NetSec-Pro NGFW And SASE Solution Functionality — Timed 15 Questions

Question 1

A administrator needs to ensure that users are authenticated before accessing a web-based internal application. Which User-ID method provides the most granular control by prompting users via a captive portal?

15 minute time limit — choose an answer to begin.

Accepted Answer

Captive Portal. Captive Portal is a User-ID method that intercepts HTTP/HTTPS requests from unauthenticated users and redirects them to a web page where they must enter credentials. This provides granular control because authentication is tied to the user session, and policies can be applied based on the authenticated user. It is ideal for scenarios where users need to authenticate before accessing internal web applications, as it directly prompts them via a browser.

Answer

IP-to-User Mapping via XML API

Answer

Clientless VPN

Answer

GlobalProtect Transparent Authentication

Question 2

You are migrating an existing branch office to Prisma Access. Which component is required to allow the branch to communicate with your on-premises data center?

Accepted Answer

Service Connection. A Service Connection is the specific component used to link the Prisma Access cloud infrastructure to on-premises resources.

Answer

Mobile User Connection

Answer

Prisma Access Insights

Answer

Remote Network Connection

Question 3

In a Prisma Access environment, how does the system ensure that a user always connects to the geographically nearest location?

Accepted Answer

Global DNS load balancing.. Prisma Access uses Global DNS load balancing to direct users to the nearest location. When a GlobalProtect agent resolves the portal or gateway FQDN, the authoritative DNS service returns the IP address of the closest Prisma Access location based on the user's source IP. This ensures optimal performance and low latency without user intervention.

Answer

The user's local ISP routing table.

Answer

Manual selection of gateways in the GlobalProtect agent.

Answer

Static configuration on the firewall.

Question 4

You want to allow access to a specific SaaS application but block file uploads to that application. Which feature facilitates this?

Accepted Answer

App-ID Features. App-ID allows you to use 'App-ID Features' (like file-upload) to create specific control policies within an application.

Answer

URL Filtering categories

Answer

Data Filtering Profiles

Answer

Security Zones

Question 5

Which feature of Content-ID helps prevent the execution of malicious scripts on a web page?

Accepted Answer

Anti-Spyware. The Anti-Spyware profile includes signatures that can detect and block malicious script execution patterns.

Answer

File Blocking

Answer

App-ID

Answer

URL Filtering

Question 6

What is the purpose of the 'Pre-Rule' and 'Post-Rule' sections in a Panorama-managed firewall?

Accepted Answer

To ensure global policies are enforced before local policies.. Pre-rules are evaluated before local rules, ensuring that global corporate policies override local branch configurations.

Answer

To speed up the policy lookup.

Answer

To provide backup for failed rules.

Answer

To organize rules by date.

Question 7

When a user connects via GlobalProtect, how does the firewall identify the user if they are not in the AD group?

Accepted Answer

It falls back to the IP-to-User mapping table.. The firewall can identify users via the GlobalProtect portal authentication logs or by falling back to the IP-to-User mapping.

Answer

It blocks the traffic by default.

Answer

It requests the MAC address.

Answer

It uses the machine name.

Question 8

Which TWO of the following are valid ways to deploy GlobalProtect?

Accepted Answer

Split Tunnel VPN. Split Tunnel VPN (C) is a valid GlobalProtect deployment because the GlobalProtect agent establishes an SSL/IPsec tunnel to the portal/gateway while only routing specific, administrator-defined destination subnets (via the split-tunnel access route and include/exclude lists) through the tunnel, leaving other traffic to go directly out the local internet connection. Full Tunnel VPN (D) is also valid because GlobalProtect can be configured so that all client traffic (0.0.0.0/0) is forced through the gateway, typically enforced with the no-split-tunnel option and security policy applied to the tunnel interface. Physical wire mode (A) is a Palo Alto Networks firewall interface deployment mode (TAP/vwire), not a GlobalProtect client deployment method. Local Bridge Mode (B) is not a GlobalProtect deployment option — it is not a supported agent/gateway mode. Static VPN (E) is not a GlobalProtect deployment type; GlobalProtect uses portal/gateway configurations with SSL or IPsec, not a 'static VPN' mode.

Answer

Physical wire mode

Answer

Local Bridge Mode

Answer

Static VPN

Question 9

Which TWO of the following are types of security policies supported by the NGFW?

Accepted Answer

Security. In Palo Alto Networks NGFW terminology, the firewall supports three policy types: Security, NAT, and Decryption (plus Policy-Based Forwarding in some versions), so option D (Security) is correct because Security policies define the allow/deny/scan rules that match traffic by zone, address, application, user, and service and then apply security profiles. Option E (NAT) is also correct because NAT policies are a distinct, separately configured policy type that handles source and destination address translation (and port translation) independently of the Security policy that permits the translated session. Options A (Application-Allow) and B (Bandwidth-Limit) are not policy types — application control is enforced inside a Security policy via the Application field and App-ID, and bandwidth limiting is done with QoS policy or traffic shaping, not a dedicated policy type. Option C (Device-Management) is also not a policy type; management access is controlled through interface management profiles and administrative roles, not a firewall policy rulebase.

