How should I use these Network Security practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Network Security questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Network Security domain.

Cybersecurity-Practitioner · topic practice

Network Security practice questions

Practise Certified Cybersecurity Practitioner (Cybersecurity-Practitioner) Network Security practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Network Security

Practice 10 questions Browse domain →

What the exam tests

What to know about Network Security

Network Security questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Network Security exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Network Security questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Review the full subnetting walkthrough →

A network administrator observes that a specific internal subnet is experiencing intermittent connectivity to an external SaaS application. Inspection shows that packets exceeding a certain size are being dropped because the intermediate router does not support Path MTU Discovery, and the firewall is not adjusting the MSS. Where should the administrator enable Maximum Segment Size (MSS) adjustment on the firewall?

Trap 1: Objects > Application > Custom App Timeout

Application timeouts dictate when idle sessions are purged, unrelated to MTU size.

Trap 2: Policies > Security > Options Tab

Security policies match and act on traffic, but do not contain interface-level TCP parameter clamping settings.

Trap 3: Device > Setup > Session > TCP Settings

Device setup session settings control timeouts and TCP asymmetric routing behaviors, not direct MSS clamping.

Study all Network Security common traps →

A
Network > Zone Protection Profiles > Packet Based Attack Protection
Zone Protection Profiles include TCP Drop options and TCP-MSS adjustment parameters to handle fragmentation issues.
B
Objects > Application > Custom App Timeout
Why wrong: Application timeouts dictate when idle sessions are purged, unrelated to MTU size.
C
Policies > Security > Options Tab
Why wrong: Security policies match and act on traffic, but do not contain interface-level TCP parameter clamping settings.
D
Device > Setup > Session > TCP Settings
Why wrong: Device setup session settings control timeouts and TCP asymmetric routing behaviors, not direct MSS clamping.

Network Security practice questions

What to know about Network Security

Common Network Security exam traps

Network Security questions

An administrator needs to configure a Palo Alto Networks NGFW security rule to log traffic only when a new session is successfully established. Which setting in the Security Policy Rule options tab accomplishes this requirement?

An enterprise firewall is configured with multiple virtual systems (vsys). An administrator needs to configure inter-vsys routing to allow traffic to flow securely between Vsys1 and Vsys2 without traversing physical external interfaces. What is the correct method to achieve this in PAN-OS?

An administrator configures High Availability (HA) Active/Active mode on a pair of Palo Alto Networks firewalls. Which THREE operational considerations or configurations apply specifically to Active/Active deployments compared to Active/Passive? (Choose three)

An administrator is deploying WildFire to protect an organization from zero-day malware. Which TWO configuration steps are required to ensure files are successfully forwarded to the WildFire cloud for analysis? (Choose two)

An organization wants to inspect encrypted outbound HTTPS traffic to detect malware without causing certificate warnings on user workstations. Which component must be installed on the client endpoints to achieve this?

A firewall is deployed in an environment with asymmetric routing. Packets belonging to the same TCP session enter on different interfaces due to multi-path upstream routing. What configuration change is required on the Palo Alto Networks firewall to prevent the traffic from being dropped?

An administrator needs to configure a security rule that applies specifically to traffic destined for a DMZ web server using its public NAT IP address (Destination NAT). Which IP address must be specified in the Destination field of the Security policy rule?

An administrator configures a dynamic address group (DAG) based on User-ID tags, but security rules referencing this DAG fail to match traffic from users who have successfully authenticated via GlobalProtect. What is the most likely root cause?

An administrator needs to restrict access to malicious command-and-control (C2) domains. Which security profile should be attached to the outbound Security policy rules to inspect and block this traffic?

An administrator wants to ensure that critical database servers are protected against vulnerability exploits, SQL injections, and buffer overflows. Which security profile must be applied to the relevant Security policy rule to provide this protection?

An administrator is reviewing the Palo Alto Networks firewall traffic logs and sees a session marked with the application 'unknown-tcp'. What does this application classification typically indicate?

Track your progress over time

Start a Network Security only practice session

Related Cybersecurity-Practitioner topic practice pages

Cloud Security practice questions

Cybersecurity Fundamentals practice questions

Network Security practice questions

Endpoint Security practice questions

SOC Operations practice questions

Cybersecurity-Practitioner fundamentals practice questions

Cybersecurity-Practitioner scenario practice questions

Cybersecurity-Practitioner troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid