301 questions total · 5 pages · All types, answers revealed
A single service object cannot hold both TCP and UDP on the same port, since protocol is a defining attribute. Creating separate TCP and UDP objects and combining them in a Service Group represents the dual-protocol requirement within one logical service definition.
An analyst is building a new Security Policy rule set for a data center firewall. Several rules need to reference the same set of ten web server IP addresses in the DMZ. Rather than entering all ten IPs into every rule individually, the analyst wants a single reusable object that contains all of them. Which object type should the analyst create?
An Address Group is a container that references multiple Address Objects, either statically or dynamically. By creating one Address Group containing the ten web server Address Objects, the analyst can reference that single group in every rule, simplifying maintenance and ensuring consistency across the rule set.
Why this answer
An Address Group is the correct construct because it holds multiple Address Objects and can be referenced as a single entity in Security Policy rules. Creating one group for the ten DMZ web servers means future changes, such as adding or removing a server, require editing only the group rather than every rule, which reduces error and administrative overhead.
Exam trap
The trap here is confusing an Address Group, which contains IP-based Address Objects, with a Service Group, which contains protocol and port definitions.
A network security analyst is troubleshooting an issue where users on the internal network cannot access a web server hosted in the DMZ. The analyst runs 'show session all filter source 10.1.1.100 destination 192.168.1.50' on the firewall and sees a session in the 'discard' state. Which action should the analyst take next to determine why the session is being discarded?
The 'show session id' command provides in-depth details for a specific session, including the reason it was discarded (e.g., policy deny, application dependency, or threat). This directly answers why the session is in the discard state. Other commands may show symptoms but not the specific discard reason tied to that session.
Why this answer
The session is in a discard state, indicating that the firewall is dropping packets after a policy or security profile action. To find the exact cause, the analyst must inspect the session details using 'show session id <session-id>', which reveals the discard reason. Other commands provide broader information but lack session-specific discard context, making them less effective for this precise troubleshooting step.
Exam trap
The trap here is assuming that reviewing the security policy or global counters will directly explain why a specific session is discarded, when only session details provide the exact discard reason.
An administrator is configuring a high-availability (HA) pair. Which step is essential to ensure consistent configuration across both firewalls?
Configuration Sync automatically replicates policy, objects, and network settings from the active firewall to its peer, guaranteeing identical configuration across the HA pair. This directly satisfies the stem's requirement for consistent configuration on both devices.
Why this answer
Configuring HA requires setting up synchronization, which ensures that the configuration is automatically shared between the active and passive units.
What happens if a packet matches multiple security policies?
Security policies are evaluated top-down, and evaluation halts at the first match. The stem asks what happens when a packet matches several policies; the first matching rule wins and subsequent policies are never consulted, so ordering directly determines enforcement outcome.
Why this answer
The firewall evaluates policies from top to bottom and matches the first rule that criteria apply to.
Which TWO options describe valid ways to handle traffic that is identified as 'unknown-tcp' in a security policy?
An Application Override policy forces traffic on a specified port to be treated as a named custom application instead of unknown-tcp, restoring App-ID inspection and policy control for that session. This is a supported method for handling unidentified TCP traffic.
Why this answer
Option A is correct because an Application Override policy lets you force traffic that the firewall cannot identify (such as unknown-tcp) to be treated as a specific application on a specified port, giving you control over how that traffic is handled in the security policy. Option D is correct because creating a custom App-ID allows you to define signatures for the unidentified application so the firewall can properly recognize and classify the unknown-tcp traffic, after which normal security policy rules can match it. Option B is incorrect because changing the zone to 'Internal' does not affect application identification and is not a valid method for handling unknown-tcp traffic.
Option C is incorrect because disabling NAT has no bearing on how the firewall identifies or processes unknown-tcp sessions. Option E is incorrect because enabling QoS on an interface only affects bandwidth and prioritization, not the identification or policy handling of unknown-tcp traffic.
Which of the following describes an 'Address Object'?
An Address Object is a named container holding one or more IP addresses, subnets or ranges, referenced by policy rules instead of raw values. This satisfies the stem's definition, since the name abstracts the underlying address for reuse.
Why this answer
An address object is a reusable entity that represents a single IP, a range of IPs, or a subnet.
Which THREE criteria can be used to filter traffic logs in the Monitor tab?
Traffic logs record the Layer 4 session details, including the destination port of each connection, so the Monitor tab filter can match on that field. This satisfies the stem's requirement for a valid log-filter criterion drawn from logged session attributes.
Why this answer
In the Monitor tab's traffic log filtering, destination port (A) is a valid criterion because logs record the Layer 4 port of the session, allowing filters such as destination port 443 to isolate HTTPS traffic. Application name (D) is also valid since the firewall performs App-ID classification and stores the recognized application in the log, so filtering by application (e.g., ssl or web-browsing) is supported. Source IP address (E) is a valid filter because each traffic log entry includes the originating IP of the session, enabling queries for a specific host or subnet.
Options B (power supply voltage) and C (CPU temperature) are hardware and environmental metrics, not fields present in traffic logs, so they cannot be used to filter log entries in the Monitor tab.
A security analyst is reviewing a security policy that has the action 'allow' and the profile 'strict' applied. The profile includes antivirus, anti-spyware, and vulnerability protection. A user reports that a file download from a trusted site is being blocked. The analyst checks the Threat log and sees a 'virus' signature with action 'block'. What is the most likely cause of the block?
When a security policy action is 'allow', any block action observed in the Threat log is the result of a Security Profile. In this case, the antivirus profile detected a virus signature and blocked the file. The policy itself does not block; it only permits, and the profile enforces the block.
Why this answer
The block is caused by the Security Profile, specifically the antivirus component, which detected a virus signature and took the configured action to block. The security policy action 'allow' only permits the traffic; it does not perform content inspection.
Exam trap
The trap here is confusing the security policy action with the Security Profile action, assuming that 'allow' means no blocking can occur.
A network security analyst is troubleshooting an intermittent connectivity issue between a client and a server. The analyst suspects that certain packets are being dropped by the firewall's security policy. The analyst runs 'test security-policy-match' with the relevant parameters on a Palo Alto Networks firewall. Which output field in the CLI result should the analyst examine to identify the specific security policy rule that matched the traffic?
The test security-policy-match command output includes a 'Rule' or 'Rule Name' field that explicitly states which security policy rule matched the simulated traffic. This is the most direct way to identify the rule, as it shows the exact rule that would be applied. The analyst can then review that rule's configuration to understand why packets are being dropped or allowed.
Why this answer
The test security-policy-match command simulates a traffic flow and reports which security policy rule would match. The output includes a field that names the matching rule, allowing the analyst to pinpoint the exact policy. This is critical for troubleshooting because it directly identifies the rule responsible for the action, enabling focused review of that rule's configuration.
Exam trap
The trap here is assuming that the application or destination port shown in the output identifies the matching rule, when the rule name is the specific field that denotes the policy that matched.
Which THREE items are required to successfully register a new firewall in the Customer Support Portal?
A valid Customer Support Portal account is mandatory to register a firewall, since the serial and entitlement are bound to that account. This satisfies the stem's requirement by providing the authenticated identity needed for registration.
