Certified Network Security Professional (NetSec-Pro) (NetSec-Pro) — Questions 151–225

Device Deployment tokens are issued from SCM Inventory/Device Management, where onboarding credentials for new firewalls are generated. This is the only area that produces the token required to register a firewall with Strata Cloud Manager.

App-ID is the correct technology because it identifies applications regardless of port, protocol, or encryption by using multiple detection mechanisms such as application signatures, decryption, and heuristics. In a SASE deployment with Prisma Access, App-ID enables consistent enforcement of security policies based on the actual application, which is exactly what the administrator needs to inspect traffic beyond port-based rules.

Port security limits the number of source MAC addresses learned on an access port and can take action when the limit is exceeded. This directly counters MAC flooding, where an attacker overwhelms the CAM table with bogus addresses to force the switch into hub-like flooding, so it is a correct hardening measure.

Traffic between interfaces in the same zone is intrazone and is allowed by default without requiring an explicit rule, so it may not be subject to the intended policy and inspection. Assigning each segment to its own zone makes the traffic interzone, which is denied by default and requires an explicit allow rule, enabling enforcement.

Session-end logging buffers the connection's details and writes the entry only once the session closes, so no log record appears while traffic flows. This differs from logging at session start, which records immediately upon connection establishment.

User Identification maps source IP addresses to directory usernames, so firewall policy can be enforced per user rather than per address. This satisfies the scenario by tying security rules to authenticated identities, which is stronger than IP-based rules alone.

The App-ID Test tool allows the engineer to input session parameters and see how the firewall would identify the application. It can simulate a session and display the App-ID, providing real-time classification. This is the most direct way to verify application identification and troubleshoot misclassification issues.

Security policy rules are evaluated sequentially from the top of the rulebase to the bottom. The first rule that matches the traffic is applied, and subsequent rules are not evaluated. This is why rule order is critical: a broad allow rule at the top can override a more specific deny rule below it. Administrators must arrange rules carefully to ensure intended enforcement.

Policy evaluation is sequential, so the first rule matching source, destination, and service is applied before any later rule is examined. Because both policies share identical match criteria, the earlier entry takes precedence, and the second policy's differing application condition is never evaluated for that traffic.

App-ID identifies facebook-base rather than web-browsing, so the session fails to match the allowing rule and falls through to the default deny, dropping it. Application identification overrides port-based assumptions, which is the behaviour the stem describes.

In a security policy rule, the 'Actions' tab includes a 'Profile Setting' field where you can attach a Security Profile Group or individual profiles. If this is set to 'None', no security profiles are applied even if the action is 'Allow'. This is the most common reason why traffic is allowed but not inspected. To fix it, the engineer must edit the security policy and assign the appropriate Security Profile Group or profiles.

App-ID identification can require several packets to complete. If the application cannot be identified within the configured packet threshold, the session may be denied or handled according to the unidentified traffic settings. This matches the observed drop reason and explains the intermittent nature, since only some flows fail to identify in time.

Firmware upgrades do not refresh the content that powers detection, so installing the latest Dynamic Updates for App-ID and Threats brings signatures and application definitions current. This ensures the firewall identifies and blocks newly catalogued applications and threats.

Captive Portal forces users to authenticate through a web form before network access, letting the firewall bind the source IP to the authenticated username. This satisfies the User-ID mapping requirement without an agent, capturing identity directly at the point of connection for policy enforcement.

AIOps in Strata Cloud Manager provides intelligent monitoring and alerting for firewall health and performance. Administrators can configure alert policies based on metrics like CPU utilization, with thresholds and duration. When the condition is met, an alert is triggered. This directly addresses the requirement to receive alerts for sustained high CPU usage.

Antivirus signatures are delivered through Dynamic Updates, which push content and signature refreshes to the firewall without a full software upgrade. This satisfies the question's requirement for a Dynamic Update type alongside application and threat signatures.

SSL Decryption Exclusion allows administrators to bypass decryption for specific sites that may break due to certificate pinning or privacy concerns. Banking websites often use certificate pinning, which causes decryption to fail. Excluding these sites from decryption resolves access issues while still allowing other traffic to be inspected. This is the recommended approach for known incompatible sites.

Dynamic Address Groups derive their membership from tags registered by a workload registry or orchestration platform, so policy follows the workload's identity rather than its IP address. When a virtual machine migrates and its tag is updated, the group membership refreshes automatically and the existing policy continues to apply. This directly satisfies the requirement for identity-based segmentation that survives live migration across hypervisors and physical hosts.

