NetSec-Pro Platform Solutions Services And Tools Practice Test 4 — 15 Questions

Question 1

Which THREE configuration elements are commonly managed via Panorama Templates?

Accepted Answer

NTP server settings. Panorama Templates are used to manage device and network settings that are pushed to managed firewalls, so NTP server settings (A) are correct because time synchronization is a device-level configuration typically defined under Device > Setup > Services in a template. Network interfaces (C) are correct because interface configuration (Layer 2, Layer 3, virtual routers, zones, etc.) is a core template-managed network setting. DNS settings (E) are also correct because DNS servers, DNS proxy, and related resolution settings are device-level parameters configured in templates. Address objects (B) and security policy rules (D) do not belong here because they are managed through Panorama Device Groups, not Templates, since they are policy-related objects and rules rather than device/network configuration.

Answer

Address objects

Answer

Security policy rules

Question 2

Which TWO factors contribute to 'Configuration Drift' between a firewall and Panorama?

Accepted Answer

Local administrators making changes directly on the firewall CLI.. Configuration drift occurs when the firewall's running configuration diverges from what Panorama expects to manage. Option A is correct because local administrators editing the firewall directly via the CLI create out-of-band changes that Panorama does not know about, so the device state no longer matches the Panorama-managed configuration. Option D is correct because if a template variable or parameter lacks the proper 'Override' setting, the firewall cannot accept or retain the intended value from Panorama, causing the device to keep a different value than Panorama defines. Option B is incorrect because 'Read-Only' mode prevents changes rather than causing divergence. Option C is incorrect because Panorama being offline during a push simply means the push fails or is deferred; it does not itself create drift. Option E is incorrect because differing Pan-OS versions may cause compatibility issues, but version mismatch alone is not a defined cause of configuration drift.

Answer

The firewall is in 'Read-Only' mode.

Answer

Panorama is offline during a policy push.

Answer

Using different versions of Pan-OS on Panorama and the firewall.

Question 3

Which TWO steps are involved in the process of replacing a failed firewall that is managed by Panorama?

Accepted Answer

Push the configuration to the new device using the existing Device Group.. Option A is correct because Panorama manages firewalls through Device Groups, so once the replacement firewall is added and its serial number is registered, the existing Device Group configuration can be pushed to it, restoring the same policy and object configuration without rebuilding anything. Option D is correct because Panorama identifies managed firewalls by serial number, so the failed device's serial number must be removed (or the device deleted) and the replacement firewall's serial number added so Panorama can manage and push policy to the new hardware. Option B is incorrect because licensing is tied to the firewall's serial number and is handled through the support/licensing portal, not by manually re-licensing every feature as a Panorama replacement step. Option C is incorrect because creating a new Device Group is unnecessary and would fragment policy; the replacement should join the existing Device Group. Option E is incorrect because a new or replacement firewall does not require a factory reset as part of the Panorama replacement workflow.

Answer

Re-license every feature manually.

Answer

Create a new Device Group for the replacement.

Answer

Reset the firewall to factory defaults.

Question 4

Which THREE items are included in a Panorama configuration 'Export'?

Accepted Answer

Security policy rules. Option A (Security policy rules) is correct because Panorama's Export function saves the device-group policy configuration, including security rules, as part of the exported XML/configuration bundle. Option B (Template network configurations) is correct because template stacks and their network settings (interfaces, zones, virtual routers, etc.) are part of the Panorama configuration and are included in the export. Option E (Address and Service objects) is correct because these are configuration objects stored in Panorama and referenced by policy, so they are exported along with the rest of the config. Option C (Log data files) is not included because logs reside in the logging storage and are not part of a configuration export. Option D (Historical threat reports) is not included because reports are generated data/artifacts, not configuration, and are not part of the export.

Answer

Log data files

Answer

Historical threat reports

Question 5

Which TWO actions should an administrator perform to prepare for a large-scale firmware upgrade across an enterprise using Panorama?