Why this answer
To register a new firewall in the Customer Support Portal, you must have a valid Customer Support Portal account (option B), since the registration process is tied to your authenticated user identity and licenses/devices are associated with that account. You also need the hardware serial number (option D), which uniquely identifies the specific firewall appliance and is used by the portal to bind the device record and its entitlements. Finally, a registration authorization code (option E) is required, as it is generated for the device and validates that the firewall is authorized to be added to your account.
Options A and C are not required: a list of connected switch ports is irrelevant to portal registration, and the firewall's public SSH key is not used for this registration workflow.
Which THREE of the following are valid methods for registering tags to IP addresses to populate Dynamic Address Groups?
VM-Series instances can query cloud provider metadata services (AWS, Azure, GCP) to harvest instance tags, then register those tags against the instance IP addresses. This populates Dynamic Address Groups without external agents, satisfying the tag-registration requirement for cloud-hosted workloads.
Why this answer
Option B is correct because the VM-Series can be configured with a cloud provider plugin (e.g., AWS, Azure, GCP) that polls the cloud metadata service to learn which IP addresses belong to instances carrying specific tags, and this information is used to populate Dynamic Address Groups. Option D is correct because the User-ID agent can register IP-to-tag mappings via the User-ID XML API, allowing tags to be associated with IP addresses and thereby populate Dynamic Address Groups. Option E is correct because the PAN-OS XML API exposes a 'register' operation (e.g., type=user-id, cmd=<register><entry ip=...><tag><member>...</member></tag></entry></register>) that directly registers tags to IP addresses for Dynamic Address Group membership.
Option A is not a valid method because tags are not assigned to interfaces in the Network tab; interface configuration does not register tags to IP addresses for Dynamic Address Groups. Option C is not a valid method because custom App-ID creation identifies applications in traffic and does not register tags to IP addresses for Dynamic Address Group population.
Which tab in the Palo Alto Networks GUI is primarily used to manage Security and NAT policies?
The Policies tab in the Palo Alto Networks GUI contains the Security, NAT, Decryption, Application Override, and other policy rulebases. This satisfies the stem's requirement for the primary location to manage Security and NAT policies.
Why this answer
The 'Policies' tab is the central location for managing all types of policies.
A security analyst is troubleshooting why the firewall is not generating a specific type of log. The analyst suspects that the log forwarding profile is not correctly attached to the security policy rule. Where in the PAN-OS web interface can the analyst verify which log forwarding profile is applied to a specific security rule?
In the Policies > Security page, the Actions column displays icons that indicate whether logging is enabled and which log forwarding profile is attached. Clicking the log forwarding icon shows the profile name. This is the correct location to verify the association between a security rule and its log forwarding profile.
Why this answer
The security policy rule itself defines whether logging is enabled and which log forwarding profile is used. The Actions column in Policies > Security provides a quick way to see this association. Other locations either manage profiles globally or display logs, but not the rule-specific configuration.
Verifying the rule's actions is essential for troubleshooting missing logs.
Exam trap
The trap here is confusing where log forwarding profiles are created with where they are attached to security rules.
An analyst is reviewing a security policy that references an Address object named Web-Server-Prod. A change request requires updating the object to a new IP address, but the object is referenced by multiple policies across several folders in Strata Cloud Manager. The analyst wants the change to take effect everywhere with minimal effort. What should the analyst do?
Address objects are referenced by name, so editing the object's value updates every policy that uses it. This is the core benefit of object reuse: a single change propagates to all referencing rules without editing each policy individually. It minimizes effort and reduces the risk of inconsistent configurations across folders.
Why this answer
Because policies reference Address objects by name, editing the object's IP value automatically updates every rule that references it, regardless of folder. This is the primary advantage of object-based configuration: a single edit propagates consistently and eliminates the need to touch each policy, reducing effort and the chance of configuration drift.
Exam trap
The trap here is thinking that each policy stores its own copy of the IP address, when policies actually reference the object by name and inherit its current value.
A security analyst is creating a new static Address Object on a Palo Alto Networks firewall to represent a partner company's web server at 203.0.113.45/32. The analyst must complete the required fields correctly for the object to commit and function in policy. Which two elements are required when defining this static Address Object? (Choose two.)
A static Address Object must contain the actual IP address or subnet it represents, such as 203.0.113.45/32. This value is what the firewall matches against in policy evaluation, so omitting it leaves the object undefined and unusable in any Security Policy rule.
Why this answer
A static Address Object fundamentally needs two things: a unique name so it can be referenced unambiguously, and the IP address or subnet value that the firewall will match. Tags, descriptions, and DNS associations are optional attributes that enhance management or apply to other object types but are not required to create or use this object.
Exam trap
The trap here is treating optional metadata such as tags or descriptions as mandatory fields, when only the name and address value are truly required for a static Address Object.
A security administrator is configuring a firewall to send alerts when the number of failed login attempts exceeds a threshold. The administrator wants to avoid alerting on failed logins from the internal vulnerability scanner, which regularly performs brute-force tests. Which configuration should the administrator use?
A Log Forwarding profile can include match criteria that filter logs based on source IP. By creating a match list that excludes the scanner's IP, the administrator can forward only relevant failed login alerts to the alerting system. This is the correct method to selectively forward logs while ignoring the scanner's activity, as it operates at the log forwarding level.
Why this answer
The correct approach is to use a Log Forwarding profile with a match list that excludes the scanner's IP address. This allows the firewall to generate logs for all failed logins but only forward those that do not originate from the scanner to the alerting system. Security policy rules and DoS profiles do not control log forwarding, and authentication profiles lack the required filtering capability.
Exam trap
The trap here is thinking that authentication profiles or security rules can filter log alerts; log forwarding profiles are the correct tool for selective forwarding.
A NetSec-Analyst is troubleshooting why a user cannot access a web application. The traffic is allowed by the security policy, but the application fails to load. The analyst suspects an issue with SSL decryption. Which two actions should the analyst take to verify that SSL decryption is functioning correctly for this traffic? (Choose two.)
The Decryption Log records details about SSL decryption sessions, including the decryption policy rule matched, the certificate used, and any errors such as untrusted issuer or unsupported cipher. By filtering for the user's session, the analyst can see if decryption was attempted and if it succeeded or failed. This directly verifies whether SSL decryption is working for that traffic.
Why this answer
To verify SSL decryption for a specific traffic flow, the analyst should examine the Decryption Log for session details and use the 'test decryption-policy-match' command to confirm which decryption rule applies. The Decryption Log reveals if decryption was attempted and any errors, while the policy match test ensures the correct rule is matched. Together, they provide a clear picture of whether decryption is functioning as intended for that user's traffic.
Exam trap
The trap here is assuming that if a session is identified as SSL, it is automatically decrypted, when in fact decryption depends on policy match and certificate trust.
A network security analyst is creating a new Security Policy rule in Strata Cloud Manager to allow access to a SaaS application. The SaaS provider publishes a list of IP addresses that changes frequently, and the analyst wants the rule to automatically adapt without manual edits. They decide to use a Dynamic Address Group (DAG) based on tags. What must be configured on the firewall or in Strata Cloud Manager for the DAG to populate its members?
Dynamic Address Groups rely on tags applied to IP addresses by an external source. Without a registered IP-tag source like a VM Information Source, User-ID agent, or an API-based tag provider, the firewall has no way to learn which IPs belong to the group. This makes the rule automatically adapt as the SaaS provider's IPs change.
