NetSec-Pro NGFW And SASE Solution Maintenance And Configuration — All Questions With Answers

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

A company requires that traffic from the VPN zone to the Untrust zone undergoes source NAT using a specific interface IP. Which configuration step is mandatory to ensure this traffic is correctly matched?

Question 2easymultiple choice

Which type of interface is used to connect to a switch in a Layer 2 configuration where the firewall acts as a transparent bridge?

Question 3hardmultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

An administrator notices high memory utilization. What is the most effective way to identify which processes are consuming the most resources on the control plane?

Question 4mediummultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

Which feature allows you to monitor traffic patterns and generate security policy recommendations?

Question 5easymulti select

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

Which of the following are examples of Interface Management Profile services? (Choose TWO)

Question 6hardmulti select

Which three components must be configured to enable GlobalProtect Clientless VPN? (Choose THREE)

Question 7mediummulti select

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

Which three items must be configured to successfully implement a Source NAT rule? (Choose THREE)

Question 8mediummulti select

Which three settings are part of a Zone Protection Profile? (Choose THREE)

Question 9hardmulti select

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

Which three items can be used as match criteria in a Security Policy rule? (Choose THREE)

Question 10mediummultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

An administrator needs to ensure that internal users can access a public web server using its public IP address even when they are physically inside the internal network. Which NAT type and configuration approach should be used?

Question 11hardmultiple choice

An application is failing to function correctly even though the Security policy allows the traffic. The App-ID is showing as 'incomplete'. What is the most likely cause?

Question 12mediummultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

An administrator observes that dynamic updates for App-ID and Threat signatures are failing. Which troubleshooting step should be performed first?

Question 13hardmultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

You are migrating a physical firewall to a SASE (Prisma Access) environment. Which component is responsible for managing the security policies in the SASE model?

Question 14hardmulti select

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

Which THREE criteria must be satisfied for a traffic session to match a specific NAT rule?

Question 15hardmultiple choice

A NetSec-Pro administrator is configuring a Palo Alto Networks NGFW to enforce Security Policy on outbound traffic. Users are assigned to the 'Engineering' zone and connect through an internal Layer 3 interface. The administrator wants to decouple policy from physical topology so that rules can be reused across multiple sites as the organization adopts SASE. Which configuration object should be used as the source match criterion in the Security Policy rule to achieve this?

Question 16easymultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

A network administrator is configuring a NetSec-Pro firewall to act as a Layer 2 transparent bridge between two switches. Which interface type should be used for the connection to each switch?

Question 17hardmultiple choice

A company uses Palo Alto Networks firewalls with GlobalProtect. Remote users report that they can access internal web applications but cannot reach internal servers via RDP. The GlobalProtect gateway is configured with split tunneling. Which configuration should be checked to ensure RDP traffic is routed through the tunnel?

Question 18hardmultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

A network security engineer is configuring a Prisma Access remote network deployment. The engineer needs to ensure that traffic from a branch office to the internet is inspected by Prisma Access while traffic to internal corporate applications is routed through an IPsec tunnel to the headquarters data center. The engineer has already configured the remote network and the service connection. Which additional configuration is required to achieve this traffic steering?

Question 19mediummultiple choice

An administrator is configuring a Palo Alto Networks next-generation firewall to act as a Secure Web Gateway for outbound user traffic. The requirement is to decrypt HTTPS traffic, enforce URL filtering, and then re-encrypt the traffic before it leaves the firewall. However, after enabling SSL Forward Proxy decryption, users report that HTTPS sites show certificate warnings in their browsers. The administrator has already installed the forward trust certificate on the firewall and exported the forward untrust certificate. What is the most likely cause of the certificate warnings?

Question 20mediummultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

A network security engineer is configuring a Palo Alto Networks next-generation firewall to inspect outbound web traffic. The requirement is to decrypt and inspect traffic that uses TLS 1.3, but the firewall is currently only decrypting TLS 1.2. What must be configured to enable TLS 1.3 decryption?

Question 21hardmulti select

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

An administrator is configuring a NetSec-Pro firewall's Security Policy rule to match traffic for a specific application. Which two items can be used as match criteria in a Security Policy rule? (Choose two.)

