NetSec-Pro NGFW And SASE Solution Maintenance And Configuration Practice Test 1 — 15 Questions

Question 1

A company requires that traffic from the VPN zone to the Untrust zone undergoes source NAT using a specific interface IP. Which configuration step is mandatory to ensure this traffic is correctly matched?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Select the specific source zone and destination zone in the NAT rule.. The source NAT rule must explicitly match the source zone and destination zone of the traffic, along with the source interface if specified.

Answer

Disable 'Address Translation' in the NAT rule.

Answer

Enable 'Proxy ARP' on the egress interface.

Answer

Configure a policy-based forwarding rule instead of NAT.

Question 2

Which type of interface is used to connect to a switch in a Layer 2 configuration where the firewall acts as a transparent bridge?

Accepted Answer

Layer 2 interface. Layer 2 interfaces are designed for transparent switching and do not require IP addresses for traffic processing.

Answer

Virtual Wire interface

Answer

Aggregate interface

Answer

Layer 3 interface

Question 3

An administrator notices high memory utilization. What is the most effective way to identify which processes are consuming the most resources on the control plane?

Accepted Answer

Use 'show system resources' in the CLI.. The CLI command 'show system resources' displays real-time CPU, memory, and process-level utilization on the management plane, including top processes by resource consumption. It is the fastest and most direct way to identify which processes are consuming the most memory on the control plane. This is the standard PAN-OS troubleshooting command for resource exhaustion.

Answer

Check the App-ID cache in the GUI.

Answer

Navigate to Device > Support > Logs.

Answer

Perform a packet capture on the management interface.

Question 4

Which feature allows you to monitor traffic patterns and generate security policy recommendations?

Accepted Answer

Policy Optimizer. Policy Optimizer in PAN-OS analyzes traffic logs and existing security policies to identify unused, overly permissive, or redundant rules, and generates recommendations to tighten policies — such as converting port-based rules to App-ID-based rules or removing unused rules. It provides visibility into rule usage and helps migrate from legacy port-based policies to application-based policies.

Answer

App-ID Lifecycle

Answer

Threat Intelligence Cloud

Answer

Traffic Profiler

Question 5

Which of the following are examples of Interface Management Profile services? (Choose TWO)

Accepted Answer

SSH. Management Profiles allow you to enable services like Ping, SSH, and HTTPS on an interface.

Answer

BGP

Answer

FTP

Answer

DHCP

Question 6

Which three components must be configured to enable GlobalProtect Clientless VPN? (Choose THREE)

Accepted Answer

SSL/TLS Service Profile. Option B (SSL/TLS Service Profile) is correct because Clientless VPN relies on the GlobalProtect portal/gateway HTTPS listener, which must reference an SSL/TLS Service Profile that defines the server certificate and the minimum/maximum TLS protocol versions for the web-based session. Option D (GlobalProtect Portal) is correct because the portal is where Clientless VPN is enabled and where the clientless apps (web applications, SaaS, and terminal/SSH/RDP services) are defined and presented to users. Option E (GlobalProtect Gateway) is correct because the gateway terminates the Clientless VPN traffic and enforces the security policy, and it must be configured with the SSL/TLS profile and the clientless access settings that the portal references. Option A (Static NAT Rule) is not required, since Clientless VPN is an application-layer HTTPS service that does not mandate static source/destination NAT to function. Option C (RADIUS Server) is not required, because authentication can be satisfied by local, LDAP, SAML, Kerberos, or other supported authentication profiles; RADIUS is only one optional method.

Answer

Static NAT Rule

Answer

RADIUS Server

Question 7

Which three items must be configured to successfully implement a Source NAT rule? (Choose THREE)

Accepted Answer

Translated Address. To implement a Source NAT rule, you must define the Translated Address (B), which specifies the IP address (or address pool) that the original source IP will be rewritten to, and you must specify the Source Zone (D) to match the traffic originating from that zone, as well as the Destination Zone (E) to match the traffic leaving toward that zone; these three elements are the core match and translation parameters of a NAT policy. A Security Policy Rule (A) is needed to permit the translated traffic, but it is not a required configuration item within the NAT rule itself, and a Decryption Profile (C) is unrelated to NAT and applies to SSL/TLS decryption policies, so neither belongs to the three required NAT rule components.

Answer

Security Policy Rule

Answer

Decryption Profile

Question 8

Which three settings are part of a Zone Protection Profile? (Choose THREE)

Accepted Answer

Flood Protection. Zone Protection includes DoS protection, reconnaissance protection, and packet-based attack protection.

Answer

User-ID Mapping

Answer

Decryption Policy

Question 9

Which three items can be used as match criteria in a Security Policy rule? (Choose THREE)

Accepted Answer

Application. Security policies can match on Source/Destination zones, Users, Applications, and Services.