Why this answer
Dynamic Address Groups automatically include IP addresses based on tags applied by a registered IP-tag source. The firewall must receive tag information from a VM Information Source, User-ID agent, or similar service. This allows the Security Policy rule to dynamically adapt to changing IP addresses without manual intervention, which is essential for SaaS applications with frequently updated IP ranges.
Exam trap
The trap here is assuming that an External Dynamic List alone can populate a Dynamic Address Group, when in fact the DAG requires tags from a registered source.
A security analyst needs to define a custom application object in Strata Cloud Manager for an internally developed line-of-business tool that uses TCP port 8443 and is not covered by any existing App-ID signature. The analyst wants the security policy to match this traffic by the custom application rather than by a port-based service. Which configuration step is required?
A custom Application object lets the analyst define a new application with its own port, protocol, and timeout characteristics when no App-ID signature exists. Once created, it is selectable in the security policy's application field, so policy matching is by the custom application rather than by a raw service. This meets the requirement precisely.
Why this answer
When no App-ID signature covers an internal application, the correct approach is to create a custom Application object that defines the port and protocol, then reference it in the policy. This gives application-based matching and control for the custom tool, which a port-only Service object or an Application Filter cannot provide.
Exam trap
The trap here is assuming that a Service object for the port is equivalent to an application definition, when Service objects match only port and protocol.
An analyst is registering a new firewall in Strata Cloud Manager (SCM) and needs to create a Security Zone object that is restricted to the 'internet' and 'dmz' interfaces only, so that later Security Policy rules can reference it. Which object type should the analyst create to meet this requirement?
A Security Zone object is the correct construct for grouping one or more interfaces into a logical trust boundary. By assigning the 'internet' and 'dmz' interfaces to a single zone object, the analyst gives policy rules a stable reference that automatically tracks those interfaces. This is exactly the purpose of a zone object in SCM's object configuration model.
Why this answer
A Security Zone object is the only object type in SCM that inherently groups interfaces into a logical unit that policy rules can reference. Address, Service, and Application Filter objects operate on IPs, ports, or application signatures respectively and cannot represent interface membership. Creating a zone object with the two interfaces assigned gives the analyst a reusable, interface-aware reference for subsequent policy configuration.
Exam trap
The trap here is assuming that any object which lists the interfaces' IP addresses behaves like a zone, when only a Security Zone object actually binds to interfaces.
A user reports that they cannot access a website, receiving a 'page cannot be displayed' error. Which log type should the administrator check first to see if the traffic is reaching the firewall?
Traffic logs record every connection attempt traversing the firewall, including source, destination, port and action taken. Checking them first confirms whether the user's request reached the firewall and whether a rule allowed or blocked it, directly satisfying the stem's requirement to verify traffic arrival before investigating DNS, proxy or endpoint causes.
Why this answer
The Traffic log tracks every session that hits the firewall, making it the primary source for connectivity troubleshooting.
A security analyst is tasked with creating a policy to block traffic from known malicious IP addresses. The analyst wants to use a dynamic list that is automatically updated. Which two components are required to implement this? (Choose two.)
A security policy must be configured to block traffic from the EDL. The policy would specify the EDL as the source address and set the action to deny. This directly enforces the block based on the dynamic list. Without a policy, the EDL alone does not block anything.
Why this answer
To block traffic from a dynamic list, an External Dynamic List (EDL) must be configured to retrieve the list of malicious IPs. Then, a security policy must be created that references the EDL as the source and sets the action to deny. Together, these components provide automatic updates and enforcement.
Exam trap
The trap here is thinking that a Dynamic Address Group is mandatory for using an EDL, when in fact a security policy can directly reference the EDL without it.
A network security administrator is configuring a firewall to send alerts to an external SIEM when a critical threat is detected. The administrator wants to ensure that the alerts include the source and destination IP addresses, threat name, and severity. Which configuration step is necessary to achieve this?
A Log Forwarding profile defines which logs are forwarded to external systems and what fields are included. By matching threat logs and specifying the SIEM syslog server, the firewall will send the required details. Attaching it to the security policy ensures that logs generated by that policy are forwarded. This is the correct method to achieve the desired alerting.
Why this answer
To forward threat logs to an external SIEM with specific fields, a Log Forwarding profile must be created and attached to the security policy. The profile matches threat logs and specifies the syslog server (SIEM) as the destination. This ensures that when a threat is detected, the log is sent with the configured details.
Other options either do not forward logs or forward the wrong log type.
Exam trap
The trap here is confusing syslog server configuration with log forwarding; defining a server does not automatically forward logs.
A network security analyst is troubleshooting a site-to-site VPN tunnel that is showing as 'up' but no traffic is passing through it. The analyst wants to verify if the firewall is encrypting and decrypting packets correctly. Which tool should the analyst use to capture and examine the packets?
Packet capture on the tunnel interface allows the analyst to see both encrypted (outside) and decrypted (inside) packets. By comparing them, the analyst can verify if encryption/decryption is occurring. This is a standard troubleshooting method for VPN issues. It provides direct evidence of whether traffic is being processed correctly.
Why this answer
When a VPN tunnel is up but no traffic passes, the analyst must verify that packets are being encrypted and decrypted. Packet capture on the tunnel interface allows examination of both the encrypted outer packets and the decrypted inner packets. This confirms whether the firewall is processing traffic correctly.
Other options like checking status or logs do not provide direct evidence of packet flow.
Exam trap
The trap here is relying on tunnel status indicators or logs, which may show the tunnel as up but not reveal that data is not being encrypted or decrypted due to policy or routing issues.
An administrator attempts to delete an Address Object that is referenced by a security policy. What will happen?
Strata Cloud Manager enforces referential integrity. When an object is referenced by a policy, deletion is blocked. The administrator must edit the policy to remove the reference before the object can be deleted. This prevents accidental policy breakage and maintains configuration consistency.
Why this answer
Strata Cloud Manager blocks the deletion of an object that is referenced in a security policy. The administrator must first remove the object from all policies, then delete it. This referential integrity check prevents accidental policy misconfigurations and ensures that policies always reference valid objects.
Exam trap
The trap here is assuming that deletion is allowed and that the system automatically cleans up references, which it does not.
When managing objects in SCM, which actions can be performed on tags? (Choose TWO)
Tags in SCM support metadata such as a colour label, letting administrators visually group and distinguish objects within the shared policy structure. Assigning a colour is a supported tag action, alongside naming and description, and it aids rapid identification across folders and snippets.
Why this answer
Option A (Assigning a color) is correct because Palo Alto Networks SCM (Strata Cloud Manager) allows administrators to assign a color to a tag, which serves as a visual label for quick identification and filtering of tagged objects. Option D (Applying to objects for organization) is correct because tags are metadata labels that can be attached to objects such as addresses, address groups, and policies to categorize, group, and organize them logically within SCM. Options B and C are incorrect because IP ranges and port protocols are attributes of address objects and service objects respectively, not of tags.
Option E is incorrect because a security policy is a separate rule construct that can reference tags, but tags themselves do not create security policies.
A network security analyst is troubleshooting why a security policy is not matching traffic from a specific user. The policy is configured to allow HTTP traffic from the 'Trust' zone to the 'Untrust' zone for a specific source IP. The analyst runs 'test security-policy-match' and sees that the traffic matches a different policy that denies it. The analyst wants to determine the exact order of policy evaluation and why the deny policy is matching first. Which action should the analyst take?