Question 22mediummulti select

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

An administrator is configuring a Prisma Access mobile users deployment and needs to ensure that the GlobalProtect app on endpoints can connect to the Prisma Access gateways. The administrator has already configured the GlobalProtect portal and gateway in Prisma Access. Which two additional configurations are required for successful mobile user connectivity? (Choose two.)

Question 23mediummultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

An administrator is configuring a Prisma Access deployment that uses a service connection to provide access to internal applications. The administrator wants to ensure that traffic from remote users to the internal applications is inspected by the same security policies that apply to internet-bound traffic. Which configuration should be used?

Question 24hardmultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

A NetSec-Pro administrator is configuring a SASE solution with Prisma Access and needs to ensure that remote users' traffic to sanctioned SaaS applications is optimized for performance. The administrator wants to leverage cloud-based security inspection while minimizing latency. Which feature should be enabled?

Question 25mediummulti select

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

A NetSec-Pro administrator is configuring a Prisma Access mobile users deployment and needs to ensure that the GlobalProtect app on endpoints can connect to the Prisma Access infrastructure. The administrator must configure the portal and gateway settings. Which two actions are required to enable this connectivity? (Choose two.)

Question 26mediummultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

You are troubleshooting an application that is being blocked despite having an Allow security policy. You observe in the Traffic Log that the App-ID is identified as 'incomplete'. What is the most likely cause?

Question 27hardmultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

Which feature allows an administrator to prevent unauthorized users from using a stolen credential by requiring a second form of authentication?

Question 28easymultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

An administrator needs to ensure that internal users can reach the internet while hiding their private IP addresses. Which NAT type should be configured on the egress interface?

Question 29mediummultiple choice

You have configured a custom application object for a proprietary internal tool. When you attempt to use this object in a Security Policy, traffic is still being denied. What is a common configuration error?

Question 30mediummultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

You want to perform a configuration backup and store it on an external server using SCP. Which menu path contains the configuration for scheduled exports?

Question 31easymultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

Where do you navigate in PAN-OS to update the App-ID and Threat signatures to the latest versions?

Question 32easymultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

When configuring a virtual wire (VWire) interface, which setting is required to pass traffic between the two physical ports?

Question 33hardmultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

A security policy with a 'Log at Session End' setting is missing log entries for long-lived sessions. Why might this happen?

Question 34easymultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

When adding a new Security Policy rule, what is the default position for the rule if you do not specify 'Top' or 'Bottom'?

Question 35mediummultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

You need to allow traffic based on user group membership. Which feature must be configured to map users to their group information?

Question 36hardmultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

An administrator is unable to download content updates. The firewall has valid internet access, but the management interface has no route to the update server. What is the best solution?

Question 37mediummultiple choice

You want to block a specific URL category for all users except for the 'HR' department. How should the security policy be structured?

Question 38easymultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

Which action in a Security Policy rule will cause the firewall to send a TCP Reset to the client and server?

Question 39mediummultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

What is the purpose of the 'Zone Protection Profile'?

Question 40easymultiple choice

Which object type is used to group multiple IP addresses or subnets for use in a security policy?

Question 41hardmultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

An administrator needs to restrict administrative access to the firewall from only one specific subnet. Where should this be configured?

Question 42mediummultiple choice

If a packet matches a Security Policy rule, but the application is not explicitly defined in the rule, what happens to the traffic?

Question 43hardmultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

What is the primary difference between a 'Pre-rule' and a 'Post-rule' in a Panorama-managed environment?

Question 44easymultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

What is the first step in the packet processing flow when a packet arrives at the firewall?

Question 45hardmultiple choice

Read the full DHCP explanation →

When configuring an interface for DHCP client, where do you set the default gateway?

Question 46mediummultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

What is the benefit of using an 'Aggregate Interface'?

Question 47easymultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

Which command is used to restart the management server process on the firewall without impacting traffic flow?

Question 48mediummulti select

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

Which three actions can be taken when a match occurs in a Security Policy rule? (Choose THREE)

Question 49hardmultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

An administrator needs to prevent a specific file type (e.g., .exe) from being downloaded. Which profile is used?

Question 50easymulti select

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

Which of the following are valid methods for performing an initial configuration of a Palo Alto Networks NGFW? (Choose TWO)

Question 51hardmulti select

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

Which three types of logs can be generated by a PAN-OS firewall? (Choose THREE)

Question 52easymulti select

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

Which of the following are types of Dynamic Updates? (Choose TWO)

Question 53easymultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

When configuring a zone, what is the primary security benefit of selecting 'Enable User Identification'?