A Virtual Wire object binds the two physical interfaces into a transparent pair, so the firewall forwards frames between them without MAC or IP re-addressing. Without this object, the two ports remain independent and no traffic passes, failing the VWire requirement in the stem.

The 'App Usage' view in Policy Optimizer shows the applications detected by the rule over time. By reviewing this data, the administrator can identify the actual applications in use and then create a more specific rule allowing only those applications, reducing risk while maintaining necessary access.

Sinkholing redirects queries for known malicious domains to a controlled IP address, preventing resolution to attacker infrastructure. Specifying the sinkhole IP ensures the profile has a valid destination, satisfying the requirement to block DNS-based malware command-and-control traffic.

Dynamic device groups in Strata Cloud Manager automatically include firewalls based on tags, such as region 'EU'. This allows a single policy to be pushed to all matching firewalls without manual selection. It ensures consistency and scalability for large deployments, exactly matching the requirement to target European branch offices by tag.

WildFire Analysis logs record the outcome of cloud sandbox inspection, so the final verdict — Malware, Benign, Grayware or Phishing — appears alongside the file's identifying details. This satisfies the stem's requirement for information displayed in that log.

App-ID classifies traffic by application regardless of port or protocol, feeding the single-pass pipeline so identification, threat inspection and policy enforcement occur once per packet. This satisfies the architecture's requirement that all three functions run in one unified pass rather than separate engines.

If the address object does not contain the correct IP address, the rule will not match traffic to that IP. Even if the rule is at the top, an incorrect address object means the destination does not match, so the traffic is evaluated by subsequent rules and may be allowed. This is a common misconfiguration when manually entering IP addresses.

Vulnerability Protection inspects traffic signatures for known exploit patterns such as buffer overflows and SQL injection, blocking those specific requests while permitting legitimate traffic. This satisfies the 'Strict' profile requirement of blocking exploits without disrupting normal web access.

The Monitor > Logs > Traffic page displays real-time traffic logs generated by the firewall. By reviewing these logs, the administrator can confirm that the security policy is matching traffic and generating logs. If the logs appear here and the Log Forwarding profile is correctly attached, the logs should also be forwarded to the syslog server. This is the primary interface for verifying log generation.

In a route-based VPN, traffic is routed to the tunnel interface via a static route. Without a route for the remote subnet pointing to the tunnel interface, traffic will not be sent into the tunnel. This is a common misconfiguration when mixing policy-based and route-based VPNs, as the policy-based side may expect proxy IDs to trigger the tunnel.

A Service Route directs management-plane traffic, such as content updates, out through a specified data-plane interface rather than the management port. Pointing the update service at an interface with a valid route restores connectivity without altering the firewall's internet access.

The Application field in a Security Policy rule uses App-ID, which identifies applications based on their unique characteristics, not just port numbers. By specifying 'web-browsing', the firewall will correctly identify HTTP traffic even if it runs on a non-standard port, ensuring accurate policy enforcement. This meets the requirement to identify the application regardless of port.

The Device > Dynamic Updates page is where administrators can view available updates, download them, and schedule automatic updates. It allows setting the frequency and time for application and threat updates. This is the correct location to configure the update schedule.

An Address Group is a named collection of IP addresses, subnets, or ranges that a security policy references as a single source or destination. This satisfies the requirement to group multiple addresses, unlike individual address objects or services.

The Vulnerability Protection profile is designed to detect and block exploits targeting known vulnerabilities. By configuring it to alert on critical severity events, the firewall can generate logs and alerts when such exploits are detected. This profile is applied to security rules to inspect traffic for vulnerability exploits.

SaaS Security API (formerly Prisma SaaS) integrates with SaaS applications via APIs to provide granular control over activities such as file uploads, downloads, and sharing. It can enforce policies based on user identity and data sensitivity. This directly meets the requirement to allow access but block file uploads.

By default, the firewall denies all inter-zone traffic unless a security policy rule explicitly allows it. Therefore, simply not creating any allow rules for traffic destined to this zone will result in a default deny. This is the intended behavior and requires no additional configuration beyond avoiding allow rules.

The GlobalProtect app is installed on remote endpoints and establishes a secure tunnel to Prisma Access. It provides user authentication and collects device posture information, which is essential for enforcing access policies based on user identity and device compliance. Without the GlobalProtect app, remote users cannot securely connect to Prisma Access, and the required identity and posture data would not be available for policy enforcement.

The Reset-Both action blocks the traffic and sends a TCP reset packet to both the client and the server. This immediately terminates the session on both ends, preventing further communication. It is the correct action when you want to actively reject the connection and notify both parties. This meets the requirement of sending a TCP reset to both client and server.

