scenario questions

Which license is required to receive real-time updates for malicious file identification in the cloud?

An administrator notices high CPU usage on the management plane. Which command should be used to identify which process is causing the load?

What is the 'Any' object?

A security analyst at a financial firm is reviewing the firewall rulebase after an audit finding. The auditor noted that several rules have the action set to 'allow' but no security profiles attached. The analyst wants to enforce a policy that prevents any allowed traffic from bypassing threat inspection, while still allowing the business applications. What should the analyst do first to align with a defense-in-depth policy?

A network security analyst notices that the dataplane CPU on a Palo Alto Networks firewall is consistently above 90%. They need to identify which network interface is generating the highest volume of traffic to pinpoint the source of the load. Which CLI command should they use?

A security administrator is reviewing the object list in Panorama's Shared policy. The administrator notices that an Address Object named 'Server1' is referenced by several security policies. A change request asks to modify the IP address of 'Server1'. What will happen to the policies that reference this object after the change is committed?

A network security administrator is configuring a new firewall and wants to ensure that administrative access is logged for auditing purposes. Which configuration should be enabled to log all management access attempts?

Which THREE items can be used as filters in the 'test security-policy-match' command?

A network security analyst is reviewing the firewall's log settings and notices that the firewall is sending logs to an external syslog server. The analyst wants to ensure that only logs for denied traffic are forwarded to reduce noise. Which configuration should the analyst modify?

Which THREE things can be done via the CLI to check the health of a firewall?

A security analyst is configuring a firewall to allow a custom line-of-business application that communicates on TCP ports 8443 and 9443. The application vendor also uses UDP port 500 for keepalive traffic. The analyst wants a single reusable object that represents all of these port and protocol combinations so the same object can be referenced in multiple Security Policy rules. Which object type should the analyst create?

You are troubleshooting a policy that fails to match traffic for a group of servers. The servers are represented by an Address Group. What is the most likely cause if the Address Group is dynamic?

A NetSec-Analyst is troubleshooting a connectivity issue between two internal subnets. The analyst suspects that the firewall is dropping packets due to a security policy. Which CLI command should the analyst use to view the security policy that is matching a specific flow?

Which TWO conditions must be met to use the Panorama/SCM 'Push' functionality to a managed firewall?

Which action in the web interface generates a configuration commit operation?

A network security administrator is managing a Palo Alto Networks NGFW in a high-security environment. The administrator needs to ensure that all administrative access to the firewall's web interface is encrypted and that administrators are authenticated using multi-factor authentication (MFA). The environment uses an external LDAP server for user credentials and a RADIUS server for MFA. Which configuration should the administrator implement to meet these requirements?

Which components can be included in a 'Security Profile Group'? (Choose TWO)

When you use an Application Group in a policy, what happens if you add a new application to that group?

Which TWO of the following statements are true regarding the use of 'Address Groups' in PAN-OS?

A NetSec-Analyst is reviewing the firewall's management plane configuration. The administrator wants to ensure that the firewall can be managed securely from the internal network only, while still allowing the firewall to reach external services like DNS and NTP for updates. Which management interface configuration should be used?

A NetSec-Analyst inherits a rulebase where an outbound permit rule lists a destination of 'any' and an application of 'any'. A change request asks to allow only business-approved SaaS applications from the corporate zone while continuing to block everything else, without disrupting existing sessions. Which policy change best meets the request?

What is the result of applying a 'Log at Session End' setting in a security policy?

An administrator suspects that a specific App-ID is not correctly identifying traffic. Which log column should they examine to confirm the application match?

A network security analyst is designing a policy for a new branch office that will use a Palo Alto Networks firewall. The branch has a mix of corporate-owned devices and guest devices. The analyst must ensure that guest traffic is isolated from the corporate network and that corporate traffic is inspected for threats. The branch uses a single firewall with multiple zones. Which two actions should the analyst take to meet these requirements? (Choose two.)

Which TWO of the following represent valid interface types on a Palo Alto Networks firewall?

Which object type is most appropriate for a web proxy that uses a hostname?

What is the significance of the 'Inheritance' setting when creating objects in a Device Group hierarchy?

What happens if you delete an object that is currently in use by a Security Policy?

A firewall is reporting 'Packet buffer protection' drops. What is the most likely cause of this issue?

A network security analyst is troubleshooting a connectivity issue where a client cannot access a web server. The analyst runs 'test security-policy-match' and finds that the traffic matches a rule that allows the application 'web-browsing'. However, the analyst notices that the rule has a 'URL Filtering' profile attached that blocks the 'malware' category. The analyst wants to verify whether the URL category of the web server is being correctly identified. Which CLI command should the analyst use to test the URL category for the web server?

In a scenario where you use an Application Object in a Security Policy, how does the firewall identify the traffic?

When creating tags, what is the best practice for naming conventions?

A security administrator is creating a new Service Object to represent a custom application that uses TCP port 8443. The administrator wants to ensure the object can be used in Security Policy rules. Which of the following is a required field when defining a new Service Object?

An organization has a strict requirement that all web traffic must be inspected. Which policy is required in addition to the Security policy to achieve this?

A security analyst is reviewing the firewall's log settings and notices that logs are being stored locally on the firewall's disk. The analyst needs to ensure that logs are also sent to an external syslog server for long-term retention and analysis. Which configuration step is required to forward logs to a syslog server?

An administrator is creating a security policy to allow outbound web traffic. The policy uses the application 'web-browsing' and the service 'application-default'. A user reports that a website using a non-standard port (TCP 8080) is blocked. What is the most likely cause?

A NetSec-Analyst is reviewing a Palo Alto Networks firewall policy and needs to ensure that logging and log forwarding are correctly configured for security rules. The analyst wants to capture traffic that is allowed by a specific rule and also capture traffic that is denied by the implicit deny rule. Which two actions must be taken to meet these requirements? (Choose two.)

A security administrator needs to grant a new team member read-only access to the firewall's web interface for monitoring purposes. The administrator wants to ensure the team member can view configurations and logs but cannot make any changes. Which role should be assigned to the team member?

If an administrator creates an Application Override policy, what impact does it have on security inspection?

When using a Dynamic Address Group (DAG) in a policy, what is the prerequisite for the traffic to match the intended members?

