NetSec-Pro NGFW And SASE Solution Maintenance And Configuration Practice Test 2 — 15 Questions

Question 1

A network administrator is configuring a NetSec-Pro firewall to act as a Layer 2 transparent bridge between two switches. Which interface type should be used for the connection to each switch?

Accepted Answer

Layer 2 interface. In a Layer 2 transparent bridge configuration, the firewall uses Layer 2 interfaces to forward traffic without routing. These interfaces are assigned to a Layer 2 zone and can be paired in a virtual wire. The physical connection to each switch uses a Layer 2 interface, which allows the firewall to inspect traffic while remaining transparent at Layer 3.

Answer

Virtual wire interface

Answer

Loopback interface

Answer

Layer 3 interface

Question 2

A company uses Palo Alto Networks firewalls with GlobalProtect. Remote users report that they can access internal web applications but cannot reach internal servers via RDP. The GlobalProtect gateway is configured with split tunneling. Which configuration should be checked to ensure RDP traffic is routed through the tunnel?

Accepted Answer

GlobalProtect gateway: split tunnel application settings. In split tunnel mode, application-based split tunneling determines which applications are tunneled. If RDP is not listed, its traffic bypasses the tunnel. Since web applications work, the access routes are likely correct, but the application list may exclude RDP. Checking the gateway's split tunnel application settings and adding RDP ensures the traffic is tunneled.

Answer

GlobalProtect portal agent configuration: split tunnel access routes

Answer

GlobalProtect portal: client certificate authentication profile

Answer

Security policy rule allowing RDP from the VPN zone

Question 3

A network security engineer is configuring a Prisma Access remote network deployment. The engineer needs to ensure that traffic from a branch office to the internet is inspected by Prisma Access while traffic to internal corporate applications is routed through an IPsec tunnel to the headquarters data center. The engineer has already configured the remote network and the service connection. Which additional configuration is required to achieve this traffic steering?

Accepted Answer

Configure policy-based forwarding in the remote network to direct internet-bound traffic to the Prisma Access tunnel and corporate traffic to the headquarters tunnel.. In a Prisma Access remote network deployment, policy-based forwarding on the remote network firewall is used to steer traffic. Internet-bound traffic can be directed to the Prisma Access tunnel for inspection, while corporate traffic can be sent over a separate IPsec tunnel to headquarters. This provides the necessary split-tunnel behavior. The other options do not correctly address traffic steering for the branch office.

Answer

Configure a service connection in Prisma Access that includes the headquarters data center as a remote network.

Answer

Configure a static route in the remote network's virtual router that points to the Prisma Access service IP for internet-bound traffic.

Answer

Configure a GlobalProtect portal and gateway for the branch office users to connect to Prisma Access.

Question 4

An administrator is configuring a Palo Alto Networks next-generation firewall to act as a Secure Web Gateway for outbound user traffic. The requirement is to decrypt HTTPS traffic, enforce URL filtering, and then re-encrypt the traffic before it leaves the firewall. However, after enabling SSL Forward Proxy decryption, users report that HTTPS sites show certificate warnings in their browsers. The administrator has already installed the forward trust certificate on the firewall and exported the forward untrust certificate. What is the most likely cause of the certificate warnings?

Accepted Answer

The forward trust certificate has not been installed on the client browsers as a trusted root CA.. SSL Forward Proxy decryption requires the firewall to present a certificate signed by the forward trust certificate to clients. If clients do not trust that certificate as a root CA, they will display warnings. The forward untrust certificate is for the firewall's trust of external servers, and management certificates are unrelated. Therefore, installing the forward trust certificate on client systems is the correct fix.

Answer

The firewall's management interface certificate has expired, causing browsers to distrust all connections through the firewall.

Answer

The SSL decryption policy is not matching the traffic, so the firewall is not decrypting and clients see the original server certificates.

Answer

The forward untrust certificate has not been installed on the client browsers as a trusted root CA.