Prisma Access enforces Security policy using App-ID and can apply SaaS tenant restrictions to control which SaaS tenants are allowed. By scoping rules to user groups, the team can apply different inspection profiles, such as Data Filtering for sanctioned apps and block actions for unsanctioned ones. This directly meets the requirements for application-aware control, data loss inspection, and group-based differentiation. It uses native Prisma Access and NGFW capabilities without additional third-party components.

Audit Logs record every administrative action against firewall policy rules, capturing the administrator identity, timestamp and the exact change made. Reviewing these configuration logs lets you trace who modified a specific security rule, which is precisely the accountability the stem requires.

Source Zone is a valid match criterion because zones represent the ingress interface or tunnel from which traffic originates. Rules match on source zone to enforce policy between trust levels, satisfying the stem's requirement for items usable as match criteria in a Security Policy rule.

Even if the tunnel is up and routing is correct, security policies must explicitly allow traffic between the VPN zone (where the tunnel interface resides) and the internal zones. The default deny rule will block traffic if no policy permits it. The administrator should verify that a policy exists allowing traffic from the VPN zone to the internal zone and vice versa, with the correct source and destination addresses.

An Interface Management Profile defines which management services are permitted on an interface and from which source addresses, so attaching one restricting permitted IP addresses to the management interface satisfies the single-subnet administrative access constraint.

WildFire Analysis sends files to the WildFire cloud for dynamic analysis, where they are executed in a sandbox to observe behavior. This detects zero-day exploits and unknown malware that signature-based tools miss. It provides the required protection by identifying malicious behavior and generating signatures for future prevention. It is the correct component for analyzing unknown files.

Objects defined in the Shared device group are inherited by every managed firewall, giving global scope. Defining the address object there makes it available across all firewalls, which is exactly the constraint the question specifies.

In the GlobalProtect gateway configuration, under Agent > Client Settings, there is an authentication method that can be set. If it is set to 'none', users are not prompted for credentials and are allowed to connect without authentication. This is often used for testing but is insecure. The engineer must set the authentication method to 'client certificate' or 'LDAP' or another method to enforce authentication. This is the most likely cause.

CPU utilization is one of the metrics surfaced in the Panorama Device Health report, which aggregates resource telemetry from managed firewalls. It satisfies the stem's requirement by being a system-level performance indicator, distinct from session or threat data, letting administrators spot overloaded devices.

SSL Forward Proxy decryption lets the firewall act as a man-in-the-middle for outbound TLS sessions, decrypting the traffic so that security profiles can inspect the application data inside. Because the sessions are outbound and the protocol is decryptable, this is the appropriate mechanism. Attaching profiles to the allowing rule ensures the decrypted content is actually scanned for threats and sensitive data.

File Blocking Profiles inspect traffic by file extension or MIME type and drop matching transfers inline, so an .exe download is blocked before reaching the endpoint. This directly satisfies the stem's requirement to prevent a specific file type from being downloaded, unlike URL Filtering, which only categorises destinations rather than the files themselves.

An External Dynamic List (EDL) allows the firewall to dynamically import lists of IP addresses, URLs, or domains from an external source. Creating EDLs for malicious IPs and domains is a fundamental step to automatically block traffic to those indicators. The EDL can be hosted on a web server or cloud service and referenced in security policies.

Compute Location selects the geographic region where Prisma Access security processing and policy enforcement occur, directing traffic through that data centre. It governs where policies are applied, not where logs are stored or how users authenticate.

The DNS Client service on the firewall allows it to resolve domain names to IP addresses. This is essential for features like URL filtering, where the firewall needs to resolve domain names to enforce policy. Configuring DNS servers in the DNS Client settings enables the firewall to perform these lookups.

Panorama context displays policies and objects inherited from the Panorama management server in read-only form, since editing occurs centrally. This satisfies the managed firewall scenario, where locally pushed configuration must be visible but not modifiable on the device.

Strata Cloud Manager allows policies to be defined at the Global tenant level and then inherited by child tenants. The 'Override' feature enables a child tenant to create a local exception or modification to the inherited policy. This meets the requirement of applying a rule to all tenants while allowing a specific tenant to override it. This is the standard hierarchical policy management approach.

The ssl application is defined to use TCP 443 as its default port. When the service is set to application-default, the firewall derives the port from the application definition rather than from a fixed service object. The rule therefore matches the server's outbound TCP 443 session and permits it, which explains the connectivity without a port-specific rule.

Panorama Templates hold device and network settings pushed to managed firewalls, including the time zone. Configuring it in a Template satisfies the stem's multi-time-zone requirement, since the setting is defined once and inherited by every firewall in the stack.