Security policies are evaluated top-down, and the first matching rule is applied. If a deny rule appears before the allow rule, traffic will be denied even if a later rule would allow it. Reviewing the rule order in the interface reveals the sequence and explains why the deny rule matches first. This is the most direct way to resolve the issue.
Why this answer
Security policies are processed sequentially, and the first rule that matches the traffic is enforced. If a deny rule precedes an allow rule, the deny takes effect. The analyst must inspect the rule order to see that the allow rule is positioned incorrectly.
This is a common misconfiguration in complex rule sets. Adjusting the order so that the allow rule appears before the deny rule will resolve the issue.
Exam trap
The trap here is focusing on session or counter data when the real issue is the top-down evaluation order of security policies.
A security analyst is tasked with reviewing the firewall's logs to identify potential security incidents. The analyst needs to ensure that logs are being forwarded to an external SIEM for long-term retention and analysis. Which TWO actions must the analyst verify are configured correctly on the firewall? (Choose two.)
Log Forwarding profiles define where logs are sent, such as to a SIEM via syslog. Applying the profile to security policy rules ensures that traffic logs matching those rules are forwarded. Without this, logs may only be stored locally and not reach the SIEM. This is a critical configuration step.
Why this answer
To forward logs to an external SIEM, the firewall must have a syslog server profile that defines the SIEM's address and port, and a Log Forwarding profile that references that syslog profile and is applied to security policy rules. These two components ensure logs are generated and sent to the SIEM. Other options, such as management gateway, Threat Prevention license, or local logging, do not enable external forwarding.
Exam trap
The trap here is assuming that enabling logging on security rules or having a valid license automatically forwards logs externally, when a separate forwarding configuration is required.
Which elements are required when creating a new custom Service Object? (Choose THREE)
A custom Service Object must define the protocol it represents, since the protocol determines whether destination port fields apply. Without a protocol value the object cannot be matched against traffic, so Protocol is a mandatory element when creating one.
Why this answer
When creating a custom Service Object, the Protocol (A) is required because the firewall must know which IP protocol (e.g., TCP, UDP, ICMP) the service uses to match traffic correctly. The Port (C) is required because a service object defines the destination port (or port range) that the protocol operates on, such as TCP/443. The Name (D) is required because every service object must have a unique identifier used to reference it in security policy rules.
Tag (B) is optional metadata used for grouping or filtering objects and is not mandatory for creation. Description (E) is also optional documentation and is not required for the object to function.
Which of the following is NOT a valid type of address object?
An address object represents a network host, range, subnet or FQDN used in security policy rules. IP Protocol is a transport-layer protocol identifier (TCP, UDP, ICMP), not an address, so it cannot be defined as an address object in a firewall configuration.
Why this answer
Palo Alto Networks supports IP Netmask, IP Range, and FQDN objects. IP Protocol is not an address object type.
A security operations team wants to ensure that firewall configuration changes are reviewed and approved before being committed to production devices. The team uses a change management workflow and needs an audit trail of who made each change and when. Which capability should be implemented to meet these requirements?
Integrating with a change management system that enforces approval gates ensures changes are reviewed before deployment. Logging commits with user identity creates the required audit trail. This combination directly addresses both the approval workflow and the need to track who made each change, which the other options do not provide.
Why this answer
A change management system with approval gates enforces review before commits and captures user identity in logs, creating an auditable record. RBAC and versioning are supportive controls but do not provide the required workflow or identity-linked audit trail on their own.
Exam trap
The trap here is equating role-based access control with an approval workflow, when RBAC only limits who can change settings, not whether changes are reviewed.
When creating a NAT policy, which field defines the address that the traffic will be translated to on the destination side?
The Translated Address field specifies the destination IP that original traffic is rewritten to, matching the stem's requirement for the destination-side translation address. Source Translation defines the outbound source rewrite, so it addresses a different axis of the NAT rule.
Why this answer
In a NAT policy, the Translated Address field (sometimes labeled 'Translated Packet' or 'NAT Translated Address') specifies the IP address that the original source or destination is rewritten to. For destination NAT (DNAT), this is the internal address that external traffic is redirected to; for source NAT (SNAT), it is the public address outbound traffic appears to come from. The field name explicitly describes the post-translation address.
Exam trap
NetSec-Analyst often tests the confusion between the original packet fields (Source/Destination Address) and the translated packet fields — candidates pick 'Destination Address' because the question mentions 'destination side,' missing that the question asks for the post-translation address.
How to eliminate wrong answers
Option A is wrong because Destination Address defines the original destination of the traffic (the pre-translation target), not the address it is translated to. Option B is wrong because Service Port defines the port or protocol match for the policy, not an IP address translation. Option C is wrong because Source Address defines the original source of the traffic (pre-translation), not the translated address.
Which TWO of the following are benefits of using Strata Cloud Manager for enterprise firewall management?
Strata Cloud Manager aggregates telemetry from every managed firewall into one console, delivering centralised visibility and reporting across the estate. This directly satisfies the stem's enterprise-scale constraint, where distributed firewalls otherwise require separate logins and disjointed log review, obscuring correlated threats and policy drift.
Why this answer
Option A (Centralized visibility and reporting) is correct because Strata Cloud Manager is Palo Alto Networks' cloud-delivered management plane that aggregates telemetry, logs, and health data from managed firewalls into a single console, giving administrators unified dashboards, analytics, and reporting across the entire estate. Option C (Uniform policy distribution across device groups) is correct because Strata Cloud Manager uses hierarchical device groups and policy objects to push consistent security rules and configurations to many firewalls at once, eliminating per-device manual configuration and reducing policy drift. The remaining options are incorrect: power supplies (B) are a physical hardware concern unrelated to a cloud management service, automatic hardware replacement (D) is a support/RMA function rather than a management-platform benefit, and interface speed (E) is determined by the firewall's hardware and link capabilities, not by Strata Cloud Manager.
A network security analyst is configuring a rule that must permit outbound traffic to any IP address within the range 172.20.0.0 through 172.20.255.255. Instead of creating 256 separate address objects, the analyst wants to define a single object. Which object type should be used?
An IP Range object allows a start and end IP address to be specified, covering the entire contiguous block from 172.20.0.0 to 172.20.255.255 in one object. This is the correct choice because the requirement is a contiguous range that is not easily expressed as a single CIDR (it spans multiple /24 networks). The firewall expands the range internally, so a single object reference in policy is sufficient.
Why this answer
The requirement is to represent a contiguous block of IP addresses that does not align to a single CIDR prefix. An IP Range object is designed exactly for this purpose, allowing a start and end address to be defined in one object. Address Groups, FQDN objects, and Dynamic Address Groups serve different purposes and cannot statically define such a range.
Exam trap
The trap here is assuming that any object containing multiple addresses is an Address Group, when the scenario actually requires a single object that natively defines a contiguous IP range.
An administrator is creating a new Service Object to represent a custom application that uses TCP port 8443. The application is used by multiple departments and will be referenced in several security policies. Which of the following is the correct way to create this Service Object?
A Service Object is defined by protocol and port. For a custom application using TCP port 8443, specifying TCP and destination port 8443 correctly identifies the service. This object can then be reused in policies, ensuring consistent enforcement. The destination port is the standard way to define the service port for TCP.
Why this answer
A Service Object must accurately reflect the protocol and port used by the application. Since the custom application uses TCP port 8443, the object should be defined with protocol TCP and destination port 8443. This ensures that policies referencing the object will correctly identify and control the traffic.
