Certified Network Security Professional (NetSec-Pro) (NetSec-Pro) — Questions 76–150

Changing the action for the malware category to 'block' in the URL Filtering profile will prevent users from accessing domains categorized as malware. This directly addresses the issue of malicious traffic being allowed. The 'alert' action only logs the traffic, so changing it to 'block' enforces the desired security control.

Panorama enforces rule order by type: pre-rules sit above local firewall rules in the evaluation sequence, post-rules below them. This satisfies the stem's ordering constraint, since traffic is matched against pre-rules first, then device-level rules, then post-rules.

The GlobalProtect app establishes the connection from the mobile user to Prisma Access. It redirects traffic to the Prisma Access security processing nodes, where policies are enforced. Without the GlobalProtect app, mobile users cannot securely connect to Prisma Access, and their traffic would not be inspected. Thus, it is essential for enforcing security policies on mobile user traffic.

Policy Preview in Strata Cloud Manager allows administrators to simulate the effect of a security policy rule against historical traffic logs. It shows which sessions would be allowed or denied without actually enforcing the rule. This is exactly what the engineer needs to verify that critical applications will not be blocked before committing the policy.

To enforce DLP for SaaS applications, a DLP profile must be created and then applied to a security policy that governs access to those applications. This allows the firewall to inspect traffic for sensitive data patterns and block or alert on violations. This is the standard method for implementing DLP in Prisma Access.

Destination NAT rewrites the public-facing address and port in the packet header to the internal server's private address and port. Without this translation, the firewall would forward the packet with the original public destination address, which the web server cannot recognize as its own, so the connection would never complete even with a permissive security policy.

When an application is not defined in the matching rule, PAN-OS falls back to matching on the service, meaning the destination port and protocol. Traffic to that port is permitted regardless of the actual application, so the rule still allows the packet.

Strata Cloud Manager is a cloud-native management platform that provides centralized policy management, visibility, and enforcement across the security infrastructure, including branch firewalls. It eliminates the need for on-premises Panorama and is designed for cloud-delivered management. This directly addresses the requirement to manage a remote firewall without dedicated on-site staff or a management server.

Allow permits the matched traffic to pass, and it is one of the three terminal actions a Security Policy rule can enforce. It satisfies the stem by being a valid match action alongside Deny and the reset or drop options.

A service connection in Prisma Access connects the Prisma Access infrastructure to the corporate network or data center. This allows branch office users to access internal applications hosted in the data center. It creates a secure tunnel between Prisma Access and the corporate network, enabling traffic to flow to internal resources while still being inspected by Prisma Access security policies.

Web-browsing depends on the ssl application for HTTPS traffic, so the firewall denies the session when ssl is absent from the allowed applications. Palo Alto Networks resolves applications with dependencies before matching; permitting only web-browsing leaves the encrypted flow unmatched, satisfying the stem's denial despite the policy match.

WildFire is the cloud-based malware analysis service that analyzes files for zero-day exploits and returns verdicts to the firewall. Enabling WildFire in a Security Profile allows the firewall to forward files for analysis and block them if malicious. This directly meets the requirement for zero-day analysis and verdict-based blocking.

App-ID is the NetSec-Pro technology that identifies applications regardless of port, protocol, or encryption. It can distinguish between HTTP and HTTPS traffic and enforce policy based on the actual application, ensuring only the desired web protocols are allowed while blocking all others, which meets the requirement precisely.

GCM combines counter-mode encryption with a Galois field message authentication code, delivering confidentiality and integrity in one pass. Because it is a stream-oriented mode, blocks can be processed in parallel, and each packet uses a unique nonce to prevent keystream reuse. This satisfies all the stated requirements.

Without an explicit placement, a new Security Policy rule is appended to the bottom of the rulebase. This default matters because PAN-OS evaluates rules top-down, so a bottom rule is matched only after all preceding rules fail, making it the implicit catch-all position.

This configuration restricts access to the DMZ web server from the untrusted zone, allows only the web-browsing application, and uses the application-default service, which automatically allows only the ports required by that application. This is the most restrictive and secure approach, adhering to least privilege.

Session lookup is a Dataplane task: the firewall checks its session table to identify whether a flow already exists, enabling fast-path processing. Without this lookup, every packet would require full policy evaluation, so it is fundamental to traffic processing.

IKE phase one requires the responder to reach the initiator's peer address on UDP 500 and 4500; a wrong peer IP or blocked ports prevents the IKE SA from forming, leaving the tunnel stuck at INIT.

SSL decryption alone yields plaintext, but threat inspection requires a Security Profile such as Anti-Virus to scan that decrypted stream. Without a profile bound to the decryption policy, malicious payloads pass uninspected, so the profile satisfies the visibility requirement alongside decryption.

