Knowledge + Practice

CCNA Network Fundamentals Questions

55 questions · Network Fundamentals · All types, answers revealed

Practice these questions Domain overview All questions

1

Multi-Selectmedium

A security administrator is planning a network segmentation design and needs to understand how devices communicate at Layer 2. Which TWO statements accurately describe Ethernet MAC address behavior in a switched network? (Choose two.)

Select 2 answers

A.A unicast frame with an unknown destination MAC address is dropped by the switch.

B.A switch forwards a frame with a destination MAC address of FF:FF:FF:FF:FF:FF only to the default gateway.

C.A broadcast frame is forwarded out all ports except the port on which it was received.

D.A switch builds its MAC address table by learning the source MAC address of frames received on each port.

E.MAC addresses are logical addresses assigned by the network administrator and can be changed per subnet.

AnswersC, D

Broadcast frames have a destination MAC address of FF:FF:FF:FF:FF:FF and must be delivered to all devices in the broadcast domain. A switch floods such frames out every port in the same VLAN except the ingress port. This ensures all hosts receive the broadcast while avoiding a loop back to the sender, which is essential for protocols like ARP and DHCP.

Why this answer

Switches learn MAC addresses from source addresses of received frames and flood broadcast frames to all ports in the same VLAN except the ingress port. These two behaviors enable efficient unicast forwarding after learning and ensure broadcast-based protocols reach all hosts. Understanding them is key to predicting traffic flow and troubleshooting Layer 2 connectivity issues.

Exam trap

The trap here is assuming that unknown unicast frames are dropped or that broadcast frames are sent only to a gateway, rather than being flooded within the VLAN.

Practice this question →

2

MCQeasy

An administrator wants to view active sessions matching a specific source IP address (192.168.1.50) using the firewall CLI. Which command is correct?

A.show session all filter source 192.168.1.50

B.show arp filter 192.168.1.50

C.show session filter ip 192.168.1.50

D.show ip session 192.168.1.50

AnswerA

The `show session all filter source 192.168.1.50` command queries the firewall's active session table and applies a source-IP filter, returning only sessions originating from 192.168.1.50. This directly satisfies the stem's requirement to view active sessions matching that specific source address via the CLI.

Why this answer

The correct CLI command to view active sessions matching a specific source IP is 'show session all filter source 192.168.1.50'. The 'show session all' command lists sessions, and the 'filter source' keyword narrows the output to sessions originating from that IP. This is the documented PAN-OS syntax for filtering sessions by source address.

Exam trap

Cybersecurity-Apprentice often tests whether candidates know the exact PAN-OS CLI syntax, particularly the 'show session all filter source <ip>' form, versus plausible but invalid variants like 'show session filter ip'.

How to eliminate wrong answers

Option B is wrong because 'show arp filter' displays ARP table entries, not active sessions, and does not accept an IP as a positional argument in that form. Option C is wrong because the correct keyword is 'source', not 'ip'; 'show session filter ip' is not valid PAN-OS syntax. Option D is wrong because 'show ip session' is not a PAN-OS command; the correct verb-noun order is 'show session'.

Practice this question →

3

Multi-Selecthard

A network security analyst is investigating a suspected ARP spoofing attack on the local network. The analyst needs to verify the ARP cache on a Windows workstation to identify any duplicate IP addresses mapped to different MAC addresses. Which TWO commands can be used to display the ARP cache on the workstation? (Choose two.)

Select 2 answers

A.route print

B.arp -a

C.netstat -ano

D.ipconfig /all

E.netsh interface ip show arp

AnswersB, E

The arp -a command displays the current ARP entries for all interfaces on a Windows system. It shows the IP address and corresponding MAC address, allowing the analyst to spot duplicate IPs with different MACs, which may indicate ARP spoofing. This is a standard command for examining the ARP cache.

Why this answer

To inspect the ARP cache on a Windows workstation, the analyst can use either arp -a or netsh interface ip show arp. Both commands list IP-to-MAC address mappings, enabling detection of duplicate IPs with different MACs, which is a sign of ARP spoofing. The other commands provide different network information and do not show ARP entries.

Exam trap

The trap here is confusing commands that show IP configuration or connections with those that display the ARP cache.

Practice this question →

4

MCQmedium

A network administrator is configuring a Layer 3 interface on a Palo Alto Networks firewall to participate in a broadcast domain. The interface must obtain its IP address automatically from a DHCP server on the same subnet. Which interface configuration setting must be enabled to allow the firewall to act as a DHCP client?

A.DHCP Client

B.Static IP

C.DHCP Server

D.PPPoE

AnswerA

Selecting DHCP Client on a Layer 3 interface instructs the firewall to send DHCP requests and accept a lease from a DHCP server on the connected subnet. This provides automatic IP address, gateway, and DNS assignment for that interface. It is the correct choice when the firewall must integrate into an existing network without a manually assigned static address.

Why this answer

To have the firewall obtain an address automatically from a DHCP server on the same subnet, the Layer 3 interface must be configured with DHCP Client enabled. This mode allows the interface to request and renew a lease, dynamically receiving an IP address, subnet mask, default gateway, and DNS settings, which simplifies deployment in environments where centralized address management is used.

Exam trap

The trap here is confusing the DHCP Server role with the DHCP Client role; the firewall must be a client to receive an address, not a server that distributes addresses.

Practice this question →

5

Multi-Selecteasy

Which TWO interface types are available when configuring physical ports on a Palo Alto Networks firewall? (Choose two)

Select 2 answers

A.WAN Accelerator

B.Layer 3

C.Switchport Trunk

D.Promiscuous Bridge

E.Virtual Wire

AnswersB, E

Layer 3 interfaces are routable ports that carry IP addresses and participate in routing decisions, supporting features such as zones, virtual routers and NAT. This is one of the standard configurable interface types on Palo Alto Networks firewalls, alongside Layer 2, virtual wire, tap and HA.

Why this answer

Option B (Layer 3) is correct because a Palo Alto Networks firewall physical interface can be configured as a Layer 3 interface, which is assigned an IP address and participates in routing decisions, supporting features like static routes, OSPF, BGP, and DHCP. Option E (Virtual Wire) is correct because a physical port can be configured as a virtual wire interface, which binds two ports into a transparent, bump-in-the-wire pair that forwards traffic without any MAC or IP addressing or routing. The other options are not valid physical interface types on a Palo Alto firewall: WAN Accelerator is not an interface configuration mode, Switchport Trunk is a Cisco-style Layer 2 switching concept not offered as a physical port type here, and Promiscuous Bridge is not a supported interface type (tap and Layer 2 are the relevant transparent modes, but not 'promiscuous bridge').

Exam trap

Cybersecurity-Apprentice often tests whether candidates recognize that PAN-OS uses its own interface taxonomy (Layer 3, Layer 2, Virtual Wire, Tap) and not Cisco-style terms like 'switchport trunk' or invented types like 'WAN Accelerator.'

Practice this question →

6

MCQhard

A security analyst is examining a packet capture (PCAP) and observes that the TCP window size is dropping to zero during a data transfer between a client and a server through the firewall. What does a zero window size typically indicate in a TCP transmission?

A.The maximum segment size (MSS) negotiation has failed during the three-way handshake.

B.The receiver's buffer is full and it is requesting the sender to pause transmission.

C.An asymmetric routing loop has caused sequence numbers to go out of sync.

D.The firewall has blocked the session due to a security profile match.

AnswerB

A zero window advertises that the receiver's TCP receive buffer is full, so the sender must stop transmitting until a window update arrives. This is TCP flow control, distinct from congestion control or packet loss.

Why this answer

A TCP window size of zero means the receiver's receive buffer is full and it is advertising a zero window to tell the sender to stop transmitting until it can drain the buffer. This is normal TCP flow control, not an error — the sender will periodically send zero-window probes until the receiver advertises a non-zero window.

Exam trap

Cybersecurity-Apprentice often tests whether candidates confuse TCP flow control (window size) with error conditions like MSS failure, routing loops, or firewall blocks — the trap is assuming a zero window means something is broken when it is actually normal backpressure.

How to eliminate wrong answers

Option A is wrong because MSS negotiation happens during the three-way handshake via the SYN/SYN-ACK options, and a failed MSS negotiation would not manifest as a zero window mid-transfer — it would affect segment sizing from the start. Option C is wrong because asymmetric routing causes sequence number and ACK inconsistencies, not a zero window; a zero window is an explicit flow-control signal from the receiver, not a routing symptom. Option D is wrong because a firewall security profile block would reset or drop the session (RST or silent drop), not produce a zero window advertisement — the zero window is generated by the endpoint's TCP stack, not the firewall.

Practice this question →

7

MCQmedium

A security analyst is reviewing captured traffic and needs to identify which protocol resolves a known IPv4 address to its corresponding MAC address on the local segment. Which protocol performs this function?

A.DHCP

B.ARP

C.DNS

D.ICMP

AnswerB

Address Resolution Protocol broadcasts a request asking which device owns a given IPv4 address, and the owner replies with its MAC address. This is exactly the IPv4-to-MAC mapping the analyst is looking for on the local segment. ARP operates at Layer 2 and is essential because Ethernet frames require a destination MAC address, not just an IP address, to be delivered.

Why this answer

ARP is the protocol that maps a known IPv4 address to a MAC address on a local network. A host broadcasts an ARP request asking who owns the address, and the owner responds with its hardware address. This mapping is required because Ethernet frames must carry a destination MAC address, so without ARP a host could not deliver traffic to another device on the same segment.

Exam trap

The trap here is confusing name-to-address resolution with address-to-hardware resolution, which are handled by different protocols at different layers.

Practice this question →

8

MCQhard

A network engineer configures OSPF on a Palo Alto Networks virtual router. Neighbors are stuck in the EXSTART/EXCHANGE state. What is the most likely cause of this issue?

