NetSec-Pro NGFW And SASE Solution Maintenance And Configuration Practice Test 5 — 15 Questions

Question 1

A network security engineer is configuring a Palo Alto Networks firewall to decrypt outbound HTTPS traffic for inspection. The engineer wants to avoid decrypting traffic to financial institutions and healthcare sites for privacy compliance. Which firewall feature should be used to selectively bypass decryption for these categories?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Decryption policy with a 'no-decrypt' action based on URL Category. A decryption policy with a 'no-decrypt' action based on URL Category allows the firewall to selectively bypass decryption for specific categories, such as financial services and healthcare. This satisfies privacy compliance while still decrypting other traffic for security inspection. The other options either do not bypass decryption or are unrelated to the requirement.

Answer

Application Override policy for financial and healthcare applications

Answer

SSL Forward Proxy with a custom certificate for each category

Answer

URL Filtering profile with a 'block' action for those categories

Question 2

An administrator is configuring a SASE deployment with Prisma Access and needs to ensure that remote users' traffic to sanctioned SaaS applications is inspected by the NGFW security stack while traffic to unsanctioned applications is blocked. The administrator has already configured the Prisma Access mobile users globalprotect infrastructure and added the SaaS applications to the SaaS application list. Which component must be configured next to enforce this policy for remote users?

Accepted Answer

A SaaS Security policy rule that references the SaaS application list and specifies the action for sanctioned and unsanctioned applications. SaaS Security policy in Prisma Access is designed to control access to SaaS applications using the SaaS application list. It allows administrators to define actions for sanctioned and unsanctioned applications, ensuring that remote users' traffic is handled according to policy. The other options either do not use the SaaS application list or serve different purposes such as decryption or URL categorization.

Answer

A URL Filtering profile attached to the Security policy rule that categorizes the SaaS applications

Answer

A Security policy rule with the SaaS application as the destination and an action of allow or deny

Answer

A Decryption policy rule that decrypts traffic to the SaaS applications so that App-ID can identify them

Question 3

A NetSec-Pro administrator is troubleshooting a SASE deployment where remote users report slow access to SaaS applications. The administrator suspects that traffic is being backhauled to the data center instead of going directly to the internet. The organization uses a SASE solution with a cloud secure web gateway (SWG) and SD-WAN. Which action should the administrator take to ensure that SaaS traffic is routed directly to the internet while still being inspected by the SWG?

Accepted Answer

Enable local internet breakout with cloud SWG integration in the SASE management console.. To reduce latency and avoid backhauling, SaaS traffic should break out locally at the branch while still being inspected by the cloud SWG. Enabling local internet breakout with cloud SWG integration in the SASE management console achieves this by directing traffic directly to the internet and transparently steering it to the SWG for security inspection. This combines performance optimization with consistent security enforcement.

Answer

Configure a policy-based forwarding rule to send SaaS traffic to the local internet breakout.

Answer

Apply an application override policy to force SaaS traffic through the data center proxy.

Answer

Create a static route for SaaS IP ranges pointing to the data center VPN tunnel.

Question 4

An administrator is troubleshooting a NetSec-Pro firewall where dynamic updates for App-ID and Threat signatures are failing. The firewall has valid internet access, and the management interface has a default route. Which action should be taken next to resolve the issue?

Accepted Answer

Verify that the firewall can resolve the update server's DNS name.. Dynamic update failures often stem from DNS resolution issues, even when general internet access works. The firewall must resolve the update server's hostname to connect. Verifying DNS resolution is a targeted troubleshooting step that can quickly identify the problem. Other actions like checking licenses or rebooting are less specific to the symptom.

Answer

Increase the management interface's MTU to 9000.

Answer

Reboot the firewall to clear any temporary glitches.

Answer

Check the license status to ensure the support contract is active.

Question 5

A NetSec-Pro administrator needs to configure a new security policy rule on a next-generation firewall to allow HTTP traffic from the trust zone to the untrust zone. The administrator wants to ensure that the rule is placed at the top of the rulebase so that it is evaluated before any other rules. Which action should the administrator take when creating the rule?

