NetSec-Pro Platform Solutions Services And Tools Practice Test 2 — 15 Questions

Question 1

An administrator has deployed a pair of NetSec-Pro appliances in an active/passive high availability configuration. They want to test a new security policy that blocks risky applications without affecting production traffic. The administrator decides to use the 'Policy Optimizer' feature within the NetSec-Pro management console. What is the primary function of Policy Optimizer in this context?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

It automatically converts unused or overly permissive rules into more secure, application-specific rules based on observed traffic.. Policy Optimizer helps administrators reduce risk by identifying rules that are unused or too permissive and suggesting more granular, application-based rules. In the scenario, this allows testing a new blocking policy without affecting production because the recommendations are derived from actual traffic patterns, enabling safe, data-driven policy refinement.

Answer

It provides a real-time dashboard of all active sessions and their associated applications, users, and threats.

Answer

It simulates the impact of a policy change by replaying captured packets against the new ruleset before committing.

Answer

It enforces a baseline security policy across all managed devices to ensure compliance with organizational standards.

Question 2

A network security administrator is using the Strata Cloud Manager CLI to automate the retrieval of a list of all managed firewalls. Which command should the administrator use?

Accepted Answer

scm show firewalls. The Strata Cloud Manager CLI provides the 'scm show firewalls' command to list all firewalls managed by SCM. This command is essential for administrators who need to inventory devices or automate tasks. It returns structured output that can be parsed for further processing.

Answer

scm get firewalls

Answer

scm list firewalls

Answer

scm show devices

Question 3

An administrator is using the Strata Cloud Manager (SCM) to manage security policies across multiple firewalls. They need to create a policy rule that will be applied to all firewalls in a specific region. Which SCM feature should they use to group firewalls for policy application?

Accepted Answer

Folders. SCM uses a hierarchical folder structure to organize firewalls and other devices. Policies are applied to folders, and all devices within a folder inherit those policies. This allows administrators to group firewalls by region, department, or any other logical grouping. Folders are the correct feature for this scenario.

Answer

Tags

Answer

Device Groups

Answer

Templates

Question 4

A security operations team wants to automatically block IP addresses that exceed a threshold of failed SSH login attempts on a monitored Linux server. They plan to use the firewall's XML API to add the offending IPs to a Dynamic Address Group. Which API request method and endpoint should they use to add an IP address to a registered DAG?

Accepted Answer

A POST request to /api/?type=user-id&action=set& vsys=vsys1 with the payload specifying the DAG name and the IP address to register.. Dynamic Address Groups are populated at runtime through the User-ID API. To add an IP address, the security team must send a request to the User-ID endpoint with the action set, specifying the DAG name and the IP. This registration takes effect immediately without a commit, enabling rapid response to the failed login threshold. Config edits and operational commands do not provide this dynamic registration capability.

Answer

A PUT request to /api/?type=config&action=edit&xpath=/config/devices/entry/vsys/entry[@name='vsys1']/address-group/entry[@name='DAG']&element=1.2.3.4

Answer

A GET request to /api/?type=config&action=set&xpath=/config/devices/entry/vsys/entry[@name='vsys1']/address-group/entry[@name='DAG']&element=1.2.3.4

Answer

A POST request to /api/?type=op&cmd=1.2.3.4DAG

Question 5

An administrator is configuring Palo Alto Networks firewall to integrate with a SIEM using the Log Forwarding profile. The administrator wants to ensure that logs are forwarded in a structured format that is easily parsed by the SIEM. Which two log format options should be considered? (Choose two.)

Accepted Answer

LEEF. Palo Alto Networks firewalls support specific log formats for forwarding: CSV, LEEF, and the default custom format. CSV and LEEF are both structured and easily parsed by SIEMs. CEF and JSON are not natively supported, and syslog is a transport protocol, not a format.

Answer

JSON

Answer

Syslog

Answer

CEF

Question 6

An administrator is using Strata Cloud Manager to manage a group of firewalls. They need to ensure that a specific security policy rule is applied only to firewalls in the 'Retail' region and not to those in the 'Corporate' region. The administrator creates a new security policy rule and wants to target it appropriately. Which two configuration elements must be used to achieve this scoping? (Choose two.)

