NetSec-Pro NGFW And SASE Solution Functionality Practice Test 2 — 15 Questions

Question 1

A NetSec-Pro administrator is configuring a Security Policy rule to allow web traffic from the Trust zone to the Untrust zone. The administrator wants to ensure that the rule allows only HTTP and HTTPS traffic, and that the firewall logs the application and URL category for each session. Which two actions should the administrator take in the Security Policy rule configuration? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set the Application to 'web-browsing' and 'ssl'.. To allow only HTTP and HTTPS traffic and log application and URL category, the administrator must set the Application to 'web-browsing' and 'ssl' to identify the applications, and set the Service to 'application-default' to restrict to default ports. These actions ensure that the rule matches the intended traffic and that the firewall can log the application and URL category at session end by default. The other options are either unnecessary or not directly related to the requirement.

Answer

Enable logging at session start.

Answer

Attach a URL Filtering profile to the rule.

Answer

Enable logging at session end.

Question 2

An administrator is configuring a Security policy rule to allow access to a web application. The rule includes the application 'web-browsing' and a URL Filtering profile. Users report that they can access the site but the URL Filtering profile is not blocking a category that should be blocked. What is the most likely reason?

Accepted Answer

The application 'web-browsing' does not include SSL, so the firewall cannot inspect encrypted traffic.. The correct answer is that the application 'web-browsing' does not include SSL, so the firewall cannot inspect encrypted traffic. Most web applications use HTTPS, and if the Security policy rule does not allow the 'ssl' application and decryption is not configured, the firewall cannot identify the URL or enforce the URL Filtering profile. The profile itself is correctly configured, and zone or rule order issues are not indicated.

Answer

The URL Filtering profile is not applied to the correct zone.

Answer

The Security policy rule is placed after a more permissive rule that allows all traffic.

Answer

The URL Filtering profile is misconfigured because it does not include the category to block.

Question 3

An engineer is configuring an NGFW to enforce least-privilege egress for SaaS traffic. The requirement is to allow access to a sanctioned SaaS application while blocking only file uploads to that same application, without disrupting normal browsing and API calls. Which Palo Alto Networks capability should the engineer use to meet this requirement?

Accepted Answer

Security policy rule with App-ID and a File Blocking profile that blocks uploads. The requirement is to permit a SaaS application while preventing file uploads to it. That is achieved by matching the application with App-ID in a Security policy rule and attaching a File Blocking profile that blocks the upload direction. This gives granular, application-aware control without blocking legitimate browsing or API calls. URL Filtering, QoS, and generic data filtering do not provide the same precise, direction-aware enforcement for a specific SaaS application's file transfers.

Answer

SaaS Security Inline policy with a Data Filtering profile

Answer

URL Filtering profile set to block the SaaS application's file upload path

Answer

QoS profile that rate-limits the SaaS application's upload traffic

Question 4

A network security administrator is configuring a Security policy rule on a Palo Alto Networks NGFW to allow access to a business-critical SaaS application. The rule must also ensure that only corporate tenants of that SaaS application are reachable, and that any attempt to access a personal tenant is logged and blocked. Which TWO actions should the administrator take to meet these requirements? (Choose two.)

Accepted Answer

Enable SaaS tenant restrictions in the Security policy rule for the application. To allow only corporate tenants and log blocked attempts, the administrator should enable SaaS tenant restrictions in the Security policy rule and ensure the rule allows and logs sessions. Tenant restrictions enforce the corporate tenant requirement, while logging provides the required visibility. URL Filtering, custom signatures, and QoS do not provide tenant-level control or the needed logging behavior for this scenario.

Answer

Attach a URL Filtering profile that blocks the SaaS application's login page

Answer

Create a custom application signature for the SaaS application

Answer

Apply a QoS profile to limit bandwidth for the SaaS application

Question 5

A security engineer is troubleshooting why a Security policy rule that allows a specific SaaS application is not matching traffic from a remote user connected through Prisma Access. The engineer confirms the user is authenticated and the application is recognized. Which factor is most likely preventing the rule from matching?

Accepted Answer

The rule is placed after a more general deny rule that matches the traffic. Security policy rules are evaluated in order, and the first matching rule is applied. If a general deny rule precedes the specific allow rule, the deny rule will match and block the traffic, preventing the allow rule from ever being evaluated. The engineer should reorder the rules so the specific allow rule is above the general deny rule. Other factors like port, decryption, or zone mismatch are less likely given the application is recognized and the user is connected.

Answer

The user's traffic is being decrypted and then re-encrypted, causing a session mismatch

Answer

The rule is configured with a source zone that does not include the Prisma Access tunnel zone

Answer

The application is using a non-standard port that the rule does not include

Question 6

A security administrator at a manufacturing company is configuring a Security policy rule to allow contractors to access a web-based ERP application hosted on an internal server in the DMZ. The administrator wants to ensure that contractors cannot use the same rule to access any other internal web applications. Which feature should be used in the Security policy rule to enforce this restriction?

Accepted Answer

Application-ID. Application-ID is the correct feature because it identifies the application itself, not just the port or protocol. This allows the administrator to create a rule that permits only the ERP application while blocking all other applications, even if they share the same network characteristics. URL Category and Service are too broad, and Application Filters group multiple applications, which could permit unintended access.

Answer

Service

Answer

Application Filter

Answer

URL Category

Question 7

A network security engineer is configuring a Security policy rule to allow access to a business-critical SaaS application. The engineer wants to ensure that the application is allowed only for users in the 'Finance' group and that file uploads to the application are blocked. Which two configurations are needed to achieve this? (Choose two.)