Answer

Application-Allow

Answer

Bandwidth-Limit

Answer

Device-Management

Question 10

A security administrator needs to allow employees to access a sanctioned SaaS application (e.g., Salesforce) while preventing them from uploading sensitive files to that same application. The administrator wants to enforce this directly on the NGFW without relying on endpoint agents or proxy re-encryption. Which Palo Alto Networks feature should be used to achieve this granular control?

Accepted Answer

SaaS Inline App-ID with SaaS Tenant Restrictions. SaaS Inline App-ID is designed to provide granular control over SaaS applications by identifying specific actions within the application, such as upload, download, and view. This allows the firewall to block file uploads to a sanctioned SaaS app while still allowing other activities. The other options either lack inline enforcement, operate at a different layer, or cannot distinguish between upload and download actions.

Answer

SaaS Security API

Answer

URL Filtering with custom URL categories

Answer

App-ID with File Blocking profile

Question 11

A network security engineer is configuring a Security Policy rule to block traffic from a specific source IP address to a destination IP address. The engineer wants to ensure that the firewall does not send a TCP reset to the source and does not silently drop the packet, but instead sends an ICMP unreachable message. Which action should be configured in the Security Policy rule?

Accepted Answer

Deny. The Deny action in a Security Policy rule sends an ICMP unreachable message to the source, which fulfills the requirement of notifying the source that the destination is unreachable without sending a TCP reset or silently dropping the packet. The other actions either silently drop (Drop) or send TCP resets (Reset-Both, Reset-Client), which do not meet the specified criteria.

Answer

Drop

Answer

Reset-Client

Answer

Reset-Both

Question 12

A network security engineer is configuring a Security Policy rule on a Palo Alto Networks NGFW to allow a specific SaaS application but block file uploads to it. The engineer wants to avoid blocking non-file-sharing functions of the application. Which feature should be used to meet this requirement?

Accepted Answer

App-ID with a Security Policy rule that uses Application Filters to select the SaaS application and then applies a File Blocking profile for upload direction. The requirement is to allow a SaaS application while blocking only its file upload capability. App-ID identifies the application, and Application Filters enable selection of that application. A File Blocking profile applied to the rule can block uploads based on file type and direction, while other functions remain allowed. This granular control is achieved by combining App-ID, Application Filters, and File Blocking, ensuring that only file uploads are blocked without affecting other application features.

Answer

SaaS Application Policy with a specific application and action set to 'block file uploads'

Answer

App-ID with a Security Profile Group that includes a File Blocking profile

Answer

URL Filtering profile with a custom URL category for the SaaS application and action set to 'block' for upload URLs

Question 13

A security engineer is configuring a Security Policy rule to allow traffic from the 'Trust' zone to the 'Untrust' zone. The engineer wants to ensure that the rule only allows specific applications and that the traffic is inspected for threats. Which TWO of the following configurations are required to achieve this? (Choose two.)

Accepted Answer

Attach a Security Profile Group to the rule. To allow specific applications and inspect traffic for threats, the rule must specify the desired applications (not 'any') and have a Security Profile Group attached to enable threat inspection. The action 'Allow' and zone definitions are basic and already implied, but the two specific configurations needed are application specification and Security Profile Group attachment.

Answer

Define the source and destination zones

Answer

Specify the application as 'any' in the rule

Answer

Set the action to 'Allow'

Question 14

A network security engineer is configuring a Security Policy rule to allow access to a specific SaaS application but wants to prevent users from uploading files to it. The application is identified by App-ID, and the engineer wants to enforce this restriction without blocking the entire application. Which Palo Alto Networks feature should be used to accomplish this?

Accepted Answer

SaaS Security profile with the appropriate data filtering and file policy settings. The requirement is to allow access to a SaaS application but block file uploads to it. This is precisely the function of a SaaS Security profile, which provides application-specific controls for SaaS environments. By associating the profile with the Security Policy rule that permits the application, the firewall can inspect the traffic and enforce the upload restriction. Other options either do not target SaaS uploads or are too broad, making the SaaS Security profile the correct choice.

Answer

URL Filtering profile with a custom URL category for the application's upload endpoints

Answer

Data Filtering profile with a custom pattern for file contents

Answer

File Blocking profile configured to block all file types

Question 15

A security administrator has configured a Security policy rule to allow traffic from the 'Trust' zone to the 'Untrust' zone. The rule includes an application group called 'web-browsing' and a URL Filtering profile that blocks the 'social-networking' category. Users report that they can access social media sites despite the URL Filtering profile. What is the most likely cause?

Accepted Answer

The application group 'web-browsing' does not include SSL, so the firewall cannot inspect the encrypted traffic.. The correct answer is that the application group 'web-browsing' does not include SSL, so the firewall cannot inspect encrypted traffic. Social media sites use HTTPS, and if the Security policy rule does not allow the 'ssl' application and decryption is not configured, the firewall cannot identify the URL or enforce the URL Filtering profile. The profile itself is correctly configured, and zone or rule order issues are not indicated.

Answer

The Security policy rule is placed after a more permissive rule that allows all traffic.

Answer

The URL Filtering profile is not applied to the correct zone.

Answer

The URL Filtering profile is misconfigured because it does not include the 'social-networking' category.