Accepted Answer

Assign the 'Retail' firewalls to a dedicated device group and apply the rule to that group.. In Strata Cloud Manager, security policy rules can be scoped to specific firewalls using targets with filters (such as region tags) or by assigning firewalls to device groups and targeting the rule to that group. Both methods allow precise control over which devices receive the policy. Using administrative roles or traffic-based filters does not limit the rule's deployment scope, so they are not valid for this requirement.

Answer

Use a 'Source User' filter in the security policy rule to match users in the 'Retail' region.

Answer

Define a custom application group that includes all applications used in the 'Retail' region and reference it in the rule.

Answer

Create a separate administrative role that only has access to the 'Retail' region and apply the rule under that role.

Question 7

An administrator needs to configure a new Palo Alto Networks next-generation firewall that will be managed by Panorama. The firewall is located behind a NAT device and cannot be directly reached from the Panorama management server. The administrator wants the firewall to initiate the connection to Panorama for management. Which Panorama component should be configured to allow this?

Accepted Answer

Panorama Management Server with a pre-shared key and the firewall configured to connect to Panorama. For a firewall behind NAT, Panorama cannot initiate a management connection. Instead, the firewall must be configured to connect to Panorama. This requires setting up a pre-shared key on the Panorama Management Server and configuring the firewall with Panorama's IP address and the same pre-shared key. The firewall then initiates an outbound connection to Panorama, allowing management without inbound access.

Answer

Panorama Collector Group

Answer

Panorama Log Collector

Answer

Panorama Management Server

Question 8

An administrator is configuring a new Strata Cloud Manager tenant and needs to integrate it with an external SIEM for log forwarding. The administrator wants to ensure that logs are forwarded in a secure and reliable manner. Which two actions should the administrator perform? (Choose two.)

Accepted Answer

Configure a syslog server profile in Strata Cloud Manager and assign it to the appropriate log forwarding profile.. To forward logs from Strata Cloud Manager to an external SIEM, the administrator must configure a syslog server profile that specifies the SIEM's address, port, and protocol, and enable TLS for encryption. This profile is then referenced in a log forwarding profile that defines which logs are sent. These two actions ensure secure and reliable log transmission.

Answer

Set up a bidirectional synchronization between SCM and the SIEM to ensure logs are not lost.

Answer

Install a dedicated log collector VM in the local network and configure SCM to send logs to it.

Answer

Create a custom report in Strata Cloud Manager that includes all log types and schedule it to run hourly.

Question 9

An administrator is deploying a new Palo Alto Networks next-generation firewall and wants to ensure that it can be managed by Panorama. The firewall is in a remote branch with a dynamic IP address. The administrator has configured the Panorama Management Server with a pre-shared key. Which two additional steps must be performed on the firewall to enable management by Panorama? (Choose two.)

Accepted Answer

Enter the same pre-shared key that was configured on Panorama.. To enable a firewall behind NAT or with a dynamic IP to be managed by Panorama, the firewall must initiate the connection. This requires configuring the Panorama IP address or hostname and the pre-shared key on the firewall. These two settings are found under Device > Setup > Management > Panorama Settings. Once configured, the firewall connects outbound to Panorama, allowing management without inbound access.

Answer

Configure a static route to the Panorama Management Server.

Answer

Set the firewall to operate in Panorama mode instead of standalone mode.

Answer

Enable the Panorama Log Collector service on the firewall.

Question 10

An administrator is using the Strata Cloud Manager CLI to apply a security policy to a specific firewall. The administrator runs the command 'scm set policy security --device <serial> --file policy.json' but receives an error that the device is not found. Which of the following is the most likely reason?

Accepted Answer

The firewall is not onboarded to Strata Cloud Manager.. The 'device not found' error in the SCM CLI typically indicates that the specified firewall is not onboarded to Strata Cloud Manager. Onboarding is a prerequisite for managing devices via SCM CLI. The administrator should verify the firewall's onboarding status and ensure the serial number is correct.

