Network Security practice questions

Convert all layer 3 interfaces into virtual wire interfaces.

Why it fails: Virtual wire interfaces still enforce stateful inspection unless explicitly bypassed.

Enable 'Strict-ID' checking in the Zone Protection Profile.

Why it fails: Strict-ID increases security checks, which worsens asymmetric drops.

Configure a custom application override rule for the affected traffic.

Why it fails: Application override skips App-ID inspection, it does not resolve stateful asymmetric drops.

External Dynamic List

Why it fails: External Dynamic Lists import IP lists dynamically from external web servers, not manual static groupings.

Application Group

Why it fails: Application groups group App-IDs, not IP addresses.

Service Object

Why it fails: Service objects define TCP/UDP ports and protocols, not IP addresses.

Loopback Interface

Why it fails: Loopback interfaces are logical interfaces used for management and routing protocols.

Layer 3 Interface

Why it fails: Layer 3 interfaces process IP packets and require IP addresses and routing.

Virtual Wire Interface

Why it fails: Virtual wire binds two ports together purely inline without MAC bridging tables.

Objects > Security Profiles > Decryption

Why it fails: Decryption profiles apply to transit data plane traffic, not firewall management interfaces.

Network > Interfaces > Management > Zone Protection Profile

Why it fails: Zone protection profiles apply to data plane traffic zones, not management web servers.

Policies > Decryption > Rulebase

Why it fails: Decryption rules enforce policy for traversing user traffic, not local management daemons.

show running-config security-rules

Why it fails: This outputs the XML/text configuration of security rules without live evaluation.

debug dataplane packet-log dump

Why it fails: This is a packet capture debugging syntax, not a policy evaluation command.

show system resources active-sessions

Why it fails: This command displays CPU/memory or active session counts, not policy rule evaluation.

Phishing credential harvesting

Why it fails: Phishing is handled via URL Filtering credential defense, not Zone Protection.

SQL injection exploits

Why it fails: SQL injections are application-layer web attacks mitigated by Vulnerability Protection/WildFire, not Zone Protection.

HA-1 Backup Interface

Why it fails: HA-1 backup interfaces use IP addresses for heartbeat communication, but HA control links are distinct from data/loopback interfaces. Wait, HA interfaces do require IPs, but the standard primary network interface answers are Layer 3 and Loopback. Let's look at standard PAN-OS interface types: Layer 3, Layer 2, Virtual Wire, Tap, Loopback. Out of standard data/logical interfaces, Layer 3 and Loopback require IPs.

Layer 2 Interface

Why it fails: Layer 2 interfaces connect to switches and do not require IP addresses on the interface.

Virtual Wire Interface

Why it fails: Virtual wire interfaces operate inline at Layer 1/2 without IP addresses.

Both firewalls must have distinct serial numbers and separate licensing.

Why it fails: Serial numbers are unique per hardware appliance, but licensing can be shared or synchronized via support portal, though separate device licenses are normal. However, distinct serial numbers is a given hardware reality, but let's evaluate standard HA prerequisites.

All data interfaces must be configured as DHCP clients.

Why it fails: HA interfaces do not require DHCP; static IP addressing is standard for HA links.

Set rule action to 'Drop'.

Why it fails: Drop blocks the traffic, preventing traffic flow observation.

Disable all security profiles entirely.

Why it fails: Disabling profiles is unnecessary and reduces security posture.

Convert the interface to Tap mode.

Why it fails: Tap mode is an interface deployment type, not a rule action setting.

Intrusion Prevention System (IPS)

Why it fails: An IPS can detect some web attacks, but it is network-focused and may not deeply parse HTTP payloads or understand application context. It might miss obfuscated SQL injection or generate false positives. While IPS can complement a WAF, it is not the primary tool for protecting a specific web application from SQL injection.

Stateful firewall

Why it fails: A stateful firewall tracks connections but does not inspect application-layer payloads for SQL injection. It allows or denies based on IP, port, and protocol. Even with deep packet inspection, it lacks the specialized logic to detect SQL injection patterns. Thus it cannot adequately protect the web server from application-layer attacks.

Load balancer

Why it fails: A load balancer distributes traffic across servers but does not inspect for malicious payloads. Some advanced load balancers offer WAF features, but a standard load balancer alone does not block SQL injection. The scenario requires a dedicated security control, so a load balancer is insufficient.

Create a Security policy rule that denies all TCP traffic with the SYN flag set from untrusted zones to the DMZ zone.

Why it fails: Denying all TCP SYN packets would block legitimate connection attempts as well, breaking normal web access. SYN flood protection requires intelligent mitigation, not blanket denial. The firewall should allow legitimate SYN packets while limiting excessive half-open connections. This approach is too broad and disrupts business traffic.

Enable TCP Intercept on the firewall's ingress interface to proxy SYN requests and validate handshakes before forwarding to the web server.

Why it fails: TCP Intercept is a Cisco IOS feature, not a Palo Alto Networks feature. Palo Alto Networks firewalls use Zone Protection and DoS Protection profiles for SYN flood mitigation. This option incorrectly references a non-existent feature for this platform, making it invalid.

Configure a DoS Protection profile with SYN Flood protection enabled and apply it to a Security policy rule that allows traffic to the web server.

Why it fails: DoS Protection profiles are used for granular protection against specific hosts or resources, but they are applied via Security policy rules, not directly to zones. While they can include SYN flood protection, the scenario asks for zone-level protection. Zone Protection profiles are applied to zones and are the primary method for zone-wide flood protection. This option misplaces the control.

DoS Protection Policy with a SYN flood rule

Why it fails: A DoS Protection Policy is used for granular protection against specific IP addresses or subnets, often for critical resources. While it can include SYN flood protection, it is not the primary feature for general SYN flood mitigation. Zone Protection Profiles are designed for broad protection at the zone level and are the standard method for SYN flood thresholds.

QoS Profile with a maximum connection rate

Why it fails: QoS Profiles manage bandwidth allocation and prioritization, not connection rate limiting. They do not inspect TCP handshake states and cannot mitigate SYN floods. QoS is used for traffic shaping, not security. SYN flood protection requires stateful inspection of TCP handshakes, which is provided by Zone Protection, not QoS.

Security policy rule with an Application filter for 'syn-flood'

Why it fails: Security policy rules control allowed applications and services, but they do not provide SYN flood protection. The 'syn-flood' application is not a valid application in Palo Alto Networks; SYN floods are layer 4 attacks, not applications. Security rules alone cannot limit half-open connections; a Zone Protection Profile is required.

Internet Key Exchange (IKE) version 2

Why it fails: IKEv2 is used to negotiate and establish IPsec security associations. It includes some liveness checks, but its primary role is key management, not failover. IKEv2 alone does not automatically switch to a backup tunnel upon failure; additional mechanisms like DPD or routing protocols are needed. Therefore, IKEv2 does not fulfill the dynamic failover requirement by itself.

Generic Routing Encapsulation (GRE)

Why it fails: GRE is a tunneling protocol that can encapsulate various payloads, but it does not provide encryption or dynamic failover. GRE keepalives can detect tunnel failures, but they are not automatic failover triggers for IPsec. The scenario requires IPsec VPN failover, so GRE alone is insufficient and does not address the need for dynamic switching.

Border Gateway Protocol (BGP)

Why it fails: BGP is a routing protocol that can influence path selection, but it does not directly monitor IPsec tunnel health. While BGP can be used with IPsec for dynamic routing, it does not detect tunnel failures at the IPsec layer. Without DPD or similar, BGP may not converge quickly enough. Thus BGP alone does not provide the required dynamic failover for IPsec tunnels.

Application-layer anomaly detection

Why it fails: Application-layer anomaly detection focuses on deviations in application protocols like HTTP, DNS, or SMTP. A TCP SYN scan operates at the network and transport layers and does not involve application-layer payloads. Therefore, this method would not detect the scan. It is designed for attacks that exploit application logic, not for port scanning reconnaissance.

Signature-based detection

Why it fails: Signature-based detection matches known attack patterns in packet payloads or headers. A SYN scan does not contain a unique malicious payload signature; it simply sends SYN packets to many ports. While some IPS signatures can detect scans, they typically rely on threshold or statistical methods rather than a static signature. This is not the most direct method for this scenario.

Protocol anomaly detection

Why it fails: Protocol anomaly detection looks for deviations from RFC-specified protocol behavior, such as malformed headers or illegal state transitions. A normal TCP SYN scan uses well-formed packets that comply with TCP standards, so it would not trigger protocol anomaly rules. This method is better suited for detecting evasion techniques, not for identifying the reconnaissance pattern of sequential connection attempts.

The randomly early drop action drops all SYN packets once the alarm rate is exceeded.

Why it fails: Randomly early drop does not drop all SYN packets; it randomly drops a percentage of SYN packets before the queue fills completely. This reduces the impact on legitimate traffic while mitigating the flood. Dropping all SYN packets would be the 'random drop' or 'SYN cookies' behavior, not randomly early drop.

The randomly early drop action is only available for UDP flood protection, not SYN flood.

Why it fails: Randomly early drop is available for both SYN and UDP flood protection. It is a common action to mitigate floods while preserving some legitimate traffic. The administrator can select it for SYN flood protection as well, so this statement is incorrect.

SYN flood protection requires a decryption policy rule to inspect SYN packets.

Why it fails: SYN flood protection operates at the network layer and does not require decryption. Decryption is for encrypted application traffic, not for SYN packets. The firewall inspects SYN packets directly in the dataplane without any decryption policy.

The HA passive link state is set to 'auto' to allow the passive firewall to bring up its interfaces upon failover.

Why it fails: The passive link state setting determines whether the passive firewall keeps its interfaces down or up. While important for failover, it does not trigger failover; it only affects the state of interfaces after failover occurs. The issue is that failover is not happening, so this setting is not the cause. It is a post-failover behavior setting.