Accepted Answer

Upload the firmware images to Panorama.. Option B is correct because Panorama must have the target PAN-OS firmware images uploaded to it (via Device > Software or the Panorama software manager) so they can be pushed to managed firewalls during a large-scale upgrade. Option C is correct because the Compatibility Matrix must be verified to confirm that each firewall model supports the target PAN-OS release and that the required base image and upgrade path are valid before deploying enterprise-wide. Option A is wrong because deleting logs does not prepare firmware images or validate upgrade paths and could destroy audit data. Option D is wrong because disabling security policies is unnecessary and would create a security gap during the upgrade. Option E is wrong because manually SSHing into every firewall is not scalable or required; Panorama can check and report disk space and readiness across managed devices.

Answer

Delete all old logs to free up space.

Answer

Disable all security policies.

Answer

Manually SSH into every firewall to check disk space.

Question 6

Which TWO of the following are benefits of using Strata Cloud Manager over traditional on-premises Panorama?

Accepted Answer

Automatic updates and feature availability.. SCM provides cloud-native benefits such as reduced infrastructure overhead and automated updates.

Answer

Direct root access to the management server.

Answer

Support for legacy PAN-OS versions 6.0 and below.

Answer

Ability to host custom local scripts.

Question 7

When managing multiple firewalls in Panorama, what is the best practice for handling software image updates?

Accepted Answer

Upload images to Panorama and use the 'Software' tab to push them to devices.. Uploading images to the Panorama server first allows for consistent deployment to all managed firewalls.

Answer

Use the 'Auto-Update' feature on firewalls only.

Answer

Download images directly on each firewall.

Answer

Use an external TFTP server for all devices.

Question 8

An administrator managing 200 Palo Alto Networks firewalls with Strata Cloud Manager needs to rapidly deploy a new decryption policy only to firewalls in the European branch offices, which are identified by the region tag 'EU'. The administrator wants to avoid manual per-firewall configuration and ensure the policy is applied consistently. Which SCM feature should the administrator use?

Accepted Answer

Use a dynamic device group with a tag-based membership criterion filtering on 'EU'.. Dynamic device groups in Strata Cloud Manager allow policies to be applied based on tags, enabling automatic inclusion of firewalls matching the 'EU' region tag. This eliminates manual configuration, ensures consistency, and scales efficiently. Static groups require manual updates, source zones are not geographic, and Panorama template stacks address device settings rather than dynamic policy targeting.

Answer

Define a policy rule with a source zone of 'EU' and apply it globally.

Answer

Use a Panorama template stack with region-based variables.

Answer

Create a static device group and manually add each European firewall.

Question 9

A security engineer is using the Palo Alto Networks Expedition tool to migrate a configuration from a Cisco ASA firewall to a Palo Alto Networks firewall. After importing the ASA configuration, the engineer notices that some access control rules are not being translated correctly. What is the most likely cause?

Accepted Answer

The ASA configuration contains unsupported object types that Expedition cannot parse.. Expedition may not fully support all ASA object types, leading to incomplete or incorrect translation of associated rules. The tool provides a report of unsupported items, which should be reviewed. The other options are less likely because Expedition is built to handle typical ASA exports and any/any rules, and PAN-OS version affects import, not translation.

Answer

The ASA configuration includes rules with any/any which Expedition cannot translate.

Answer

The ASA configuration was exported in a format that Expedition does not support.

Answer

The Palo Alto Networks firewall is running an older version of PAN-OS that is incompatible with Expedition.

Question 10

A network security administrator needs to ensure that the Palo Alto Networks firewall can resolve domain names for security policy enforcement. Which service should be configured on the firewall?

Accepted Answer

DNS Client. The DNS Client service is responsible for resolving domain names for the firewall itself. This is necessary for various features, including URL filtering and security policy enforcement based on domain names. The other options are either client-facing services or security features that do not provide resolution.

Answer

DNS Proxy

Answer

DNS Sinkhole

Answer

DNS Security

Question 11

A security administrator needs to allow the NetSec-Pro management plane to authenticate firewall administrators against the corporate Microsoft Active Directory. The AD servers are reachable only on the internal network. Which server profile type should the administrator configure on the firewall to meet this requirement?