A.A mismatch in OSPF area ID types (e.g., normal vs. stub)

B.Incorrect OSPF hello or dead timer intervals

C.An MTU mismatch between the OSPF neighbors

D.Authentication type or password mismatch

AnswerC

In ExStart and Exchange, neighbours swap Database Description packets that include the interface MTU. A router rejects DBD packets whose MTU is larger than its own, so the pair retransmits and never moves on to Loading and Full. Match the MTU on both sides, on PAN-OS in the Layer 3 interface or subinterface settings, rather than ignoring the check, which only hides the problem and can drop large packets later.

Why this answer

OSPF neighbors stuck in EXSTART/EXCHANGE almost always indicate an MTU mismatch between the two routers. During the ExchangeStart phase, routers negotiate the Database Description (DBD) sequence and Master/Slave roles, and if the MTU values differ, the DBD packets are dropped, preventing progression to the Loading and Full states.

Exam trap

The trap is that candidates see 'neighbors stuck' and immediately blame timers or authentication, but those failures prevent adjacency from forming at all — only MTU mismatch lets neighbors reach EXSTART/EXCHANGE and then stall.

How to eliminate wrong answers

Option A is wrong because an area ID type mismatch (normal vs. stub) prevents adjacency formation earlier — neighbors would not reach EXSTART at all, typically staying in INIT or failing with a stub area mismatch error. Option B is wrong because hello/dead timer mismatches prevent the INIT state from progressing; the routers would never form a two-way adjacency, so they would not reach EXSTART. Option D is wrong because authentication mismatches cause the hello packets to be rejected, again preventing adjacency from forming past INIT/DOWN.

Practice this question →

9

MCQeasy

A junior security analyst is reviewing the TCP/IP model as part of onboarding. She needs to identify which layer is responsible for logical addressing and routing of packets between different networks. Which layer of the TCP/IP model performs this function?

A.The Network Access layer

B.The Application layer

C.The Transport layer

D.The Internet layer

AnswerD

The Internet layer of the TCP/IP model handles logical addressing and routing, using protocols such as IP, ICMP, and ARP to move packets between networks. In this scenario, the analyst needs to identify the layer that assigns logical addresses and determines the best path between distinct networks, which is precisely the Internet layer's role.

Why this answer

The Internet layer of the TCP/IP model is responsible for logical addressing and routing. Protocols like IP assign addresses and determine paths across networks. The Network Access layer deals with physical and link concerns, the Transport layer manages end-to-end delivery, and the Application layer supports user services.

Only the Internet layer performs the logical addressing and inter-network routing the scenario describes.

Exam trap

The trap here is confusing the Transport layer's logical port numbers with the Internet layer's logical network addressing and routing.

Practice this question →

10

Multi-Selectmedium

A network security analyst is reviewing how a host on a corporate LAN resolves names and discovers services. The analyst wants to identify TWO protocols or mechanisms that operate at the application layer and rely on UDP for transport. (Choose two.)

Select 2 answers

A.SMTP delivery between mail servers

B.SSH remote administration sessions

C.HTTP requests to a web server on port 80

D.mDNS queries on the local segment

E.DNS queries sent to a recursive resolver

AnswersD, E

Multicast DNS sends queries to 224.0.0.251 on UDP port 5353, allowing hosts to resolve .local names without a central server. It is an application-layer protocol that deliberately uses UDP multicast for lightweight, local discovery. This makes mDNS a valid example of an application-layer mechanism relying on UDP, distinct from unicast DNS to a resolver.

Why this answer

DNS to a recursive resolver and mDNS both operate at the application layer and use UDP. DNS favors UDP for its small, fast request-response exchanges on port 53, while mDNS uses UDP multicast on port 5353 for local name resolution and service discovery. HTTP, SMTP, and SSH are application-layer protocols but rely on TCP for reliable transport, so they do not meet the stated criterion.

Exam trap

The trap here is assuming every application-layer protocol uses TCP, when DNS and mDNS are common examples that deliberately use UDP for speed and multicast.

Practice this question →

11

MCQhard

A network security engineer observes that TCP sessions are being terminated prematurely during periods of inactivity. The default application timeout is not meeting the business requirement for a custom database application. Where should the engineer modify the session timeout for this specific application?

A.Network > Interfaces > Advanced > TCP Timeout

B.Objects > Applications > [Application Name], modifying TCP timeout settings

C.Policies > Security > Timeout Profile

D.Device > Setup > Management > Session Settings

AnswerB

Objects > Applications > [Application Name] exposes per-application TCP timeout settings, letting the engineer override the global default for only the custom database application. This satisfies the stem's constraint that the default application timeout fails the business requirement, without altering timeouts for unrelated traffic.

Why this answer

In Palo Alto Networks PAN-OS, application-specific TCP timeout settings are configured under Objects > Applications > [Application Name], where you can override the default session timeout for that application. This allows the engineer to extend the timeout for the custom database application without affecting global or interface-level timeouts. Modifying the application object ensures the change applies only to traffic identified as that application.

Exam trap

Cybersecurity-Apprentice often tests PAN-OS configuration paths — the trap is that candidates pick interface-level or global timeout settings instead of the application-specific object where per-app timeouts actually live.

How to eliminate wrong answers

Option A is wrong because Network > Interfaces > Advanced > TCP Timeout sets timeouts at the interface level, affecting all traffic on that interface rather than a specific application. Option C is wrong because Policies > Security > Timeout Profile does not exist as a standard PAN-OS configuration path for per-application timeouts. Option D is wrong because Device > Setup > Management > Session Settings controls global session parameters (like maximum sessions), not application-specific TCP timeouts.

Practice this question →

12

MCQhard

A network engineer is configuring a router interface with the IPv4 address 172.16.10.33 and subnet mask 255.255.255.224. The engineer needs to determine the network address and broadcast address for this subnet. What are the network and broadcast addresses, respectively?

A.172.16.10.0 and 172.16.10.31

B.172.16.10.0 and 172.16.10.63

C.172.16.10.32 and 172.16.10.63

D.172.16.10.33 and 172.16.10.62

AnswerC

The subnet mask 255.255.255.224 is a /27, which means the block size is 32. The subnet containing 172.16.10.33 starts at 172.16.10.32 (the network address) and ends at 172.16.10.63 (the broadcast address). The usable host range is 172.16.10.33 through 172.16.10.62. This is correct.

Why this answer

With a subnet mask of 255.255.255.224 (/27), the subnet increment is 32. The address 172.16.10.33 falls within the subnet starting at 172.16.10.32. Therefore, the network address is 172.16.10.32 and the broadcast address is 172.16.10.63.

The correct answer is 172.16.10.32 and 172.16.10.63.

Exam trap

The trap here is miscalculating the subnet boundaries by using the wrong block size or confusing network/broadcast with usable host addresses.

Practice this question →

13

MCQhard

An administrator is troubleshooting a packet flow issue where traffic arriving on a Layer 3 interface is being dropped. The administrator runs the command 'show counter global filter packet-drop yes' and notices an increment in counters related to 'Discard due to zone mismatch'. What does this counter typically indicate?

A.The security rule destination zone does not match the source zone.

B.The NAT policy is translating the packet to an unassigned IP address.

C.The Virtual Router has two default routes pointing to different interfaces.

D.The packet arrived on an interface belonging to a different zone than what is expected by the routing table or existing session state.

AnswerD

The zone mismatch counter increments when a packet's ingress security zone differs from the zone associated with the existing session or expected by policy lookup, so the firewall discards it. This matches the stem's Layer 3 interface drop condition.

Why this answer

The 'Discard due to zone mismatch' counter indicates that the packet arrived on an interface belonging to a different zone than what is expected by the routing table or existing session state. In Palo Alto Networks firewalls, zones are used to enforce security policies, and if a packet ingresses on an interface in one zone but the routing or session lookup expects it to be in another zone, the firewall drops it. This counter specifically tracks such zone mismatches.

Exam trap

Cybersecurity-Apprentice often tests zone-based firewall concepts, and candidates may confuse zone mismatch with security rule mismatches or NAT issues, leading to incorrect answers.

How to eliminate wrong answers

Option A is wrong because a security rule destination zone mismatch would be a policy issue, not a zone mismatch counter; the counter is about the packet's ingress zone not matching expectations. Option B is wrong because NAT policy translation to an unassigned IP would trigger different counters, such as NAT-related drops. Option C is wrong because multiple default routes would cause routing ambiguity, not a zone mismatch drop.

Practice this question →

14

MCQmedium

A security analyst is reviewing a packet capture of a TCP session between an internal client and an external server. The capture shows the client sending a segment with the SYN flag set and the server responding with a segment that has both SYN and ACK set. The client then sends an ACK. What does this sequence indicate about the session?

A.The TCP three-way handshake completed and the connection is established

B.The session is being torn down gracefully by both endpoints

C.The client is retransmitting a lost SYN because the server did not respond

D.The server is rejecting the connection and resetting the session

AnswerA

The three-way handshake consists of SYN from the client, SYN+ACK from the server, and ACK from the client. Seeing exactly these three segments in order confirms the connection reached the ESTABLISHED state on both sides. After this, application data such as HTTP requests can flow. The analyst can treat the session as successfully opened, assuming no RST or missing ACK appears later.

Why this answer

The three segments SYN, SYN+ACK, and ACK are the canonical TCP three-way handshake. The client proposes a connection with SYN, the server acknowledges and proposes its own sequence with SYN+ACK, and the client confirms with ACK. Completion of this exchange places both endpoints in the ESTABLISHED state, allowing application data to be exchanged.

Recognizing this pattern helps the analyst distinguish normal session setup from resets, retransmissions, or teardown traffic.