A network security analyst is reviewing the firewall's logs and notices a high number of denied sessions from a specific internal IP address to various external destinations. The analyst wants to quickly identify the user associated with that IP address to determine if the activity is malicious. Which feature should the analyst use?

A security analyst is reviewing logs in SCM and realizes that logs from a specific firewall are missing. What is the most likely cause?

An administrator is using SCM to manage multiple firewalls. What happens when an administrator pushes a configuration that contains a duplicate object name?

A security operations team is preparing to enable automated threat intelligence sharing between their Palo Alto Networks firewall and a third-party SIEM. They plan to use the firewall's built-in integration capabilities. Which TWO components must be configured to allow the firewall to send logs to the SIEM? (Choose two.)

A NetSec-Analyst must implement a rule so that only members of the 'finance-approvers' group can reach a payment processing system, and the group membership is maintained in the corporate directory. The firewall is already integrated with the directory service and user mapping is working for other rules. Which source configuration on the Security Policy rule enforces this requirement most precisely?

What is the main advantage of using an object over manually entering an IP address in a policy?

An administrator maintains a large set of internal web servers whose IPs change frequently. Rather than editing address objects each time, the administrator wants policy rules to match servers dynamically based on tags applied to them. Which SCM object should the administrator configure to achieve automatic membership updates?

A security analyst receives an alert that a critical server is communicating with a known malicious IP address. The analyst wants to block this traffic immediately without affecting other traffic. Which action should the analyst take?

A network security analyst notices that a critical business application is intermittently failing. The application traffic passes through a Palo Alto Networks firewall. The analyst wants to identify exactly which security policy rule is allowing or denying the traffic in real time, without committing changes. Which CLI command should the analyst use?

While building a security policy in Strata Cloud Manager, an analyst selects the destination field and finds that the required Address object does not yet exist. The analyst wants to create the Address object without leaving the policy rule editor. What is the correct action?

Which of the following is a valid use case for a Tag?

An administrator is configuring a Dynamic Address Group (DAG) that should automatically include all endpoints tagged with 'Quarantine'. The administrator wants to ensure the DAG populates correctly. Which action must be performed first?

A network security analyst is troubleshooting a performance issue where throughput on a specific sub-interface is lower than expected. The analyst needs to monitor real-time throughput data for that sub-interface to determine if the interface is saturated. Which CLI command should the analyst use?

A security analyst is asked to provide a report on the top applications used in the network over the past week. Which firewall feature should the analyst use to obtain this information?

A security analyst is investigating why a large file transfer from a trusted internal server to an external partner is being blocked. The security policy allows the application 'ftp' and the service 'application-default'. The analyst runs 'show session all filter source 10.1.1.5' and sees the session is in the 'discard' state. Which action should the analyst take next to determine the cause?

A network security analyst is investigating why a specific application is not being identified correctly by App-ID. The analyst wants to see the details of how the firewall classified the application for a particular session. Which CLI command should the analyst use to display the application identification details for an active session?

You want to color-code objects in Strata Cloud Manager to improve visibility. Which feature do you use?

An administrator wants to ensure that all administrative sessions are logged out after 30 minutes of inactivity. Where is this configured?

A security analyst is tasked with creating a report that shows the top application categories used by employees over the past week. The analyst needs to present this data to management. Which Palo Alto Networks feature provides this information with the least amount of manual effort?

Which TWO administrative roles are standard within a Palo Alto Networks firewall?

An administrator wants to group multiple existing FQDN Address Objects into a single logical container for easier policy management. Which object type should they use?

A security analyst is investigating a potential data exfiltration incident. The analyst needs to determine which files were transferred out of the network and whether any contained sensitive information. Which Palo Alto Networks feature should the analyst use to identify file transfers and inspect their content?

What is the primary function of a 'Service Route' in a Palo Alto Networks firewall?

A security analyst is creating a new Service Object to represent a custom TCP service used by an internal application. The service listens on TCP port 9200. The analyst wants the object to be usable in Security Policy rules. Which configuration is required when defining this Service Object?

When configuring log forwarding, which protocol is recommended for secure, encrypted transmission of logs to an external collector?

You need to create a service object for a legacy application that uses a custom TCP port 8888. How should this be defined in PAN-OS?

A NetSec-Analyst is creating a new custom Application Object to identify a proprietary internal application that uses TCP port 8443 and a specific URL pattern. The analyst wants the firewall to correctly match and control this application. Which two configuration elements are required when defining this custom Application Object? (Choose two.)

An analyst is reviewing a firewall rulebase and notices that a security policy allowing outbound web traffic has no Application Filters or Service objects attached. The rule uses only source zone, destination zone, and user group as match criteria. What is the primary effect of this policy on traffic classification and enforcement?

A security administrator needs to create a new Service Object for a custom application that uses TCP port 8443. The administrator wants to ensure the object can be used in a security policy immediately. Which object type should be created?

A network administrator is troubleshooting a connectivity issue between two sites connected by an IPsec VPN. The VPN tunnel status shows as 'up', but no traffic is passing. The administrator wants to verify whether packets are being encrypted and decrypted correctly. Which tool should the administrator use?

A network security administrator is configuring a new firewall and needs to ensure that management traffic uses a specific interface and next-hop. Which feature should the administrator configure?

What is the purpose of the 'Policy Optimizer' feature?

What is the purpose of the 'Service' field in a Security Policy?

A security administrator is configuring a new Palo Alto Networks firewall and needs to ensure that management traffic (such as SSH and HTTPS) is only accessible from the internal management network. The firewall has multiple interfaces, and the administrator wants to restrict management access to a specific interface. Which configuration step should the administrator take?

An administrator needs to allow access to a new internal web application for employees in the 'Marketing' user group. The application uses a custom TCP port 8443. Which policy configuration should the administrator use to minimize security risk while ensuring access?

A security team is implementing a new firewall rule that allows access to a critical application. They want to ensure that the rule is only active during business hours (9 AM to 5 PM) on weekdays. Which configuration element should they use to enforce this time restriction?

When creating a custom Tag, which action is performed in the 'Objects' > 'Tags' menu?

What action should be taken before upgrading the PAN-OS version on a production firewall?

You are configuring an Address Object in Strata Cloud Manager for a new web server. Which field must be unique within the configuration scope?