Other protocols or port directions would not match the application's traffic.
Exam trap
The trap here is mixing up source and destination ports, or selecting the wrong protocol, which are common mistakes when defining Service Objects.
A network security analyst is configuring an object in Strata Cloud Manager (SCM) to represent a partner company's web portal that is reachable at portal.example.com and resolves to several changing public IP addresses. The analyst wants the security policy to remain valid even when the partner rotates its DNS records. Which object type should the analyst create to satisfy this requirement?
An FQDN Address object stores a fully qualified domain name and is resolved by the firewall at policy evaluation time, so when the partner rotates DNS records the policy automatically uses the updated IP addresses. This keeps the security policy valid without manual edits or object recreation, which is exactly what the scenario requires.
Why this answer
An FQDN Address object is the right fit because it resolves a hostname to IP addresses at policy evaluation time, so DNS changes by the partner are absorbed automatically. Static address types and tag-driven dynamic groups do not perform DNS resolution, meaning they would require manual updates and could break the security policy when the partner's records change.
Exam trap
The trap here is assuming that any object resolving a hostname must be a Dynamic Address Group, when FQDN Address objects are the type that actually performs DNS resolution.
Which of the following is an example of a 'Service' object?
A Service object is defined by its port and transport protocol pairing, so TCP/80 identifies the service listening on port 80. This contrasts with Host and Network objects, which are defined by IP addressing rather than protocol-port combinations.
Which TWO pieces of information must an administrator provide when setting up a Log Forwarding profile?
A Log Forwarding profile requires the destination server's IP address so the firewall knows where to send traffic logs. This satisfies the stem's constraint of mandatory configuration data: without a defined collector address, the profile cannot establish the syslog or HTTP forwarding session to the external log server.
Why this answer
Option B is correct because a Log Forwarding profile must specify the destination server's IP address (or FQDN) so the firewall knows where to send the forwarded logs, typically as a syslog server or an HTTP/S server. Option E is correct because the profile must define which log types to forward — such as Traffic, Threat, URL, WildFire, or Data — since the profile matches logs by type before forwarding them to the destination. Option A is incorrect because a local user account list is unrelated to log forwarding; user accounts are managed under authentication/User-ID settings, not in a Log Forwarding profile.
Option C is incorrect because the firewall root password is a device administration credential and is never required to configure or operate log forwarding. Option D is incorrect because physical chassis weight is a hardware specification with no role in configuring a Log Forwarding profile.
A network security analyst is troubleshooting a site-to-site VPN tunnel that shows as 'up' but no traffic is passing. The analyst wants to verify whether the firewall is encrypting and decrypting packets correctly. Which two CLI commands should the analyst use to check the VPN tunnel statistics and the status of the IPsec security associations? (Choose two.)
The 'show vpn ipsec-sa detail' command provides detailed information about the IPsec security associations, including encryption and decryption packet counters, bytes, and any errors. This directly shows whether packets are being encrypted and decrypted, which is crucial when the tunnel is up but traffic is not passing. It can reveal if one direction has zero counters, indicating a problem.
Why this answer
To verify that the firewall is encrypting and decrypting packets correctly, the analyst should check the IPsec security associations and their statistics. The 'show vpn ipsec-sa' command lists the SAs and their status, confirming that Phase 2 is established. The 'show vpn ipsec-sa detail' command provides packet and byte counters for encryption and decryption, showing whether traffic is actually being processed.
Together, they pinpoint whether the tunnel is passing traffic and if there are errors in one or both directions.
Exam trap
The trap here is focusing on IKE SAs or general flow statistics, which only confirm Phase 1 or overall flow presence, but not the actual IPsec SA status and packet counters needed to diagnose why traffic is not passing.
Which TWO of the following are valid source types for a Security Policy?
A Security Policy can match on source address, the IP address or subnet of the originating host. Address-based matching is a standard source criterion in the rulebase, so it satisfies the stem's requirement for a valid source type.
Why this answer
Security policies can match on Source Zones and Source Address objects.
A security analyst is reviewing the firewall's logs and notices a high number of 'session end' logs with reason 'policy-deny' for traffic from the internal network to an external IP. The analyst wants to determine if this is a security incident or misconfiguration. Which step should the analyst take first?
Reviewing the rulebase identifies which rule is denying the traffic and why. If the rule is intentionally blocking, it may be expected; if not, it could indicate misconfiguration or a security event. This is the logical first step to understand the context of the denies before escalating or taking action.
Why this answer
The first step is to review the security policy rulebase to identify which rule is causing the denies. This helps determine if the denies are intentional (e.g., a block rule for a known bad IP) or accidental (e.g., a misconfigured rule). Understanding the policy context guides further investigation and response, whether it is a security incident or a configuration issue.
Exam trap
The trap here is jumping to block the external IP or enable packet capture without first understanding why the traffic is being denied by policy.
A firewall administrator must back up the current configuration before applying a risky change. The administrator wants a backup that can be restored directly through the firewall's web interface and that includes all configuration settings. Which action should be taken?
Exporting a named configuration snapshot creates a full XML backup of the running configuration that can be imported and restored via the web interface. It captures all settings, including policies, objects, and network configuration, making it suitable before a risky change. This is the standard on-box backup method.
Why this answer
A named configuration snapshot exported from Device > Setup > Operations is a complete, web-restorable backup of the firewall configuration. Tech support files and certificate exports serve different purposes, and a raw config save to USB is not the standard web-restore path. Exporting the snapshot before a risky change is the correct safeguard.
Exam trap
The trap here is confusing a tech support file, which is for diagnostics, with a configuration backup that can actually be restored.
Which TWO of the following characteristics apply to Service Objects in Strata Cloud Manager?
Service Objects define protocol and port criteria, and they support port ranges such as 1000-2000 rather than only single ports. This range capability is a defining characteristic, letting one object represent a contiguous span of ports.
Why this answer
Option B is correct because Service Objects in Strata Cloud Manager support port ranges (for example, 1000-2000) in addition to single ports, which lets administrators define a contiguous span of ports within one object rather than creating many individual entries. Option E is correct because Service Objects can be referenced inside Service Groups, and those groups can then be used in policy rules, simplifying and reducing the size of the rulebase. Option A is incorrect because tags are not automatically inherited from the policy rule a Service Object is applied to; tags are assigned to objects directly.
Option C is incorrect because Service Objects are scoped to a folder/device group hierarchy and are not required to be globally unique across all Device Groups. Option D is incorrect because a Service Object defines a single protocol (TCP or UDP) with its port or port range, so TCP and UDP cannot be combined in one object.
Which THREE features are associated with an 'Application Filter'?
Application Filters in Microsoft Defender for Cloud Apps inspect traffic by technology type, such as SaaS, IaaS or PaaS, letting you scope policies to specific cloud service categories. This satisfies the stem's requirement for a recognised Application Filter attribute, alongside risk score and permission level.
Why this answer
Application Filters group applications based on category, subcategory, and technology, and these filters update automatically as new applications are added to the PAN-OS database.
A security analyst is reviewing the firewall's administrative accounts and wants to enforce the principle of least privilege. The analyst needs to create a custom administrative role that allows a user to view security policies and logs but not modify them. Which two permissions should be assigned to this custom role? (Choose two.)