Accepted Answer

Select 'Add rule to top' in the rule creation dialog.. When creating a security policy rule, the administrator can choose to add it to the top of the rulebase. This ensures the rule is evaluated first, which is critical when the rule must take precedence over existing rules. Selecting 'Add rule to top' is the direct and correct method to achieve this without manual reordering.

Answer

Select 'Add rule to bottom' in the rule creation dialog.

Answer

Create the rule with any position and then use a policy optimizer to reorder rules.

Answer

Leave the default position and manually drag the rule to the top after creation.

Question 6

An administrator is configuring a NetSec-Pro firewall to prevent users from downloading executable files (.exe) from the internet. Which profile should be applied to the Security Policy rule to block this file type?

Accepted Answer

File Blocking profile. File Blocking profiles are used to block specific file types based on extension or magic bytes. To prevent .exe downloads, the administrator should configure a File Blocking profile with the executable file type set to block, and apply it to the Security Policy rule. Other profiles like Antivirus or Vulnerability Protection do not block by file type.

Answer

Vulnerability Protection profile

Answer

URL Filtering profile

Answer

Antivirus profile

Question 7

An administrator is configuring a SASE solution with Palo Alto Networks Prisma Access. The goal is to ensure that traffic from remote users to SaaS applications is inspected for threats while optimizing performance. Which two components are required to achieve this? (Choose two.)

Accepted Answer

Prisma Access security processing node (SPN) in the closest region. To secure remote user traffic to SaaS applications with Prisma Access, a GlobalProtect app on user devices establishes the connection, and a Security Processing Node (SPN) in the closest region performs security inspection and optimizes routing. These two components are essential for SASE security and performance.

Answer

A dedicated VPN concentrator in the data center

Answer

Explicit proxy configuration on the remote user's device

Answer

SD-WAN devices at branch offices

Question 8

An administrator is configuring a SASE solution with Prisma Access and needs to ensure that all traffic from mobile users is inspected by the NGFW security stack, including traffic to the internet and to private applications. The administrator has already configured the GlobalProtect portal and gateway. Which additional component must be configured to allow mobile users to access private applications hosted in the data center?

Accepted Answer

A service connection to the data center. To allow mobile users to access private applications hosted in a data center, a service connection must be configured in Prisma Access. The service connection creates an IPsec tunnel between Prisma Access and the data center, enabling traffic from mobile users to reach private applications. Other options like remote network connections, split tunneling, or decryption do not provide the necessary connectivity.

Answer

A GlobalProtect app configuration with split tunneling enabled

Answer

A remote network connection to the data center

Answer

A Decryption policy rule for private applications

Question 9

A security administrator needs to configure a Palo Alto Networks firewall to send logs to an external syslog server. The logs should include traffic, threat, and URL filtering data. Which type of profile should be configured to forward these logs?

Accepted Answer

Log Forwarding Profile. A Log Forwarding Profile is used to specify which logs are forwarded to external syslog servers. It matches on log types and attributes and references server profiles that contain the syslog server details. This is the correct configuration object to meet the requirement.

Answer

Security Policy Rule

Answer

Syslog Profile

Answer

Server Profile

Question 10

A network security engineer is configuring a Palo Alto Networks firewall to decrypt outbound HTTPS traffic for inspection. The engineer wants to avoid decrypting traffic to financial institutions and healthcare sites for privacy compliance. Which firewall feature should be used to selectively bypass decryption for these categories?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The GlobalProtect gateway is not configured to route all client traffic through the tunnel (split tunnel is enabled).. For GlobalProtect to inspect all remote user traffic, the gateway must be configured to route all traffic through the tunnel. If split tunneling is enabled, internet-bound traffic bypasses the firewall. Security profiles on the policy rule are necessary but only effective if traffic traverses the firewall. Decryption and certificates are unrelated to the routing issue. Therefore, the missing configuration is the tunnel mode setting.

Answer

The GlobalProtect portal configuration does not include the correct client certificate for authentication.

Answer

The firewall's SSL decryption policy is not configured to decrypt traffic from GlobalProtect users.

Answer

The security policy rule allowing traffic from the GlobalProtect zone to the internet does not have security profiles attached.