Link monitoring is enabled on the HA interfaces to detect link failures.

Why it fails: Link monitoring on HA interfaces is used to detect failures of the HA communication links themselves, not the dataplane interfaces. If HA links fail, the firewalls may split-brain, but the scenario is about a dataplane link failure. Enabling link monitoring on HA interfaces would not trigger failover for a dataplane link down event.

The HA election settings have the active firewall's priority set lower than the passive firewall.

Why it fails: HA election priority determines which firewall becomes active in a preemption scenario, but it does not trigger failover based on link failure. A lower priority on the active firewall would actually make it less likely to be active. The scenario is about failover not occurring due to a link failure, so election priority is not the relevant setting.

The firewall is in multi-vsys mode and the rule is not configured in the correct vsys.

Why it fails: In multi-vsys mode, each vsys has its own rulebase. If the rule is not in the vsys handling the traffic, it will not be evaluated. However, the scenario does not mention multi-vsys mode, and it is less common than a zone mismatch. While possible, zone mismatch is a more frequent cause of this issue in standard deployments.

The Security policy rule is disabled.

Why it fails: If the rule were disabled, it would not be evaluated at all, and traffic would be allowed by a subsequent rule. However, the scenario states the rule is at the top and has action deny, implying it is active. The more likely cause is that the rule is not matching due to zone or IP configuration, or there is a more specific rule above it. But the rule is at the top, so a rule above it is not possible. Disabling is a possible cause but less likely than a zone mismatch.

The Security policy rule is missing an Application filter, so it does not match any traffic.

Why it fails: An Application filter is not required for a rule to match; setting application to 'any' is valid and matches all applications. The rule will match traffic if other criteria are met. The absence of an Application filter is not a cause for non-matching. The issue is more likely a zone mismatch or a rule above it (but it's at the top).

Scan the endpoint for open ports and vulnerable services.

Why it fails: Scanning for open ports is a vulnerability assessment activity, often performed by separate tools, not typically part of NAC posture assessment. NAC usually checks for specific attributes like patches and antivirus via agents or dissolvable clients. While port scanning can be part of endpoint compliance in some advanced solutions, it is not a standard NAC posture check.

Monitor network bandwidth usage per endpoint.

Why it fails: Bandwidth monitoring is a performance management function, not a security posture check. NAC focuses on endpoint security compliance, such as patches and antivirus, not on how much bandwidth a device consumes. While bandwidth data can be useful, it is not part of typical posture assessment for access control.

Assign a static IP address to the endpoint.

Why it fails: Assigning a static IP address is an addressing task, not a posture assessment. NAC may assign VLANs or IP addresses dynamically based on compliance, but checking for a static IP is not a security requirement. Posture assessment evaluates the endpoint's security state, not its IP configuration.

Set the Service to 'any' and specify the desired applications in the Application field.

Why it fails: Setting Service to 'any' allows the applications to run on any port, which can bypass security if applications are misidentified. While App-ID will still inspect, using 'any' is not recommended because it may allow applications on non-standard ports, potentially circumventing policy. The scenario asks for proper application identification, and 'application-default' is more secure and precise. This option is less secure.

Set the Service to 'any' and specify the desired TCP and UDP ports in the Service field.

Why it fails: Specifying ports in the Service field is a port-based approach, not application-based. The requirement is to inspect the application layer to identify applications regardless of port. Port-based rules cannot identify applications that use dynamic ports or non-standard ports. This option does not leverage App-ID and thus fails to meet the scenario's goal.

Set the Service to 'application-default' and leave the Application field as 'any'.

Why it fails: Leaving the Application field as 'any' allows all applications that use default ports, which contradicts the requirement to allow only specific applications. The administrator wants to block all others, so the Application field must list the allowed applications. This configuration would be too permissive and not achieve the desired security posture.

Configure a File Blocking profile to forward files to WildFire.

Why it fails: A File Blocking profile can block or alert on file transfers based on file type, but it does not forward files to WildFire. The WildFire analysis profile is responsible for forwarding files. File Blocking is used for policy enforcement on file types, not for WildFire submission. Therefore, this action is not required and would not achieve the goal.

Set the Security policy rule action to 'deny' for all file transfers.

Why it fails: Setting the rule action to deny would block all traffic, preventing file transfers entirely and thus no files would be sent to WildFire. WildFire analysis requires that the traffic be allowed so that files can be extracted and forwarded. The action should be allow, with the WildFire profile attached to inspect and potentially block malicious files.

Enable SSL decryption for HTTP and SMTP traffic.

Why it fails: SSL decryption is required for HTTPS traffic, but the scenario specifies HTTP and SMTP, which are plaintext protocols. Decryption is not needed for HTTP or SMTP. While SMTP can use TLS, the scenario does not mention SMTPS. Enabling decryption for plaintext protocols is unnecessary and would not affect WildFire forwarding.