Exam trap

The trap here is misreading SYN+ACK as a reset or a retransmission, when the three-segment sequence specifically denotes successful connection establishment.

Practice this question →

15

MCQhard

A network engineer is analyzing a packet capture and notices that a host is sending a series of ICMP Echo Requests to a remote server. The host receives ICMP Echo Replies, but the payload sizes vary. The engineer wants to determine the maximum transmission unit (MTU) of the path to avoid fragmentation. Which protocol or mechanism is used to discover the path MTU?

A.Dynamic Host Configuration Protocol (DHCP)

B.Domain Name System (DNS)

C.Path MTU Discovery (PMTUD)

D.Address Resolution Protocol (ARP)

AnswerC

Path MTU Discovery (PMTUD) is a mechanism that determines the maximum transmission unit (MTU) along a network path to avoid fragmentation. It works by sending packets with the Don't Fragment (DF) flag set; if a packet is too large for a link, an ICMP 'Fragmentation Needed' message is returned, and the sender reduces the packet size. This process is essential for efficient data transfer and is defined in RFC 1191 for IPv4 and RFC 8201 for IPv6.

Why this answer

Path MTU Discovery (PMTUD) is the correct mechanism for determining the maximum transmission unit along a network path. It uses the Don't Fragment (DF) flag in IP packets; when a router cannot forward a packet because it exceeds the next link's MTU, it sends an ICMP Fragmentation Needed message back to the sender. The sender then reduces the packet size.

This process avoids fragmentation and optimizes performance. ARP, DHCP, and DNS serve different purposes and are not involved in MTU discovery.

Exam trap

The trap here is assuming that any protocol that sends small packets, like ICMP ping, is automatically performing MTU discovery, when in fact PMTUD requires specific DF flags and ICMP error handling.

Practice this question →

16

MCQeasy

A junior administrator is asked to identify the default administrative distance values used by a Palo Alto Networks firewall for routes learned from different sources. Which statement correctly identifies the default administrative distance for OSPF internal routes?

A.30

B.120

C.10

D.110

AnswerA

Palo Alto Networks PAN-OS assigns a default administrative distance of 30 to OSPF internal routes. This value determines route preference when multiple routing sources provide a path to the same destination. Recognizing this default is essential when troubleshooting why a particular route is or is not installed in the virtual router's forwarding table.

Why this answer

PAN-OS uses a default administrative distance of 30 for OSPF internal routes, which is lower than values for RIP or eBGP but higher than static or connected routes. This preference order ensures that more trusted or directly configured paths win when multiple sources advertise the same prefix, which is critical for predictable routing behavior on the firewall.

Exam trap

The trap here is assuming that PAN-OS uses the same OSPF administrative distance as other vendors, such as 110, instead of verifying the PAN-OS-specific default of 30.

Practice this question →

17

MCQmedium

An administrator is assigning IPv4 addresses to devices in a lab subnet. One host must be configured so that it can always be reached at the same address by other lab systems, and it must not depend on a DHCP server being available. Which configuration approach should the administrator use?

A.Configure the host with a static IP address, subnet mask, and default gateway.

B.Configure the host to obtain an address automatically with a short lease time.

C.Reserve the address on the DHCP server using the host's MAC address.

D.Enable APIPA so the host self-assigns an address from 169.254.0.0/16.

AnswerA

A static configuration assigns the address directly on the host, so the device keeps the same IPv4 address regardless of whether a DHCP server exists. This guarantees the predictable reachability the lab requires and removes dependency on lease renewal. It is exactly the right approach when a host must always be found at a known address and DHCP availability cannot be assumed.

Why this answer

A static IP configuration writes the address, mask, and gateway directly into the host, so the device always uses the same address whether or not a DHCP server is running. That satisfies both requirements: predictable reachability and independence from DHCP. Reservations and automatic leases still require the DHCP server, and APIPA produces non-routable link-local addresses.

Exam trap

The trap here is treating a DHCP reservation as equivalent to a static address, when a reservation still depends on the DHCP server being reachable.

Practice this question →

18

MCQeasy

A cybersecurity apprentice is examining a suspicious packet capture. The captured frame shows a source MAC address of 00:1A:2B:3C:4D:5E, a destination MAC address of FF:FF:FF:FF:FF:FF, and an EtherType value of 0x0806. Based on these layer 2 header fields, which type of traffic is this?

A.An IPv4 multicast packet delivering a UDP datagram

B.A VLAN-tagged frame carrying internetwork control traffic

C.An IPv6 neighbor solicitation sent to a solicited-node address

D.An ARP request broadcast to the local subnet

AnswerD

EtherType 0x0806 identifies the Address Resolution Protocol, and the destination MAC FF:FF:FF:FF:FF:FF is the layer 2 broadcast address. ARP requests are broadcast so every host on the local segment can inspect the request and determine whether it owns the IPv4 address being queried. These two header values together uniquely identify this frame as an ARP request.

Why this answer

The combination of the all-ones destination MAC address and EtherType 0x0806 is the signature of an Address Resolution Protocol request. ARP operates at the boundary between layer 2 and layer 3: a host that knows a target IPv4 address but not its MAC address broadcasts the request so the owner of that address can reply with its hardware address, allowing the sending host to populate its ARP cache and forward the frame.

Exam trap

The trap here is assuming that any broadcast frame must be a DHCP or discovery broadcast, when the EtherType field alone tells you which protocol is encapsulated.

Practice this question →

19

MCQmedium

A network engineer needs to configure a redundant path for outbound traffic using static routes with different metrics (administrative distances). If the primary route has a metric of 10, what metric should be assigned to the backup static route to ensure it is only used when the primary route fails?

A.A metric lower than 10 (e.g., 5)

B.A metric of 0

C.A metric higher than 10 (e.g., 20)

D.The exact same metric of 10 to enable equal-cost multi-path (ECMP)

AnswerC

Administrative distance ranks route trustworthiness; the lower value wins. Assigning the backup a higher metric than 10, such as 20, keeps it out of the routing table while the primary remains reachable, so it installs only after the primary fails.

Why this answer

Static routes use administrative distance (AD) or metric to rank preference — the lower the value, the more preferred the route. To make a backup route used only when the primary fails, it must have a higher metric than the primary. With the primary at 10, assigning the backup 20 ensures the router installs the primary in the routing table and only falls back to the backup when the primary route is withdrawn (e.g., interface down or next-hop unreachable).

Exam trap

Cybersecurity-Apprentice often tests the direction of metric preference — candidates who forget that lower AD wins will pick the lower number thinking 'backup should be smaller,' which is exactly backwards.

How to eliminate wrong answers

Option A is wrong because a metric lower than 10 (e.g., 5) would make the backup route preferred over the primary, inverting the intended design — the 'backup' would become the active path. Option B is wrong because a metric of 0 is the most preferred value possible and is typically reserved for connected/directly attached routes; assigning it to a static backup would make it win over the primary. Option D is wrong because equal metrics enable ECMP, which load-balances traffic across both paths simultaneously rather than providing a standby-only failover path.

Practice this question →

20

MCQmedium

A company is deploying a new VoIP phone system. The network administrator needs to ensure that voice traffic is prioritized over regular data traffic on the LAN. Which technology should be implemented on the switches to achieve this?

A.Link aggregation

B.Port mirroring

C.VLAN tagging

D.Quality of Service (QoS)

AnswerD

QoS mechanisms classify and prioritize traffic, ensuring that latency-sensitive voice packets are forwarded ahead of less critical data. By configuring QoS on switches, administrators can assign voice traffic to a high-priority queue, reducing jitter and delay. This is the standard method for prioritizing VoIP traffic on a LAN.

Why this answer

To prioritize voice traffic over data on a LAN, Quality of Service (QoS) must be implemented. QoS classifies packets and places voice traffic in a higher-priority queue, ensuring timely delivery. VLAN tagging, port mirroring, and link aggregation do not provide prioritization, so they are not suitable for this requirement.

Exam trap

The trap here is assuming that placing voice in a separate VLAN automatically prioritizes it, but VLANs alone do not provide QoS.

Practice this question →

21

MCQmedium

A network administrator is setting up a new branch office firewall. The ISP provides a single public IP address and requires the branch's internal web server (10.1.1.10) to be reachable from the internet on TCP port 443. The administrator configures a destination NAT rule translating the public IP to 10.1.1.10. However, external users still cannot access the web server. What is the most likely missing configuration?

A.An application override policy to identify HTTPS traffic on port 443.

B.A security policy allowing traffic from the untrust zone to the trust zone on port 443.

C.A source NAT rule to translate the internal server's IP to the public IP for return traffic.

D.A static route pointing to the ISP gateway for the server's subnet.

AnswerB

Destination NAT only translates the address; it does not permit traffic. The firewall still evaluates a security policy based on the post-NAT destination zone and address. If no rule allows untrust-to-trust traffic on TCP 443 to the server, the packet is dropped. This is the classic missing step after configuring DNAT.

Why this answer

After configuring destination NAT, the firewall still enforces security policy. The policy must allow the translated traffic from the untrust zone to the trust zone on the correct port. Without it, the packet is dropped.

Source NAT, static routes, or application overrides are not needed for basic inbound access to a directly connected server.

Exam trap

The trap here is assuming that NAT alone permits traffic, forgetting that security policy is evaluated after NAT and must explicitly allow the flow.

Practice this question →

22

Multi-Selectmedium

A junior administrator is documenting the corporate network and must list services that operate at the transport layer of the TCP/IP model. Which TWO protocols operate at the transport layer? (Choose two.)