Question 11

A network engineer is troubleshooting a Palo Alto Networks firewall where a decryption policy is not decrypting traffic as expected. The policy is configured to decrypt traffic to a specific web server, but the traffic passes through encrypted. Which step should be taken first to diagnose the issue?

Accepted Answer

Check the decryption policy rule order and ensure no preceding rule is matching with a no-decrypt action. Decryption policies are processed in order. A preceding no-decrypt rule can prevent a later decrypt rule from taking effect. Checking the rule order and actions is the first diagnostic step to ensure the intended decrypt rule is reached. Other factors like certificates are secondary.

Answer

Verify the forward trust certificate is installed and trusted by the client

Answer

Ensure the SSL Forward Proxy is enabled on the egress interface

Answer

Confirm that the server's certificate is signed by a trusted CA

Question 12

A network security engineer is configuring a Palo Alto Networks firewall to decrypt outbound HTTPS traffic for inspection. The engineer wants to avoid decrypting traffic to financial institutions and healthcare sites for privacy compliance. Which firewall feature should be used to selectively bypass decryption for these categories?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Antivirus profile. To detect and block a malicious PDF, the Antivirus profile is the correct choice because it scans files for malware using signatures. The profile can be configured to block the file and log the event. Other profiles like Anti-Spyware, Vulnerability Protection, or File Blocking do not perform file content scanning for malware, so they would not reliably block a malicious PDF.

Answer

Anti-Spyware profile

Answer

File Blocking profile

Answer

Vulnerability Protection profile

Question 13

An administrator manages a Palo Alto Networks firewall and needs to ensure that the firewall can resolve domain names for its own services, such as for updating dynamic content and resolving FQDN objects in security policies. The administrator has configured DNS servers on the management interface. However, FQDN objects in security policies are not being resolved correctly. What is the most likely cause?

Accepted Answer

The DNS servers configured on the management interface are incorrect or unreachable, preventing FQDN resolution.. FQDN objects in security policies are resolved by the management plane using the DNS servers configured in Device > Setup > Services > DNS. If those servers are incorrect or unreachable, resolution fails. The management interface's DNS settings are used for this purpose, and dataplane DNS proxy is not required. Thus, checking the DNS server configuration and reachability is the correct troubleshooting step.

Answer

The firewall is configured to use the management interface for DNS resolution, but the FQDN objects require a DNS proxy configured on a dataplane interface.

Answer

The FQDN objects are not supported in security policies; only IP addresses can be used.

Answer

The DNS servers configured on the management interface are not reachable from the dataplane.

Question 14

An administrator is configuring a Palo Alto Networks firewall to integrate with a SASE solution using Prisma Access. They need to ensure that traffic from branch offices is securely forwarded to Prisma Access for inspection. Which component should be configured on the branch office firewall to achieve this?

Accepted Answer

IPSec tunnel to Prisma Access service connection. To forward branch office traffic to Prisma Access for inspection, an IPSec tunnel must be configured from the branch firewall to a Prisma Access service connection. This tunnel securely transports traffic to Prisma Access, where security policies are applied. Other options like GlobalProtect portal, explicit proxy, or SD-WAN do not provide the required site-to-site secure forwarding for all branch traffic.

Answer

Explicit proxy configuration on the branch firewall

Answer

SD-WAN policy on the branch firewall

Answer

GlobalProtect portal on the branch firewall

Question 15

An administrator needs to configure a Palo Alto Networks firewall to perform dynamic updates for applications and threats. The firewall has a valid support license and internet connectivity on the management interface. However, the administrator wants to schedule the updates to occur automatically at a specific time. Which configuration tab in the web interface should the administrator use to set up the update schedule?

Accepted Answer

Device > Dynamic Updates. Dynamic updates for applications and threats are scheduled in the Device > Dynamic Updates section of the web interface. This page allows administrators to set the update schedule, including frequency and time. Other tabs like Device > Setup > Services are for general services, Objects > Security Profiles for security profiles, and Network > Interfaces for interface configuration. Therefore, the correct tab is Device > Dynamic Updates.

Answer

Objects > Security Profiles

Answer

Network > Interfaces

Answer

Device > Setup > Services