A security administrator at a financial firm needs to enforce that only members of the Active Directory group 'Finance' can access the internal accounting application, while all other authenticated users are denied. The firewall is configured with User-ID and an LDAP server profile. Which policy construct should the administrator use to meet this requirement?

Which THREE settings must be configured to allow inbound NAT traffic for a web server?

A network security administrator is troubleshooting an issue where a user cannot access a website. The administrator checks the traffic log and sees that the session was denied by a security policy. To determine which security policy rule is causing the denial, which CLI command should the administrator use?

A network security administrator notices that a critical business application is intermittently failing to connect through the firewall. The security policy allows the application based on its App-ID. During a failure, the administrator runs a packet capture on the firewall and sees that the first few packets of the session are allowed, but subsequent packets are dropped. Which troubleshooting step should the administrator take first to identify the cause?

A security analyst is asked to create a policy that logs all traffic from the guest wireless network to the internet, including allowed and denied sessions, for compliance reporting. Which action should be taken when configuring the security policy rule?

You are managing security policies in Strata Cloud Manager and need to create an Address Object that represents a subnet used by multiple regional offices. Which approach is best practice for organizational visibility?

A network security analyst is tasked with creating a policy to block traffic from the untrust zone to the trust zone for all applications except DNS and web browsing. The analyst wants to ensure that the policy is as specific as possible while maintaining the ability to log all denied traffic. Which policy action should be used for the deny rule?

An administrator wants to prioritize VoIP traffic over all other traffic. Which policy type is the best choice?

A security analyst is investigating a potential breach. The analyst needs to correlate network traffic logs with threat logs to identify which internal host triggered a specific threat signature. Which Palo Alto Networks feature should be used to efficiently perform this correlation?

You want to create a group that contains both individual address objects and other address groups. Is this supported?

An administrator is creating a new External Dynamic List (EDL) to block traffic from known malicious IP addresses. The list is hosted on an external web server and updates hourly. The administrator wants to ensure that the firewall can retrieve and use the list. Which of the following must be configured on the firewall to use the EDL in a security policy?

A security administrator is creating a new Application Filter object to identify a custom application that uses a specific URL pattern. The application is accessed via HTTP and HTTPS, and the URL contains the string '/secure/login'. The administrator wants to ensure that the filter matches only traffic to that specific path. Which of the following is the most appropriate configuration for the Application Filter?

What is the benefit of using an Address Group over a single Address Object?

Which tab would you use to add a new Security policy rule?

You have an FQDN address object set to 'www.example.com'. Why might the firewall fail to block traffic to this FQDN?

An administrator is troubleshooting why a site-to-site VPN tunnel is not passing traffic despite the tunnel showing as 'up'. The administrator suspects that the Phase 2 selectors (proxy IDs) are mismatched. Which TWO commands should the administrator use to verify the proxy IDs on both ends of the tunnel? (Choose two.)

A security analyst is configuring a Palo Alto Networks firewall to allow access to a web application hosted on a server in the DMZ. The application uses a custom TCP port 8443 and is not recognized by App-ID. The analyst wants to allow only this application while still using App-ID for other traffic. Which configuration should the analyst use?

A network security analyst is reviewing the firewall's Security Policy and notices that the 'Allow-Web' rule has 15,000 hits in the last 24 hours, while a rule named 'Deny-Telnet' has zero hits. The analyst wants to reduce clutter and improve performance. Which action is most appropriate according to security best practices?

An administrator needs to allow traffic from the internal network to a public web server using Source NAT. Which configuration is required to ensure the internal client IP is translated to the firewall's public interface IP?

You are creating a new policy and realize you need a new Address Object. Can you create it from within the policy window?

Which of the following are valid types of address objects? (Choose TWO)

What is the function of an 'Application Group' in PAN-OS policy creation?

Where do you go in SCM to manage all your network objects in one location?

A security analyst is creating a policy to control outbound web access. The requirement states that only corporate-approved SaaS applications may be used, and all other web traffic must be blocked. The analyst wants to minimize ongoing maintenance as new shadow IT applications appear. Which policy construct best satisfies this requirement?

Which of the following is the most efficient way to manage NAT policies for multiple similar servers?

A security analyst is creating an External Dynamic List (EDL) to block traffic from known malicious IPs. The EDL is hosted on an internal web server that requires authentication. The analyst wants the firewall to retrieve the list every hour. Which configuration must be applied to the EDL object to successfully fetch the list?

A user reports that they are seeing a 'Server Certificate Warning' when accessing an internal site. Which feature should the administrator investigate?

A security analyst is troubleshooting an issue where a critical application is being blocked intermittently. The analyst suspects that the application is being identified differently at different times. Which TWO actions should the analyst take to verify the application identification and policy matching? (Choose two.)

Which THREE items can be used as a match criterion in a Security Policy?

If you update an Address Object that is referenced by multiple Security Policies, what happens?

An administrator needs to identify which rule is blocking legitimate traffic. What is the most effective approach?

An administrator needs to exclude a specific server from a Dynamic Address Group that uses a filter for all 'Production' tagged servers. What is the most efficient way to achieve this?

Which THREE items are required for a valid QoS policy match?

Which THREE pieces of information are displayed on the firewall Dashboard by default?

A junior analyst needs to define a reusable object for TCP port 8443 so that multiple Security Policy rules can reference the same port without retyping it. Which object type should the analyst create?

You are migrating configurations to Strata Cloud Manager. What is the benefit of using Snippets?

A security administrator is creating a Security Policy rule to allow access to a specific external SaaS application. The administrator wants to ensure that the rule only allows traffic to that application and not to other applications that might use the same ports. Which Palo Alto Networks feature should be used in the Security Policy rule to achieve this granular control?

An administrator is creating a new Address Object for a web server that has a hostname 'web01.example.com'. The administrator wants the firewall to resolve this hostname to an IP address dynamically. Which Address Object type should be used?

What is the purpose of the 'Zone' field in an Address Object?

A network security administrator is reviewing the firewall's licensing status and notices that the WildFire license is about to expire in 30 days. The administrator needs to ensure continuous WildFire analysis for submitted files. What is the most appropriate action to take?

Which object type should be used when you want to group several address objects together?

An administrator wants to automate the deployment of security policy updates across 50 branch firewalls using Strata Cloud Manager. Which feature should they use?