Accepted Answer

LDAP server profile. To authenticate firewall administrators against Microsoft Active Directory, the management plane needs to query the directory for user and group objects. An LDAP server profile provides the server address, port, and bind credentials for that query, enabling role-based admin access. Kerberos, RADIUS, and TACACS+ profiles serve different authentication purposes and do not provide the directory browsing required for AD group mapping.

Answer

Kerberos server profile

Answer

TACACS+ server profile

Answer

RADIUS server profile

Question 12

A security administrator is deploying a new Palo Alto Networks next-generation firewall in a remote branch office. The branch has limited on-site IT staff and no dedicated management server. The administrator wants to centrally manage this firewall, push security policies, and monitor traffic without deploying Panorama. Which Palo Alto Networks cloud-delivered service should be used?

Accepted Answer

Strata Cloud Manager. Strata Cloud Manager is the cloud-delivered management solution from Palo Alto Networks that provides centralized management, policy enforcement, and visibility for firewalls and other security services. It is specifically designed for organizations that want to avoid deploying on-premises management infrastructure like Panorama, making it the correct choice for managing a remote branch firewall with minimal on-site resources.

Answer

AutoFocus

Answer

WildFire

Answer

Panorama

Question 13

A security engineer is configuring a NetSec-Pro appliance to forward logs to an external SIEM using syslog. The SIEM requires that logs be sent over TCP with TLS encryption for compliance. The engineer configures a syslog server profile with the SIEM's IP address and port 6514, and selects 'SSL' as the transport. However, the SIEM is not receiving any logs. Which of the following is the most likely cause of the failure?

Accepted Answer

The syslog server profile requires a certificate to be imported and associated for TLS to function, and this step was omitted.. TLS-encrypted syslog requires a certificate on the sending device to establish a secure connection. Without importing and associating a certificate in the syslog server profile, the NetSec-Pro appliance cannot initiate the TLS handshake, so logs are not transmitted. The port and protocol selections are correct, but the missing certificate is the likely cause.

Answer

The NetSec-Pro appliance does not support TLS encryption for syslog; it only supports UDP and TCP without encryption.

Answer

Port 6514 is not a valid port for syslog over TLS; the correct port is 514.

Answer

The SIEM must be configured to accept syslog over UDP because NetSec-Pro only supports UDP for external log forwarding.

Question 14

An administrator is using the Strata Cloud Manager API to programmatically create a security rule. The API request fails with a 400 Bad Request error. The administrator has verified that the authentication token is valid and the endpoint URL is correct. Which of the following is the most likely cause of the error?

Accepted Answer

The API request is missing a required HTTP header, such as 'Content-Type: application/json'.. A 400 Bad Request error in the SCM API usually indicates a malformed request. Common causes include missing required HTTP headers like 'Content-Type: application/json', invalid JSON syntax, or missing required fields. Since the token and URL are correct, the administrator should inspect the request headers and body for compliance with the API specification.

Answer

The API endpoint URL is incorrect and points to a non-existent resource.

Answer

The security rule name contains special characters that are not allowed.

Answer

The API token has expired and needs to be refreshed.

Question 15

A network administrator is configuring a NetSec-Pro firewall to send alerts to an external email server when a critical threat is detected. They navigate to the 'Log Settings' under the 'Device' tab and configure the email server profile. Which additional step is required to ensure that threat logs trigger email notifications?

Accepted Answer

Create a log forwarding profile that includes email as a destination and attach it to the security policy.. To send email alerts for critical threats, the administrator must create a log forwarding profile that specifies email as a destination and apply it to the security policy. The email server profile provides the server details, but the log forwarding profile is what actually triggers the email based on matching logs.

Answer

Set the 'Log Severity' for threat logs to 'critical' in the global log settings.

Answer

Configure a syslog server profile and set the email server as the syslog destination.

Answer

Enable 'Email Notifications' in the 'Threat Prevention' profile settings.