Question 5

A network security engineer is configuring a Palo Alto Networks next-generation firewall to inspect outbound web traffic. The requirement is to decrypt and inspect traffic that uses TLS 1.3, but the firewall is currently only decrypting TLS 1.2. What must be configured to enable TLS 1.3 decryption?

Accepted Answer

Enable TLS 1.3 support in the SSL Decryption profile and assign it to the decryption policy rule.. To decrypt TLS 1.3 traffic, the firewall must be running PAN-OS 10.0 or later, and the SSL Decryption profile must have TLS 1.3 enabled. This setting allows the firewall to negotiate and decrypt TLS 1.3 sessions. Once enabled, the decryption policy rule with the appropriate profile will inspect the traffic. Other options are either incorrect or insufficient because they do not address the profile configuration required to enable TLS 1.3 decryption.

Answer

Configure a decryption policy rule with the action 'no-decrypt' for TLS 1.3 traffic.

Answer

Upgrade the firewall to PAN-OS 9.1, which introduced TLS 1.3 decryption support.

Answer

Import a forward trust certificate that supports TLS 1.3 and apply it to the decryption policy.

Question 6

An administrator is configuring a NetSec-Pro firewall's Security Policy rule to match traffic for a specific application. Which two items can be used as match criteria in a Security Policy rule? (Choose two.)

Accepted Answer

Source zone. Security Policy rules can match on several criteria, including source zone, destination zone, source address, destination address, application, user, and service. Source zone and application are two fundamental match criteria that are directly used in the rule definition. They allow granular control over traffic based on where it comes from and what application it is.

Answer

URL category

Answer

Source IP address

Answer

Destination port

Question 7

An administrator is configuring a Prisma Access mobile users deployment and needs to ensure that the GlobalProtect app on endpoints can connect to the Prisma Access gateways. The administrator has already configured the GlobalProtect portal and gateway in Prisma Access. Which two additional configurations are required for successful mobile user connectivity? (Choose two.)

Accepted Answer

Configure a security policy rule to allow traffic from the mobile users to the internet.. For mobile users to connect to Prisma Access, the GlobalProtect agent must be configured with the correct portal FQDN, and a security policy rule must allow traffic from mobile users. The FQDN directs the agent to the portal, and the security policy permits traffic flow. Other options like certificate authentication, service connections, or static routes are not required for basic connectivity.

Answer

Configure a service connection to allow access to private applications.

Answer

Configure the GlobalProtect portal to use a certificate for authentication.

Answer

Configure a static route on the Prisma Access gateway to the mobile user subnet.

Question 8

An administrator is configuring a Prisma Access deployment that uses a service connection to provide access to internal applications. The administrator wants to ensure that traffic from remote users to the internal applications is inspected by the same security policies that apply to internet-bound traffic. Which configuration should be used?

Accepted Answer

Enable 'Traffic Inspection' on the service connection and define security policies in Prisma Access.. Enabling traffic inspection on the service connection ensures that all traffic to internal applications is inspected by Prisma Access security policies. This allows the same policy set used for internet-bound traffic to be applied to internal traffic, providing consistent security enforcement. Without this setting, traffic may bypass inspection.

Answer

Configure a policy-based forwarding rule on the service connection to redirect traffic to a decryption profile.

Answer

Set up a VPN tunnel between the service connection and the mobile users to force traffic through the security policy.

Answer

Configure a static route on the service connection to direct internal traffic to the internet gateway.

Question 9

A NetSec-Pro administrator is configuring a SASE solution with Prisma Access and needs to ensure that remote users' traffic to sanctioned SaaS applications is optimized for performance. The administrator wants to leverage cloud-based security inspection while minimizing latency. Which feature should be enabled?