What is the primary difference between a 'Service' object and an 'App-ID' in a security policy?

A network security analyst is reviewing a rulebase where a security policy allows traffic from the 'Guest' zone to the 'Internet' zone with an application filter that permits only 'web-browsing' and 'ssl'. Users report they cannot reach a new SaaS application that uses QUIC over UDP 443. The analyst confirms the application is identified as 'quic-base' by App-ID. Which action should the analyst take to allow the SaaS application while maintaining the least privilege?

A security administrator is creating a new security policy rule to allow internal users to access an external SaaS application. The administrator wants to ensure that only the specific application is permitted, not all web traffic. Which policy component should be used to achieve this?

Where are objects typically defined in Strata Cloud Manager to be available for use across multiple firewalls?

An administrator wants to verify that a specific security policy rule is hitting traffic. Which tool should they use?

An administrator needs to manage multiple NGFWs from a single interface using Strata Cloud Manager. Which task must be performed first to enable centralized policy management?

A security analyst is creating a new custom Service object to represent a proprietary application that uses both TCP and UDP on the same port number. Which two parameters must be defined when creating this Service object? (Choose two.)

When configuring a firewall for Strata Cloud Manager, which connectivity requirement must be met?

An administrator is configuring a Decryption policy on a Palo Alto Networks firewall. The policy must decrypt outbound SSL traffic to inspect for threats, but certain financial websites must be excluded from decryption to comply with privacy regulations. Which action should the administrator take?

A security analyst is creating a new Address Object for a server that will be referenced by several security policies. The server's IP address is 10.20.30.40 and it belongs to the subnet 10.20.30.0/24. The analyst wants the object to represent only this single host, not the entire subnet. Which object type should the analyst select in the SCM object configuration?

What information can you see in the object list view in SCM? (Choose THREE)

A NetSec-Analyst is creating a Security Policy rule to permit a specific internal application for the finance department. The application uses a custom TCP port that is not recognized by App-ID, and the analyst wants to match traffic based on the destination port. Which configuration element must be used in the Security Policy rule to match the custom TCP port?

An administrator wants to permit traffic based on a specific User-ID group. Where should this group be referenced in the Security Policy?

Where can an administrator view the current version of the App-ID database installed on a firewall?

A network security analyst is defining a custom Application Object for a proprietary database that uses TCP ports 1521 and 1522, and the application performs a three-way handshake but never sends a FIN or RST. The analyst wants the firewall to correctly identify and allow this application. Which step is critical to ensure the firewall recognizes the application session?

A security analyst is implementing a policy to block peer-to-peer file sharing applications on a Palo Alto Networks firewall. The analyst creates a security policy that denies traffic from the 'Trust' zone to the 'Untrust' zone with an application filter containing 'bittorrent' and 'gnutella'. However, users are still able to use these applications. Which action should the analyst take to ensure the policy effectively blocks the traffic?

Which THREE resources should an administrator use to stay updated on security advisories and product changes?

You are configuring a Security policy to allow web traffic. Why should you place the most specific rules at the top of the Security policy list?

A security administrator is configuring a new firewall to integrate with an external LDAP server for user authentication. The administrator needs to ensure that user groups are correctly mapped for policy enforcement. Which TWO actions must be performed to enable group mapping? (Choose two.)

A security analyst is reviewing an existing Address Group that contains several Address Objects. The analyst needs to add a new server to the group so that it inherits the same policy permissions as the other members. What is the most efficient way to accomplish this in SCM?

A network security analyst is troubleshooting connectivity issues between two internal subnets separated by a firewall. The analyst suspects that the firewall is dropping packets due to a security policy rule. Which CLI command should the analyst use to view the real-time packet drop counters for the firewall's dataplane?

A NetSec-Analyst is planning a rulebase migration between two Palo Alto Networks firewalls managed by different Panorama appliances. The analyst must preserve rule order and intent, and wants to use configuration elements that are portable and self-contained rather than dependent on external systems. Which TWO practices best support a clean, auditable migration? (Choose two.)

An administrator wants to verify that a specific Threat Prevention profile is applied to a security rule. Where is the most accurate place to check this?

Which TWO items can be managed or configured within the Device > Setup > Services tab?

When configuring App-ID, how does the firewall identify traffic?

A NetSec-Analyst is configuring a new Security Policy rule to allow outbound access to a partner's web server. The partner has provided a hostname but warns that the IP address may change without notice. The analyst wants the policy to keep working if the IP changes. Which object type should the analyst use for the destination?

A network security analyst is onboarding a new Palo Alto Networks firewall managed by Panorama. The security team wants to block outbound access to a known command-and-control (C2) domain used by a recent malware campaign. The domain resolves to multiple, frequently changing IP addresses. Which object type should the analyst create to reliably enforce this block in a Security Policy rule?

A security analyst is creating a new Security Policy rule and needs to reference a Service Object that does not yet exist. The analyst wants to create the Service Object inline without leaving the policy rule configuration. Which statement accurately describes the inline object creation capability for Service Objects in the NetSec-Analyst platform?

An engineer is creating a new Security Policy rule in Strata Cloud Manager that must allow outbound traffic only to a specific external SaaS provider whose IP ranges change frequently. The provider publishes a public HTTPS feed of its current IP ranges. The engineer wants the rule to automatically stay current without manual edits. Which object configuration best meets this requirement?

You are migrating policies to Strata Cloud Manager. You notice that an Address Object is being used in a security policy, but the object is defined at the 'Device Group' level. What happens if you try to use this object in a policy at a higher hierarchy level?

A security analyst is reviewing the firewall's log forwarding configuration. The analyst needs to ensure that all traffic logs are sent to an external syslog server in a specific format. Which of the following must be configured to achieve this?

Which TWO log types can be forwarded to an external collector from a Palo Alto firewall?

A security analyst is reviewing the firewall's operational logs and notices that the firewall is not sending SNMP traps to the monitoring server. The analyst verifies that the SNMP community string is correct and the server is reachable. Which TWO additional configurations should the analyst check on the firewall? (Choose two.)

A security analyst is reviewing the firewall's policy optimization settings. The organization wants to eliminate redundant rules that are fully shadowed by earlier, broader rules. Which built-in tool should the analyst use to identify these shadowed rules?

