Network Security practice questions

Configure an explicit Security policy rule with 'Any' to 'Any' action set to accept asymmetric flows.

Why it fails: Security rules evaluate stateful sessions; if the session lookup fails due to asymmetric routing, the packet drops before rule evaluation.

Enable strict TCP validation under Device > Setup > Session.

Why it fails: Strict TCP validation drops asynchronous packets.

Disable stateful inspection globally using a custom Application Override policy.

Why it fails: Application override disables Layer 7 classification, but does not solve L3 asymmetric interface path mismatches.

The loopback interface IP address of the firewall.

Why it fails: Loopback addresses are used for management or routing, not standard DNAT mappings.

The MAC address of the DMZ server.

Why it fails: Security rules do not match on layer 2 MAC addresses.

The private post-NAT IP address of the internal web server.

Why it fails: Security policy evaluation occurs before Destination NAT takes place in the packet flow.

Objects > Application > Custom App Timeout

Why it fails: Application timeouts dictate when idle sessions are purged, unrelated to MTU size.

Policies > Security > Options Tab

Why it fails: Security policies match and act on traffic, but do not contain interface-level TCP parameter clamping settings.

Device > Setup > Session > TCP Settings

Why it fails: Device setup session settings control timeouts and TCP asymmetric routing behaviors, not direct MSS clamping.

Install a secondary Forward Untrusted Certificate.

Why it fails: Forward Untrusted Certificate handles untrusted issuers, not protocol version blocking.

Configure a URL Filtering profile with a custom blocking action.

Why it fails: URL filtering applies to HTTP URL categories, not TLS handshake protocol failures.

Change the decryption action from 'Decrypt' to 'No Decrypt' automatically upon protocol failure.

Why it fails: Once decryption starts, fallback to No Decrypt for unsupported TLS versions depends on 'Untrusted Issuer' or error actions, but cannot dynamically decrypt without support.

Increase the User-ID aging timer to 72 hours.

Why it fails: Aging timers do not resolve missing IP mappings caused by intermediate NAT.

Add a static IP-to-MAC mapping entry in the ARP table.

Why it fails: ARP maps IP to MAC, which is overwritten by the NAT router's MAC address.

Enable LDAP server pooling under Device > Authentication Profile.

Why it fails: Authentication profiles handle authentication requests, not IP-to-user mapping collection mechanics.

Disable session logging

Why it fails: Disabling logging prevents any log generation.

Log Forwarding Profile set to disable session start

Why it fails: Log forwarding profiles handle downstream forwarding destinations, not the base generation trigger.

Log at Session End

Why it fails: Log at Session End writes a single log entry when the session terminates, verifying successful completion.

Randomized Port Allocation

Why it fails: Randomized port allocation disperses ports dynamically without maintaining sticky mappings per source host.

Dynamic IP Only

Why it fails: Dynamic IP only exhausts ports immediately without port overloading (DIPP), requiring 1:1 public-to-private IP ratios.

Round-Robin

Why it fails: Round-robin cycles through available translated IPs, which changes the source IP across sessions.

Quality of Service (QoS) Profile

Why it fails: QoS profiles manage bandwidth allocation.

File Blocking Profile

Why it fails: File blocking restricts files based on extensions, not network-level C2 communications.

Data Filtering Profile

Why it fails: Data Filtering Profiles inspect outbound traffic for sensitive data patterns such as credit card or personal data, not domain reputation or C2 signatures. They would be the correct choice when preventing exfiltration of confidential content, but blocking malicious domains requires a URL or anti-spyware profile.

Enable Multi-Virtual System Redundancy Protocol (MVSRP) on the system tab.

Why it fails: MVSRP is not a valid PAN-OS feature.

Create a Layer 2 VLAN subinterface with an 802.1Q tag shared between both virtual systems.

Why it fails: Layer 2 VLANs do not span multiple virtual systems directly without physical bridging or inter-vsys specific objects.

Configure a static route in Vsys1 pointing to the next-hop IP of Vsys2's management interface.

Why it fails: Management interfaces are out-of-band and cannot be used for data plane inter-vsys routing.

Enable SSL Decryption with a custom Decryption Forward Trust certificate.

Why it fails: SSL decryption exposes the HTTPS payload, but WildFire inline machine learning inspects files and links, not custom encrypted protocols; the stem describes a bespoke exfiltration channel, so decryption alone cannot classify it. Forward Trust decryption suits inspecting standard TLS traffic against known threats.

Set the Anti-Spyware profile action to 'Reset Both' for all severity levels.

Why it fails: Reset Both terminates the TCP session, which cannot decrypt or inspect custom-encrypted HTTPS payloads, so the zero-day still reaches the client. It is tempting because reset actions stop known malicious sessions; it would be correct for blocking identified spyware traffic rather than detecting unknown threats via inline machine learning.

Configure a custom Application Override rule for the encrypted stream.

Why it fails: Application Override bypasses signature and protocol inspection for specified traffic, so it would let the custom encrypted stream pass uninspected rather than block it. It is intended for trusted non-standard applications that inspection would otherwise disrupt.

Delete the pre-defined system files directly from the FreeBSD CLI shell.

Why it fails: Modifying system files directly via CLI shell is unsupported and violates Palo Alto Networks best practices.

Change the Application Override policy to drop TLS handshake packets for banking apps.

Why it fails: Application override would break HTTPS entirely rather than manage decryption exclusions.

Downgrade the WildFire dynamic content version to remove the hardcoded exclusion database.