Accepted Answer

Configure 'SaaS Application Optimization' with optimal routing to the nearest Prisma Access location.. SaaS Application Optimization in Prisma Access uses optimal routing to direct traffic to the nearest Prisma Access location, reducing latency and improving performance for sanctioned SaaS applications. This feature ensures that traffic is inspected in the cloud without backhauling, providing both security and performance benefits.

Answer

Enable Prisma Access Cloud-Delivered Security Services for SaaS application optimization.

Answer

Enable the 'App Acceleration' feature in Prisma Access for sanctioned SaaS applications.

Answer

Configure a service connection with BGP to route SaaS traffic through the corporate data center.

Question 10

A NetSec-Pro administrator is configuring a Prisma Access mobile users deployment and needs to ensure that the GlobalProtect app on endpoints can connect to the Prisma Access infrastructure. The administrator must configure the portal and gateway settings. Which two actions are required to enable this connectivity? (Choose two.)

Accepted Answer

Configure the portal to use a certificate signed by a trusted CA for authentication.. To enable GlobalProtect connectivity to Prisma Access, both the portal and gateway must have valid certificates signed by a trusted CA. These certificates are used for authentication and encryption, ensuring secure communication between endpoints and the Prisma Access infrastructure. Without them, the GlobalProtect app cannot establish a secure connection.

Answer

Set up a service connection to the corporate network.

Answer

Enable 'User-ID' on the portal to map users to IP addresses.

Answer

Enable 'Split Tunneling' to allow direct internet access.

Question 11

You are troubleshooting an application that is being blocked despite having an Allow security policy. You observe in the Traffic Log that the App-ID is identified as 'incomplete'. What is the most likely cause?

Accepted Answer

The client sent a SYN packet but the server did not respond.. The 'incomplete' App-ID usually signifies that the TCP three-way handshake did not complete, or the application traffic ceased before it could be identified.

Answer

The Security Policy is missing a Decryption Profile.

Answer

The App-ID database is outdated.

Answer

The application is using a custom port not defined in the Service object.

Question 12

Which feature allows an administrator to prevent unauthorized users from using a stolen credential by requiring a second form of authentication?

Accepted Answer

MFA Profile. Multi-Factor Authentication (MFA) profiles are integrated into the Authentication Policy to enforce secondary verification.

Answer

Authentication Portal

Answer

Credential Protection Profile

Answer

GlobalProtect Authentication Override

Question 13

An administrator needs to ensure that internal users can reach the internet while hiding their private IP addresses. Which NAT type should be configured on the egress interface?

Accepted Answer

Source NAT. Source NAT (SNAT) is correct because it translates the source IP address of outbound packets to a public IP address, allowing internal users with private IPs to access the internet while hiding their private addresses. This is the standard NAT type used for masquerading internal networks behind a single public IP or pool. It is typically implemented on the egress interface of a router or firewall, and is also known as IP masquerading or NAT overload (PAT).

Answer

Static NAT

Answer

Double NAT

Answer

Destination NAT

Question 14

You have configured a custom application object for a proprietary internal tool. When you attempt to use this object in a Security Policy, traffic is still being denied. What is a common configuration error?

Accepted Answer

The application signature does not match the traffic's port or pattern.. When creating a custom application object, the signature must correctly match the traffic's port and pattern. If the signature does not match the actual traffic characteristics (e.g., wrong port, incorrect pattern matching, or missing context), the firewall will not identify the application as the custom App-ID, and the Security Policy referencing that App-ID will not match, resulting in a deny.

Answer

The application must be assigned to the 'web' category.

Answer

The App-ID must be added to a service group.

Answer

The application requires an SSL decryption policy first.

Question 15

You want to perform a configuration backup and store it on an external server using SCP. Which menu path contains the configuration for scheduled exports?

Accepted Answer

Device > Setup > Operations. Device > Setup > Operations allows you to configure 'Scheduled Configuration Export'.

Answer

Network > GlobalProtect

Answer

Objects > External Dynamic Lists

Answer

Device > Software