Select 2 answers

A.IP

B.Ethernet

C.UDP

D.HTTP

E.TCP

AnswersC, E

User Datagram Protocol operates at the transport layer and provides connectionless, best-effort delivery with minimal overhead. It uses port numbers for multiplexing but omits handshakes, acknowledgments, and retransmissions. Protocols such as DNS, DHCP, and voice traffic often rely on UDP, making it a correct transport-layer entry for the administrator's documentation.

Why this answer

The transport layer is responsible for end-to-end delivery between applications, using port numbers to identify processes and offering different service levels. TCP provides reliable, connection-oriented delivery, while UDP provides lightweight, connectionless delivery. Both are transport-layer protocols.

IP belongs to the network layer, Ethernet to the link layer, and HTTP to the application layer.

Exam trap

The trap here is grouping protocols by what they carry rather than by the layer whose functions they actually implement.

Practice this question →

23

MCQeasy

A junior administrator is documenting the TCP/IP model layers for a training manual. The administrator needs to map the OSI model's Transport layer to its equivalent layer in the TCP/IP model. Which layer of the TCP/IP model corresponds to the OSI Transport layer?

A.Transport layer

B.Network Access layer

C.Application layer

D.Internet layer

AnswerA

In the TCP/IP model, the Transport layer directly corresponds to the OSI Transport layer. It provides end-to-end communication, segmentation, and optionally reliable delivery via TCP or lightweight datagram service via UDP. This layer uses port numbers to identify application endpoints, making it the correct mapping for the OSI Transport layer in documentation and troubleshooting discussions.

Why this answer

The TCP/IP model's Transport layer is the direct counterpart to the OSI Transport layer. Both handle end-to-end data transfer, segmentation, and port addressing. The Internet layer aligns with OSI Network, while the Network Access layer covers OSI Data Link and Physical.

The Application layer aggregates the top three OSI layers. Correctly mapping these layers is essential for troubleshooting and for understanding where protocols like TCP and UDP operate.

Exam trap

The trap here is assuming that the TCP/IP model has a one-to-one layer count with OSI, leading to misalignment of the Transport layer.

Practice this question →

24

MCQmedium

An administrator configures a Virtual Wire (VWire) interface pair on a Palo Alto Networks firewall. Traffic passing between the two VWire interfaces is intermittently failing. Upon checking, the administrator realizes VLAN tags are being stripped or not matched properly. What setting should be checked in the VWire object configuration?

A.VLAN tagging and subinterface bindings on the Virtual Wire object

B.DHCP relay agent configuration

C.Virtual Router next-hop IP addresses

D.NAT Destination translation rules

AnswerA

VLAN tags must be explicitly permitted on the Virtual Wire object; by default a VWire drops tagged frames. Enabling VLAN tagging and binding subinterfaces lets the firewall match and forward tagged traffic, resolving the intermittent failures caused by stripped or unmatched tags.

Why this answer

A Virtual Wire (VWire) on a Palo Alto Networks firewall binds two physical interfaces into a transparent Layer 2 path, so the firewall inspects traffic without participating in routing or NAT. When VLAN-tagged frames traverse a VWire, the firewall must be told how to handle those tags — either to pass them through or to match them to subinterfaces. The VLAN tagging and subinterface bindings on the Virtual Wire object control this behaviour, so misconfiguration there directly explains intermittent tag-stripping or tag-mismatch failures.

Exam trap

The trap here is assuming VWire behaves like a routed interface and therefore requires Virtual Router or NAT configuration — candidates who don't recognize VWire as a Layer 2 transparent mode pick options C or D.

How to eliminate wrong answers

Option B is wrong because a DHCP relay agent forwards DHCP DISCOVER/REQUEST messages between subnets — it has no bearing on how VLAN tags are preserved or matched on a VWire. Option C is wrong because VWire interfaces are transparent and do not use a Virtual Router for next-hop forwarding; next-hop IPs are irrelevant in a Layer 2 VWire deployment. Option D is wrong because NAT destination translation rewrites IP headers, not 802.1Q VLAN tags, and NAT is not applied on a VWire unless explicitly configured — it cannot cause tag stripping.

Practice this question →

25

MCQmedium

An engineer is configuring a new Layer 3 interface on a Palo Alto Networks firewall and needs to ensure that the interface responds to ICMP echo requests for diagnostic purposes. Where must the administrator enable this setting?

A.A Security Policy rule with an application of 'ping'

B.An Interface Management Profile assigned to the interface

C.A Zone Protection Profile applied to the egress zone

D.The Device > Setup > Management tab

AnswerB

An Interface Management Profile defines which management services, including ICMP, the interface answers. Assigning the profile to the Layer 3 interface enables ping replies for diagnostics; the setting is not enabled by default on dataplane interfaces.

Why this answer

To allow a Palo Alto Networks firewall interface to respond to ICMP echo requests (ping) for diagnostics, an Interface Management Profile must be created and assigned to that interface. The profile explicitly enables management services like Ping, Telnet, SSH, HTTP, HTTPS, and SNMP on the interface.

Exam trap

Cybersecurity-Apprentice often tests whether candidates confuse Security Policy rules (which govern transit traffic) with Interface Management Profiles (which govern traffic destined to the firewall itself), so 'ping' security policy rules are a common wrong answer.

How to eliminate wrong answers

Option A is wrong because a Security Policy rule with application 'ping' controls whether traffic is permitted through the firewall, not whether the firewall itself responds to pings directed at its own interface IP. Option C is wrong because a Zone Protection Profile protects against flood and reconnaissance attacks at the zone level; it does not enable ICMP responses on an interface. Option D is wrong because Device > Setup > Management configures global management services (like the management interface), not per-interface ICMP response settings.

Practice this question →

26

Multi-Selectmedium

A security analyst is reviewing how data moves through the TCP/IP stack. She needs to identify TWO protocols that operate at the Transport layer and provide end-to-end communication between applications on different hosts. (Choose two.)

Select 2 answers

A.ARP

B.TCP

C.ICMP

D.IP

E.UDP

AnswersB, E

TCP operates at the Transport layer and provides reliable, connection-oriented, end-to-end communication using sequence numbers, acknowledgments, and retransmissions. It is directly relevant to the analyst's task because it delivers data between applications across hosts. Its connection-oriented nature and flow control make it a core transport protocol alongside UDP.

Why this answer

TCP and UDP are the two core Transport layer protocols in the TCP/IP model. TCP provides reliable, connection-oriented delivery, while UDP offers connectionless, best-effort delivery. Both use port numbers to multiplex application data between hosts.

IP and ICMP work at the Internet layer, and ARP resolves link-layer addresses, so none of those provide the end-to-end application transport the analyst requires.

Exam trap

The trap here is selecting IP because it carries application data across networks, when IP actually operates at the Internet layer rather than the Transport layer.

Practice this question →

27

MCQeasy

An administrator needs to configure a static route on a Palo Alto Networks firewall so that traffic destined for a remote subnet (192.168.10.0/24) reaches its next-hop router (10.0.0.1). Which menu path must the administrator navigate to configure this?

A.Device > Setup > Operations > Routing

B.Network > Interfaces > Ethernet > Static Route

C.Network > Virtual Routers > [Virtual Router Name] > Static Routes

D.Policies > Routing > Static

AnswerC

Static routes on Palo Alto Networks firewalls live under the virtual router, not the interface or zone. Binding the route to the correct virtual router ensures the next-hop 10.0.0.1 is reachable within that routing instance.

Why this answer

On a Palo Alto Networks firewall, static routes are configured under the virtual router. The correct path is Network > Virtual Routers > [Virtual Router Name] > Static Routes, where you define the destination subnet (192.168.10.0/24) and the next-hop IP (10.0.0.1). This is the standard PAN-OS navigation for static routing.

Exam trap

The Cybersecurity-Apprentice exam often tests PAN-OS menu navigation — candidates who are familiar with other firewall vendors (Cisco, Fortinet) may guess interface-level or policy-level paths, but PAN-OS centralizes routing under Network > Virtual Routers.

How to eliminate wrong answers

Option A is wrong because Device > Setup > Operations > Routing does not exist as a static route configuration path — Device > Setup is for system-level settings like management interface and software updates, not routing tables. Option B is wrong because Network > Interfaces > Ethernet > Static Route is not a valid path — interface configuration is for Layer 2/3 interface settings, not route entries. Option D is wrong because Policies > Routing > Static does not exist — the Policies tab is for security, NAT, and QoS policies, not routing configuration.

Practice this question →

28

MCQeasy

An administrator is configuring a new Layer 2 subinterface on a Palo Alto Networks firewall and needs to associate it with an existing VLAN ID. Where is the VLAN tag specified for a Layer 2 subinterface?

A.In the Tag field of the Layer 2 interface configuration

B.Within the DHCP Server IP pool configuration

C.In the Virtual Router general settings

D.Inside the Zone Protection Profile assigned to the interface

AnswerA

For a Layer 2 subinterface, the VLAN association is defined by the Tag value in the interface configuration, which binds that subinterface to the existing VLAN ID. This is the field that carries the 802.1Q tag.

Why this answer

For a Layer 2 subinterface on a Palo Alto Networks firewall, the VLAN tag is specified in the Tag field of the Layer 2 interface configuration. This field binds the subinterface to a specific 802.1Q VLAN ID so the firewall can process tagged frames correctly. The Tag field is the only place where the VLAN ID is defined for a Layer 2 subinterface.

Exam trap

Cybersecurity-Apprentice often tests whether candidates know that the VLAN ID for a Layer 2 subinterface lives in the Tag field of the interface configuration, not in DHCP, virtual router, or zone protection settings.

How to eliminate wrong answers

Option B is wrong because the DHCP Server IP pool configuration defines address assignment ranges, not VLAN tagging. Option C is wrong because Virtual Router general settings control routing behavior and interfaces, not VLAN tags on Layer 2 subinterfaces. Option D is wrong because a Zone Protection Profile provides flood and reconnaissance protection for a zone, and has no field for VLAN tagging.

