NetSec-Pro NGFW And SASE Solution Maintenance And Configuration — Timed 10 Questions

Question 1

A company requires that traffic from the VPN zone to the Untrust zone undergoes source NAT using a specific interface IP. Which configuration step is mandatory to ensure this traffic is correctly matched?

10 minute time limit — choose an answer to begin.

Accepted Answer

Select the specific source zone and destination zone in the NAT rule.. The source NAT rule must explicitly match the source zone and destination zone of the traffic, along with the source interface if specified.

Answer

Disable 'Address Translation' in the NAT rule.

Answer

Enable 'Proxy ARP' on the egress interface.

Answer

Configure a policy-based forwarding rule instead of NAT.

Question 2

Which type of interface is used to connect to a switch in a Layer 2 configuration where the firewall acts as a transparent bridge?

Accepted Answer

Layer 2 interface. Layer 2 interfaces are designed for transparent switching and do not require IP addresses for traffic processing.

Answer

Virtual Wire interface

Answer

Aggregate interface

Answer

Layer 3 interface

Question 3

An administrator notices high memory utilization. What is the most effective way to identify which processes are consuming the most resources on the control plane?

Accepted Answer

Use 'show system resources' in the CLI.. The CLI command 'show system resources' displays real-time CPU, memory, and process-level utilization on the management plane, including top processes by resource consumption. It is the fastest and most direct way to identify which processes are consuming the most memory on the control plane. This is the standard PAN-OS troubleshooting command for resource exhaustion.

Answer

Check the App-ID cache in the GUI.

Answer

Navigate to Device > Support > Logs.

Answer

Perform a packet capture on the management interface.

Question 4

Which feature allows you to monitor traffic patterns and generate security policy recommendations?

Accepted Answer

Policy Optimizer. Policy Optimizer in PAN-OS analyzes traffic logs and existing security policies to identify unused, overly permissive, or redundant rules, and generates recommendations to tighten policies — such as converting port-based rules to App-ID-based rules or removing unused rules. It provides visibility into rule usage and helps migrate from legacy port-based policies to application-based policies.

Answer

App-ID Lifecycle

Answer

Threat Intelligence Cloud

Answer

Traffic Profiler

Question 5

Which of the following are examples of Interface Management Profile services? (Choose TWO)

Accepted Answer

SSH. Management Profiles allow you to enable services like Ping, SSH, and HTTPS on an interface.

Answer

BGP

Answer

FTP

Answer

DHCP

Question 6

Which three components must be configured to enable GlobalProtect Clientless VPN? (Choose THREE)

Accepted Answer

SSL/TLS Service Profile. Option B (SSL/TLS Service Profile) is correct because Clientless VPN relies on the GlobalProtect portal/gateway HTTPS listener, which must reference an SSL/TLS Service Profile that defines the server certificate and the minimum/maximum TLS protocol versions for the web-based session. Option D (GlobalProtect Portal) is correct because the portal is where Clientless VPN is enabled and where the clientless apps (web applications, SaaS, and terminal/SSH/RDP services) are defined and presented to users. Option E (GlobalProtect Gateway) is correct because the gateway terminates the Clientless VPN traffic and enforces the security policy, and it must be configured with the SSL/TLS profile and the clientless access settings that the portal references. Option A (Static NAT Rule) is not required, since Clientless VPN is an application-layer HTTPS service that does not mandate static source/destination NAT to function. Option C (RADIUS Server) is not required, because authentication can be satisfied by local, LDAP, SAML, Kerberos, or other supported authentication profiles; RADIUS is only one optional method.

Answer

Static NAT Rule

Answer

RADIUS Server

Question 7

Which three items must be configured to successfully implement a Source NAT rule? (Choose THREE)

Accepted Answer

Translated Address. To implement a Source NAT rule, you must define the Translated Address (B), which specifies the IP address (or address pool) that the original source IP will be rewritten to, and you must specify the Source Zone (D) to match the traffic originating from that zone, as well as the Destination Zone (E) to match the traffic leaving toward that zone; these three elements are the core match and translation parameters of a NAT policy. A Security Policy Rule (A) is needed to permit the translated traffic, but it is not a required configuration item within the NAT rule itself, and a Decryption Profile (C) is unrelated to NAT and applies to SSL/TLS decryption policies, so neither belongs to the three required NAT rule components.

Answer

Security Policy Rule

Answer

Decryption Profile

Question 8

Which three settings are part of a Zone Protection Profile? (Choose THREE)

Accepted Answer

Flood Protection. Zone Protection includes DoS protection, reconnaissance protection, and packet-based attack protection.

Answer

User-ID Mapping

Answer

Decryption Policy

Question 9

Which three items can be used as match criteria in a Security Policy rule? (Choose THREE)

Accepted Answer

Application. Security policies can match on Source/Destination zones, Users, Applications, and Services.

Answer

Hardware Serial Number

Answer

VLAN ID

Question 10

An administrator needs to ensure that internal users can access a public web server using its public IP address even when they are physically inside the internal network. Which NAT type and configuration approach should be used?

Accepted Answer

Configure a Destination NAT rule with the internal zone as both the source and destination zone.. Destination NAT (DNAT) with the internal zone as both source and destination zone enables hairpin/U-turn NAT, allowing internal clients to reach a public IP that is mapped to an internal server. When the source and destination zones are both internal, the firewall performs the translation and routes the traffic back into the same zone, so the internal user's session to the public IP is rewritten to the server's private IP. This is the standard PAN-OS approach for internal-to-public-IP access to an internal resource.

Answer

Create a static NAT rule with a translation type of 'Bidirectional' in the Source NAT tab.

Answer

Enable 'DNS Sinkhole' on the Security policy to map the public IP to the private IP internally.

Answer

Enable 'Proxy ARP' on the external interface for the public IP address.