CCNA Network Security Questions

Decrypting outbound HTTPS for inspection requires the firewall to re-sign traffic with its own certificate. Installing the Palo Alto Networks root CA into the endpoint trust store lets clients validate that certificate silently, preventing browser warnings while enabling inspection.

Excessive XML API calls or script-driven configuration pushes load the management plane directly, since that CPU handles parsing and commit operations rather than dataplane traffic. This satisfies the stem's constraint of sustained 99% management-plane utilisation, distinguishing control-plane processing from forwarding load.

The Vulnerability Protection Profile inspects traffic for exploits such as SQL injection and buffer overflows, blocking them at the Security policy rule. It satisfies the stem's requirement to shield critical database servers from those specific attack signatures.

An IP-type EDL parses entries strictly as IPv4 addresses, so domain names in the file trigger parsing errors and no entries load, leaving rules with nothing to match. The firewall downloaded the file successfully, ruling out connectivity.

Zone Protection profiles include Port Scan Protection, which detects and blocks TCP port scans, host sweeps, and other reconnaissance activities. By applying a Zone Protection profile with Port Scan Protection enabled to the external-facing zone, the firewall can identify and mitigate port scans targeting internal hosts. This directly addresses the requirement to detect and block TCP port scans.

Pre-defined exclusions match known applications by signature and standard ports, so a pinned certificate on TCP 8443 escapes them. An explicit No Decrypt rule placed above other rules matches the custom port and destination address directly, guaranteeing the medical portal's traffic bypasses interception regardless of the exclusion list.

DAG membership is populated by tag-to-IP mappings registered through User-ID. If neither the agent nor the GlobalProtect portal pushes the authenticated user's IP under the exact tag name the DAG filter references, the group stays empty and rules never match.

Even in Layer 2 mode, the firewall enforces Security policy between zones. If the Layer 2 interfaces are not bound to zones, no interzone rule can match the traffic, and the default deny silently drops it. Assigning interfaces to zones and creating the appropriate allow rules restores forwarding.

A Vulnerability Protection profile inspects traffic for known exploits and attack patterns, such as buffer overflows and SQL injection attempts, and can block or alert on them. In this scenario, the web server receives HTTP traffic that must be inspected for malicious requests, so applying a Vulnerability Protection profile to the permitting Security policy rule is the correct choice to detect and block those attacks.

External Dynamic Lists (EDLs) allow the firewall to dynamically import lists of IP addresses, URLs, or domains from an external source. By subscribing to a threat intelligence feed that provides malicious URLs and IPs, the firewall can automatically block access to those sites. This meets the requirement for a dynamically updated list.

Source NAT with Dynamic IP and Port translates the source IP address of outbound traffic and uses port translation to allow many internal hosts to share a single public IP address. This is the correct choice because it enables the entire 10.1.1.0/24 subnet to access the internet through 203.0.113.5 by multiplexing sessions using different source ports.

App-ID identifies applications by analyzing traffic characteristics, signatures, and behavior rather than relying on port numbers. This allows the analyst to determine the actual application generating the outbound traffic even if it uses a non-standard port, which is common with command-and-control communications. It is the correct tool for application identification in this scenario.

A Layer 3 interface with an IP address, routed to an Untrust zone, terminates the untrusted ISP segment and enforces zone-based policy between external and internal networks. Tap and virtual wire modes lack IP addressing or routing, so they cannot satisfy the requirement to connect and route to an untrusted ISP router.

The Untrust zone is the conventional designation for interfaces connected to the public internet, where traffic is treated as hostile by default. Security policy rules must explicitly permit traffic from Untrust to Trust or DMZ, which enforces a default-deny posture and supports least-privilege access control.

HTTP and Telnet transmit credentials and session data in cleartext, exposing the management plane to interception. Replacing them with HTTPS and SSH enforces encrypted administrative access, directly hardening the firewall's management interface against credential theft.

SYN Flood Protection within a Zone Protection profile allows you to set thresholds for half-open connections, including per-source IP limits. Configuring this feature with a threshold of 100 per second for a single source IP directly addresses the requirement. It activates SYN cookies and other mitigations when the threshold is exceeded, protecting the firewall and internal hosts from SYN flood attacks.

A URL Filtering profile defines the categories to block or allow, and attaching it to the relevant Security policy rule enforces that profile for matching traffic. This blocks gambling and adult categories while permitting all other business-related sites.

A no-decrypt rule placed above the decrypt rule matches the banking portal first and lets the TLS session pass through untouched, so certificate pinning is not broken. The firewall does not present its own certificate, so the client's pinned certificate remains valid. This is the intended mechanism for exempting pinned or privacy-sensitive destinations from inspection.

App-ID identifies applications regardless of port, protocol, or encryption, so it enforces the actual application rather than the port. By creating Security policy rules that allow only the necessary applications, the administrator ensures that even if a non-standard port is used, only sanctioned applications are permitted. This directly reduces the attack surface by preventing unknown or unwanted applications from traversing the firewall.

Palo Alto Networks firewalls include a built-in Brute Force Protection feature for the management interface. Located under Device > Setup > Management, it allows administrators to set the number of failed login attempts (threshold) and the duration to block the source IP. This feature automatically blocks the IP address after the threshold is exceeded, providing native protection against brute force attacks on management access.

When return packets arrive on an interface different from the one used for the outbound direction, the firewall may not find the session and can drop the traffic. Allowing asymmetric routing by relaxing strict TCP sequence checking and keeping both paths through the same firewall restores session handling for this scenario.

Zone Protection Profiles include flood protection that enforces packet-rate thresholds for ICMP, UDP, and other protocols, dropping excess traffic before it reaches the zone. This mitigates volumetric layer 3 and layer 4 floods against the internal network.

QoS classification only takes effect once enabled on the egress Layer 3 interface itself; security-rule profiles merely tag traffic. Without interface-level guaranteed and maximum bandwidth limits, packets bypass the QoS class engine and transmit best-effort, so VoIP still queues behind bulk data during peak hours.

Separating tiers into distinct zones creates clear enforcement points, and permitting only required interzone flows enforces least privilege. This limits lateral movement because a compromised host in one tier cannot freely reach other tiers. It is a foundational segmentation practice.

SYN flood protection is a native flood defence within Zone Protection profiles, activating per-zone SYN cookie verification once configured thresholds are exceeded. It satisfies the stem's requirement for a flood mechanism by absorbing half-open TCP connection attempts, dropping spoofed or excessive SYN packets before they exhaust the firewall's session table.

This rule correctly specifies the source zone as Untrust (internet) and destination zone as DMZ (where the web server resides). It allows only the web-browsing and ssl applications, which correspond to HTTP and HTTPS. All other traffic will be denied by the implicit deny rule. This is the standard best practice for publishing a web server.

A BGP session stuck in Connect with SYNs sent but no SYN-ACK indicates the firewall's own policy is dropping inbound TCP/179. Verifying a Security policy rule permitting application bgp from the external zone to the to-firewall zone confirms control-plane traffic is allowed.

Palo Alto Networks firewalls resolve application dependencies at commit; a rule referencing an application whose dependencies are absent triggers a warning. Explicitly adding the dependent application and its required dependencies lets the policy validate and commit successfully.

The show session all command queries the firewall's session table, returning live sessions with source and destination ports, NAT-translated addresses and the security rule each flow matched, which is exactly the real-time detail the administrator requires.

SYN Flood Protection is part of Zone Protection and allows the administrator to set thresholds for half-open connections per source and per destination. It can activate randomly early drop or SYN cookies to mitigate SYN floods. This directly meets the requirement to limit half-open connections from a single source IP to a specific destination.

Grouping related rules into logical categories keeps the rulebase ordered and readable, so administrators can audit, review and troubleshoot policies efficiently. This supports the recommended top-down organisation, reducing shadowed or redundant rules as the policy set grows.

A Security profile group bundles multiple profiles so they are applied together to matching traffic. Antivirus detects malware, Anti-Spyware detects command-and-control and spyware activity, and Vulnerability Protection detects exploits against known vulnerabilities. Attaching this group to the rule provides the layered inspection the administrator requires for outbound web traffic.

