as 'web-browsing' but failing a specific Security Profile. Which action is most appropriate?

Question 26hardmultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

You are troubleshooting a performance issue in Prisma Access. Users report slow access to SaaS applications. You suspect the issue is related to the path selection. Which tool should you use to analyze the latency between the user's mobile client and the Service Connection?

Question 27easymultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

When using User-ID with Active Directory, what is the primary purpose of the User-ID Agent?

Question 28easymultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

Which Content-ID component specifically prevents the exfiltration of sensitive data like credit card numbers?

Question 29mediummultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

What is the effect of setting a Security Policy rule action to 'Drop' versus 'Reset-Both'?

Question 30mediummultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

You are configuring App-ID for an application that uses non-standard ports. You have created a custom application object, but the traffic is still being identified as 'incomplete'. What is the most likely reason?

Question 31easymultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

What happens when a security policy rule is set to 'Log at Session End'?

Question 32mediummultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

An administrator wants to categorize traffic based on the 'Server' role in the network. Which feature should be used to tag this traffic for policy grouping?

Question 33mediummultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

If a packet matches a Security Policy rule, but the application is not identified yet, what action does the firewall take?

Question 34easymultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

Which NGFW feature allows for the inspection of files for malicious content based on signatures and heuristic analysis?

Question 35hardmultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

When configuring SSL Forward Proxy, which step is mandatory for the firewall to successfully inspect encrypted traffic?

Question 36mediummultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

You are configuring a 'Strict' security profile for a web server. Which profile action is best suited to block known exploit patterns while allowing the traffic?

Question 37easymultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

Which command is used to display the current User-ID mapping information on the CLI?

Question 38hardmultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

You are setting up an SSL Decryption policy. If you want to exclude traffic to financial websites to comply with privacy laws, how do you configure it?

Question 39mediummultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

You need to ensure that traffic between two internal zones is inspected for threats. What must be configured on the Security Policy?

Question 40hardmultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

In Prisma Access, what is the role of the 'Compute Location' setting?

Question 41hardmultiple choice

Study the full SD-WAN breakdown →

You are configuring an SD-WAN path for a branch office. Which metric does the firewall use to determine the best path when multiple paths are available?

Question 42mediummulti select

Read the full NGFW And SASE Solution Functionality explanation →

Which TWO of the following are valid log types available on the Palo Alto Networks firewall?

Question 43mediummulti select

Read the full NGFW And SASE Solution Functionality explanation →

Which TWO of the following are valid methods for mapping IP addresses to usernames in a Palo Alto Networks NGFW?

Question 44mediummultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

Which action in a Security Profile allows you to permit traffic but generate an alert in the logs?

Question 45mediummulti select

Read the full NGFW And SASE Solution Functionality explanation →

Which TWO of the following are benefits of using App-ID over port-based security policies?

Question 46hardmulti select

Read the full NGFW And SASE Solution Functionality explanation →

Which THREE of the following are considered 'App-ID' identification techniques?

Question 47hardmulti select

Read the full NGFW And SASE Solution Functionality explanation →

Which THREE components are involved in the Prisma Access architecture for protecting mobile users?

Question 48hardmulti select

Read the full NGFW And SASE Solution Functionality explanation →

Which THREE of the following are actions that can be taken when a file is detected by a File Blocking Profile?

Question 49mediummulti select

Read the full NGFW And SASE Solution Functionality explanation →

Which TWO of the following are features of Content-ID?

Question 50hardmulti select

Read the full NGFW And SASE Solution Functionality explanation →

Which THREE of the following are settings that can be configured in a URL Filtering profile?

Question 51hardmulti select

Read the full NGFW And SASE Solution Functionality explanation →

Which THREE of the following items are required to successfully deploy a Prisma Access Service Connection?

Question 52hardmultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

A NetSec-Pro administrator is configuring a Palo Alto Networks NGFW for a SASE deployment. Remote users connect through Prisma Access, and the security team wants to enforce consistent security policies that inspect traffic based on application identity rather than just port and protocol. The administrator needs to ensure that the firewall can identify applications even when they use non-standard ports or encryption. Which Palo Alto Networks technology should the administrator rely on to achieve this?

Question 53easymultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

A security analyst is reviewing logs and notices that a user's traffic to a known malicious domain is being allowed. The analyst checks the URL Filtering profile and sees that the domain is categorized as 'malware' and the action is set to 'alert'. The analyst wants to block this traffic immediately. What should the analyst change in the URL Filtering profile?

Question 54hardmulti select

Read the full NGFW And SASE Solution Functionality explanation →

A security administrator is deploying Prisma Access for mobile users and needs to ensure that traffic from remote users is inspected for threats and sensitive data. The administrator wants to leverage the Prisma Access architecture to apply security policies consistently. Which TWO of the following components are essential for enforcing security policies on mobile user traffic in Prisma Access? (Choose two.)

Question 55easymultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

A network security engineer is configuring a Security Policy rule on a Palo Alto Networks NGFW. The engineer wants to allow traffic but generate an alert in the logs for auditing purposes. Which action should be selected in the Security Policy rule?

