NetSec-Pro NGFW And SASE Solution Functionality Practice Test 3 — 15 Questions

Question 1

What happens when a security policy rule is set to 'Log at Session End'?

Accepted Answer

The log is generated only when the session terminates.. The log entry is generated only after the session has been closed, providing a summary of the total bytes and duration.

Answer

The log is generated at the start of the session only.

Answer

The log is triggered by a threat detection event.

Answer

The log is sent to the management plane every 10 seconds.

Question 2

An administrator wants to categorize traffic based on the 'Server' role in the network. Which feature should be used to tag this traffic for policy grouping?

Accepted Answer

Dynamic Address Groups. Dynamic Address Groups allow tagging of IP addresses based on criteria such as the 'Server' role. These tags can then be used in security policies to group traffic dynamically. This is ideal for environments where server IPs change frequently, as the group membership updates automatically based on the tags.

Answer

Device Groups

Answer

Static Address Groups

Answer

Security Profiles

Question 3

If a packet matches a Security Policy rule, but the application is not identified yet, what action does the firewall take?

Accepted Answer

It allows the packet based on the port-based match.. When a packet matches a Security Policy rule but the application has not yet been identified, the firewall allows the packet based on the port-based match. This is because application identification typically requires multiple packets to complete, so the firewall must permit the initial packets to flow to gather enough data for identification. The firewall then continues to monitor the session and may later enforce application-specific policies once the application is identified.

Answer

It drops the packet immediately.

Answer

It buffers the packet until identification is complete.

Answer

It rejects the packet and sends a TCP Reset.

Question 4

Which NGFW feature allows for the inspection of files for malicious content based on signatures and heuristic analysis?

Accepted Answer

WildFire. WildFire is Palo Alto Networks' cloud-based malware analysis and prevention service that inspects files using signatures, heuristics, and dynamic sandbox analysis. It detects unknown and zero-day threats by executing files in a virtual environment and observing behavior. WildFire verdicts are then shared globally to protect all subscribers.

Answer

URL Filtering

Answer

App-ID

Answer

User-ID

Question 5

When configuring SSL Forward Proxy, which step is mandatory for the firewall to successfully inspect encrypted traffic?

Accepted Answer

Install the firewall's Forward Trust Certificate on all client devices.. For SSL Forward Proxy to inspect encrypted traffic, the firewall acts as a man-in-the-middle by presenting a certificate to the client that is signed by the firewall's Forward Trust Certificate. For the client to trust this certificate without errors, the Forward Trust Certificate (or its CA) must be installed in the client's trusted root store. Without this, clients will see certificate warnings and may block the connection, preventing inspection.

Answer

Enable SSH decryption on the management interface.

Answer

Configure a static IP address for the Decryption Broker.

Answer

Disable Certificate Revocation List (CRL) checks.

Question 6

You are configuring a 'Strict' security profile for a web server. Which profile action is best suited to block known exploit patterns while allowing the traffic?

Accepted Answer

Vulnerability Protection. Vulnerability Protection is the security profile specifically designed to detect and block known exploit patterns, such as buffer overflows, SQL injection, and cross-site scripting, while allowing the traffic if it is not malicious. It inspects traffic for signatures of known vulnerabilities and can be configured to block or alert. For a web server, this profile is essential to protect against application-layer attacks.

Answer

Anti-Spyware

Answer

URL Filtering

Answer

File Blocking

Question 7

Which command is used to display the current User-ID mapping information on the CLI?

Accepted Answer

show user ip-user-mapping all. The command 'show user ip-user-mapping all' provides the current IP to username mapping table.

Answer

show logging user-id

Answer

test user-id

Answer

show system user-id

Question 8

You are setting up an SSL Decryption policy. If you want to exclude traffic to financial websites to comply with privacy laws, how do you configure it?

Accepted Answer

Add a 'No Decrypt' rule matching the 'financial-services' URL category.. In an SSL Decryption policy, you can create rules to selectively bypass decryption for specific traffic. To exclude financial websites, you add a 'No Decrypt' rule that matches the URL category 'financial-services'. This ensures that traffic to those sites is not decrypted, complying with privacy laws. The rule is processed in order, so placing it before any decrypt rules ensures it takes effect.

Answer

Configure a separate decryption broker.

Answer

Disable decryption for the entire zone.

Answer

Delete the financial sites from the allowed list.