A NetSec-Analyst is writing a security policy baseline for a Palo Alto Networks firewall. The security team wants to ensure that any traffic not explicitly permitted by a security policy is logged and blocked, but they also need to allow a temporary exception for a vulnerability scanner during an authorized penetration test. The scanner must be permitted from a specific management subnet to all internal zones. Which policy configuration best meets these requirements while maintaining least privilege?

A security analyst is drafting a policy that defines how the organization classifies data and who may access each class. Which document type is the analyst creating?

A network security administrator needs to give a junior analyst read-only visibility into traffic logs and threat logs on a production Palo Alto Networks firewall, but must ensure the analyst cannot change any configuration. Which built-in administrator role should be assigned?

In a multi-vsys environment, how do you manage shared objects?

Which TWO items are considered 'Objects' in the PAN-OS environment?

An analyst is creating a new Security Policy rule and needs to reference a service that uses TCP port 8443. No such service object exists yet. What is the most efficient way to proceed while staying within the policy rule creation workflow?

Which feature allows you to group multiple Address Objects together to simplify Security Policy management?

Which object category is used to group various network services to simplify policy definitions?

Which menu path in the NGFW GUI allows an administrator to view the status of all active security subscriptions?

Which of the following are true regarding Dynamic Address Groups? (Choose TWO)

An analyst is reviewing a firewall policy that permits outbound traffic from the Trust zone to the Untrust zone using the application 'web-browsing'. During an incident, the analyst notices that an internal host is accessing an external site over TCP port 8080, but the firewall logs show the session as 'web-browsing' and allows it. Which mechanism is responsible for this behavior?

When an administrator sees 'incomplete' in the Application column of the traffic logs, what does this usually signify?

A network security analyst is configuring a Security Policy on a Palo Alto Networks firewall to allow outbound access for a specific set of applications. The analyst wants to ensure that the policy is as secure as possible while still allowing the required applications. Which two actions should the analyst take when configuring the Security Policy rule? (Choose two.)

While building a Security Policy rule, an analyst realizes the destination address object does not exist yet. The analyst wants to create it without leaving the rule configuration workflow in SCM. What is the most efficient approach?

What is the primary function of a Security Profile Group in the context of object creation?

A security administrator needs to ensure that the firewall's configuration is backed up automatically every day and stored on an external server. The administrator wants to use the firewall's built-in capabilities without installing additional software. Which method should the administrator use?

A network security analyst is reviewing the firewall's configuration logs and notices that a recent commit changed the behavior of a security policy. The analyst wants to identify exactly which administrator made the change and what was modified. Which firewall feature should the analyst use?

A firewall is reporting 'License Expired' for Threat Prevention. The administrator renewed the license in the Support Portal. What is the most likely cause for the warning to persist?

A NetSec-Analyst is tasked with creating a policy that allows internal users to access a specific SaaS application while blocking all other SaaS applications. The firewall is a Palo Alto Networks appliance with App-ID and URL Filtering licensed. The analyst wants to ensure that even if the SaaS application uses dynamic IP addresses and multiple domains, the policy remains effective. Which approach best meets this requirement?

A NetSec-Analyst is asked to enforce a corporate standard that all outbound traffic from the guest wireless zone must be logged for compliance, but the business does not want to block guest browsing. The analyst needs a rule action that permits the traffic while generating traffic logs for every session. Which action should the analyst select?

A NetSec-Analyst is finalizing a Security Policy rule set on a Palo Alto Networks firewall. The change window requires that all rules be documented so that a future analyst can understand the business justification without contacting the original author. The analyst wants the justification stored inside the policy itself so it travels with the configuration backup. Which policy element should the analyst populate to meet this requirement?

Which type of account is typically used to manage Palo Alto Networks assets in the Customer Support Portal?

Which THREE factors can impact the performance of a firewall during a log-intensive period?

A security analyst is configuring a rule to allow access to a web server that is part of a load-balanced pool. The server's IP address changes frequently due to autoscaling, but its DNS name remains constant. The analyst wants the rule to automatically adapt to IP changes without manual updates. Which object type should be used?

A network security analyst is configuring a new Palo Alto Networks firewall. They need to create an Address Object for a server that has a hostname of 'web01.example.com' but also has a static IP address of 192.168.1.10. The analyst wants the firewall to resolve the hostname dynamically in case the IP changes. Which type of Address Object should they create?

A user is unable to access a web application. The security policy log shows the traffic is hitting the default 'deny' rule. What is the most effective way to troubleshoot the App-ID identification?

A network security analyst is troubleshooting a connectivity problem where internal users cannot reach an external web server. The analyst suspects a NAT issue. After running a packet capture on the firewall, the analyst sees that the source IP address of outbound packets is not being translated to the firewall's external IP address. Which of the following is the most likely cause?

An administrator is creating a security policy rule on a Palo Alto Networks firewall. The rule must allow only DNS traffic to a specific external server at 203.0.113.53, but the administrator notices that the 'Application' column is set to 'any'. What is the most secure and recommended way to enforce that only DNS is permitted?

A security administrator is creating a new Address Group to simplify policy management. The administrator wants to include a mix of static IP addresses and a Dynamic Address Group (DAG) that contains servers tagged as 'web'. Which two statements are true regarding the configuration of this Address Group? (Choose two.)

How can an administrator ensure that only specific IP addresses can access the firewall management interface?

An administrator is unable to add an object to a specific Device Group. What is the most likely reason?

A security analyst is reviewing a firewall policy that uses Security Profiles to protect against known threats. The analyst notices that a file download was allowed and later found to contain a malicious payload that should have been blocked by the antivirus profile. Which action should the analyst take to ensure the antivirus profile inspects the file content in real time?

What is the purpose of the 'Zone' in a Palo Alto Networks firewall?

A security analyst is reviewing a firewall policy that includes a rule allowing traffic from the 'Trust' zone to the 'Untrust' zone with the Application ID 'any'. The analyst notices that the rule has no Security Profiles attached. The analyst wants to enforce a policy that all allowed traffic must be inspected for threats, but also wants to minimize the impact on legitimate traffic. What should the analyst do?

A network security analyst is troubleshooting an issue where a user cannot access a website. The analyst suspects that the traffic is being denied by a security policy. Which CLI command should the analyst use to simulate the flow and see which security policy rule is matching?

What is the difference between 'Candidate Configuration' and 'Running Configuration'?