Question 56easymultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

A NetSec-Pro administrator is configuring a Security Policy rule to allow HTTP traffic from the Trust zone to the Untrust zone. The administrator wants to ensure that the firewall identifies the application as web-browsing regardless of the port used. Which Security Policy rule component should be used to achieve this requirement?

Question 57mediummultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

A security administrator is deploying Prisma Access for a branch office. The branch office needs to access internal applications hosted in the corporate data center. Which Prisma Access component should be configured to enable this connectivity?

Question 58mediummultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

A security administrator is deploying Prisma Access for mobile users. The administrator wants to ensure that traffic from mobile users is inspected for threats and that access to certain applications is controlled based on user identity. Which component of Prisma Access is responsible for enforcing security policies and inspecting traffic?

Question 59mediummultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

A security engineer is deploying a SASE solution to protect remote users accessing SaaS applications. The engineer needs to ensure that traffic from remote users is inspected for threats and that access to sanctioned SaaS applications is controlled based on user identity. Which SASE component should the engineer configure to achieve these goals?

Question 60hardmultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

A security engineer is configuring a Security Policy rule on a Palo Alto Networks NGFW to block traffic and send a TCP reset to both the client and server. Which action should be selected?

Question 61hardmultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

A NetSec-Pro administrator is configuring a Security Profile to block malicious files. The administrator wants to ensure that files are analyzed for zero-day exploits and that a verdict is returned to the firewall to block malicious files. Which Palo Alto Networks service should be enabled to achieve this?

Question 62mediummultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

A security administrator is configuring a Security Policy rule to allow web traffic but wants to ensure that users cannot download executable files. The administrator decides to attach a File Blocking profile to the rule. Which action should be set in the File Blocking profile to prevent the download of executable files while still allowing other file types?

Question 63mediummultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

A network security administrator is configuring a Security Policy rule to allow access to a specific SaaS application, but wants to block file uploads to that application. Which Palo Alto Networks feature should the administrator use to achieve this granular control?

Question 64hardmulti select

Read the full NGFW And SASE Solution Functionality explanation →

A network security engineer is configuring a Security Policy rule to allow access to a specific SaaS application but wants to enforce data loss prevention by blocking the upload of files containing credit card numbers. The engineer also wants to ensure that the application is identified correctly even if it uses non-standard ports. Which two Palo Alto Networks features should be used together to achieve these goals? (Choose two.)

Question 65hardmulti select

Read the full NGFW And SASE Solution Functionality explanation →

A company is deploying Prisma Access for remote users. The security team wants to ensure that all traffic from remote users is inspected by the full security stack, including threat prevention and URL filtering, while also providing optimal performance for SaaS applications. Which two components are required to achieve this? (Choose two.)

Question 66hardmultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

A network security engineer is troubleshooting a Security policy rule that is supposed to block traffic to a known malicious IP address. The rule is configured with the action 'deny' and is placed at the top of the rulebase. However, traffic to that IP is still being allowed. What is the most likely cause?

Question 67hardmultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

A security team is deploying Prisma Access for remote users and wants to ensure that traffic to sanctioned SaaS applications is inspected for data loss while traffic to unsanctioned SaaS is blocked. They also need to apply different inspection profiles based on user group. Which combination of Prisma Access and NGFW features should they use to meet these requirements?

Question 68hardmultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

A multinational company uses Prisma Access to secure remote workers. They want to ensure that employees can access only approved SaaS applications and that any attempt to use unsanctioned SaaS is blocked and logged for compliance. They also need to apply different policies based on the user's department. Which Prisma Access feature should they use to enforce application-level access control with department-based granularity?

Question 69hardmulti select

Read the full NGFW And SASE Solution Functionality explanation →

A network security engineer is deploying Prisma Access to secure remote workers. The engineer needs to ensure that traffic from remote users is inspected for threats and that access to SaaS applications is controlled based on user identity and device posture. Which two components are required to achieve these goals? (Choose two.)

Question 70easymultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

A security administrator is configuring a Security Profile to protect against unknown threats. The administrator wants to ensure that files downloaded from the internet are analyzed for malicious behavior and that zero-day exploits are detected. Which Security Profile component should be configured?

Question 71hardmultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

A security administrator is troubleshooting why a Security policy rule that allows access to a specific SaaS application is not working for some users. The rule uses App-ID and User-ID, and the users are authenticated via GlobalProtect. The administrator notices that the rule matches for some users but not others, even though they are in the same User-ID group. What is the most likely cause?

Question 72hardmultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

A security administrator is configuring a Security Policy rule to allow access to a sanctioned SaaS application. The administrator wants to ensure that the rule only allows the specific SaaS application and not other applications that might use the same underlying protocol. Which App-ID characteristic should be used to achieve this?

Question 73easymultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

A network administrator is configuring a Security Policy rule to block traffic from a specific IP address. The administrator wants to ensure that the rule is evaluated before other rules that might allow the traffic. What should be configured to achieve this?

Question 74hardmultiple choice

Read the full NGFW And SASE Solution Functionality explanation →

A network security administrator is configuring a Security Policy rule to allow access to a web application. The rule includes the application 'web-browsing' and 'ssl'. Users report that they cannot access the application, and the traffic logs show the application as 'incomplete'. What is the most likely cause?