Answer

Hardware Serial Number

Answer

VLAN ID

Question 10

An administrator needs to ensure that internal users can access a public web server using its public IP address even when they are physically inside the internal network. Which NAT type and configuration approach should be used?

Accepted Answer

Configure a Destination NAT rule with the internal zone as both the source and destination zone.. Destination NAT (DNAT) with the internal zone as both source and destination zone enables hairpin/U-turn NAT, allowing internal clients to reach a public IP that is mapped to an internal server. When the source and destination zones are both internal, the firewall performs the translation and routes the traffic back into the same zone, so the internal user's session to the public IP is rewritten to the server's private IP. This is the standard PAN-OS approach for internal-to-public-IP access to an internal resource.

Answer

Create a static NAT rule with a translation type of 'Bidirectional' in the Source NAT tab.

Answer

Enable 'DNS Sinkhole' on the Security policy to map the public IP to the private IP internally.

Answer

Enable 'Proxy ARP' on the external interface for the public IP address.

Question 11

An application is failing to function correctly even though the Security policy allows the traffic. The App-ID is showing as 'incomplete'. What is the most likely cause?

Accepted Answer

The client sent a SYN packet but closed the connection before sending application-specific data.. An 'incomplete' App-ID usually signifies that the TCP 3-way handshake occurred, but no further data was sent, or the data was malformed, preventing the firewall from identifying the application signature.

Answer

The Security policy rule uses an App-ID group that does not include 'unknown-tcp'.

Answer

The traffic was dropped due to a mismatched TCP sequence number in the session.

Answer

The application is performing an encrypted handshake that the firewall cannot inspect without a Decryption policy.

Question 12

An administrator observes that dynamic updates for App-ID and Threat signatures are failing. Which troubleshooting step should be performed first?

Accepted Answer

Check the 'Device > Licenses' page to ensure the 'Threat Prevention' or 'PAN-DB' subscription is active.. The firewall requires a valid support license and connectivity to the Palo Alto Networks update servers (updates.paloaltonetworks.com).

Answer

Restart the management plane process using the 'debug software restart process management-plane' command.

Answer

Rebuild the configuration database using 'request system reset-config'.

Answer

Increase the timeout value in the 'Device > Setup > Management' tab.

Question 13

You are migrating a physical firewall to a SASE (Prisma Access) environment. Which component is responsible for managing the security policies in the SASE model?

Accepted Answer

Panorama.. In the SASE/Prisma Access model, Panorama is used as the centralized management plane to push configurations to the cloud-delivered firewalls.

Answer

The local WebUI of the Prisma Access compute node.

Answer

The Cloud Service Plugin.

Answer

The Cloud Identity Engine.

Question 14

Which THREE criteria must be satisfied for a traffic session to match a specific NAT rule?

Accepted Answer

Destination Zone. In Palo Alto Networks PAN-OS, a NAT rule's matching criteria are evaluated on the original (pre-NAT) packet header and consist of Source Zone, Destination Zone, Destination Interface, Source Address, Destination Address, and Service. Option B (Destination Zone) is correct because the rule must specify the zone of the original destination IP, and NAT is applied only when the incoming packet's destination zone matches. Option D (Destination Interface) is correct because the rule must reference the ingress interface of the original packet, and the session matches only if the traffic arrives on that interface. Option E (Source Zone) is correct because the rule must specify the zone from which the original packet originates, and the session matches only when the source zone of the incoming traffic equals it. Options A (Security Profile) and C (App-ID) are not part of NAT rule matching: App-ID is determined by Security policy and content inspection, and Security Profiles are attached to Security rules for threat/prevention scanning, not to NAT rules.

Answer

Security Profile

Answer

App-ID

Question 15

A NetSec-Pro administrator is configuring a Palo Alto Networks NGFW to enforce Security Policy on outbound traffic. Users are assigned to the 'Engineering' zone and connect through an internal Layer 3 interface. The administrator wants to decouple policy from physical topology so that rules can be reused across multiple sites as the organization adopts SASE. Which configuration object should be used as the source match criterion in the Security Policy rule to achieve this?

Accepted Answer

A source User-ID group object named 'Engineering'. Matching on a User-ID group makes the Security Policy rule follow the authenticated user rather than the interface or subnet, so the same rule can be applied at any site without redesigning zones or address objects. This supports the SASE goal of consistent, identity-based policy that is independent of physical topology and reduces rule duplication.

Answer

A source Device-ID object named 'Engineering-Device'

Answer

A source IP address object named 'Engineering-Subnet'

Answer

A source Zone object named 'Engineering'