Policy Creation And Application

A security analyst at a financial firm is reviewing the firewall rulebase after an audit finding. The auditor noted that several rules have the action set to 'allow' but no security profiles attached. The analyst wants to enforce a policy that prevents any allowed traffic from bypassing threat inspection, while still allowing the business applications. What should the analyst do first to align with a defense-in-depth policy?

When you use an Application Group in a policy, what happens if you add a new application to that group?

A NetSec-Analyst inherits a rulebase where an outbound permit rule lists a destination of 'any' and an application of 'any'. A change request asks to allow only business-approved SaaS applications from the corporate zone while continuing to block everything else, without disrupting existing sessions. Which policy change best meets the request?

What is the result of applying a 'Log at Session End' setting in a security policy?

A network security analyst is designing a policy for a new branch office that will use a Palo Alto Networks firewall. The branch has a mix of corporate-owned devices and guest devices. The analyst must ensure that guest traffic is isolated from the corporate network and that corporate traffic is inspected for threats. The branch uses a single firewall with multiple zones. Which two actions should the analyst take to meet these requirements? (Choose two.)

An organization has a strict requirement that all web traffic must be inspected. Which policy is required in addition to the Security policy to achieve this?

An administrator is creating a security policy to allow outbound web traffic. The policy uses the application 'web-browsing' and the service 'application-default'. A user reports that a website using a non-standard port (TCP 8080) is blocked. What is the most likely cause?

A NetSec-Analyst is reviewing a Palo Alto Networks firewall policy and needs to ensure that logging and log forwarding are correctly configured for security rules. The analyst wants to capture traffic that is allowed by a specific rule and also capture traffic that is denied by the implicit deny rule. Which two actions must be taken to meet these requirements? (Choose two.)

If an administrator creates an Application Override policy, what impact does it have on security inspection?

A NetSec-Analyst must implement a rule so that only members of the 'finance-approvers' group can reach a payment processing system, and the group membership is maintained in the corporate directory. The firewall is already integrated with the directory service and user mapping is working for other rules. Which source configuration on the Security Policy rule enforces this requirement most precisely?

An analyst is reviewing a firewall rulebase and notices that a security policy allowing outbound web traffic has no Application Filters or Service objects attached. The rule uses only source zone, destination zone, and user group as match criteria. What is the primary effect of this policy on traffic classification and enforcement?

What is the purpose of the 'Policy Optimizer' feature?

What is the purpose of the 'Service' field in a Security Policy?

An administrator needs to allow access to a new internal web application for employees in the 'Marketing' user group. The application uses a custom TCP port 8443. Which policy configuration should the administrator use to minimize security risk while ensuring access?

A security administrator at a financial firm needs to enforce that only members of the Active Directory group 'Finance' can access the internal accounting application, while all other authenticated users are denied. The firewall is configured with User-ID and an LDAP server profile. Which policy construct should the administrator use to meet this requirement?

Which THREE settings must be configured to allow inbound NAT traffic for a web server?

A security analyst is asked to create a policy that logs all traffic from the guest wireless network to the internet, including allowed and denied sessions, for compliance reporting. Which action should be taken when configuring the security policy rule?

A network security analyst is tasked with creating a policy to block traffic from the untrust zone to the trust zone for all applications except DNS and web browsing. The analyst wants to ensure that the policy is as specific as possible while maintaining the ability to log all denied traffic. Which policy action should be used for the deny rule?

An administrator wants to prioritize VoIP traffic over all other traffic. Which policy type is the best choice?

Which tab would you use to add a new Security policy rule?

A security analyst is configuring a Palo Alto Networks firewall to allow access to a web application hosted on a server in the DMZ. The application uses a custom TCP port 8443 and is not recognized by App-ID. The analyst wants to allow only this application while still using App-ID for other traffic. Which configuration should the analyst use?

An administrator needs to allow traffic from the internal network to a public web server using Source NAT. Which configuration is required to ensure the internal client IP is translated to the firewall's public interface IP?

What is the function of an 'Application Group' in PAN-OS policy creation?

A security analyst is creating a policy to control outbound web access. The requirement states that only corporate-approved SaaS applications may be used, and all other web traffic must be blocked. The analyst wants to minimize ongoing maintenance as new shadow IT applications appear. Which policy construct best satisfies this requirement?

Which of the following is the most efficient way to manage NAT policies for multiple similar servers?

Which THREE items can be used as a match criterion in a Security Policy?

Which THREE items are required for a valid QoS policy match?