Answer

The policy.json file is not in the correct format.

Answer

The administrator lacks the necessary permissions to apply policies to that device.

Answer

The serial number provided is incorrect or does not match the firewall's serial.

Question 11

A security administrator is configuring a Palo Alto Networks firewall to forward logs to an external syslog server. The administrator wants to ensure that logs are sent in a structured format that is easily parsed by the SIEM. Which log format should be selected?

Accepted Answer

Syslog. Palo Alto Networks firewalls support forwarding logs to external syslog servers. The syslog format is standardized and widely supported by SIEMs. When configuring log forwarding, the administrator can choose the syslog format, which includes structured fields that are easily parsed. Other formats like CSV, LEEF, and CEF are also available, but syslog is the most common and versatile. The correct answer is syslog because it provides structured data that SIEMs can parse easily.

Answer

CEF

Answer

LEEF

Answer

CSV

Question 12

A NetSec-Pro administrator maintains a fleet of 12 Palo Alto Networks PA-3200 Series firewalls managed by on-premises Panorama. The security team wants to ensure that all firewalls have the latest Advanced Threat Prevention signatures without waiting for a scheduled content update. Which Panorama feature should the administrator use to immediately push the newest content version to all managed firewalls?

Accepted Answer

Push the latest content version to all managed firewalls by selecting Panorama > Device Deployment > Dynamic Updates and clicking 'Check Now' followed by 'Download' and 'Install'.. The requirement is to immediately push the latest content version to all managed firewalls. Panorama's Device Deployment > Dynamic Updates feature is designed exactly for this purpose, allowing a single action to check, download, and install updates across all devices. Other options either lack immediacy, misuse features, or are not designed for content distribution.

Answer

Schedule a recurring content update job on each firewall individually via Device > Dynamic Updates, setting the recurrence to every hour.

Answer

Use the Panorama > Device Groups feature to assign a content update policy that forces all firewalls to download the latest signatures at the next commit.

Answer

Configure an auto-update schedule in Panorama > Scheduled Config Export to push content updates to all firewalls every 15 minutes.

Question 13

A NetSec-Pro administrator is configuring a new Palo Alto Networks firewall to send logs to an external syslog server for long-term retention. The administrator wants to ensure that only threat logs and traffic logs are forwarded, and that the logs are sent in a format that includes the firewall's hostname. Which two actions should the administrator take to meet these requirements? (Choose two.)

Accepted Answer

Configure the syslog server profile to include the firewall's hostname in the syslog header by enabling the 'Include Hostname' option.. To forward only Threat and Traffic logs, a Log Forwarding profile must be created with those log types and attached to security policies. To include the firewall's hostname, the syslog server profile must have the 'Include Hostname' option enabled. These two actions together satisfy the requirements.

Answer

Set the syslog server to use TCP instead of UDP to guarantee delivery of threat logs.

Answer

Create a custom log format that manually inserts the firewall's hostname into each log entry.

Answer

Enable 'Log at Session End' in the security policy to ensure all traffic logs are generated.

Question 14

You are troubleshooting a connectivity issue between an SCM-managed firewall and the SCM cloud service. Which log source in the firewall UI provides the most detailed information regarding the management connection?

Accepted Answer

System logs. System logs on the firewall capture management-plane events including SCM (Strata Cloud Manager) connectivity, management service status, and control-plane communication with cloud services. When troubleshooting the management connection between the firewall and SCM, the System log is the authoritative source because it records connection state changes, authentication events, and service errors for the management plane.

Answer

Configuration logs

Answer

Threat logs

Answer

Traffic logs

Question 15

When using Panorama, an administrator wants to push policies to specific firewalls based on their geographical location. Which feature should be used?

Accepted Answer

Device Groups. Device Groups allow for hierarchical organization of firewalls, enabling targeted policy application.

Answer

Panorama Templates

Answer

Address Groups

Answer

Policy Groups