Question 54easymultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

Which action should be taken after performing a firmware upgrade on a Palo Alto Networks firewall to ensure all components are up to date?

Question 55mediummultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

An administrator needs to create a backup of the current configuration. Which file type is recommended for an off-box manual restore?

Question 56mediummulti select

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

Which TWO of the following are required to successfully implement an App-ID based Security policy?

Question 57easymulti select

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

Which TWO methods can be used to manage administrator access to a Palo Alto Networks firewall?

Question 58mediummultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

An engineer is configuring a SASE solution to provide secure web access for remote users. The organization wants to enforce different security policies based on user group membership. Which component of the SASE solution is responsible for applying security policies to web traffic?

Question 59hardmultiple choice

A network administrator is troubleshooting a Prisma Access deployment where remote users are unable to access internal applications. The administrator suspects that the issue is related to the service connection configuration. Which component is responsible for routing traffic between Prisma Access and the corporate network?

Question 60mediummultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

An administrator needs to enable NetSec-Pro Clientless VPN for remote users. The portal is configured with a valid certificate and authentication profile. Users report that the portal loads, but no internal web applications are accessible. Which additional component must be configured to allow access to internal web applications?

Question 61mediummultiple choice

A network security engineer is configuring a Palo Alto Networks firewall to decrypt outbound HTTPS traffic for inspection. The engineer wants to avoid decrypting traffic to financial institutions and healthcare sites for privacy compliance. Which firewall feature should be used to selectively bypass decryption for these categories?

Question 62mediummultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

An administrator is configuring a SASE deployment with Prisma Access and needs to ensure that remote users' traffic to sanctioned SaaS applications is inspected by the NGFW security stack while traffic to unsanctioned applications is blocked. The administrator has already configured the Prisma Access mobile users globalprotect infrastructure and added the SaaS applications to the SaaS application list. Which component must be configured next to enforce this policy for remote users?

Question 63hardmultiple choice

Study the full SD-WAN breakdown →

A NetSec-Pro administrator is troubleshooting a SASE deployment where remote users report slow access to SaaS applications. The administrator suspects that traffic is being backhauled to the data center instead of going directly to the internet. The organization uses a SASE solution with a cloud secure web gateway (SWG) and SD-WAN. Which action should the administrator take to ensure that SaaS traffic is routed directly to the internet while still being inspected by the SWG?

Question 64hardmultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

An administrator is troubleshooting a NetSec-Pro firewall where dynamic updates for App-ID and Threat signatures are failing. The firewall has valid internet access, and the management interface has a default route. Which action should be taken next to resolve the issue?

Question 65easymultiple choice

A NetSec-Pro administrator needs to configure a new security policy rule on a next-generation firewall to allow HTTP traffic from the trust zone to the untrust zone. The administrator wants to ensure that the rule is placed at the top of the rulebase so that it is evaluated before any other rules. Which action should the administrator take when creating the rule?

Question 66mediummultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

An administrator is configuring a NetSec-Pro firewall to prevent users from downloading executable files (.exe) from the internet. Which profile should be applied to the Security Policy rule to block this file type?

Question 67mediummulti select

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

An administrator is configuring a SASE solution with Palo Alto Networks Prisma Access. The goal is to ensure that traffic from remote users to SaaS applications is inspected for threats while optimizing performance. Which two components are required to achieve this? (Choose two.)

Question 68easymultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

An administrator is configuring a SASE solution with Prisma Access and needs to ensure that all traffic from mobile users is inspected by the NGFW security stack, including traffic to the internet and to private applications. The administrator has already configured the GlobalProtect portal and gateway. Which additional component must be configured to allow mobile users to access private applications hosted in the data center?

Question 69easymultiple choice

Read the full network assurance explanation →

A security administrator needs to configure a Palo Alto Networks firewall to send logs to an external syslog server. The logs should include traffic, threat, and URL filtering data. Which type of profile should be configured to forward these logs?

Question 70hardmultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

A network security engineer is configuring a Palo Alto Networks firewall to integrate with a SASE solution using GlobalProtect. The requirement is to ensure that traffic from remote users is inspected by the firewall's security profiles before being forwarded to the internet. The engineer has configured a GlobalProtect portal and gateway, and users can connect. However, traffic from remote users is not being inspected by security profiles. What is the most likely missing configuration?

