Certified Network Security Professional (NetSec-Pro) (NetSec-Pro) — Questions 1–75

Which THREE components are required to successfully deploy and use Advanced URL Filtering?

You have a Security Policy rule allowing 'web-browsing' and 'ssl'. A user cannot access a specific site, and the logs show the traffic as 'web-browsing' but failing a specific Security Profile. Which action is most appropriate?

An administrator notices high memory utilization. What is the most effective way to identify which processes are consuming the most resources on the control plane?

You need to ensure that traffic between two internal zones is inspected for threats. What must be configured on the Security Policy?

You are troubleshooting a connectivity issue between an SCM-managed firewall and the SCM cloud service. Which log source in the firewall UI provides the most detailed information regarding the management connection?

When deploying a firewall in a Zero Trust environment, what is the recommended stance for the default interzone policy?

Which TWO settings are configurable within a URL Filtering profile?

Which command is used to restart the management server process on the firewall without impacting traffic flow?

Which log type should be filtered if you are searching for specific firewall configuration changes made by an administrator?

Where is the configuration located to enable the 'DNS Security' service on a specific security zone?

An administrator finds that the 'Threat Prevention' logs are not showing any data, despite having an active subscription. What is the most likely cause?

Where do you navigate in PAN-OS to update the App-ID and Threat signatures to the latest versions?

Which TWO steps are necessary to ensure that 'Threat Prevention' is protecting traffic against known vulnerabilities?

When managing multiple firewalls in Panorama, what is the best practice for handling software image updates?

What is the purpose of a 'Security Profile Group'?

An administrator wants to categorize traffic based on the 'Server' role in the network. Which feature should be used to tag this traffic for policy grouping?

Which THREE of the following are valid Security Profile types?

You are migrating existing on-premises Panorama appliances to Strata Cloud Manager (SCM). After establishing connectivity, you notice that your device groups are not appearing in the SCM interface. Which action is required to resolve this?

Which TWO of the following steps are required to implement a successful Site-to-Site VPN with a third-party vendor?

Which THREE criteria must be satisfied for a traffic session to match a specific NAT rule?

Which TWO of the following are valid ways to deploy GlobalProtect?

Which protocol does Panorama use to communicate with managed firewalls for configuration synchronization?

Which of the following are valid methods for performing an initial configuration of a Palo Alto Networks NGFW? (Choose TWO)

A administrator needs to ensure that users are authenticated before accessing a web-based internal application. Which User-ID method provides the most granular control by prompting users via a captive portal?

An administrator needs to enforce a consistent security policy across 50 branch firewalls using SCM. They want to ensure that any changes made at the local firewall level are overridden by SCM. Which setting must be configured?

Which three components must be configured to enable GlobalProtect Clientless VPN? (Choose THREE)

What is the primary function of the 'DNS Sinkhole' feature in a DNS Security profile?

Which TWO of the following are required to successfully implement an App-ID based Security policy?

Which TWO methods can be used to manage administrator access to a Palo Alto Networks firewall?

Which command is used on a Palo Alto Networks firewall to verify current license entitlements from the CLI?

An application is failing to function correctly even though the Security policy allows the traffic. The App-ID is showing as 'incomplete'. What is the most likely cause?

Which TWO criteria are used by the firewall to match a security policy rule?

Which THREE components are involved in configuring an IKE Gateway for a VPN?

Which interface type is used to connect the firewall to a switch for management or routing?

Which command is used to display the current User-ID mapping information on the CLI?

You are configuring a new Security Policy on a PAN-OS firewall. To adhere to the principle of least privilege, which configuration approach should you take for the destination zone and address?

Which TWO actions should an administrator perform to prepare for a large-scale firmware upgrade across an enterprise using Panorama?

Which TWO of the following are features of Content-ID?

You are troubleshooting an issue where a specific Threat Prevention profile is not applying correctly via Panorama. The setting is configured in a Template, but the firewall shows a different value. What should you check?

When migrating from Panorama to SCM, what happens to the existing log data stored on the Panorama appliance?

You are setting up an SSL Decryption policy. If you want to exclude traffic to financial websites to comply with privacy laws, how do you configure it?

Which TWO of the following are benefits of using App-ID over port-based security policies?

Which component of the Palo Alto Networks architecture is responsible for the 'Single Pass' processing engine?

When configuring an interface for DHCP client, where do you set the default gateway?

If a packet matches a Security Policy rule, but the application is not identified yet, what action does the firewall take?

Which THREE components are involved in the Prisma Access architecture for protecting mobile users?

When using OSPF with a Palo Alto Networks firewall, which area type would you configure to ensure the firewall does not receive external routing information while still maintaining connectivity to the backbone?

A security policy with a 'Log at Session End' setting is missing log entries for long-lived sessions. Why might this happen?

Which three items must be configured to successfully implement a Source NAT rule? (Choose THREE)

When a user connects via GlobalProtect, how does the firewall identify the user if they are not in the AD group?

You are troubleshooting a performance issue in Prisma Access. Users report slow access to SaaS applications. You suspect the issue is related to the path selection. Which tool should you use to analyze the latency between the user's mobile client and the Service Connection?

You are configuring Advanced URL Filtering. Users report that a site is being blocked, but the category is 'Newly Registered Domains'. How can you allow access to this specific site while keeping the policy for other newly registered domains?

Which THREE items are necessary for a properly configured Security Policy rule?

Which three settings are part of a Zone Protection Profile? (Choose THREE)

Which THREE of the following are consequences of enabling 'Log at Session End'?

Which THREE criteria can be used to define a security policy for granular control?

An administrator observes that traffic is being correctly identified by App-ID, but the firewall is not applying the expected security profile. What is the most likely reason?

You need to allow traffic based on user group membership. Which feature must be configured to map users to their group information?

An administrator is unable to push a configuration to a firewall managed by Panorama. The error message indicates a 'Template conflict'. What is the most likely cause?

A company requires that traffic from the VPN zone to the Untrust zone undergoes source NAT using a specific interface IP. Which configuration step is mandatory to ensure this traffic is correctly matched?

Which object type in PAN-OS should be used to group multiple IP addresses for use in a security policy?

What is the primary difference between a 'Pre-rule' and a 'Post-rule' in a Panorama-managed environment?

An administrator needs to ensure that internal users can access a public web server using its public IP address even when they are physically inside the internal network. Which NAT type and configuration approach should be used?

If a packet matches a Security Policy rule, but the application is not explicitly defined in the rule, what happens to the traffic?

Which three actions can be taken when a match occurs in a Security Policy rule? (Choose THREE)

Which TWO methods can be used to monitor the status of a configuration push from Panorama?

You have a policy matching 'web-browsing' but traffic is being denied. What is the most likely cause?

When adding a new Security Policy rule, what is the default position for the rule if you do not specify 'Top' or 'Bottom'?

Which TWO settings are configured within a GlobalProtect Gateway to manage user access?

When managing infrastructure, what is the best practice for handling 'Security Profile Groups'?

Which THREE tasks are performed by the Dataplane during traffic processing?

When troubleshooting a site-to-site VPN that is stuck in 'INIT' status, what is the most likely cause?

Which TWO of the following are required to enable full visibility into threats inside SSL traffic?

You want to block a specific URL category for all users except for the 'HR' department. How should the security policy be structured?

What is the purpose of the 'Pre-Rule' and 'Post-Rule' sections in a Panorama-managed firewall?