Practice this question →

29

MCQeasy

A help desk technician is on a support call with a remote user whose workstation cannot reach any resources on the corporate network. The technician asks the user to run a command that will show the workstation's IP address, subnet mask, and default gateway. Which command should the user run?

A.tracert 8.8.8.8

B.ipconfig /all

C.netstat -an

D.nslookup corp-dc01

AnswerB

On Windows workstations, ipconfig /all displays the complete TCP/IP configuration for every adapter, including the IPv4 address, subnet mask, default gateway, and DHCP server details. This gives the technician the exact information needed to verify whether the workstation has a valid address, the correct mask, and a reachable gateway, making it the right first diagnostic step for this connectivity complaint.

Why this answer

When a workstation cannot reach the network, the first thing to verify is its own IP configuration. Running ipconfig /all on Windows shows the IPv4 address, subnet mask, default gateway, DNS servers, and DHCP lease information in one output. That lets the technician confirm whether the host has a valid address on the correct subnet and a gateway it can actually use.

Exam trap

The trap here is assuming any connectivity command will do, when only the one that prints local adapter addressing and gateway information answers the question.

Practice this question →

30

MCQmedium

A network administrator is troubleshooting a connectivity issue between two hosts on the same VLAN. The hosts are connected to the same switch, but they cannot ping each other. The administrator suspects a Layer 2 problem. Which command should be used on the switch to verify the MAC address table and confirm that the switch has learned the MAC addresses of both hosts?

A.show mac address-table

B.show ip route

C.show arp

D.show interface status

AnswerA

This command displays the MAC address table, which maps MAC addresses to switch ports. By verifying that both hosts' MAC addresses are present and associated with the correct ports, the administrator can confirm whether the switch has learned their locations. If a MAC address is missing, it indicates a learning or connectivity issue.

Why this answer

To diagnose a Layer 2 connectivity issue between hosts on the same VLAN, the administrator should check the switch's MAC address table using the show mac address-table command. This verifies whether the switch has learned the MAC addresses and on which ports they reside. Other commands like show arp or show ip route operate at Layer 3 and are not relevant for this Layer 2 problem.

Exam trap

The trap here is confusing the ARP cache with the MAC address table; ARP operates at Layer 3 and does not show switch port associations.

Practice this question →

31

MCQhard

A network technician is configuring a small branch office where the ISP provides a single public IPv4 address. Multiple internal hosts must reach the internet simultaneously using that one address. Which technology should the technician implement?

A.Network Address Translation (NAT)

B.Virtual LAN (VLAN) tagging

C.Link Aggregation (LACP)

D.Spanning Tree Protocol (STP)

AnswerA

NAT allows many internal hosts with private addresses to share one public IPv4 address by translating source addresses and tracking port mappings. This directly solves the branch office problem, where the ISP supplies only a single public address but numerous devices need concurrent internet access. It conserves public addresses and is the standard mechanism for this exact scenario.

Why this answer

NAT lets a router translate private internal addresses to a single public address, tracking each conversation by port so many hosts can share one connection. That matches the branch office situation exactly: the ISP supplies one public IPv4 address, but numerous devices need simultaneous internet access. VLANs, link aggregation, and STP solve segmentation, bandwidth, and loop problems, not address sharing.

Exam trap

The trap here is selecting a Layer 2 switching feature for a problem that is fundamentally about Layer 3 address translation.

Practice this question →

32

Multi-Selecteasy

Which TWO protocols are commonly used for device management and administrative access on a Palo Alto Networks firewall management plane? (Choose two)

Select 2 answers

A.FTP

B.Telnet

C.SSH

D.HTTP

E.HTTPS

AnswersC, E

SSH provides encrypted command-line administrative access to the Palo Alto Networks management plane, satisfying the requirement for a secure administrative protocol. It encrypts credentials and session traffic, unlike Telnet, and is commonly enabled alongside HTTPS for firewall configuration and troubleshooting.

Why this answer

SSH (Option C) is correct because it provides encrypted command-line administrative access to the Palo Alto Networks firewall management plane, typically on port 22, and is a standard secure management protocol. HTTPS (Option E) is correct because it secures the web-based management interface (PAN-OS web UI) using TLS, commonly on port 443, and is the recommended protocol for GUI administration. FTP (Option A) is not used for management access since it is an unencrypted file-transfer protocol and lacks administrative session capabilities.

Telnet (Option B) is excluded because, although it offers remote CLI access, it is cleartext and insecure, so it is not a recommended management protocol. HTTP (Option D) is not correct because the web UI should be accessed over HTTPS rather than unencrypted HTTP.

Exam trap

Cybersecurity-Apprentice often tests the distinction between secure and insecure management protocols — candidates may pick Telnet or HTTP because they are 'common,' but the exam expects recognition that SSH and HTTPS are the secure, recommended management protocols.

Practice this question →

33

MCQmedium

A help desk technician is diagnosing a user's workstation that can reach a server by IP address but cannot reach it by hostname. The technician confirms the workstation has a valid IP address, default gateway, and can ping the server's IP successfully. Which network service should the technician investigate first?

A.DHCP lease renewal

B.Routing table corruption

C.DNS resolution

D.ARP cache poisoning

AnswerC

The ability to reach a server by IP but not by hostname strongly indicates a name resolution failure. DNS translates hostnames into IP addresses, and if DNS is misconfigured or unreachable, name-based access fails while direct IP access still works. Investigating DNS settings, server reachability, and cache entries is the logical first step here.

Why this answer

Reaching a server by IP but failing by hostname is a classic symptom of DNS failure. DNS resolves hostnames to IP addresses, so when it is unavailable or misconfigured, name-based connections fail while direct IP connections succeed. DHCP already worked because the workstation has valid configuration, ARP works because pinging succeeds, and routing works for the same reason.

DNS is the correct focus.

Exam trap

The trap here is assuming a general network outage when the ability to ping by IP already proves connectivity and points specifically to name resolution.

Practice this question →

34

MCQeasy

A help desk technician is explaining basic network concepts to a new hire. The technician needs to describe which protocol operates at the Transport layer of the OSI model and provides reliable, connection-oriented delivery. Which protocol should the technician identify?

A.TCP

B.ARP

C.ICMP

D.UDP

AnswerA

TCP operates at the Transport layer and provides reliable, connection-oriented communication. It establishes a connection through a three-way handshake, acknowledges received data, retransmits lost segments, and orders data before delivery to the application. These features make TCP suitable for applications like web browsing and email where data integrity is critical.

Why this answer

TCP is the Transport layer protocol that provides reliable, connection-oriented delivery through mechanisms such as the three-way handshake, sequence numbers, acknowledgments, and retransmissions. UDP is connectionless, while ICMP and ARP serve Network layer and address resolution functions respectively. Identifying TCP correctly is fundamental to understanding how applications achieve dependable data transfer.

Exam trap

The trap here is conflating connectionless protocols like UDP with reliable transport, or misplacing ICMP and ARP at the Transport layer instead of the Network layer or address resolution role.

Practice this question →

35

Multi-Selectmedium

An administrator needs to configure static routing on a PAN-OS Virtual Router. Which THREE parameters are required when defining a static route entry? (Choose three)

Select 3 answers

A.BGP Autonomous System Number

B.OSPF Area ID

C.Next-hop (IP address or interface)

D.Destination subnet (IP prefix)

E.Route Name

AnswersC, D, E

The next-hop defines where traffic is forwarded, specified as either an IP address or an egress interface. This satisfies the stem's requirement for a static route entry, since PAN-OS needs a destination path to install the route into the virtual router's forwarding table.

Why this answer

The three required parameters for a PAN-OS static route entry are the Route Name (E), the Destination subnet (D), and the Next-hop (C). Option E is correct because every static route in a Virtual Router must be given a unique name to identify it in the routing table and configuration. Option D is correct because a static route must specify the destination IP prefix (network/mask) that the route matches.

Option C is correct because the route must define where to forward matching traffic, either via a next-hop IP address or an egress interface. Options A and B are incorrect because BGP AS numbers and OSPF Area IDs are parameters for dynamic routing protocols, not for a static route entry.

Exam trap

Cybersecurity-Apprentice often tests the confusion between static and dynamic routing parameters, leading candidates to select BGP or OSPF-specific fields for static route configuration.

Practice this question →

36

MCQmedium

A security analyst is reviewing traffic from a workstation that has been assigned the IPv4 address 192.168.10.77 with a subnet mask of 255.255.255.192. The workstation needs to send a packet to 192.168.10.130. What will the workstation do with this packet?

A.Forward it to the default gateway's MAC address for routing

B.Drop the packet because the destination is on a different subnet

C.Broadcast the packet to the entire 192.168.10.0/24 network

D.Send it directly to 192.168.10.130 after resolving its MAC address with ARP

AnswerA

The mask 255.255.255.192 creates subnets of 64 addresses. The workstation at 192.168.10.77 belongs to the 192.168.10.64 subnet, whose usable range ends at 192.168.10.126, so 192.168.10.130 is off-subnet. The host therefore ARPs for its configured default gateway and sends the frame there, letting the router forward the packet toward the destination.

Why this answer

Subnetting determines whether a destination is local or remote. With a /26 mask, the workstation's subnet is 192.168.10.64/26, so 192.168.10.130 falls in the adjacent 192.168.10.128/26 subnet. Because the destination is not local, the host resolves the default gateway's MAC address and forwards the frame to it, and the router then routes the packet onward.

Exam trap

The trap here is assuming the entire 192.168.10.0/24 range is one subnet, when the /26 mask actually splits it into four separate subnets.