A NetSec-Analyst is creating a new Address Object for a subnet that will be used in multiple Security Policy rules. The analyst wants to ensure that if the subnet changes in the future, the change is reflected everywhere the object is used. What is the most efficient way to achieve this?

Which object type would you use to define a range of IP addresses (e.g., 10.1.1.1 to 10.1.1.50) in PAN-OS?

If an administrator creates an object in a local firewall that is also managed by SCM, what happens during the next push?

How can an administrator quickly determine if the firewall is experiencing high CPU usage?

Which log would display an event regarding an administrator logging into the WebUI?

When configuring an FQDN object, how frequently does the firewall refresh the DNS resolution?

A security analyst is troubleshooting a Dynamic Address Group (DAG) that is not populating with expected IP addresses. The DAG is configured with the filter 'tag.production' and is intended to include all servers tagged with 'production'. The analyst verifies that several servers have the 'production' tag applied. What is the most likely cause for the DAG not populating?

An administrator attempts to commit configuration changes from SCM to a firewall, but the commit fails due to an 'invalid reference'. What is the most effective way to troubleshoot this?

If an administrator wants to ensure that a specific server can only be accessed from a specific internal subnet, where is this best configured?

A network administrator is troubleshooting why a site-to-site VPN tunnel between two Palo Alto Networks firewalls is not establishing. The administrator runs 'show vpn ike-sa' and sees that the IKE phase 1 negotiation is failing. Which of the following is the most likely cause?

Which THREE actions occur when a 'Commit' is executed on a firewall?

A network security analyst is troubleshooting an issue where a user cannot access an internal web server. The analyst suspects that the firewall is blocking the traffic. Which TWO actions should the analyst take to determine if a security policy rule is causing the block? (Choose two.)

Which TWO log types are stored on the Palo Alto Networks firewall locally?

A network security analyst is reviewing a Security Policy on a Palo Alto Networks firewall. The policy includes a rule that allows traffic from the 'Trust' zone to the 'Untrust' zone with the Application 'ssl' and Service 'application-default'. Users report that they cannot access an internal web server that uses a self-signed certificate on port 8443. The firewall logs show that the traffic is being denied. What is the most likely reason for the denial?

Which THREE types of dynamic updates are managed in the Device > Dynamic Updates menu?

Where do you configure custom tags for use in your security policies?

A network security analyst is troubleshooting why a security policy is not matching traffic as expected. The analyst runs 'test security-policy-match' and sees that the traffic matches a policy, but the action is 'deny'. The analyst wants to see the exact rule that matched. Which field in the output should the analyst examine to identify the matching rule?

Which TWO of the following settings must be verified to ensure successful SSL Decryption?

A security administrator needs to grant a new team member read-only access to the firewall's web interface to view security policies and logs, but not make any changes. Which default administrator role should be assigned?

A policy rule is configured for 'web-browsing' and 'ssl', but the traffic is being dropped. The logs indicate the application is 'google-base'. What is the most appropriate fix?

A company has a policy that allows users in the Trust zone to access the internet. The security team wants to enforce that only corporate-approved applications are allowed, and all other applications are blocked. They also want to log all allowed traffic for auditing. Which policy configuration achieves this with the least administrative effort?

When deploying a new firewall, why is it critical to synchronize the clock with an NTP server?

A security analyst is creating a Dynamic Address Group (DAG) that should automatically include all servers tagged with the tag 'WebServer'. The analyst has already created the tag and applied it to the relevant server objects. What additional configuration is required for the DAG to populate correctly?

A security operations team wants to retain firewall traffic logs for 180 days for compliance, but the on-box log storage only holds about 30 days. They want to keep logs searchable in the firewall's Logs viewer without adding external storage. Which action should the administrator take?

Which configuration setting in a security policy rule is responsible for matching users based on their active directory group?

A security analyst manages a firewall through Panorama. The analyst deletes a Service Object that defines TCP/8080, but a Security Policy rule still references it. The analyst then attempts to push the configuration. What is the most likely outcome when the commit is validated?

A security analyst is reviewing a policy that allows access to a critical internal application. The application is accessed by users from multiple departments, and the analyst wants to ensure that only users who are currently authenticated and mapped to the correct department can access it. The firewall is integrated with Active Directory via User-ID. Which policy configuration best enforces this requirement?

An administrator is implementing a new security policy to allow only specific business applications for the finance department while blocking all other traffic. The firewall is configured with App-ID and User-ID. Which two actions are required to ensure the policy correctly identifies and enforces access for finance users? (Choose two.)

An analyst at a regional bank must produce a monthly access report showing every user who connected to the internal CRM over the previous 30 days, along with their source IP addresses and the specific application used. The report must be generated without querying each firewall individually, and it must be retained for one year. Which action should the analyst take first?

When troubleshooting a connection, an administrator sees 'aged-out' in the session table. What does this indicate?

A security analyst discovers that a firewall rule allowing outbound DNS was added by a contractor without following the change process. The rule is currently required for a critical service. What is the MOST appropriate immediate action?

A security administrator is building a URL Filtering profile in Strata Cloud Manager. The organization has a list of 40 marketing-related domains that must be allowed for the Marketing department, but these same domains should be blocked for all other departments. The administrator wants to reuse this list across multiple profiles without retyping the domains each time. Which object type should be created to satisfy this requirement?

Which configuration menu allows you to define an address object?

A security administrator is configuring a high-availability (HA) pair of firewalls. The administrator wants to ensure that if the active firewall fails, the passive firewall takes over with minimal disruption. Which HA configuration setting is critical to ensure that the passive firewall has the same session state as the active firewall?

You need to define a service for a protocol that uses both TCP and UDP on the same port. How can you represent this?

An analyst is building a new Security Policy rule set for a data center firewall. Several rules need to reference the same set of ten web server IP addresses in the DMZ. Rather than entering all ten IPs into every rule individually, the analyst wants a single reusable object that contains all of them. Which object type should the analyst create?

A network security analyst is troubleshooting an issue where users on the internal network cannot access a web server hosted in the DMZ. The analyst runs 'show session all filter source 10.1.1.100 destination 192.168.1.50' on the firewall and sees a session in the 'discard' state. Which action should the analyst take next to determine why the session is being discarded?