Security profiles must be explicitly attached to a security policy rule to take effect. If the profile group is not attached, the firewall will allow the traffic without scanning for threats. This is the most common oversight when profiles are configured but not applied to the correct rule.

Security policies evaluate top-down, so placing the HR allow rule above the category block rule means HR traffic matches the allow first and bypasses the block. All other users fall through to the block rule, satisfying the exception requirement.

Configuring the firewall as a DNS Client involves specifying DNS servers that the firewall uses for its own name resolution. This is done under Device > Setup > Services > DNS. The firewall uses these settings for management services, updates, and DNS sinkholing. This is the correct configuration to ensure the firewall can resolve domain names for its own operations.

The ingress/session lookup stage performs the initial session match against the flow table, identifying whether the packet belongs to an existing session and resolving forwarding and security policy. It precedes security profile inspection and content scanning, so it is genuinely the first processing step on arrival.

Panorama acts as the central management server, holding the authoritative device-group and template configuration that pushes policy to managed firewalls. The firewall retains only a local running copy, so edits made directly on it are overwritten on the next commit from Panorama.

System logs capture BGP neighbour state transitions and notification messages, satisfying the requirement to observe peering changes. Routing protocol events surface here rather than in traffic, threat, or configuration logs, so they reveal why the session flapped or failed to establish with the ISP.

Authentication succeeded, so the reset points to policy enforcement rather than credentials. GlobalProtect traffic arrives in the GlobalProtect zone, and the security policy must permit it into the internal zone; checking that rule first confirms whether the session is being dropped there.

Prisma Access is the SASE platform that provides secure web gateway (SWG) capabilities, including policy enforcement based on user and group. It integrates with identity providers to apply granular security policies to web traffic from remote users. This makes it the correct component for enforcing security policies in a SASE deployment.

URL Filtering profiles categorise and control web destinations, so blocking a specific site requires editing the URL Filtering profile and its category or custom URL list. Anti-Virus, Vulnerability Protection and File Blocking inspect content rather than destinations, so they cannot restrict site access.

Prisma Access is Palo Alto Networks' SASE platform that provides secure access for remote users and branches. It includes threat inspection, data loss prevention, and identity-based policy enforcement for SaaS applications. Configuring Prisma Access allows the engineer to meet both requirements: inspecting traffic for threats and controlling SaaS access based on user identity.

This command correctly simulates traffic flow against the policy database.

Traffic logs record every session traversing the firewall, capturing source and destination, application, ports, and action taken. They are one of the standard log types, alongside threat, URL filtering, and WildFire logs, generated on Palo Alto Networks firewalls.

If the IPsec tunnel is up and internal access works, the problem is likely that internet-bound traffic is not being forwarded to Prisma Access. Policy-based forwarding on the remote network firewall must be configured to send internet-bound traffic to the Prisma Access tunnel. Without it, internet traffic might be routed elsewhere or dropped. This is the most likely cause.

The Antivirus security profile is designed to scan files for viruses, worms, and other malware. It can block or alert on malicious files based on signatures. In this scenario, the administrator wants to scan files and block known malicious files, which is exactly the function of the Antivirus profile. It works in conjunction with other profiles but is the primary tool for malware scanning.

An 'incomplete' App-ID means the firewall saw the session's initial packet but insufficient application data to identify it. A SYN sent with no server response leaves the handshake unfinished, so no payload arrives for App-ID to match, and the session is denied.

Ping in the Interface Management Profile permits ICMP echo requests to terminate on the firewall interface itself, so pinging the upstream ISP gateway confirms Layer 3 reachability and correct interface connectivity, satisfying the requirement to verify the link is properly connected.

Block is one of the actions a File Blocking Profile can take when a file matches its criteria. The firewall drops the file transfer, preventing the file from reaching the endpoint, satisfying the stem's requirement for a valid detected-file action.

The URL Filtering log records each session's matched category, URL, and applied action, including the rule that triggered the block. Monitor > Logs > URL Filtering is the dedicated location exposing that verdict for the blocked user's session.

WildFire performs signature-based and heuristic analysis of files, detonating suspicious samples in a cloud sandbox to identify malicious content. This satisfies the stem's requirement for file inspection, unlike App-ID, which classifies applications, or URL Filtering, which categorises web destinations.

ACLs on routers filter packets based on IP addresses, protocols, and port numbers, and can be applied to interfaces to control traffic between VLANs. They provide network-layer segmentation and can restrict which subnets communicate, directly supporting the requirement for VLAN traffic control.