Granting read-only access to the Policies module allows the user to view security policies without the ability to edit or delete them. This aligns with the principle of least privilege, as the user can inspect policies but cannot make changes. This permission is essential for the described role.
Why this answer
To adhere to least privilege, the custom role should grant only the minimum permissions needed: read-only access to the Policies module to view security rules and read-only access to the Logs module to review log data. Other permissions, even if read-only, provide access to unrelated areas and are not necessary for the task.
Exam trap
The trap here is over-provisioning permissions by including read-only access to unrelated modules or write access, which violates least privilege.
A security analyst is investigating a suspected data exfiltration attempt. The analyst needs to examine the packet payload of a specific session to determine if sensitive data is being transmitted. Which tool should the analyst use to capture and inspect the packet payload in real time?
The 'debug dataplane packet-diag set filter' command allows the analyst to define a filter for capturing packets on the dataplane. After setting the filter, the analyst can capture packets and then view them with 'view-pcap' or export for analysis. This provides the raw packet payload needed to inspect for sensitive data exfiltration. It is the correct tool for real-time packet inspection on PAN-OS.
Why this answer
To inspect packet payload for data exfiltration, the analyst must capture raw packets. The 'debug dataplane packet-diag set filter' command enables setting up a packet capture filter on the dataplane. Once captured, the packets can be viewed or exported for analysis, revealing the payload.
Other commands provide session metadata or policy information but lack the ability to show actual packet contents.
Exam trap
The trap here is assuming that session details or counters include packet payload, when only a dedicated packet capture tool can provide that level of detail.
What are the primary characteristics of Service Groups? (Choose TWO)
Service Groups exist precisely to bundle multiple service objects into a single referenced entity, so a policy rule can match many ports and protocols without listing each service individually. This aggregation satisfies the question's requirement that groups hold service objects as members.
Why this answer
Service Groups are logical containers that bundle multiple service objects (individual TCP/UDP port definitions) into a single referenced object, so option A is correct because their core purpose is to aggregate several service objects for use in a single security policy rule. Option C is also correct because a service group can contain both TCP and UDP service members simultaneously, letting one policy rule match traffic on mixed protocols and ports. Options B, D, and E are incorrect: service groups are not restricted to inbound traffic (they can be referenced in any policy direction), they are not limited to a single service (that contradicts their aggregation purpose), and they have no requirement for a unique color, which is not a property of service group objects.
A network security analyst is troubleshooting an issue where users on the internal network cannot reach a critical external web application. The security policy rule that should permit this traffic is not generating any logs, and the session count for that rule is zero. The analyst suspects that the traffic is being denied by an implicit rule or is not matching any rule due to a configuration error. Which CLI command should the analyst use to determine the exact rule that is being applied to the traffic?
The 'test security-policy-match' command allows the analyst to simulate a traffic flow by specifying source, destination, user, and application, and it returns the security policy rule that would match. This is the most direct way to see which rule is applied, including implicit rules, without generating actual traffic. It helps identify misconfigurations such as incorrect zones or addresses that cause the traffic to miss the intended rule.
Why this answer
The 'test security-policy-match' command is designed to simulate a traffic flow and report the exact security policy rule that would be applied, including implicit deny rules. Since the traffic is not generating logs or sessions, this tool provides immediate insight into rule matching without generating actual traffic. It allows the analyst to verify zone, address, user, and application parameters to pinpoint why the intended rule is not matching.
Exam trap
The trap here is assuming that packet capture or session inspection will reveal the matching policy rule, when in fact only a policy match simulation directly identifies the rule responsible for the action.
When creating a Dynamic Address Group (DAG), what is the primary prerequisite for the object to populate successfully?
Dynamic Address Groups populate only from tags registered against IP addresses, not from static membership or subnet matching. The tag registration supplies the filter criteria the DAG evaluates, so without a registered tag the group stays empty. This satisfies the stem's prerequisite: the IP must carry a tag via registration.
Why this answer
DAGs rely on Tags being registered to the IP address via VM-Series monitoring, XML API, or User-ID.
A security analyst is reviewing firewall logs and notices that a specific internal host is generating a high volume of denied outbound connections to many external IP addresses on port 443. The analyst wants to quickly identify whether this host is compromised and what action to take. Which step should the analyst take first?
Threat logs and WildFire verdicts reveal whether the firewall detected malware, command-and-control traffic, or other malicious patterns associated with the host. This evidence determines whether the host is compromised and guides the appropriate response. It is the correct first step before containment.
Why this answer
Threat logs and WildFire verdicts provide the evidence needed to determine whether the host is compromised, including malware detections and command-and-control signatures. Containment or remediation actions such as blocking or reimaging should follow confirmation, not precede it. Reviewing threat intelligence first ensures the response is justified and preserves forensic data.
Exam trap
The trap here is jumping to containment or remediation before confirming compromise, which can destroy evidence and disrupt legitimate activity.
An administrator wants to schedule signature updates to occur at 3:00 AM daily. Where is this configured?
Device > Dynamic Updates provides the scheduled signature update setting, where a recurring daily time is defined for the firewall to fetch new content versions. This directly satisfies the 3:00 AM daily requirement, unlike manual or threshold-based update methods that cannot enforce a fixed schedule.
Why this answer
The Device > Dynamic Updates page contains the schedule settings for various update types like Applications, Threats, and WildFire.
What is the primary purpose of a 'Device Group' in the context of SCM?
A Device Group groups firewalls so that one set of security policy and objects is pushed consistently to all members, satisfying the stem's requirement for applying consistent security policies across multiple firewalls. It is the policy-container mechanism, distinct from Template stacks which handle device and network settings.
Why this answer
Device groups allow for the hierarchical grouping of firewalls for shared policy management, providing consistent security across the enterprise.
Which of the following are benefits of using Device Groups in SCM? (Choose THREE)
Device Groups let child firewalls inherit policy, objects and settings from parent groups, so configuration defined once cascades down the hierarchy. This inheritance mechanism satisfies the stem's requirement for a benefit of using Device Groups in SCM.
Why this answer
Device Groups in Palo Alto Networks Strata Cloud Manager (SCM) are hierarchical containers that let child folders/devices automatically receive settings defined at a parent level, so option B (Inheritance of configuration) is correct because policies, objects, and profiles flow down the hierarchy without being recreated per device. Option C (Shared object management) is correct because objects such as address objects, tags, and security profiles defined in a Device Group can be referenced by all member devices, eliminating duplicate definitions. Option E (Configuration modularity) is correct because Device Groups let you organize configuration into reusable, layered building blocks (for example, a baseline group plus site-specific groups) that can be mixed and matched across deployments.
Option A (Local-only access) is not a benefit of Device Groups, since Device Groups are precisely a mechanism for centralized, hierarchical management rather than restricting configuration to a single local device. Option D (Automatic hardware replacement) is not a Device Groups feature; hardware replacement/RMA is handled through device onboarding and licensing workflows, not through Device Group membership.
A security analyst is reviewing the firewall's configuration to ensure that all administrative changes are logged and can be traced back to the individual administrator. The analyst notices that all administrators are using the default 'admin' account. Which action should the analyst recommend to meet the requirement for accountability?
Creating unique administrator accounts ensures that each administrator logs in with their own credentials, so every configuration change is attributed to a specific user in logs. This directly satisfies the need for accountability and traceability. Assigning appropriate roles also follows the principle of least privilege, enhancing security. This is the recommended practice for administrative access.