Question 71hardmultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

A network engineer is troubleshooting a Palo Alto Networks firewall where a decryption policy is not decrypting traffic as expected. The policy is configured to decrypt traffic to a specific web server, but the traffic passes through encrypted. Which step should be taken first to diagnose the issue?

Question 72mediummultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

A network security engineer is configuring a Palo Alto Networks firewall to protect against a specific threat: a malicious PDF file being downloaded from a web server. The engineer wants to block the download and log the event. Which security profile should be configured to detect and block the malicious PDF?

Question 73mediummultiple choice

Read the full DNS explanation →

An administrator manages a Palo Alto Networks firewall and needs to ensure that the firewall can resolve domain names for its own services, such as for updating dynamic content and resolving FQDN objects in security policies. The administrator has configured DNS servers on the management interface. However, FQDN objects in security policies are not being resolved correctly. What is the most likely cause?

Question 74hardmultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

An administrator is configuring a Palo Alto Networks firewall to integrate with a SASE solution using Prisma Access. They need to ensure that traffic from branch offices is securely forwarded to Prisma Access for inspection. Which component should be configured on the branch office firewall to achieve this?

Question 75easymultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

An administrator needs to configure a Palo Alto Networks firewall to perform dynamic updates for applications and threats. The firewall has a valid support license and internet connectivity on the management interface. However, the administrator wants to schedule the updates to occur automatically at a specific time. Which configuration tab in the web interface should the administrator use to set up the update schedule?

Question 76hardmultiple choice

An administrator is troubleshooting a Prisma Access remote network deployment where branch users are unable to access the internet through Prisma Access. The remote network firewall shows the IPsec tunnel to Prisma Access is up, and the service connection to the data center is also up. Branch users can access internal resources at the data center but not the internet. Which configuration issue is most likely causing this problem?

Question 77mediummultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

An administrator is managing a Prisma Access deployment and needs to ensure that remote users can access a specific internal web application hosted on a server with IP address 10.1.1.100. The administrator has configured a service connection and wants to verify that traffic is being routed correctly. Which action should the administrator take to confirm that the service connection is operational?

Question 78hardmultiple choice

A NetSec-Pro administrator is configuring a SASE solution with Prisma Access and needs to enforce data loss prevention (DLP) policies for remote users accessing SaaS applications. The administrator wants to ensure that sensitive data is not uploaded to unsanctioned SaaS applications. Which configuration should be applied?

Question 1hardmultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

A company requires that traffic from the VPN zone to the Untrust zone undergoes source NAT using a specific interface IP. Which configuration step is mandatory to ensure this traffic is correctly matched?

Question 2easymultiple choice

Which type of interface is used to connect to a switch in a Layer 2 configuration where the firewall acts as a transparent bridge?

Question 3hardmultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

An administrator notices high memory utilization. What is the most effective way to identify which processes are consuming the most resources on the control plane?

Question 4mediummultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

Which feature allows you to monitor traffic patterns and generate security policy recommendations?

Question 5easymulti select

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

Which of the following are examples of Interface Management Profile services? (Choose TWO)

Question 6hardmulti select

Which three components must be configured to enable GlobalProtect Clientless VPN? (Choose THREE)

Question 7mediummulti select

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

Which three items must be configured to successfully implement a Source NAT rule? (Choose THREE)

Question 8mediummulti select

Which three settings are part of a Zone Protection Profile? (Choose THREE)

Question 9hardmulti select

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

Which three items can be used as match criteria in a Security Policy rule? (Choose THREE)

Question 10mediummultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

An administrator needs to ensure that internal users can access a public web server using its public IP address even when they are physically inside the internal network. Which NAT type and configuration approach should be used?

Question 11hardmultiple choice

An application is failing to function correctly even though the Security policy allows the traffic. The App-ID is showing as 'incomplete'. What is the most likely cause?

Question 12mediummultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

An administrator observes that dynamic updates for App-ID and Threat signatures are failing. Which troubleshooting step should be performed first?

Question 13hardmultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

You are migrating a physical firewall to a SASE (Prisma Access) environment. Which component is responsible for managing the security policies in the SASE model?

Question 14hardmulti select

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

Which THREE criteria must be satisfied for a traffic session to match a specific NAT rule?