An administrator is configuring a high-availability (HA) pair. Which step is essential to ensure consistent configuration across both firewalls?

What happens if a packet matches multiple security policies?

Which TWO options describe valid ways to handle traffic that is identified as 'unknown-tcp' in a security policy?

Which of the following describes an 'Address Object'?

Which THREE criteria can be used to filter traffic logs in the Monitor tab?

A security analyst is reviewing a security policy that has the action 'allow' and the profile 'strict' applied. The profile includes antivirus, anti-spyware, and vulnerability protection. A user reports that a file download from a trusted site is being blocked. The analyst checks the Threat log and sees a 'virus' signature with action 'block'. What is the most likely cause of the block?

A network security analyst is troubleshooting an intermittent connectivity issue between a client and a server. The analyst suspects that certain packets are being dropped by the firewall's security policy. The analyst runs 'test security-policy-match' with the relevant parameters on a Palo Alto Networks firewall. Which output field in the CLI result should the analyst examine to identify the specific security policy rule that matched the traffic?

Which THREE items are required to successfully register a new firewall in the Customer Support Portal?

Which THREE of the following are valid methods for registering tags to IP addresses to populate Dynamic Address Groups?

Which tab in the Palo Alto Networks GUI is primarily used to manage Security and NAT policies?

A security analyst is troubleshooting why the firewall is not generating a specific type of log. The analyst suspects that the log forwarding profile is not correctly attached to the security policy rule. Where in the PAN-OS web interface can the analyst verify which log forwarding profile is applied to a specific security rule?

An analyst is reviewing a security policy that references an Address object named Web-Server-Prod. A change request requires updating the object to a new IP address, but the object is referenced by multiple policies across several folders in Strata Cloud Manager. The analyst wants the change to take effect everywhere with minimal effort. What should the analyst do?

A security analyst is creating a new static Address Object on a Palo Alto Networks firewall to represent a partner company's web server at 203.0.113.45/32. The analyst must complete the required fields correctly for the object to commit and function in policy. Which two elements are required when defining this static Address Object? (Choose two.)

A security administrator is configuring a firewall to send alerts when the number of failed login attempts exceeds a threshold. The administrator wants to avoid alerting on failed logins from the internal vulnerability scanner, which regularly performs brute-force tests. Which configuration should the administrator use?

A NetSec-Analyst is troubleshooting why a user cannot access a web application. The traffic is allowed by the security policy, but the application fails to load. The analyst suspects an issue with SSL decryption. Which two actions should the analyst take to verify that SSL decryption is functioning correctly for this traffic? (Choose two.)

A network security analyst is creating a new Security Policy rule in Strata Cloud Manager to allow access to a SaaS application. The SaaS provider publishes a list of IP addresses that changes frequently, and the analyst wants the rule to automatically adapt without manual edits. They decide to use a Dynamic Address Group (DAG) based on tags. What must be configured on the firewall or in Strata Cloud Manager for the DAG to populate its members?

A security analyst needs to define a custom application object in Strata Cloud Manager for an internally developed line-of-business tool that uses TCP port 8443 and is not covered by any existing App-ID signature. The analyst wants the security policy to match this traffic by the custom application rather than by a port-based service. Which configuration step is required?

An analyst is registering a new firewall in Strata Cloud Manager (SCM) and needs to create a Security Zone object that is restricted to the 'internet' and 'dmz' interfaces only, so that later Security Policy rules can reference it. Which object type should the analyst create to meet this requirement?

A user reports that they cannot access a website, receiving a 'page cannot be displayed' error. Which log type should the administrator check first to see if the traffic is reaching the firewall?

A security analyst is tasked with creating a policy to block traffic from known malicious IP addresses. The analyst wants to use a dynamic list that is automatically updated. Which two components are required to implement this? (Choose two.)

A network security administrator is configuring a firewall to send alerts to an external SIEM when a critical threat is detected. The administrator wants to ensure that the alerts include the source and destination IP addresses, threat name, and severity. Which configuration step is necessary to achieve this?

A network security analyst is troubleshooting a site-to-site VPN tunnel that is showing as 'up' but no traffic is passing through it. The analyst wants to verify if the firewall is encrypting and decrypting packets correctly. Which tool should the analyst use to capture and examine the packets?

An administrator attempts to delete an Address Object that is referenced by a security policy. What will happen?

When managing objects in SCM, which actions can be performed on tags? (Choose TWO)

A network security analyst is troubleshooting why a security policy is not matching traffic from a specific user. The policy is configured to allow HTTP traffic from the 'Trust' zone to the 'Untrust' zone for a specific source IP. The analyst runs 'test security-policy-match' and sees that the traffic matches a different policy that denies it. The analyst wants to determine the exact order of policy evaluation and why the deny policy is matching first. Which action should the analyst take?

A security analyst is tasked with reviewing the firewall's logs to identify potential security incidents. The analyst needs to ensure that logs are being forwarded to an external SIEM for long-term retention and analysis. Which TWO actions must the analyst verify are configured correctly on the firewall? (Choose two.)

Which elements are required when creating a new custom Service Object? (Choose THREE)

Which of the following is NOT a valid type of address object?

A security operations team wants to ensure that firewall configuration changes are reviewed and approved before being committed to production devices. The team uses a change management workflow and needs an audit trail of who made each change and when. Which capability should be implemented to meet these requirements?

When creating a NAT policy, which field defines the address that the traffic will be translated to on the destination side?

Which TWO of the following are benefits of using Strata Cloud Manager for enterprise firewall management?

A network security analyst is configuring a rule that must permit outbound traffic to any IP address within the range 172.20.0.0 through 172.20.255.255. Instead of creating 256 separate address objects, the analyst wants to define a single object. Which object type should be used?

An administrator is creating a new Service Object to represent a custom application that uses TCP port 8443. The application is used by multiple departments and will be referenced in several security policies. Which of the following is the correct way to create this Service Object?

A network security analyst is configuring an object in Strata Cloud Manager (SCM) to represent a partner company's web portal that is reachable at portal.example.com and resolves to several changing public IP addresses. The analyst wants the security policy to remain valid even when the partner rotates its DNS records. Which object type should the analyst create to satisfy this requirement?

Which of the following is an example of a 'Service' object?

Which TWO pieces of information must an administrator provide when setting up a Log Forwarding profile?