Why this answer
Individual administrator accounts with unique usernames are essential for accountability because they allow the firewall to log each administrative action with the specific user who performed it. Shared accounts, even with strong authentication, cannot provide this traceability. Assigning roles ensures least privilege, but the key is unique identification.
This approach is a fundamental security best practice.
Exam trap
The trap here is assuming that external authentication or MFA alone solves accountability, when the real issue is the shared account itself.
How does an administrator perform a software update on a standalone firewall?
On a standalone firewall, software updates are installed from the Device tab's Software section, where available PAN-OS versions are downloaded and activated. Panorama-managed devices instead push updates centrally, so the standalone constraint points to this local GUI path.
Why this answer
Software updates are managed in the Device > Software page, where you can download and install new versions of PAN-OS.
A NetSec-Analyst is designing a policy for a Palo Alto Networks firewall that must enforce different security profiles for different user groups. The firewall is integrated with Active Directory via User-ID, and the analyst wants to apply a stricter URL filtering profile to the 'contractors' group while allowing the 'employees' group to access a broader set of categories. The analyst creates two security rules with the same source and destination zones and applications, but different user groups and URL filtering profiles. What must be considered to ensure the correct rule is applied?
In Palo Alto Networks, security rules are evaluated top-down, and the first rule that matches all criteria is applied. If both rules match the same traffic, the one with the more specific user group must be placed above the broader one. Placing the 'contractors' rule above the 'employees' rule ensures contractors get the stricter URL filtering profile, while employees fall through to the broader rule.
Why this answer
Security rules are evaluated top-down, and the first matching rule wins. To apply stricter URL filtering to contractors, the rule matching the 'contractors' group must be placed above the rule matching the 'employees' group. This ensures contractors hit the stricter rule first, while employees match the broader rule.
Group mapping is supported, and profiles are not merged.
Exam trap
The trap here is assuming that the firewall will automatically merge or prioritize security profiles based on specificity, when in reality rule order determines which single rule and profile are applied.
A security analyst is creating a policy to allow a specific internal application that uses a proprietary protocol over TCP port 8443. The application is not recognized by App-ID and is currently identified as unknown-tcp. The analyst wants to ensure the traffic is allowed while still enabling threat inspection. Which action should the analyst take in the security policy?
This is correct because unknown-tcp can be explicitly selected as an application in a security policy. By specifying the Service as tcp/8443, the policy narrows the match to that port, and attaching a Security Profile enables threat inspection even for unidentified traffic. This approach allows the proprietary application while maintaining security visibility.
Why this answer
To allow unidentified TCP traffic on a specific port, the analyst should explicitly select unknown-tcp as the application and define the service as tcp/8443. This narrows the policy to the proprietary protocol while still allowing a Security Profile to inspect the traffic for threats. Using any application or custom objects would either be too broad or not match the traffic correctly.
Exam trap
The trap here is thinking that unknown-tcp cannot be selected as an application in a security policy, when in fact it can be explicitly allowed with a specific service.
A network security analyst is investigating intermittent connectivity failures to an external SaaS application. Users report that sometimes the connection works, but other times it times out. The firewall is configured with a security policy that allows the SaaS application by its App-ID, and SSL decryption is enabled for the traffic. The analyst suspects that decryption is failing for some sessions. Which log should the analyst examine first to determine whether decryption is failing and why?
The Decryption log records details about SSL decryption sessions, including errors such as unsupported cipher suites, certificate pinning, or untrusted issuer. It shows the reason for decryption failure, which is exactly what the analyst needs to diagnose intermittent failures. This log is the primary place to check when troubleshooting SSL decryption issues.
Why this answer
When SSL decryption is enabled and sessions fail intermittently, the Decryption log is the correct place to look. It records each decryption attempt and any error encountered, such as unsupported protocol versions, certificate issues, or policy bypass. This allows the analyst to pinpoint the exact cause of the intermittent failures, whether it is due to server-side certificate pinning, client certificate issues, or decryption profile settings.
Exam trap
The trap here is assuming that any security-related event will appear in the Threat log, but decryption errors are specifically logged in the Decryption log, not the Threat log.
An administrator is creating a new Service Group that will contain several Service Objects for different applications. They want to ensure that the Service Group can be used in a Security Policy to allow traffic for all the services. However, they also want to minimize the number of objects they need to manage. Which of the following is a valid consideration when creating a Service Group?
In Palo Alto Networks, Service Groups can contain other Service Groups, enabling nested groups. This allows for hierarchical organization of services, which can simplify management and reduce the number of objects referenced in policies. For example, you could have a group for web services that contains HTTP and HTTPS, and then a higher-level group that includes web services and DNS services. This is a valid and useful feature.
Why this answer
Service Groups can contain other Service Groups, allowing for nested groupings. This hierarchical structure helps organize services and reduce the number of objects referenced in policies. The other options are incorrect: Service Groups can contain mixed protocols, do not require port ranges, and can be modified after being referenced.
Exam trap
The trap here is assuming that Service Groups cannot be nested, but they can, which is a key feature for scalable management.
A network security analyst is troubleshooting a site-to-site VPN issue where the tunnel is up, but traffic is not passing. The analyst has verified that the IKE and IPsec security associations are established. The analyst suspects that the issue is related to routing or policy. Which two actions should the analyst perform to further troubleshoot the problem? (Choose two.)
A missing or incorrect route to the remote network will cause traffic to be sent elsewhere or dropped, even if the VPN tunnel is up. The firewall must have a route pointing to the tunnel interface for the remote subnet. Verifying the routing table confirms that traffic destined for the remote network will be directed into the tunnel, which is essential for proper forwarding.
Why this answer
When a VPN tunnel is up but traffic is not passing, common causes are missing routes or security policies. The firewall must have a route to the remote network via the tunnel interface, and security policies must allow traffic between the relevant zones. Checking these two items directly addresses the suspected routing or policy issue.
Other actions like re-verifying IKE status or restarting the tunnel do not resolve configuration problems and may cause unnecessary disruption.
Exam trap
The trap here is assuming that an established tunnel guarantees traffic flow, ignoring the need for proper routing and policy configuration.
Which THREE requirements must be met to enable User-ID integration with Microsoft Active Directory?
The User-ID agent must authenticate to the directory to read login events, so a dedicated service account with the required read permissions is mandatory. Without it, the agent cannot query security logs or perform the group lookups User-ID depends on.
Why this answer
Option A is correct because the User-ID agent (or PAN-OS integrated agent) must authenticate to Active Directory using a dedicated service account with rights to read the security event logs and query the domain. Option D is correct because group mapping must be configured so the firewall can resolve AD group memberships into User-ID group objects used in policy. Option E is correct because the firewall or User-ID agent requires network connectivity to the domain controller over the required ports (e.g., LDAP 389/636, Kerberos 88, SMB 445, RPC 135) to read logs and perform lookups.
Option B is not required because NAT policy configuration is unrelated to User-ID-to-AD integration. Option C is not required because QoS priority classes have no bearing on enabling User-ID with Active Directory.
A NetSec-Analyst is configuring a Dynamic Address Group (DAG) that should include all servers tagged as 'Web'. The analyst notices that some servers with the 'Web' tag are not appearing in the DAG. The tags are applied via a VM monitoring agent. What is the most likely cause?