Practice this question →

37

MCQhard

A network engineer is troubleshooting an issue where a Palo Alto Networks firewall is not installing a static route into the virtual router's forwarding table. The route is configured with a next-hop IP address that is not directly connected to any interface on the firewall. What is the most likely reason the route is not active?

A.Static routes with a next-hop that is not directly connected are always rejected and must use an interface instead.

B.The virtual router must have OSPF enabled for any static route with an indirect next-hop to become active.

C.The static route's next-hop IP address must be reachable via a connected or other active route for the static route to be installed.

D.The static route's administrative distance is too high and must be lowered to 1 for the route to be installed.

AnswerC

PAN-OS requires that a static route's next-hop be resolvable through an active route in the virtual router. If the next-hop is not directly connected and no other route provides reachability to it, the static route remains inactive and is not installed in the forwarding table. This prevents black-holing traffic toward an unreachable next-hop.

Why this answer

For a static route to be installed in the virtual router's forwarding table, its next-hop must be reachable through an existing active route. If the next-hop is not directly connected and no other route provides a path to it, the static route stays inactive. Ensuring next-hop reachability, often via a connected or default route, is essential for the route to take effect.

Exam trap

The trap here is assuming that a static route is always installed regardless of next-hop reachability, when PAN-OS actually requires the next-hop to be resolvable through another active route.

Practice this question →

38

MCQhard

A network security analyst is troubleshooting intermittent packet drops on a high-speed trunk interface connected to a core switch. The interface is configured as Layer 3 with 1 Gbps speed and full duplex. The switch port is also set to 1 Gbps full duplex. However, FCS (Frame Check Sequence) errors are incrementing rapidly. What is the most probable cause?

A.An incorrect Zone Protection Profile flooding threshold

B.Physical layer issues such as damaged cabling, bad SFP transceivers, or electromagnetic interference

C.A mismatch in Virtual Router metric values

D.Incorrect TCP MSS adjustment on the Layer 3 interface

AnswerB

FCS errors indicate corrupted frames arriving at the interface, which speed and duplex mismatches do not cause when both ends match. Damaged cabling, faulty SFP transceivers, or electromagnetic interference corrupt the signal at the physical layer, producing exactly these errors.

Why this answer

FCS errors indicate that frames arrive with corrupted bits detected by the Frame Check Sequence at Layer 2. When speed and duplex are correctly matched on both ends (1 Gbps full duplex here), the remaining cause is almost always physical-layer signal integrity problems — damaged cables, faulty SFP optics, dirty connectors, or EMI. These corrupt the electrical/optical signal before it reaches the NIC, producing FCS/CRC errors rather than duplex-mismatch symptoms like late collisions.

Exam trap

Cybersecurity-Apprentice often tests whether candidates can distinguish Layer 1/2 symptoms (FCS/CRC errors, runts, giants) from Layer 3/4 misconfigurations (routing metrics, MSS, zone thresholds) — the trap is picking a higher-layer 'security' answer when the counter name itself points to the physical layer.

How to eliminate wrong answers

Option A is wrong because Zone Protection Profiles on Palo Alto firewalls govern flood protection thresholds (SYN, ICMP, UDP floods) at the zone level and have nothing to do with Layer 2 FCS/CRC errors on a switch trunk. Option C is wrong because Virtual Router metrics influence route selection for traffic forwarding, not physical frame integrity — a metric mismatch would cause suboptimal routing, not FCS errors. Option D is wrong because TCP MSS adjustment affects TCP segment sizing to prevent fragmentation on tunnels/VPNs; it operates at Layer 4 and cannot generate FCS errors on a Layer 2 interface.

Practice this question →

39

MCQeasy

An administrator is troubleshooting a connectivity issue between a host and a server across a Palo Alto Networks firewall. The administrator needs to verify whether the firewall is dropping the packets due to a security rule denial. Which CLI command should the administrator use to monitor packet drops in real time?

A.show system resources

B.show session all

C.show counter global filter packet-drop yes

D.show interface all

AnswerC

The `show counter global filter packet-drop yes` command streams global counters filtered to packet-drop events, revealing real-time discards including those caused by security rule denials. This directly satisfies the requirement to monitor drops live, unlike static log queries or session lookups that show only historical or per-flow state.

Why this answer

The command 'show counter global filter packet-drop yes' displays global counters related to packet drops in real time, allowing the administrator to see if the firewall is dropping packets and the reason (e.g., security policy deny, threat, etc.). This is the standard PAN-OS CLI troubleshooting command for verifying drop counters. It filters the global counter output to show only drop-related counters, which is exactly what is needed to diagnose a security rule denial.

Exam trap

Cybersecurity-Apprentice often tests the confusion between session monitoring commands ('show session all') and drop counter commands — candidates pick 'show session all' thinking it shows denied sessions, but it only shows active sessions, not drops.

How to eliminate wrong answers

Option A is wrong because 'show system resources' displays CPU, memory, and disk utilization — it does not show packet drops or security policy denials. Option B is wrong because 'show session all' lists active sessions but does not indicate whether packets are being dropped or why; it shows established flows, not denials. Option D is wrong because 'show interface all' shows interface status, counters, and errors at the interface level, but not security policy drop reasons or global drop counters.

Practice this question →

40

MCQhard

A network engineer is analyzing a packet capture and observes that a workstation sends a TCP segment with the SYN flag and a destination port of 443 to a web server. The server responds with SYN-ACK, and the workstation completes the handshake with ACK. Shortly after, the workstation sends a segment with the RST flag. Which statement best describes what the RST segment indicates in this scenario?

A.The workstation is abruptly terminating the TCP connection or rejecting further data.

B.The workstation is retransmitting a lost segment to the server.

C.The workstation is requesting a graceful, orderly shutdown of the session.

D.The workstation is negotiating encryption parameters for the session.

AnswerA

A RST flag indicates an abrupt termination of a TCP connection or rejection of an unexpected segment. In this scenario, after a successful three-way handshake on port 443, the workstation sending RST means it is tearing down the connection immediately or refusing further communication. This can result from an application closing unexpectedly or a segment arriving for a closed socket.

Why this answer

The RST flag in TCP signals an abrupt reset, terminating a connection or rejecting traffic. After a successful three-way handshake, a RST from the workstation means it is closing the session immediately or refusing further segments, often due to an application crash or a packet arriving at a closed port. FIN, by contrast, indicates graceful closure, and retransmissions or TLS negotiation use different mechanisms entirely.

Exam trap

The trap here is assuming any connection-ending packet is a graceful shutdown, when RST specifically means an abrupt reset rather than an orderly FIN exchange.

Practice this question →

41

MCQmedium

A security analyst is reviewing network traffic and observes a series of TCP packets where the flags field is set to SYN, then SYN-ACK, then ACK. The analyst needs to document the purpose of this exchange. What is the primary function of this three-way handshake?

A.To negotiate encryption algorithms before data transfer

B.To assign a dynamic IP address to a client from a pool

C.To establish a reliable, connection-oriented session between two hosts

D.To resolve an IP address to a MAC address on the local network

AnswerC

The TCP three-way handshake (SYN, SYN-ACK, ACK) establishes a reliable, connection-oriented session by synchronizing sequence numbers and confirming that both hosts are ready to communicate. It ensures bidirectional connectivity and sets up parameters for ordered, error-checked data delivery. This is the fundamental purpose of the handshake and is essential for any TCP-based application, from web browsing to email.

Why this answer

The TCP three-way handshake is designed to establish a reliable, connection-oriented session. The client sends a SYN to initiate, the server responds with SYN-ACK to acknowledge and synchronize, and the client sends an ACK to complete the process. This exchange synchronizes sequence numbers, confirms bidirectional communication, and sets the stage for reliable data transfer.

Other options describe functions of TLS, ARP, or DHCP, which are unrelated to TCP connection establishment.

Exam trap

The trap here is conflating the TCP handshake with other protocols like TLS or DHCP that also involve multi-step exchanges.

Practice this question →

42

MCQmedium

A cybersecurity apprentice is analyzing traffic captures and notices that a workstation sends a single packet to a server, and the server responds with a packet that is much larger than the original. The apprentice suspects that the network path cannot handle the larger frame size. Which protocol should the apprentice examine to confirm that the path supports the larger frame size without fragmentation?

A.ICMP

B.Path MTU Discovery (PMTUD)

C.Dynamic Host Configuration Protocol (DHCP)

D.Address Resolution Protocol (ARP)

AnswerB

Path MTU Discovery (PMTUD) is designed to determine the maximum transmission unit (MTU) along the entire path between two hosts, ensuring that packets are not fragmented. It uses ICMP 'fragmentation needed' messages to adjust the packet size. In this scenario, the large server response suggests a PMTUD issue, so examining PMTUD behavior directly addresses the problem of whether the path supports the larger frame size.

Why this answer

Path MTU Discovery (PMTUD) is the correct protocol because it actively determines the largest packet size that can traverse the network path without fragmentation. When a host sends a packet larger than the path MTU, PMTUD relies on ICMP 'fragmentation needed' messages to learn the correct size. In this scenario, the server's larger response likely triggered a PMTUD failure, so examining PMTUD is the right approach.

Exam trap

The trap here is assuming that ICMP alone is sufficient for MTU discovery, when in fact ICMP is only the signaling mechanism used by Path MTU Discovery.

Practice this question →

43

MCQeasy

A junior SOC analyst is examining a packet capture taken from a workstation that is failing to reach an internal web server. The capture shows the workstation sending a frame with destination MAC address 01:00:5E:00:00:FB and a destination IP address of 224.0.0.251. What is the workstation most likely attempting to do?