Accepted Answer

Create a Security policy rule with User-ID and App-ID for the SaaS application, and apply a Data Filtering profile to block file uploads.. The correct configuration uses User-ID and App-ID to identify the user group and the SaaS application, ensuring only Finance users are allowed. A Data Filtering profile is then applied to inspect and block file uploads, preventing data exfiltration. File Blocking profiles block files by type but not direction, and URL Category is less precise than App-ID.

Answer

Create a Security policy rule with User-ID and App-ID for the SaaS application, and apply a SaaS Security profile to block file uploads.

Answer

Create a Security policy rule with User-ID and URL Category for the SaaS application, and apply a Data Filtering profile to block file uploads.

Answer

Create a Security policy rule with User-ID and App-ID for the SaaS application, and apply a File Blocking profile to block file uploads.

Question 8

A network security engineer is configuring a Security Policy rule to allow only specific applications for a group of users. The engineer wants to ensure that the rule matches traffic based on the application's underlying protocol and port, regardless of the application's behavior. Which App-ID technique should be used?

Accepted Answer

Application signature. Application signatures are a core App-ID technique that can incorporate port and protocol information to identify applications. When a signature specifies a particular port and protocol, the firewall matches traffic accordingly, providing deterministic control. This is the correct approach when the requirement is to match based on the application's underlying protocol and port, as opposed to relying on behavioral or heuristic methods.

Answer

Port-based classification

Answer

Heuristic analysis

Answer

Protocol decoding

Question 9

A security engineer is configuring SSL decryption on an NGFW. The engineer needs to exclude certain traffic from decryption to comply with privacy regulations. Which two methods can be used to exclude traffic from SSL decryption? (Choose two.)

Accepted Answer

Create a Decryption Policy rule with action 'no-decrypt' for specific source and destination addresses.. To exclude traffic from SSL decryption, administrators can use a Decryption Policy rule with the action 'no-decrypt' for specific sources and destinations, or leverage the SSL Decryption Exclusion list based on certificate attributes. Both methods allow traffic to pass without decryption, complying with privacy regulations. Other options either block traffic or do not directly exclude it from decryption.

Answer

Add the traffic to a 'No Decrypt' application group.

Answer

Configure a Security Policy rule with action 'deny' for the traffic.

Answer

Enable 'Forward Proxy' mode and set the action to 'no-decrypt'.

Question 10

You have a Security Policy rule allowing 'web-browsing' and 'ssl'. A user cannot access a specific site, and the logs show the traffic as 'web-browsing' but failing a specific Security Profile. Which action is most appropriate?

Accepted Answer

Check the logs for the specific Security Profile trigger.. The logs already show the traffic is correctly identified as 'web-browsing', so the failure is not an App-ID issue. The next diagnostic step is to inspect the Security Profile logs to see which specific profile (e.g., Antivirus, Vulnerability, URL Filtering) triggered the block. This allows the administrator to adjust the profile or create an exception without weakening the overall policy.

Answer

Disable App-ID for this rule.

Answer

Increase the timeout settings on the zone.

Answer

Change the application to 'any'.

Question 11

You are troubleshooting a performance issue in Prisma Access. Users report slow access to SaaS applications. You suspect the issue is related to the path selection. Which tool should you use to analyze the latency between the user's mobile client and the Service Connection?

Accepted Answer

Prisma Access Insights. Prisma Access Insights provides visibility into the health and performance of the Prisma Access infrastructure, including latency between mobile users and Service Connections. It offers path-selection analytics and network performance metrics that directly address troubleshooting slow SaaS access due to suboptimal routing.

Answer

Traffic Logs in Panorama

Answer

GlobalProtect App logs

Answer

ACC (Application Command Center)

Question 12

When using User-ID with Active Directory, what is the primary purpose of the User-ID Agent?

Accepted Answer

To query domain controllers for IP-to-User mapping.. The User-ID Agent is a component that queries Active Directory domain controllers to map IP addresses to usernames. It reads security event logs and other sources to determine which user is logged in at which IP, then sends this mapping to the firewall. This enables User-ID-based security policies without requiring the firewall to directly query AD.

Answer

To cache user credentials for SSO.

Answer

To encrypt traffic for GlobalProtect.

Answer

To push security policies to clients.

Question 13

Which Content-ID component specifically prevents the exfiltration of sensitive data like credit card numbers?

Accepted Answer

Data Filtering. Data Filtering profiles scan traffic for specific patterns, such as regular expressions for credit card numbers.

Answer

Vulnerability Protection

Answer

URL Filtering

Answer

Antivirus

Question 14

What is the effect of setting a Security Policy rule action to 'Drop' versus 'Reset-Both'?

Accepted Answer

Reset-Both informs the client and server that the connection is closed.. 'Drop' silently discards the packet, while 'Reset-Both' actively informs the sender and receiver that the connection is terminated.

Answer

Reset-Both is only for TCP, while Drop is only for UDP.

Answer

Drop is only available for inter-zone traffic.

Answer

Drop consumes more firewall CPU cycles.

Question 15

You are configuring App-ID for an application that uses non-standard ports. You have created a custom application object, but the traffic is still being identified as 'incomplete'. What is the most likely reason?

Accepted Answer

The custom application lacks a defined signature to identify the application flow.. When a custom application is still identified as 'incomplete,' the most likely reason is that the custom application object lacks a defined signature to identify the application flow. App-ID requires signatures (patterns, context, or protocol decoders) to positively identify traffic; without a signature, the firewall cannot classify the application and marks it incomplete. Creating the object alone is insufficient without the identifying logic.

Answer

The security policy has not been committed to the Data Plane.

Answer

Content-ID is disabled on the Security Policy rule.

Answer

User-ID is not enabled on the ingress interface.