Question 15hardmultiple choice

A NetSec-Pro administrator is configuring a Palo Alto Networks NGFW to enforce Security Policy on outbound traffic. Users are assigned to the 'Engineering' zone and connect through an internal Layer 3 interface. The administrator wants to decouple policy from physical topology so that rules can be reused across multiple sites as the organization adopts SASE. Which configuration object should be used as the source match criterion in the Security Policy rule to achieve this?

Question 16easymultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

A network administrator is configuring a NetSec-Pro firewall to act as a Layer 2 transparent bridge between two switches. Which interface type should be used for the connection to each switch?

Question 17hardmultiple choice

A company uses Palo Alto Networks firewalls with GlobalProtect. Remote users report that they can access internal web applications but cannot reach internal servers via RDP. The GlobalProtect gateway is configured with split tunneling. Which configuration should be checked to ensure RDP traffic is routed through the tunnel?

Question 18hardmultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

A network security engineer is configuring a Prisma Access remote network deployment. The engineer needs to ensure that traffic from a branch office to the internet is inspected by Prisma Access while traffic to internal corporate applications is routed through an IPsec tunnel to the headquarters data center. The engineer has already configured the remote network and the service connection. Which additional configuration is required to achieve this traffic steering?

Question 19mediummultiple choice

An administrator is configuring a Palo Alto Networks next-generation firewall to act as a Secure Web Gateway for outbound user traffic. The requirement is to decrypt HTTPS traffic, enforce URL filtering, and then re-encrypt the traffic before it leaves the firewall. However, after enabling SSL Forward Proxy decryption, users report that HTTPS sites show certificate warnings in their browsers. The administrator has already installed the forward trust certificate on the firewall and exported the forward untrust certificate. What is the most likely cause of the certificate warnings?

Question 20mediummultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

A network security engineer is configuring a Palo Alto Networks next-generation firewall to inspect outbound web traffic. The requirement is to decrypt and inspect traffic that uses TLS 1.3, but the firewall is currently only decrypting TLS 1.2. What must be configured to enable TLS 1.3 decryption?

Question 21hardmulti select

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

An administrator is configuring a NetSec-Pro firewall's Security Policy rule to match traffic for a specific application. Which two items can be used as match criteria in a Security Policy rule? (Choose two.)

Question 22mediummulti select

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

An administrator is configuring a Prisma Access mobile users deployment and needs to ensure that the GlobalProtect app on endpoints can connect to the Prisma Access gateways. The administrator has already configured the GlobalProtect portal and gateway in Prisma Access. Which two additional configurations are required for successful mobile user connectivity? (Choose two.)

Question 23mediummultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

An administrator is configuring a Prisma Access deployment that uses a service connection to provide access to internal applications. The administrator wants to ensure that traffic from remote users to the internal applications is inspected by the same security policies that apply to internet-bound traffic. Which configuration should be used?

Question 24hardmultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

A NetSec-Pro administrator is configuring a SASE solution with Prisma Access and needs to ensure that remote users' traffic to sanctioned SaaS applications is optimized for performance. The administrator wants to leverage cloud-based security inspection while minimizing latency. Which feature should be enabled?

Question 25mediummulti select

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

A NetSec-Pro administrator is configuring a Prisma Access mobile users deployment and needs to ensure that the GlobalProtect app on endpoints can connect to the Prisma Access infrastructure. The administrator must configure the portal and gateway settings. Which two actions are required to enable this connectivity? (Choose two.)

Question 26mediummultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

You are troubleshooting an application that is being blocked despite having an Allow security policy. You observe in the Traffic Log that the App-ID is identified as 'incomplete'. What is the most likely cause?

Question 27hardmultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

Which feature allows an administrator to prevent unauthorized users from using a stolen credential by requiring a second form of authentication?

Question 28easymultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

An administrator needs to ensure that internal users can reach the internet while hiding their private IP addresses. Which NAT type should be configured on the egress interface?

Question 29mediummultiple choice

You have configured a custom application object for a proprietary internal tool. When you attempt to use this object in a Security Policy, traffic is still being denied. What is a common configuration error?

Question 30mediummultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

You want to perform a configuration backup and store it on an external server using SCP. Which menu path contains the configuration for scheduled exports?

Question 31easymultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

Where do you navigate in PAN-OS to update the App-ID and Threat signatures to the latest versions?