The BPA tool evaluates security policies based on best practices, such as using specific applications instead of 'any', and limiting source and destination to necessary addresses. Overly permissive rules with 'any' application and broad addresses lower the score. By replacing 'any' with specific applications and narrowing addresses, the administrator makes the rules more secure and improves the BPA score. This action maintains necessary access while adhering to best practices.

Application Default applies the predefined port set associated with the identified application signature, so traffic is limited to those standard ports rather than any port. This satisfies the constraint of enforcing application-specific port behaviour without writing custom rules.

Specifying the exact application name in the Security Policy rule ensures that only that particular SaaS application is matched. App-ID identifies the application precisely by its name, such as 'salesforce' or 'office365'. This provides the granularity required to allow only the sanctioned SaaS application and not others that might share protocols. Thus, using the application name is the correct approach.

SD-WAN path selection evaluates latency, jitter and packet loss across candidate links, choosing the path whose measured performance best meets the application's requirements. These metrics satisfy the stem's need to determine the optimal path when several are available.

A decryption policy rule with the action 'ssl-forward-proxy' is the correct method to enable SSL forward proxy decryption. This rule must be placed in the decryption policy and match the traffic based on source, destination, and URL category. Attaching a decryption profile allows enforcement of certificate validation and other security checks. Without this rule, encrypted traffic bypasses inspection even if security profiles are applied.

The Alert action in a Security Policy rule allows the traffic and generates an alert in the logs. This action is designed for scenarios where you want to permit traffic but also want to be notified of its occurrence for auditing or monitoring. It meets both requirements: allowing traffic and generating an alert. Therefore, it is the correct choice.

Panorama centrally manages firewalls through templates and device groups, so the replacement inherits its policy from the existing Device Group rather than being configured locally. Pushing that configuration commits the inherited ruleset to the new device, satisfying the requirement to restore identical policy without rebuilding it manually.

Installing the firewall's Forward Trust Certificate in client trust stores lets clients validate the certificates the firewall dynamically generates when impersonating external servers. Without this trust anchor, clients reject the forged certificates and the TLS handshake fails, so decryption and inspection cannot occur. This satisfies the mandatory client-side trust requirement for SSL Forward Proxy.

Security Policy rules are evaluated top-down, and the first rule that matches the traffic is applied. Placing the block rule at the top ensures it is evaluated before any allow rules, effectively blocking the specified traffic. This is the standard method to prioritize a rule. Therefore, moving the rule to the top is correct.

An address group aggregates multiple IP addresses into one named object, so security policies reference that single entity rather than listing each address individually. This directly satisfies the stem's requirement to group multiple IP addresses into a single entity, simplifying rule maintenance when membership changes.

Enabling local internet breakout with cloud SWG integration ensures that SaaS traffic exits directly from the branch to the internet while being transparently redirected to the cloud SWG for inspection. This reduces latency and backhaul while maintaining security. It is the correct approach because it combines direct routing with cloud-based security enforcement, as required by the scenario.

Without a signature, App-ID cannot match the application's traffic patterns, so sessions remain unidentified and are reported as incomplete. The custom application object must include a signature defining the protocol and port behaviour; otherwise non-standard ports prevent correct identification.

If the File Blocking profile action is set to 'alert' for the executable file type, the firewall will generate a log but will not block the file. The profile must be set to 'block' to prevent download. This is a common misconfiguration: administrators may set alert to monitor first, but forget to change to block. The scenario states malicious files are not blocked, so the action is likely alert.

Allowing any application means traffic is filtered only by port, not by process identity, so malware tunnelling over permitted ports such as 443 or 53 passes unchallenged. This satisfies the stem's constraint: a policy permitting any application cannot distinguish legitimate software from hidden threats abusing those same allowed ports.

Panorama manages firewalls centrally, so edits made locally through the firewall CLI bypass that management plane entirely. Panorama's device state no longer matches the firewall's running configuration, producing configuration drift until the next push or commit reconciles them.

The dashboard aggregates telemetry from all managed firewalls into a single pane, showing deployment-wide health, policy compliance and connectivity status. It is the only SCM feature providing this consolidated global view rather than per-device or per-rule detail.

NTP server settings are device-level configuration shared across managed firewalls, so Panorama Templates push them consistently to every device in the template stack. This satisfies the question's requirement for elements commonly managed via Templates rather than device groups or policy rules.

Adding proprietary hashes to the WildFire File Exclusion list prevents those known-good executables from being submitted for cloud analysis, directly reducing false positives. A WildFire analysis profile scopes the exclusion to the relevant traffic, preserving inspection of all other files, so security coverage remains intact for unknown threats.