A.Initiate a TCP three-way handshake with the web server on port 80

B.Broadcast an ARP request to resolve the web server's MAC address

C.Perform a DHCPv4 broadcast to obtain a new IP lease

D.Send an IPv4 multicast packet to the mDNS group address

AnswerD

The MAC prefix 01:00:5E maps to IPv4 multicast, and the low 23 bits of 224.0.0.251 map to 00:00:FB, matching the frame. Address 224.0.0.251 is the mDNS group used for local name resolution and service discovery. The workstation is querying for the internal web server by multicast name resolution rather than by unicast DNS, which explains why a unicast web connection attempt may fail if mDNS is filtered.

Why this answer

The multicast MAC 01:00:5E:00:00:FB corresponds to IPv4 multicast group 224.0.0.251, the mDNS address. A host sending to this group is performing multicast DNS name resolution or service discovery on the local segment. Recognizing the 01:00:5E prefix and the 23-bit mapping to the IPv4 multicast range lets the analyst identify the traffic correctly and then investigate why mDNS may be blocked, causing name resolution to fail for the internal server.

Exam trap

The trap here is assuming any non-unicast frame is ARP broadcast, when the 01:00:5E prefix and 224.0.0.251 destination specifically identify IPv4 multicast mDNS.

Practice this question →

44

MCQmedium

A network engineer configures Equal-Cost Multi-Path (ECMP) routing on a Palo Alto Networks virtual router with two paths to the same destination. By default, how does PAN-OS select which path to use for a given session?

A.Round-robin packet by packet

B.Based on a hash of session parameters (IP addresses, ports, and protocol)

C.Random selection for every individual packet

D.Based on the lowest interface latency measured by ICMP probes

AnswerB

PAN-OS hashes source and destination IP addresses, ports, and protocol to pick one of the equal-cost paths, then pins that flow to it. This per-session pinning preserves packet ordering and prevents mid-session path switching, satisfying the requirement that selection stays consistent for a given session.

Why this answer

PAN-OS uses a session-based hash of the 5-tuple (source IP, destination IP, source port, destination port, protocol) to select one of the ECMP next-hops for a flow. Because the hash is deterministic per session, all packets belonging to the same session take the same path, preserving stateful inspection and avoiding out-of-order delivery. This is the default ECMP behaviour in a PAN-OS virtual router.

Exam trap

The trap is that candidates assume ECMP means per-packet load balancing (as some routers do), but PAN-OS is session-based — the exam tests whether you know that stateful firewalls must keep a flow on one path to maintain session integrity.

How to eliminate wrong answers

Option A (round-robin packet by packet) is wrong because per-packet load balancing would scatter a single session's packets across multiple paths, breaking stateful inspection and causing reordering — PAN-OS does not do this by default. Option C (random selection per packet) is wrong for the same reason: randomness per packet destroys session stickiness and is not how PAN-OS ECMP works. Option D (lowest interface latency via ICMP probes) is wrong because PAN-OS ECMP does not perform active latency probing; path selection is hash-based, and latency-based selection would require a different mechanism (e.g., policy-based forwarding with link monitoring).

Practice this question →

45

MCQmedium

A network technician is troubleshooting a connectivity issue between two hosts on the same VLAN. The technician suspects a duplicate IP address on the network. Which command should the technician use on a Windows host to display the MAC address associated with an IP address in the local ARP cache?

A.ipconfig /all

B.arp -a

C.netstat -ano

D.nslookup

AnswerB

The arp -a command displays the current ARP cache, which maps IP addresses to MAC addresses for hosts on the local subnet. If two different MAC addresses appear for the same IP, or if the MAC does not match the expected host, a duplicate IP or ARP spoofing may be present. This command is the correct tool for inspecting IP-to-MAC bindings on a Windows host.

Why this answer

The arp -a command is the standard Windows utility to view the ARP cache, which contains IP-to-MAC mappings for recently communicated hosts on the local subnet. Duplicate IP addresses often manifest as conflicting MAC entries or unexpected MAC addresses for a known IP. Other commands like ipconfig, netstat, and nslookup serve different purposes and do not expose ARP cache contents, making arp -a the correct choice for this Layer 2 troubleshooting task.

Exam trap

The trap here is confusing local IP configuration output with ARP cache inspection, assuming ipconfig shows other hosts' MAC addresses.

Practice this question →

46

MCQmedium

A help desk technician reports that a user's workstation can reach servers on the local /24 subnet but cannot reach any host on a remote subnet. The workstation has IP address 10.20.30.45/24 and default gateway 10.20.30.1. The technician runs ipconfig and sees the correct address and mask, but pinging 10.20.40.10 fails. Which troubleshooting step should the technician perform FIRST to determine whether the problem is local or beyond the gateway?

A.Ping the default gateway 10.20.30.1 from the workstation

B.Disable the Windows firewall on the workstation and retry the ping

C.Check the ARP cache for an entry for 10.20.40.10

D.Run a traceroute to 10.20.40.10 to see where packets stop

AnswerA

Pinging the default gateway is the fastest way to test Layer 3 reachability to the first hop. If the gateway replies, local IP configuration, ARP, and the access link are working, so the fault likely lies beyond the gateway. If it fails, the technician can focus on the workstation's subnet mask, VLAN, switch port, or the gateway interface itself before investigating routing on remote devices.

Why this answer

Testing the default gateway isolates the failure domain. A successful ping to 10.20.30.1 proves the workstation's IP configuration, ARP resolution, and local switching are functional, pointing the investigation toward routing or filtering beyond the first hop. A failed ping narrows the problem to the local segment, the gateway interface, or the workstation's own stack.

This first-hop test is quick, non-disruptive, and directs further effort efficiently.

Exam trap

The trap here is jumping to traceroute or firewall changes before verifying the first hop, which can send the technician down the wrong path if the gateway itself is unreachable.

Practice this question →

47

Multi-Selecteasy

An administrator is configuring a new Layer 3 interface on a Palo Alto Networks firewall. Which TWO parameters must be defined for the interface to function correctly in a routed network? (Choose two)

Select 2 answers

A.IP Address

B.Security Zone

C.DHCP Server Scope

D.MAC Address Override

E.Virtual Wire Pair Identifier

AnswersA, B

A routed Layer 3 interface needs an IP address to participate in the network, providing the logical identifier for forwarding and next-hop reachability. Without it, the interface cannot route traffic between subnets, so the address is mandatory alongside the zone assignment.

Why this answer

Option A (IP Address) is correct because a Layer 3 interface on a Palo Alto Networks firewall must be assigned an IPv4 or IPv6 address (or be configured as DHCP client) to participate in a routed network and forward traffic between subnets. Option B (Security Zone) is correct because every Layer 3 interface must be bound to a security zone, which defines the trust level and the security policy rules that govern traffic entering and leaving that interface. Option C (DHCP Server Scope) is incorrect because a DHCP server scope is only needed if the firewall itself is acting as a DHCP server for clients, not for basic Layer 3 routed operation.

Option D (MAC Address Override) is incorrect because overriding the interface MAC address is an optional feature for specific scenarios like ISP requirements or HA, not a mandatory parameter. Option E (Virtual Wire Pair Identifier) is incorrect because virtual wire pairs are used for Layer 2 transparent (tap) deployments, not for Layer 3 routed interfaces.

Exam trap

The trap is that candidates may select optional features like DHCP scope or MAC override as 'required' because they appear in the interface configuration GUI — the exam tests whether you know the true minimum parameters (IP address and zone) for a routed interface.

Practice this question →

48

MCQhard

An analyst is troubleshooting why a workstation with IP address 172.16.5.20/24 cannot communicate with a server at 172.16.6.10/24, even though both are connected to the same Layer 2 switch and the switch shows both ports up. The analyst confirms there are no VLAN or ACL restrictions. Which network fundamental best explains the failure?

A.The switch is blocking traffic because the MAC address table has not learned the server's MAC address

B.The server's /24 mask is too large and causes it to treat the workstation as local

C.The two hosts are on different IP subnets and require a router or Layer 3 device to communicate

D.The workstation is using the wrong default gateway, which prevents ARP from resolving the server

AnswerC

Although both hosts share a physical switch, 172.16.5.20/24 and 172.16.6.10/24 belong to different subnets. A host sends directly only to destinations within its own subnet; for anything else it forwards to its default gateway. If no Layer 3 device routes between the subnets, the workstation cannot reach the server, and ARP for the server will go unanswered on the local segment.

Why this answer

IP communication depends on subnet boundaries, not physical topology. Hosts on 172.16.5.0/24 and 172.16.6.0/24 are on separate logical networks even when cabled to the same switch. A host forwards off-subnet traffic to its default gateway, so without a router or Layer 3 switch providing inter-subnet routing, the two hosts cannot exchange packets.

Confirming subnet membership and the presence of a Layer 3 path is essential before blaming switching or ACLs.

Exam trap

The trap here is assuming that sharing a physical switch means hosts can communicate, when different IP subnets always require a Layer 3 forwarding device.

Practice this question →

49

MCQmedium

An administrator has configured BGP on a Palo Alto Networks virtual router, but the BGP peers are stuck in the 'Idle' state. What is the most likely configuration error causing this status?

A.An incorrect peer AS number or incorrect peer IP address configuration

B.An AS-path loop detection trigger

C.MD5 authentication password mismatch during OPEN message exchange

D.BGP route reflection timer expiration

AnswerA

BGP peers remain in Idle when the local router cannot establish a TCP session or rejects the neighbour, typically because the configured peer IP address or remote AS number is wrong. Correcting these parameters lets the peer advance through Connect and OpenSent.

Why this answer

BGP peers stuck in the Idle state means the router has not even begun the TCP connection or has repeatedly failed to establish one, which most commonly results from a misconfigured peer IP address or peer AS number. If the peer address is wrong, the TCP session to port 179 never forms; if the peer AS number is wrong, the OPEN message is rejected and the session tears down back to Idle. Both are fundamental peer configuration errors that prevent the BGP finite state machine from progressing.