Question 32easymultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

When configuring a virtual wire (VWire) interface, which setting is required to pass traffic between the two physical ports?

Question 33hardmultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

A security policy with a 'Log at Session End' setting is missing log entries for long-lived sessions. Why might this happen?

Question 34easymultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

When adding a new Security Policy rule, what is the default position for the rule if you do not specify 'Top' or 'Bottom'?

Question 35mediummultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

You need to allow traffic based on user group membership. Which feature must be configured to map users to their group information?

Question 36hardmultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

An administrator is unable to download content updates. The firewall has valid internet access, but the management interface has no route to the update server. What is the best solution?

Question 37mediummultiple choice

You want to block a specific URL category for all users except for the 'HR' department. How should the security policy be structured?

Question 38easymultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

Which action in a Security Policy rule will cause the firewall to send a TCP Reset to the client and server?

Question 39mediummultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

What is the purpose of the 'Zone Protection Profile'?

Question 40easymultiple choice

Which object type is used to group multiple IP addresses or subnets for use in a security policy?

Question 41hardmultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

An administrator needs to restrict administrative access to the firewall from only one specific subnet. Where should this be configured?

Question 42mediummultiple choice

If a packet matches a Security Policy rule, but the application is not explicitly defined in the rule, what happens to the traffic?

Question 43hardmultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

What is the primary difference between a 'Pre-rule' and a 'Post-rule' in a Panorama-managed environment?

Question 44easymultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

What is the first step in the packet processing flow when a packet arrives at the firewall?

Question 45hardmultiple choice

Read the full DHCP explanation →

When configuring an interface for DHCP client, where do you set the default gateway?

Question 46mediummultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

What is the benefit of using an 'Aggregate Interface'?

Question 47easymultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

Which command is used to restart the management server process on the firewall without impacting traffic flow?

Question 48mediummulti select

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

Which three actions can be taken when a match occurs in a Security Policy rule? (Choose THREE)

Question 49hardmultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

An administrator needs to prevent a specific file type (e.g., .exe) from being downloaded. Which profile is used?

Question 50easymulti select

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

Which of the following are valid methods for performing an initial configuration of a Palo Alto Networks NGFW? (Choose TWO)

Question 51hardmulti select

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

Which three types of logs can be generated by a PAN-OS firewall? (Choose THREE)

Question 52easymulti select

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

Which of the following are types of Dynamic Updates? (Choose TWO)

Question 53easymultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

When configuring a zone, what is the primary security benefit of selecting 'Enable User Identification'?

Question 54easymultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

Which action should be taken after performing a firmware upgrade on a Palo Alto Networks firewall to ensure all components are up to date?

Question 55mediummultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

An administrator needs to create a backup of the current configuration. Which file type is recommended for an off-box manual restore?

Question 56mediummulti select

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

Which TWO of the following are required to successfully implement an App-ID based Security policy?

Question 57easymulti select

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

Which TWO methods can be used to manage administrator access to a Palo Alto Networks firewall?

Question 58mediummultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

An engineer is configuring a SASE solution to provide secure web access for remote users. The organization wants to enforce different security policies based on user group membership. Which component of the SASE solution is responsible for applying security policies to web traffic?

Question 59hardmultiple choice

A network administrator is troubleshooting a Prisma Access deployment where remote users are unable to access internal applications. The administrator suspects that the issue is related to the service connection configuration. Which component is responsible for routing traffic between Prisma Access and the corporate network?

Question 60mediummultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

An administrator needs to enable NetSec-Pro Clientless VPN for remote users. The portal is configured with a valid certificate and authentication profile. Users report that the portal loads, but no internal web applications are accessible. Which additional component must be configured to allow access to internal web applications?

Question 61mediummultiple choice

A network security engineer is configuring a Palo Alto Networks firewall to decrypt outbound HTTPS traffic for inspection. The engineer wants to avoid decrypting traffic to financial institutions and healthcare sites for privacy compliance. Which firewall feature should be used to selectively bypass decryption for these categories?

Question 62mediummultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

An administrator is configuring a SASE deployment with Prisma Access and needs to ensure that remote users' traffic to sanctioned SaaS applications is inspected by the NGFW security stack while traffic to unsanctioned applications is blocked. The administrator has already configured the Prisma Access mobile users globalprotect infrastructure and added the SaaS applications to the SaaS application list. Which component must be configured next to enforce this policy for remote users?