A security administrator is creating a Security Policy rule to allow access to a specific external SaaS application. The administrator wants to ensure that the rule only allows traffic to that application and not to other applications that might use the same ports. Which Palo Alto Networks feature should be used in the Security Policy rule to achieve this granular control?

Which object type should be used when you want to group several address objects together?

What is the primary difference between a 'Service' object and an 'App-ID' in a security policy?

A network security analyst is reviewing a rulebase where a security policy allows traffic from the 'Guest' zone to the 'Internet' zone with an application filter that permits only 'web-browsing' and 'ssl'. Users report they cannot reach a new SaaS application that uses QUIC over UDP 443. The analyst confirms the application is identified as 'quic-base' by App-ID. Which action should the analyst take to allow the SaaS application while maintaining the least privilege?

A security administrator is creating a new security policy rule to allow internal users to access an external SaaS application. The administrator wants to ensure that only the specific application is permitted, not all web traffic. Which policy component should be used to achieve this?

A NetSec-Analyst is creating a Security Policy rule to permit a specific internal application for the finance department. The application uses a custom TCP port that is not recognized by App-ID, and the analyst wants to match traffic based on the destination port. Which configuration element must be used in the Security Policy rule to match the custom TCP port?

An administrator wants to permit traffic based on a specific User-ID group. Where should this group be referenced in the Security Policy?

A security analyst is implementing a policy to block peer-to-peer file sharing applications on a Palo Alto Networks firewall. The analyst creates a security policy that denies traffic from the 'Trust' zone to the 'Untrust' zone with an application filter containing 'bittorrent' and 'gnutella'. However, users are still able to use these applications. Which action should the analyst take to ensure the policy effectively blocks the traffic?

You are configuring a Security policy to allow web traffic. Why should you place the most specific rules at the top of the Security policy list?

A NetSec-Analyst is planning a rulebase migration between two Palo Alto Networks firewalls managed by different Panorama appliances. The analyst must preserve rule order and intent, and wants to use configuration elements that are portable and self-contained rather than dependent on external systems. Which TWO practices best support a clean, auditable migration? (Choose two.)

When configuring App-ID, how does the firewall identify traffic?

A security analyst is reviewing the firewall's policy optimization settings. The organization wants to eliminate redundant rules that are fully shadowed by earlier, broader rules. Which built-in tool should the analyst use to identify these shadowed rules?

A NetSec-Analyst is writing a security policy baseline for a Palo Alto Networks firewall. The security team wants to ensure that any traffic not explicitly permitted by a security policy is logged and blocked, but they also need to allow a temporary exception for a vulnerability scanner during an authorized penetration test. The scanner must be permitted from a specific management subnet to all internal zones. Which policy configuration best meets these requirements while maintaining least privilege?

A security analyst is drafting a policy that defines how the organization classifies data and who may access each class. Which document type is the analyst creating?

Which TWO items are considered 'Objects' in the PAN-OS environment?

An analyst is reviewing a firewall policy that permits outbound traffic from the Trust zone to the Untrust zone using the application 'web-browsing'. During an incident, the analyst notices that an internal host is accessing an external site over TCP port 8080, but the firewall logs show the session as 'web-browsing' and allows it. Which mechanism is responsible for this behavior?

A network security analyst is configuring a Security Policy on a Palo Alto Networks firewall to allow outbound access for a specific set of applications. The analyst wants to ensure that the policy is as secure as possible while still allowing the required applications. Which two actions should the analyst take when configuring the Security Policy rule? (Choose two.)

A NetSec-Analyst is tasked with creating a policy that allows internal users to access a specific SaaS application while blocking all other SaaS applications. The firewall is a Palo Alto Networks appliance with App-ID and URL Filtering licensed. The analyst wants to ensure that even if the SaaS application uses dynamic IP addresses and multiple domains, the policy remains effective. Which approach best meets this requirement?

A NetSec-Analyst is asked to enforce a corporate standard that all outbound traffic from the guest wireless zone must be logged for compliance, but the business does not want to block guest browsing. The analyst needs a rule action that permits the traffic while generating traffic logs for every session. Which action should the analyst select?

A NetSec-Analyst is finalizing a Security Policy rule set on a Palo Alto Networks firewall. The change window requires that all rules be documented so that a future analyst can understand the business justification without contacting the original author. The analyst wants the justification stored inside the policy itself so it travels with the configuration backup. Which policy element should the analyst populate to meet this requirement?

A user is unable to access a web application. The security policy log shows the traffic is hitting the default 'deny' rule. What is the most effective way to troubleshoot the App-ID identification?