Exam trap

The trap is confusing the BGP state where a fault appears; candidates pick MD5 mismatch or AS-path loop because they sound like BGP errors, but those manifest in later states, while Idle points to basic peer reachability or AS configuration errors.

How to eliminate wrong answers

Option B is wrong because AS-path loop detection occurs after the session is established and routes are exchanged; it would cause route rejection, not an Idle peer state. Option C is wrong because an MD5 password mismatch is detected during the OPEN message exchange, which would leave the peer in a different state such as Connect or Active/OpenSent, not Idle. Option D is wrong because BGP route reflection is a route-distribution mechanism within an AS and has no timer that would drive a peer to Idle; there is no such thing as a route reflection timer expiration causing Idle.

Practice this question →

50

MCQeasy

A new administrator is documenting the address scheme of a small office network. She notes that workstations use addresses in the 192.168.1.0/24 range and that these addresses are not routable on the public Internet. Which type of address is she documenting?

A.Private IP addresses

B.Public IP addresses

C.Multicast addresses

D.Loopback addresses

AnswerA

Private IP addresses, defined in RFC 1918, include the 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 ranges. The 192.168.1.0/24 network the administrator documents falls within the 192.168.0.0/16 private range, and these addresses are not routable on the public Internet, requiring NAT for external communication. This matches the scenario exactly.

Why this answer

The 192.168.1.0/24 range falls within the RFC 1918 private address space, specifically 192.168.0.0/16. Private addresses are not routable on the public Internet and require network address translation to communicate externally. Public addresses are globally routable, multicast addresses serve groups, and loopback addresses refer to the local host, so only the private designation fits the administrator's observation.

Exam trap

The trap here is assuming any address usable on a LAN is public, when 192.168.0.0/16 is specifically reserved as private and never routed on the Internet.

Practice this question →

51

Multi-Selectmedium

An administrator is configuring OSPF on a Palo Alto Networks virtual router. Which THREE parameters must match between OSPF routers for an adjacency to form successfully? (Choose three)

Select 3 answers

A.Process ID

B.Hello and Dead timer intervals

C.Router ID

D.Authentication type and password

E.Area ID

AnswersB, D, E

OSPF neighbours exchange Hello packets to discover each other and detect failures; mismatched Hello or Dead intervals prevent the neighbour state machine from progressing past Init, so no adjacency forms. Matching these timers is a mandatory prerequisite for adjacency on the Palo Alto Networks virtual router.

Why this answer

Option B (Hello and Dead timer intervals) is correct because OSPF neighbors must agree on the Hello interval and Dead interval on the interface; mismatched timers prevent Hello packets from being accepted and the adjacency never reaches 2-Way/Full. Option D (Authentication type and password) is correct because if authentication is configured, both routers must use the same authentication type (e.g., MD5 or SHA) and matching key/password, otherwise OSPF packets fail authentication and are discarded. Option E (Area ID) is correct because two OSPF routers can only form an adjacency if their interfaces belong to the same OSPF area, since the Area ID is carried in the Hello packet and must match.

Option A (Process ID) is not required to match because the OSPF process ID is locally significant to the router and is not carried in Hello packets. Option C (Router ID) is not required to match because each OSPF router must have a unique Router ID within the OSPF domain; duplicate Router IDs actually cause adjacency problems rather than being a requirement.

Exam trap

The trap here is assuming the OSPF Process ID must match between neighbors — many candidates confuse it with the Area ID or Router ID, but the Process ID is purely local and never exchanged in Hello packets.

Practice this question →

52

MCQeasy

An administrator needs to verify the MAC address associated with a specific IP address on the local network segment using the firewall CLI. Which command should be executed?

A.show mac-table all

B.show interface ip

C.show arp all

D.show routing route

AnswerC

The 'show arp all' command displays the firewall's complete ARP table, listing each IP address mapped to its corresponding MAC address on the local segment. This directly satisfies the requirement to verify the MAC address associated with a specific IP.

Why this answer

The 'show arp all' command displays the ARP cache, which maps IP addresses to MAC addresses on the local network segment. This is the correct way to verify the MAC address associated with a specific IP on a Palo Alto Networks firewall CLI. ARP entries are populated dynamically as the firewall communicates with hosts on the same subnet.

Exam trap

The trap is confusing the ARP table (IP-to-MAC mapping) with the MAC address table (MAC-to-port mapping) or routing table — candidates often pick 'show mac-table' thinking it shows MAC addresses for IPs.

How to eliminate wrong answers

Option A is wrong because 'show mac-table all' displays the MAC address table (CAM table) used for Layer 2 switching, not the IP-to-MAC mapping — that is ARP's role. Option B is wrong because 'show interface ip' displays IP configuration of interfaces, not ARP mappings. Option D is wrong because 'show routing route' displays the routing table (Layer 3 paths), not MAC address associations.

Practice this question →

53

MCQhard

An administrator is troubleshooting a scenario where BGP routes learned from a peer are not being installed in the Virtual Router's routing table. Upon checking the BGP routing table ('show routing protocol bgp rib-in'), the routes are visible, but they are marked as not best. What is the most common reason for a learned BGP route not to be selected as the best path?

A.The firewall's management plane CPU is exceeding 90% utilization.

B.The next-hop IP address advertised by the BGP peer is unreachable in the routing table.

C.The BGP peer is configured in a different autonomous system.

D.The Virtual Router does not have OSPF enabled.

AnswerB

BGP best-path selection first validates the NEXT_HOP attribute; if the advertised next-hop address has no resolving route in the Routing Information Base, the route stays in rib-in but is marked not-best and never installed. Fixing reachability (static route, IGP, or next-hop-self) restores eligibility.

Why this answer

The most common reason a BGP route appears in the RIB-in but is not selected as best is that the next-hop IP address is unreachable. BGP best-path selection requires a valid, reachable next hop; if the next hop cannot be resolved in the routing table (or via a connected/static route), the route is marked as not best and not installed in the forwarding table.

Exam trap

Cybersecurity-Apprentice often tests whether candidates understand that BGP best-path selection is gated by next-hop reachability, not by AS numbers or IGP presence, leading them to pick plausible but incorrect options like OSPF or CPU load.

How to eliminate wrong answers

Option A is wrong because high management-plane CPU may slow BGP processing but does not by itself cause routes to be marked not best. Option C is wrong because BGP peers in different autonomous systems is normal eBGP operation, not a reason for best-path rejection. Option D is wrong because OSPF is not required for BGP to function; BGP can use static or other IGP routes for next-hop resolution.

Practice this question →

54

Multi-Selecteasy

Which TWO methods are valid ways to access the Command Line Interface (CLI) of a Palo Alto Networks firewall? (Choose two)

Select 2 answers

A.Serial Console connection using a terminal emulator

B.FTP file transfer session on port 21

C.Telnet connection to any data plane interface

D.SSH to the firewall management IP address

E.HTTPS web browser session on port 443

AnswersA, D

A serial console connection via terminal emulator gives out-of-band CLI access through the physical RJ-45 or micro-USB port, working even when management interfaces are unreachable. This satisfies the requirement for a valid CLI access method independent of network configuration.

Why this answer

Option A is correct because a serial console connection using a terminal emulator (typically 9600-8-N-1 on the console/RJ-45 or USB console port) provides direct out-of-band CLI access to the firewall, which is essential for initial configuration and recovery when network access is unavailable. Option D is correct because SSH to the firewall's management IP address on TCP port 22 is the standard in-band method for remotely accessing the CLI, and it is permitted only on the management interface per Palo Alto Networks' management-plane design. Option B is incorrect because FTP on port 21 is a file transfer protocol and does not provide an interactive CLI session.

Option C is incorrect because Telnet is not a supported management protocol on Palo Alto Networks firewalls, and CLI management access is restricted to the management interface, not arbitrary data plane interfaces. Option E is incorrect because an HTTPS session on port 443 accesses the web-based management UI (PAN-OS web interface), not the Command Line Interface.

Exam trap

Cybersecurity-Apprentice often tests whether candidates confuse CLI access methods (serial console, SSH) with web UI access (HTTPS) or unsupported protocols (Telnet, FTP).

Practice this question →

55

Multi-Selectmedium

An administrator is configuring NAT on a Palo Alto Networks firewall. Which THREE address types can be used as translation sources in a Source NAT rule? (Choose three)

Select 3 answers

A.VLAN Subinterface Tag

B.Port Forwarding Pool

C.Static IP

D.Dynamic IP and Port (DIPP)

E.Dynamic IP

AnswersC, D, E

Static IP is a valid Source NAT translation type, mapping one internal address to one fixed public address persistently. It differs from dynamic IP, which draws from a pool, and from dynamic IP and port, which also translates the source port for many-to-few overloading.

Why this answer

In a Palo Alto Networks Source NAT rule, the translated source address can be configured as Static IP (C), which maps each original source address to a fixed one-to-one translated address; Dynamic IP (E), which translates to an address from a pool without port translation (typically one-to-one or many-to-one without PAT); and Dynamic IP and Port (DIPP) (D), which performs PAT by translating both address and port so many hosts can share a pool of addresses. These three are the standard translation types offered in the Source NAT configuration under the Translated Source field. The unmarked options do not belong: VLAN Subinterface Tag (A) is an interface/zone attribute, not a NAT translation address type, and Port Forwarding Pool (B) is associated with Destination NAT (port forwarding), not Source NAT translation sources.

Exam trap

The trap here is confusing Source NAT translation types with Destination NAT or other features. Candidates might select 'Port Forwarding Pool' thinking it's a source NAT option, but it is actually a destination NAT feature. Also, 'VLAN Subinterface Tag' is a distractor from networking concepts unrelated to NAT.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Network Fundamentals questions.

Start 20-question session