Dynamic Address Group filters are often case-sensitive, so a tag registered as 'web' will not match a filter for 'Web'. This is a common oversight when tags are created manually or by different systems. Ensuring consistent casing resolves the issue.
Why this answer
Dynamic Address Group filters match tags or metadata exactly, including case. If the tag is registered as 'web' but the filter expects 'Web', those servers will not be included. Checking tag casing and consistency is the first troubleshooting step.
Exam trap
The trap here is overlooking case sensitivity in tag matching, assuming tags are case-insensitive when they are not.
A network security analyst is reviewing the firewall's dashboard and notices that the 'Threat Prevention' license is about to expire in 30 days. The analyst needs to verify the current license status and expiry date for all subscriptions on the firewall. Which action should the analyst take?
The Device > Licenses page displays all installed licenses, their status, and expiration dates. This is the central location to verify subscription details and identify upcoming expirations. It provides a clear overview and is the standard method for license management on a Palo Alto Networks firewall.
Why this answer
The Device > Licenses page is the authoritative place to check all installed licenses, their status, and expiration dates. It provides a comprehensive list and is the recommended method for verifying subscription details. Other options either provide incomplete information or are less direct.
The analyst should use this page to confirm the Threat Prevention license status and plan renewal.
Exam trap
The trap here is assuming that the Dashboard widget or logs provide complete license details, when they often show only summaries or events.
A security operations team is planning to implement a new firewall rule that allows HTTP traffic from the guest network to an external web server. They want to ensure the rule is as specific as possible and adheres to the principle of least privilege. Which two additional parameters should they configure to restrict the rule? (Choose two.)
Specifying the destination IP address narrows the rule to only the intended web server, rather than allowing HTTP to any destination. This aligns with least privilege and reduces the attack surface. Without it, the rule would permit HTTP to any external server, which is overly permissive. Therefore, it is a necessary parameter.
Why this answer
To restrict the rule to only the intended web server and application, the team should specify the destination IP address and set the application to 'web-browsing'. These parameters limit the rule's scope to exactly what is needed, following least privilege. Logging, URL category 'any', and changing the source zone do not tighten the rule; they either have no restrictive effect or are incorrect for the scenario.
Exam trap
The trap here is assuming that enabling logging or setting a URL category to 'any' adds security, when in fact only specific destination and application parameters reduce the rule's scope.
An administrator needs to create a new Security Policy rule that allows HTTP and HTTPS traffic from the internal network to a specific external web server. The internal network is already defined as an Address object, and the external server is defined as an FQDN object. Which additional object is required to complete the rule?
A Security Policy rule requires a service to define the allowed applications or ports. Since the requirement is HTTP and HTTPS, a Service object that includes TCP ports 80 and 443 is necessary. Without it, the rule would not know which ports to permit. This is the correct additional object to complete the rule.
Why this answer
To complete the Security Policy rule, the administrator must specify the service that matches HTTP and HTTPS. A Service object defining TCP ports 80 and 443 is required. The source and destination are already covered by the existing Address and FQDN objects.
Other object types do not provide the necessary port-based service definition.
Exam trap
The trap here is thinking that an Application object is always needed for web traffic, when in this scenario the rule is port-based and requires a Service object.
A network security analyst is configuring a new Security Policy rule that must block traffic to a known malicious IP address. During policy creation, the analyst selects the 'Destination Address' field and realizes the malicious IP has not been defined as an Address Object yet. What is the most efficient action the analyst can take directly from the policy rule configuration interface?
The Object Selector embedded in the Destination Address field allows the analyst to create a new Address Object without leaving the policy rule. This inline creation streamlines workflow, reduces errors, and ensures the new object is immediately available for selection. It is the intended efficient method in the NetSec-Analyst platform.
Why this answer
The Object Selector within the Destination Address field enables inline creation of a new Address Object, allowing the analyst to define the malicious IP without leaving the policy rule. This is the most efficient method because it maintains workflow continuity and immediately associates the new object with the rule. Other methods either require navigation away or skip object creation entirely.
Exam trap
The trap here is assuming that creating an object always requires navigating to a separate Objects section, when in fact the policy editor provides an inline Object Selector.
Service groups are protocol-agnostic regarding their members.
Which TWO ways can an administrator verify that a security subscription is active?
The Device > Licenses GUI page displays each enrolled device's assigned licences and their activation state, so an administrator can confirm the security subscription is active directly against the endpoint. This satisfies the stem's verification requirement without relying on billing records or tenant-wide reports, which do not confirm per-device entitlement.
Why this answer
Option A is correct because the Device > Licenses GUI page in PAN-OS displays the installed licenses and their status, allowing an administrator to confirm whether the security subscription is active. Option E is correct because the CLI command 'show system license' outputs the current license state, including subscription validity and expiration dates. Option B is incorrect because the physical serial number label only identifies the firewall hardware and does not indicate license or subscription status.
Option C is incorrect because Traffic Logs record session activity, not licensing state. Option D is incorrect because pinging the license server only tests network reachability and does not verify that the subscription itself is active.
Why might an Address Object using an IP Netmask return a validation error even if the IP is valid?
An IP Netmask object requires host bits to be zero, representing a true network address. If the supplied IP has bits set outside the mask, validation fails because the address is not a valid network identifier for that mask.
Why this answer
The IP address must match the specified netmask (e.g., 10.1.1.5/24 is invalid because the host bits are set).
In PAN-OS, what is the impact of configuring an FQDN Address Object for a site that uses multiple IP addresses returned via DNS load balancing?
FQDN Address Objects resolve the hostname periodically and populate the object with every A/AAAA record returned, so round-robin or load-balanced DNS yields multiple members. The firewall re-resolves on the configured refresh interval, keeping the member list current as records change.
What is the 'Read-Only' state of an object indicating in SCM?
Read-Only indicates the object is inherited from a parent device group, so it cannot be edited locally. Changes must be made at the parent level, and the object appears greyed out in the child group's policy view.
Why this answer
An object is read-only if it is inherited from a parent device group, meaning it cannot be modified at the current level.
An administrator wants to run a report on all traffic blocked by the 'Block_Bad_Sites' security rule. Which tool should they use?
Custom Reports let administrators filter logs by a specific security rule such as 'Block_Bad_Sites', isolating its denied sessions. This satisfies the stem's requirement to report on traffic blocked by that named rule rather than all traffic.
Why this answer
The 'Report' functionality allows users to customize views based on specific policy rule names, actions, and timeframes.
Which section of the NGFW GUI allows an administrator to configure local administrative accounts?
Device > Administrators is the dedicated pane for creating and managing local administrator accounts on the firewall, including role-based profiles and authentication settings. It directly satisfies the stem's requirement to configure local administrative accounts, unlike policy or network sections that govern traffic rather than administrator identity.
Why this answer
Device > Administrators is where local admin accounts and their roles are defined.
Traffic is failing the 'Service' check in a security policy. Which CLI tool can be used to confirm which application is being identified for a specific source-destination pair?
The `test security-policy-match` command reports which application the firewall identifies for a given source-destination pair, directly satisfying the 'Service' check failure. Unlike `test application` or packet-tracer utilities, it evaluates the security policy lookup itself, showing the matched rule and resolved application, so you can confirm misidentification before adjusting the policy.
Why this answer
The 'test security-policy-match' tool simulates a policy lookup to determine which rule and application-ID will be matched for a given flow.
Practice NetSec-Analyst by domain
Target a specific domain to shore up weak areas.