Question 63hardmultiple choice

Study the full SD-WAN breakdown →

A NetSec-Pro administrator is troubleshooting a SASE deployment where remote users report slow access to SaaS applications. The administrator suspects that traffic is being backhauled to the data center instead of going directly to the internet. The organization uses a SASE solution with a cloud secure web gateway (SWG) and SD-WAN. Which action should the administrator take to ensure that SaaS traffic is routed directly to the internet while still being inspected by the SWG?

Question 64hardmultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

An administrator is troubleshooting a NetSec-Pro firewall where dynamic updates for App-ID and Threat signatures are failing. The firewall has valid internet access, and the management interface has a default route. Which action should be taken next to resolve the issue?

Question 65easymultiple choice

A NetSec-Pro administrator needs to configure a new security policy rule on a next-generation firewall to allow HTTP traffic from the trust zone to the untrust zone. The administrator wants to ensure that the rule is placed at the top of the rulebase so that it is evaluated before any other rules. Which action should the administrator take when creating the rule?

Question 66mediummultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

An administrator is configuring a NetSec-Pro firewall to prevent users from downloading executable files (.exe) from the internet. Which profile should be applied to the Security Policy rule to block this file type?

Question 67mediummulti select

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

An administrator is configuring a SASE solution with Palo Alto Networks Prisma Access. The goal is to ensure that traffic from remote users to SaaS applications is inspected for threats while optimizing performance. Which two components are required to achieve this? (Choose two.)

Question 68easymultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

An administrator is configuring a SASE solution with Prisma Access and needs to ensure that all traffic from mobile users is inspected by the NGFW security stack, including traffic to the internet and to private applications. The administrator has already configured the GlobalProtect portal and gateway. Which additional component must be configured to allow mobile users to access private applications hosted in the data center?

Question 69easymultiple choice

Read the full network assurance explanation →

A security administrator needs to configure a Palo Alto Networks firewall to send logs to an external syslog server. The logs should include traffic, threat, and URL filtering data. Which type of profile should be configured to forward these logs?

Question 70hardmultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

A network security engineer is configuring a Palo Alto Networks firewall to integrate with a SASE solution using GlobalProtect. The requirement is to ensure that traffic from remote users is inspected by the firewall's security profiles before being forwarded to the internet. The engineer has configured a GlobalProtect portal and gateway, and users can connect. However, traffic from remote users is not being inspected by security profiles. What is the most likely missing configuration?

Question 71hardmultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

A network engineer is troubleshooting a Palo Alto Networks firewall where a decryption policy is not decrypting traffic as expected. The policy is configured to decrypt traffic to a specific web server, but the traffic passes through encrypted. Which step should be taken first to diagnose the issue?

Question 72mediummultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

A network security engineer is configuring a Palo Alto Networks firewall to protect against a specific threat: a malicious PDF file being downloaded from a web server. The engineer wants to block the download and log the event. Which security profile should be configured to detect and block the malicious PDF?

Question 73mediummultiple choice

Read the full DNS explanation →

An administrator manages a Palo Alto Networks firewall and needs to ensure that the firewall can resolve domain names for its own services, such as for updating dynamic content and resolving FQDN objects in security policies. The administrator has configured DNS servers on the management interface. However, FQDN objects in security policies are not being resolved correctly. What is the most likely cause?

Question 74hardmultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

An administrator is configuring a Palo Alto Networks firewall to integrate with a SASE solution using Prisma Access. They need to ensure that traffic from branch offices is securely forwarded to Prisma Access for inspection. Which component should be configured on the branch office firewall to achieve this?

Question 75easymultiple choice

Read the full NGFW And SASE Solution Maintenance And Configuration explanation →

An administrator needs to configure a Palo Alto Networks firewall to perform dynamic updates for applications and threats. The firewall has a valid support license and internet connectivity on the management interface. However, the administrator wants to schedule the updates to occur automatically at a specific time. Which configuration tab in the web interface should the administrator use to set up the update schedule?

Question 76hardmultiple choice

An administrator is troubleshooting a Prisma Access remote network deployment where branch users are unable to access the internet through Prisma Access. The remote network firewall shows the IPsec tunnel to Prisma Access is up, and the service connection to the data center is also up. Branch users can access internal resources at the data center but not the internet. Which configuration issue is most likely causing this problem?

Question 77mediummultiple choice