A distributed virtual firewall integrated with SDN enforces security policy at the hypervisor or host level, allowing micro-segmentation between workloads on the same VLAN without hairpinning traffic to a physical appliance. It provides centralized management, identity-based rules, and service chaining, which directly satisfies the east-west zero-trust requirement described.

If the application is using a custom port that is not defined in the application object, the firewall may not recognize the traffic as that application. The security policy rule matches on the application, so if the application is not correctly defined with the custom port, the rule will not match. Then the traffic falls through to the intrazone-default rule, which might deny if the zone is not trusted, or if the default action is deny. In this case, the session is denied because the application is not properly identified, so the rule does not match.

In a File Blocking profile, each file type can have a specific action. To prevent the download of executable files, the administrator should set the action for the 'executable' file type to 'block'. This will block files identified as executables in the specified direction (download) while allowing other file types based on their respective actions. This is the correct and granular approach.

Commit Validation inspects the candidate configuration against security best-practice checks before the commit completes, flagging non-compliant settings such as weak management access or missing threat profiles. This directly satisfies the stem's requirement to verify compliance prior to pushing changes to devices, preventing policy drift without manual review.

App-ID inspects the application payload to distinguish web-browsing from other applications tunnelling over port 80, so policy matches on the actual application rather than the port alone. This enforces the stem's requirement that only web-browsing is permitted.

The Prisma Access security processing node is where security policies are enforced and traffic is inspected for threats. It is the component that applies Security Profiles, URL Filtering, and other security policies to mobile user traffic. This is the correct answer because it directly handles policy enforcement and threat inspection for Prisma Access.

When SSL traffic is not decrypted, the firewall cannot inspect the payload to identify the application. As a result, App-ID may return 'incomplete' because it cannot determine the application. Allowing 'ssl' only permits the encrypted session without identifying the inner application. Thus, enabling decryption would allow proper identification and access.

Data Filtering inspects traffic content against defined patterns, such as credit card number formats, and blocks matching data from leaving the network. This directly addresses exfiltration of sensitive data, unlike antivirus, application control, or URL filtering, which target malware, applications, or web destinations respectively.

DNS Security's predictive analysis uses machine learning models to score domains that exhibit DGA characteristics, such as high entropy or unusual character patterns, even when the domain has no prior reputation. Enabling it lets the firewall block or alert on queries to domains that are probable DGA outputs, directly addressing the command-and-control technique described. Sinkholing alone only covers known malicious domains and cannot catch newly generated ones.

DNS sinkholing is configured in the Anti-Spyware security profile as an action for DNS signatures. When a DNS query matches a malicious domain, the firewall responds with the configured sinkhole IP instead of the real address, preventing C2 communication. The sinkhole IP must be reachable by clients, typically an internal server or the firewall's data-plane interface, so clients can be redirected and potentially quarantined.

Security policies on PAN-OS are unidirectional and evaluated based on the source and destination zones of the initiating session. A deny rule from web to database blocks web-initiated connections, while the allow rule from database to web permits replication traffic initiated by the database tier, satisfying the asymmetric requirement.

Even if the tunnel is established, security policies must explicitly allow traffic from the GlobalProtect zone (typically 'globalprotect' or 'tunnel') to the internal zones. Without a proper policy, traffic is blocked by the default deny rule. The administrator should verify that a security policy exists allowing the user's source IP (from the client pool) to access internal resources.

The running-config.xml file captures the complete active configuration, including all committed settings, making it suitable for off-box manual restore. Unlike the running-config, which is volatile and lost on reboot, this XML export preserves the full configuration state required to rebuild the device if hardware fails.

For a new session the very first packet is sent to the dataplane, where the security policy is evaluated and a session entry is installed in the session table. All subsequent packets of that flow are matched to the existing session and forwarded without repeating a full policy lookup, which is what gives PAN-OS its performance advantage.

Source NAT rewrites the packet's source address on egress, so internal private IPs are translated to the firewall's public address before reaching the internet. This directly satisfies the requirement to hide private addresses whilst preserving outbound connectivity for internal users.

Reset-Both sends a TCP RST to both the client and the server, tearing down the session from each side simultaneously. This satisfies the stem's requirement for resets to both parties, unlike Reset-Client or Reset-Server, which target only one endpoint.

App-ID performs deep content inspection to classify traffic by application signature rather than relying on port numbers, so applications tunnelled over non-standard ports are still identified correctly. This satisfies the requirement that logs name the actual application regardless of port.

Service connections are IPSec tunnels between Prisma Access and the corporate network. They enable remote users to access internal applications by routing traffic from Prisma Access to the appropriate internal networks. This is the correct component for connecting users to corporate resources.