Why it fails: WildFire dynamic content governs threat signatures and URL categories, not the SSL Decryption Exclusion list, so downgrading it cannot remove those hardcoded entries and may weaken detection. It is tempting because dynamic content updates do alter firewall behaviour, which suits refreshing threat coverage rather than overriding decryption exclusions.

A security policy rule blocking inter-zone traffic from untrust to trust.

Why it fails: Blocking inter-zone traffic would prevent communication entirely.

An Application Override rule for HTTP/HTTPS traffic.

Why it fails: Application override does not resolve IP routing or packet return path asymmetries in hairpin scenarios.

A static ARP entry on the external interface for the public IP address.

Why it fails: ARP entries map IP to MAC, which does not address internal loopback routing paths.

Automatic SNMP trap polling of user workstations.

Why it fails: SNMP traps report device status, not active user logons.

RADIUS Accounting start/stop message parsing without User-ID agents.

Why it fails: RADIUS accounting requires a RADIUS server integration, which is distinct from direct AD server monitoring or captive portal agentless methods.

Direct LDAP querying of active user sessions via continuous TCP port scanning.

Why it fails: LDAP queries user account attributes, but does not provide real-time IP-to-user session logons without event log monitoring.

Configuration commits must be performed exclusively on the passive peer.

Why it fails: Commits are always performed on the active primary management plane or Panorama, not restricted to a passive peer.

Both firewalls must have identical serial numbers and hardware license keys.

Why it fails: Firewalls have unique serial numbers; licenses can be shared or synchronized via Panorama/support, but serial numbers cannot be identical.

Session synchronization occurs automatically via the HA3 data path link.

Why it fails: HA3 is dedicated in Active/Active mode to tunnel and synchronize asymmetric packets between peers.

Verify that the Panorama management server is online and syncing policies.

Why it fails: Panorama sync status does not impact direct peer-to-peer HA1 heartbeats between firewalls.

Check that GlobalProtect portals are licensed and operational on both peers.

Why it fails: GlobalProtect licensing is independent of HA heartbeat communication.

Disable App-ID processing on all file transfer security rules.

Why it fails: App-ID is required for WildFire to classify file-sharing and transfer applications correctly.

Configure a Zone Protection Profile on the management interface.

Why it fails: Zone protection applies to data plane security zones, not the management interface.

Install a dedicated physical WildFire appliance in every remote branch office.

Why it fails: Remote branches can use the WildFire cloud service without needing a physical WildFire appliance.

Translation occurs after security policy evaluation and routing decisions.

Why it fails: SNAT translation mapping is evaluated and applied after security policy rule matching during packet egress processing.

Every internal IP address requires a dedicated 1:1 public IP address mapping.

Why it fails: 1:1 mapping describes Static IP or Dynamic IP without port translation, not DIPP.

DIPP prevents internal clients from initiating outbound HTTPS connections.

Why it fails: DIPP is commonly used for outbound internet access across all standard protocols including HTTPS.

SSL Forward Proxy

Why it fails: Incorrect. SSL Forward Proxy is used for outbound decryption where internal clients access external internet sites.

SSH Proxy

Why it fails: Incorrect. SSH Proxy is used for inspecting encrypted SSH traffic, not inbound web server TLS traffic.

SSL Outbound Inspector

Why it fails: Incorrect. This is not a standard Palo Alto Networks decryption feature name.

Create a separate Security policy rule with an explicit deny action for those categories.

Why it fails: Incorrect. Denying the traffic drops it entirely rather than allowing it to be encrypted normally without inspection.

Disable SSL Forward Proxy globally on the firewall.

Why it fails: Incorrect. Disabling it globally removes decryption for all users and sites, which violates the requirement to inspect non-sensitive traffic.

Use an Authentication Profile to prompt the user to accept a waiver before proceeding.

Why it fails: Incorrect. Captive portal authentication handles user identity, not dynamic decryption exemptions based on URL category.

Enable the 'Reject Non-SYN TCP' setting in the Zone Protection profile for the zone facing the servers.

Why it fails: Reject Non-SYN TCP is a zone protection mechanism that rejects TCP packets that are not part of a session initiation (i.e., not SYN packets). While it can help mitigate some scanning and spoofing attacks, it does not specifically detect or block brute-force SSH attacks, which typically involve legitimate SYN packets for each connection attempt. This setting would not distinguish between legitimate and malicious SSH traffic, and could disrupt legitimate connections if not carefully tuned.

Configure a DoS Protection profile with a SYN Flood protection rule applied to the server zone, and attach it to a Security policy rule allowing SSH.

Why it fails: SYN Flood protection is designed to mitigate TCP SYN flood attacks, not brute-force SSH attacks. Brute-force SSH attacks complete the TCP handshake and then attempt multiple authentication attempts. A SYN flood protection rule would not detect the repeated authentication failures characteristic of brute-force attacks. While DoS protection profiles are useful for volumetric attacks, they do not address application-layer brute-force behavior.

Enable 'Strict Source IP' in the Zone Protection profile for the zone facing the servers.

Why it fails: Strict Source IP is a zone protection setting that drops packets if the source IP is not in the same subnet as the incoming interface, which helps prevent IP spoofing. It does not detect or block brute-force SSH attacks, as those attacks use valid source IPs and complete TCP handshakes. This setting is unrelated to application-layer brute-force detection and could cause legitimate traffic from other subnets to be dropped if not properly configured.