An administrator is creating a security policy rule on a Palo Alto Networks firewall. The rule must allow only DNS traffic to a specific external server at 203.0.113.53, but the administrator notices that the 'Application' column is set to 'any'. What is the most secure and recommended way to enforce that only DNS is permitted?

A security analyst is reviewing a firewall policy that uses Security Profiles to protect against known threats. The analyst notices that a file download was allowed and later found to contain a malicious payload that should have been blocked by the antivirus profile. Which action should the analyst take to ensure the antivirus profile inspects the file content in real time?

What is the purpose of the 'Zone' in a Palo Alto Networks firewall?

A security analyst is reviewing a firewall policy that includes a rule allowing traffic from the 'Trust' zone to the 'Untrust' zone with the Application ID 'any'. The analyst notices that the rule has no Security Profiles attached. The analyst wants to enforce a policy that all allowed traffic must be inspected for threats, but also wants to minimize the impact on legitimate traffic. What should the analyst do?

If an administrator wants to ensure that a specific server can only be accessed from a specific internal subnet, where is this best configured?

A network security analyst is reviewing a Security Policy on a Palo Alto Networks firewall. The policy includes a rule that allows traffic from the 'Trust' zone to the 'Untrust' zone with the Application 'ssl' and Service 'application-default'. Users report that they cannot access an internal web server that uses a self-signed certificate on port 8443. The firewall logs show that the traffic is being denied. What is the most likely reason for the denial?

A policy rule is configured for 'web-browsing' and 'ssl', but the traffic is being dropped. The logs indicate the application is 'google-base'. What is the most appropriate fix?

A company has a policy that allows users in the Trust zone to access the internet. The security team wants to enforce that only corporate-approved applications are allowed, and all other applications are blocked. They also want to log all allowed traffic for auditing. Which policy configuration achieves this with the least administrative effort?

Which configuration setting in a security policy rule is responsible for matching users based on their active directory group?

A security analyst is reviewing a policy that allows access to a critical internal application. The application is accessed by users from multiple departments, and the analyst wants to ensure that only users who are currently authenticated and mapped to the correct department can access it. The firewall is integrated with Active Directory via User-ID. Which policy configuration best enforces this requirement?

An administrator is implementing a new security policy to allow only specific business applications for the finance department while blocking all other traffic. The firewall is configured with App-ID and User-ID. Which two actions are required to ensure the policy correctly identifies and enforces access for finance users? (Choose two.)

A security analyst discovers that a firewall rule allowing outbound DNS was added by a contractor without following the change process. The rule is currently required for a critical service. What is the MOST appropriate immediate action?

Which configuration menu allows you to define an address object?

What happens if a packet matches multiple security policies?

Which TWO options describe valid ways to handle traffic that is identified as 'unknown-tcp' in a security policy?

Which of the following describes an 'Address Object'?

A security analyst is reviewing a security policy that has the action 'allow' and the profile 'strict' applied. The profile includes antivirus, anti-spyware, and vulnerability protection. A user reports that a file download from a trusted site is being blocked. The analyst checks the Threat log and sees a 'virus' signature with action 'block'. What is the most likely cause of the block?

Which tab in the Palo Alto Networks GUI is primarily used to manage Security and NAT policies?

A security analyst is tasked with creating a policy to block traffic from known malicious IP addresses. The analyst wants to use a dynamic list that is automatically updated. Which two components are required to implement this? (Choose two.)

When creating a NAT policy, which field defines the address that the traffic will be translated to on the destination side?

Which TWO of the following are valid source types for a Security Policy?

Which THREE features are associated with an 'Application Filter'?

A NetSec-Analyst is designing a policy for a Palo Alto Networks firewall that must enforce different security profiles for different user groups. The firewall is integrated with Active Directory via User-ID, and the analyst wants to apply a stricter URL filtering profile to the 'contractors' group while allowing the 'employees' group to access a broader set of categories. The analyst creates two security rules with the same source and destination zones and applications, but different user groups and URL filtering profiles. What must be considered to ensure the correct rule is applied?

A security analyst is creating a policy to allow a specific internal application that uses a proprietary protocol over TCP port 8443. The application is not recognized by App-ID and is currently identified as unknown-tcp. The analyst wants to ensure the traffic is allowed while still enabling threat inspection. Which action should the analyst take in the security policy?

Which THREE requirements must be met to enable User-ID integration with Microsoft Active Directory?

Which TWO methods can be used to identify traffic using App-ID when port-based rules are insufficient?