A File Blocking Profile attached to the Security rule inspects the application layer, letting the administrator permit document viewing while denying upload actions within the same application family, achieving granular control that a blanket application block cannot.

Monitor > Logs > Threat records each Threat Prevention block with its signature ID, severity, and the associated packet capture, directly satisfying the need to verify which signature dropped the response. Filtering by the destination website and C2 category isolates the exact entry, confirming whether the callback verdict was a false positive.

The DNS proxy forwards queries to upstream resolvers, so invalid or missing primary and secondary external DNS server addresses cause resolution failures for internal clients. Verifying these configured IPs confirms the proxy has reachable forwarders for external domain lookups.

HA session synchronisation replicates session state and ARP tables to the passive peer. With it disabled, the passive firewall lacks existing session entries, so established TCP flows are dropped on failover, forcing re-authentication and reconnection exactly as described.

User-ID mapping aging and idle timers govern how long the firewall retains an IP-to-user mapping after logoff. Lowering these values in Device > User-ID settings directly shortens the 45-minute stale attribution, forcing quicker re-authentication of traffic.

unknown-tcp indicates TCP sessions whose payload matches no App-ID signature, so the firewall cannot identify the application. It is not a threat verdict; it simply reflects signature-database gaps, commonly seen with custom or encrypted applications, and typically triggers policy based on service or port.

HA Session Synchronization replicates the active firewall's session table to the passive peer, so established TCP flows and their state survive failover. Without it, the passive device has no session entries and drops existing connections, forcing re-establishment.

An Antivirus Profile scans downloaded files and web traffic against signature and heuristic threat databases, blocking known malware and spyware at the firewall. It satisfies the requirement to stop these threats entering via file downloads and web browsing.

App-ID identifies applications regardless of port, protocol, or encryption. It uses multiple techniques, including application signatures, protocol decoding, and heuristics, to accurately identify applications even when they use non-standard ports. By relying on App-ID, the engineer can create Security policy rules based on applications rather than ports, ensuring proper inspection and policy enforcement for traffic between internal zones.

By specifying the destination addresses of the allowed DNS servers in the Security policy rule, the firewall permits DNS traffic only to those servers. The rule matches the 'dns' application and the destination IP addresses, ensuring that DNS queries to other servers are blocked by implicit deny. This precisely meets the requirement to allow only specific external DNS servers.

Palo Alto Networks virtual routers are logical routing instances that run multiple protocol processes concurrently, so OSPFv2, OSPFv3 and BGP can be enabled on the same virtual router across different interfaces and areas, meeting the requirement for complex multi-router path selection.

The Device > Dynamic Updates page holds both the download schedule and the separate installation schedule settings, so a successful download with failed installation points there. Checking this location satisfies the stem's constraint of verifying and configuring installation timing in PAN-OS.

GlobalProtect provides secure remote access by using a client that establishes an encrypted tunnel to the firewall. It supports various authentication methods and can enforce security policies on remote users. This directly meets the requirement of allowing employees to connect from home using a client that creates an encrypted tunnel to the corporate network.

The Authentication Profile binds the firewall's administrative login to the RADIUS server profile, defining the authentication protocol and allowed users. Without it, the RADIUS server profile alone cannot authenticate administrators, so both components are required.

Correct. Panorama uses templates to manage network and device configurations for firewalls.

Allowing web-browsing and ssl applications permits normal internet access, while applying a URL Filtering profile that blocks the proxy-avoidance-and-anonymizers category prevents users from accessing proxy sites and anonymizers. This meets the requirement to allow any website but block bypass methods. The URL Filtering profile inspects the requested URLs and blocks those categorized as proxy or anonymizer.

The Antivirus profile scans traffic streams for malware signatures and exploits, satisfying the requirement to inspect outbound HTTP/HTTPS for malicious content. Attached to the Security policy rule, it enforces threat detection inline, complementing URL filtering to deliver comprehensive protection.

Quality of Service classifies and prioritises traffic, guaranteeing critical server flows preferential treatment over guest internet traffic during congestion. It enforces bandwidth allocation and queueing policies, directly satisfying the requirement to keep critical traffic ahead of lower-priority guest usage.