The User-ID Agent runs on domain controllers or Windows servers, querying Active Directory to build IP-to-user mappings and forwarding them to the firewall. This mapping lets security policy enforce identity rather than raw IP addresses.

SSL decryption terminates the TLS session at the firewall, decrypting packets so deep packet inspection can scan payloads for malware and intrusions before re-encrypting and forwarding them. This directly satisfies the stem's requirement to inspect encrypted traffic for threats, which signature-based inspection of ciphertext alone cannot achieve.

Explicit allow rules that name only the necessary applications and services implement least privilege by permitting only known-good flows. Combined with a default deny posture, this ensures that a compromised host cannot initiate arbitrary connections to other tiers, because any traffic not matching an allow rule is dropped at the firewall.

The Alert action in a Security Profile permits the matching traffic to pass while writing an alert entry to the logs. This satisfies the requirement to allow sessions yet retain visibility, unlike Block, which drops the traffic, or Allow, which logs nothing.

Scheduled configuration backups, including SCP export to an external server, are configured under Device > Setup > Operations, which hosts configuration backup and restore tasks. This path satisfies the requirement to schedule exports to a remote server.

Reset-Both terminates the session by transmitting TCP RST packets to both endpoints, immediately tearing down the connection rather than merely alerting or dropping individual packets. This satisfies the requirement to stop the detected vulnerability exploit from progressing between client and server.

FQDN objects are resolved by the management plane using the DNS servers specified in Device > Setup > Services > DNS. If these servers are incorrect or unreachable, resolution fails. The scenario states that DNS servers are configured but FQDN objects are not resolved, so the most likely cause is that the DNS servers are not functioning properly or are misconfigured.

Lowering the tunnel interface MTU prevents IPv6 packets from exceeding the path MTU between the GlobalProtect gateway and remote clients, avoiding silent drops where ICMPv6 "Packet Too Big" messages are blocked. This directly addresses the fragmentation-suspected packet loss constraint by forcing endpoints to send smaller packets that traverse the tunnel without fragmentation.

Region objects group IP ranges by geography, letting policy rules match traffic by source region and drop it. This satisfies the requirement to block traffic from a specific geographic area, which address or service-based rules cannot express.

Panorama centrally manages and aggregates data from multiple Palo Alto Networks firewalls, providing enterprise-wide visibility, logging and reporting from one console. This satisfies the stem's requirement for centralised visibility and reporting across the entire enterprise, unlike single-device management interfaces.

An External Dynamic List hosts a file of addresses on an external server that the firewall imports and refreshes automatically, so the administrator updates the file centrally and the security rule's source membership changes without editing the rule. This matches the requirement to permit a changing set of partner addresses while keeping the rule stable. It also scales better than manual object edits.

This is the correct navigation path to define client IP assignment.

Category-based blocking lets the profile allow or deny traffic according to URL categories such as social networking or malware. This satisfies the requirement by filtering requests against a maintained category database rather than individual hostnames.

Reset-Both sends TCP RST packets to both endpoints, actively tearing down the session and notifying each side, whereas Drop silently discards packets with no notification. This satisfies the stem by confirming that Reset-Both informs client and server the connection is closed.

File Blocking profiles inspect uploads and downloads against configured file-type rules, letting the administrator deny a named extension outright. This directly satisfies the stem's constraint of blocking one specific file type, since the profile enforces the restriction inline rather than relying on signatures or application identification.

PBF evaluates traffic against a rule and redirects matching sessions to a specified egress interface or next-hop gateway, bypassing the normal routing lookup. Without a valid egress interface or next hop defined in the rule, the firewall cannot forward matched traffic, so this reference is mandatory for PBF to function.

Vulnerability Protection is a Security Profile, inspecting traffic for exploits such as buffer overflows and code execution attempts. It sits alongside Anti-Virus, Anti-Spyware, URL Filtering and File Blocking, all of which are profiles rather than interfaces, zones or administrative settings.

An aggregate interface bundles multiple physical links into one logical link, increasing total throughput and providing redundancy if a member link fails. This satisfies the requirement for higher bandwidth and link redundancy through link aggregation.

Credential Phishing prevention inspects outbound form submissions, detecting when corporate credentials are entered on untrusted or newly registered sites and blocking that submission. This satisfies the requirement to stop credential theft at the point of entry rather than merely filtering URLs.

Source Zone is a mandatory matching criterion in PAN-OS Security Policy rules, defining which ingress zone traffic must originate from before the rule can apply. It satisfies the stem's requirement for a valid policy component, since every rule evaluates traffic against source and destination zones alongside addresses, applications and services.