Cybersecurity-Practitioner Network Security Practice Question
An administrator configures a QoS profile to prioritize VoIP traffic over bulk data transfers. However, after applying the profile, VoIP packets are still experiencing high latency during peak business hours. Inspection shows that the QoS profile is applied correctly to the security rules, but the packets are not being placed into the correct QoS class. What is missing in the interface configuration?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
QoS must be explicitly enabled on the egress Layer 3 interface settings with configured guaranteed and maximum bandwidth limits.
For QoS to function properly on Palo Alto Networks firewalls, QoS must be enabled on the egress interface settings, and clear-text or DSCP/IP Precedence classification mapping must be defined on the interface.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The firewall requires an active Advanced URL Filtering license to classify VoIP packets.
Why it's wrong here
QoS classification relies on App-ID, not URL filtering licenses.
- ✓
QoS must be explicitly enabled on the egress Layer 3 interface settings with configured guaranteed and maximum bandwidth limits.
Why this is correct
Enabling QoS globally or in rules is insufficient; bandwidth allocation and QoS types (IP precedence or DSCP) must be configured on the specific interface.
- ✗
GlobalProtect VPN tunnels must be configured in full-tunnel mode to preserve QoS headers.
Why it's wrong here
QoS operates on physical or virtual interfaces independently of GlobalProtect tunnels.
- ✗
An Application Override policy must be created to bypass App-ID processing for VoIP streams.
Why it's wrong here
App-ID is required to correctly classify VoIP applications for QoS classification.
About these practice questions
Courseiva writes every Cybersecurity-Practitioner question from scratch — 206 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official Palo Alto Networks exam blueprint
This Cybersecurity-Practitioner practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the Cybersecurity-Practitioner exam.