A network security analyst is troubleshooting a site-to-site VPN tunnel that shows as 'up' but no traffic is passing. The analyst wants to verify whether the firewall is encrypting and decrypting packets correctly. Which two CLI commands should the analyst use to check the VPN tunnel statistics and the status of the IPsec security associations? (Choose two.)

Which TWO of the following are valid source types for a Security Policy?

A security analyst is reviewing the firewall's logs and notices a high number of 'session end' logs with reason 'policy-deny' for traffic from the internal network to an external IP. The analyst wants to determine if this is a security incident or misconfiguration. Which step should the analyst take first?

A firewall administrator must back up the current configuration before applying a risky change. The administrator wants a backup that can be restored directly through the firewall's web interface and that includes all configuration settings. Which action should be taken?

Which TWO of the following characteristics apply to Service Objects in Strata Cloud Manager?

Which THREE features are associated with an 'Application Filter'?

A security analyst is reviewing the firewall's administrative accounts and wants to enforce the principle of least privilege. The analyst needs to create a custom administrative role that allows a user to view security policies and logs but not modify them. Which two permissions should be assigned to this custom role? (Choose two.)

A security analyst is investigating a suspected data exfiltration attempt. The analyst needs to examine the packet payload of a specific session to determine if sensitive data is being transmitted. Which tool should the analyst use to capture and inspect the packet payload in real time?

What are the primary characteristics of Service Groups? (Choose TWO)

A network security analyst is troubleshooting an issue where users on the internal network cannot reach a critical external web application. The security policy rule that should permit this traffic is not generating any logs, and the session count for that rule is zero. The analyst suspects that the traffic is being denied by an implicit rule or is not matching any rule due to a configuration error. Which CLI command should the analyst use to determine the exact rule that is being applied to the traffic?

When creating a Dynamic Address Group (DAG), what is the primary prerequisite for the object to populate successfully?

A security analyst is reviewing firewall logs and notices that a specific internal host is generating a high volume of denied outbound connections to many external IP addresses on port 443. The analyst wants to quickly identify whether this host is compromised and what action to take. Which step should the analyst take first?

An administrator wants to schedule signature updates to occur at 3:00 AM daily. Where is this configured?

What is the primary purpose of a 'Device Group' in the context of SCM?

Which of the following are benefits of using Device Groups in SCM? (Choose THREE)

A security analyst is reviewing the firewall's configuration to ensure that all administrative changes are logged and can be traced back to the individual administrator. The analyst notices that all administrators are using the default 'admin' account. Which action should the analyst recommend to meet the requirement for accountability?

How does an administrator perform a software update on a standalone firewall?

A NetSec-Analyst is designing a policy for a Palo Alto Networks firewall that must enforce different security profiles for different user groups. The firewall is integrated with Active Directory via User-ID, and the analyst wants to apply a stricter URL filtering profile to the 'contractors' group while allowing the 'employees' group to access a broader set of categories. The analyst creates two security rules with the same source and destination zones and applications, but different user groups and URL filtering profiles. What must be considered to ensure the correct rule is applied?

A security analyst is creating a policy to allow a specific internal application that uses a proprietary protocol over TCP port 8443. The application is not recognized by App-ID and is currently identified as unknown-tcp. The analyst wants to ensure the traffic is allowed while still enabling threat inspection. Which action should the analyst take in the security policy?

A network security analyst is investigating intermittent connectivity failures to an external SaaS application. Users report that sometimes the connection works, but other times it times out. The firewall is configured with a security policy that allows the SaaS application by its App-ID, and SSL decryption is enabled for the traffic. The analyst suspects that decryption is failing for some sessions. Which log should the analyst examine first to determine whether decryption is failing and why?

An administrator is creating a new Service Group that will contain several Service Objects for different applications. They want to ensure that the Service Group can be used in a Security Policy to allow traffic for all the services. However, they also want to minimize the number of objects they need to manage. Which of the following is a valid consideration when creating a Service Group?

A network security analyst is troubleshooting a site-to-site VPN issue where the tunnel is up, but traffic is not passing. The analyst has verified that the IKE and IPsec security associations are established. The analyst suspects that the issue is related to routing or policy. Which two actions should the analyst perform to further troubleshoot the problem? (Choose two.)

Which THREE requirements must be met to enable User-ID integration with Microsoft Active Directory?

A NetSec-Analyst is configuring a Dynamic Address Group (DAG) that should include all servers tagged as 'Web'. The analyst notices that some servers with the 'Web' tag are not appearing in the DAG. The tags are applied via a VM monitoring agent. What is the most likely cause?

A network security analyst is reviewing the firewall's dashboard and notices that the 'Threat Prevention' license is about to expire in 30 days. The analyst needs to verify the current license status and expiry date for all subscriptions on the firewall. Which action should the analyst take?

A security operations team is planning to implement a new firewall rule that allows HTTP traffic from the guest network to an external web server. They want to ensure the rule is as specific as possible and adheres to the principle of least privilege. Which two additional parameters should they configure to restrict the rule? (Choose two.)

An administrator needs to create a new Security Policy rule that allows HTTP and HTTPS traffic from the internal network to a specific external web server. The internal network is already defined as an Address object, and the external server is defined as an FQDN object. Which additional object is required to complete the rule?

A network security analyst is configuring a new Security Policy rule that must block traffic to a known malicious IP address. During policy creation, the analyst selects the 'Destination Address' field and realizes the malicious IP has not been defined as an Address Object yet. What is the most efficient action the analyst can take directly from the policy rule configuration interface?

When you define a 'Service Group', can you include both TCP and UDP services?

Which TWO ways can an administrator verify that a security subscription is active?

Why might an Address Object using an IP Netmask return a validation error even if the IP is valid?

In PAN-OS, what is the impact of configuring an FQDN Address Object for a site that uses multiple IP addresses returned via DNS load balancing?

What is the 'Read-Only' state of an object indicating in SCM?

An administrator wants to run a report on all traffic blocked by the 'Block_Bad_Sites' security rule. Which tool should they use?

Which section of the NGFW GUI allows an administrator to configure local administrative accounts?

Traffic is failing the 'Service' check in a security policy. Which CLI tool can be used to confirm which application is being identified for a specific source-destination pair?

Which TWO methods can be used to identify traffic using App-ID when port-based rules are insufficient?