Question 9

You need to ensure that traffic between two internal zones is inspected for threats. What must be configured on the Security Policy?

Accepted Answer

Apply Security Profiles to the inter-zone policy rule.. Security Profiles (such as Antivirus, Anti-Spyware, Vulnerability Protection, URL Filtering, and WildFire Analysis) are the components that actually inspect traffic for threats. Applying them to an inter-zone Security Policy rule enables content inspection on traffic permitted between the two zones. Without Security Profiles attached, the rule only performs allow/deny based on zone, address, user, and application — no threat scanning occurs.

Answer

Enable inter-zone routing.

Answer

Configure a virtual wire.

Answer

Change the zones to a single zone.

Question 10

In Prisma Access, what is the role of the 'Compute Location' setting?

Accepted Answer

It determines the data center region for policy enforcement.. In Prisma Access, the 'Compute Location' setting determines the data center region where security policy is enforced for mobile users and remote networks. It specifies the geographic location of the Prisma Access compute nodes that process traffic, ensuring compliance with data residency requirements and optimal performance.

Answer

It limits the bandwidth available to a user.

Answer

It defines the GlobalProtect Gateway IP.

Answer

It sets the user's home location for accounting.

Question 11

You are configuring an SD-WAN path for a branch office. Which metric does the firewall use to determine the best path when multiple paths are available?

Accepted Answer

Performance metrics (latency, jitter, loss).. The SD-WAN policy uses Performance Probes to measure latency, jitter, and packet loss to select the best path.

Answer

Source IP address.

Answer

Static cost metrics.

Answer

Interface priority only.

Question 12

Which TWO of the following are valid log types available on the Palo Alto Networks firewall?

Accepted Answer

Traffic. Option D (Traffic) is correct because the Palo Alto Networks firewall maintains a Traffic log that records every session traversing the firewall, including source/destination zones, IP addresses, applications, ports, and session end reasons. Option E (Threat) is correct because the firewall keeps a Threat log that records security events detected by the security profiles, such as antivirus, anti-spyware, vulnerability protection, URL filtering, and WildFire verdicts. These two are among the standard log types (alongside System, Configuration, URL Filtering, WildFire, Data Filtering, HIP Match, and Correlation). Option A (Policy-Update) is not a valid log type; policy changes are captured in the Configuration log. Option B (Hardware) is not a valid log type; hardware and system events are recorded in the System log. Option C (Encryption) is not a valid log type; decryption-related events appear in the Traffic and System logs, not a dedicated Encryption log.

Answer

Policy-Update

Answer

Hardware

Answer

Encryption

Question 13

Which TWO of the following are valid methods for mapping IP addresses to usernames in a Palo Alto Networks NGFW?

Accepted Answer

Captive Portal. User-ID can use the User-ID Agent to monitor logs or use the Captive Portal to directly authenticate users.

Answer

SNMP Traps

Answer

DNS Reverse Lookup

Answer

DHCP Relay

Question 14

Which action in a Security Profile allows you to permit traffic but generate an alert in the logs?

Accepted Answer

Alert. In a Security Profile, the 'Alert' action allows the traffic to pass but generates a log entry for the event. This is useful for monitoring and testing without blocking legitimate traffic. The other actions either block or reset the connection.

Answer

Reset-Server

Answer

Drop

Answer

Allow

Question 15

Which TWO of the following are benefits of using App-ID over port-based security policies?

Accepted Answer

Prevents applications from bypassing security by using non-standard ports.. Option C is correct because App-ID identifies applications by their traffic signatures and behavior rather than by TCP/UDP port, so an application attempting to evade policy by running on a non-standard port (e.g., SSH on port 8080) is still recognized and controlled. Option E is correct because once SSL decryption is configured, App-ID can inspect the decrypted payload and identify applications inside TLS sessions, giving visibility that port-based rules cannot provide. Option A is incorrect because App-ID depends on a continually updated application signature database (content updates from Palo Alto Networks) to recognize new and modified applications. Option B is incorrect because App-ID classifies traffic but does not automatically author security policies; policy creation remains an administrative task. Option D is incorrect because App-ID inspection is a security feature and does not inherently increase firewall throughput; it can in fact add processing overhead.

Answer

Requires no updates to the signature database.

Answer

Automatically creates security policies.

Answer

Increases throughput of the firewall.