CCNA Infrastructure Management And CDSS Questions

Multi-Selecthard

Which THREE components are required to successfully deploy and use Advanced URL Filtering?

Select 3 answers

A.An endpoint agent installed on all user devices.

B.An active Advanced URL Filtering subscription.

C.An enabled Security Policy rule that references the URL Filtering profile.

D.A dedicated management interface for URL updates.

E.A URL Filtering profile configured with the desired actions.

AnswersB, C, E

Subscription is required for the feature to function.

Why this answer

Advanced URL Filtering requires the subscription, a profile, and the enforcement via policy.

Practice this question →

MCQeasy

Where is the configuration located to enable the 'DNS Security' service on a specific security zone?

A.Objects > Security Profiles > DNS Security

B.Network > Zones > [Zone Name]

C.Device > Setup > Services > DNS

D.Policies > Security > [Rule Name] > Actions tab

AnswerD

Security profiles are applied within the Security Policy Rule.

Why this answer

DNS Security profiles are applied to security policy rules, which then process traffic from specific zones.

Practice this question →

MCQhard

An administrator finds that the 'Threat Prevention' logs are not showing any data, despite having an active subscription. What is the most likely cause?

A.The 'Threats' dynamic update is not scheduled.

B.The firewall is in 'Evaluation Mode'.

C.The log forwarding profile is missing the 'Global' setting.

D.The security policy rules do not have an attached Security Profile Group.

AnswerD

Logs are only generated if a Security Profile is applied to the traffic.

Why this answer

Threat prevention logs are generated by policy rules; if a rule does not have a security profile attached, no logs are generated.

Practice this question →

Multi-Selectmedium

Which TWO steps are necessary to ensure that 'Threat Prevention' is protecting traffic against known vulnerabilities?

Select 2 answers

A.Disable 'App-ID' to prevent interference.

B.Ensure the 'Threats' dynamic update is downloaded and installed.

C.Manually restart the firewall after every update.

D.Enable SSL Decryption for all traffic.

E.Apply a Vulnerability Protection profile to the security policy rule.

AnswersB, E

Signatures must be up to date to detect new vulnerabilities.

Why this answer

Threat prevention requires active signatures and the application of those signatures via policy profiles.

Practice this question →

MCQeasy

What is the purpose of a 'Security Profile Group'?

A.To organize firewall administrators by department.

B.To collect all logs from a specific security zone.

C.To group firewall interfaces for load balancing.

D.To combine multiple security profiles into a single object for easier policy assignment.

AnswerD

This is the definition of a Security Profile Group.

Why this answer

A Security Profile Group is a container that holds multiple types of security profiles (AV, URL, Threat, etc.) to be applied as a single unit.

Practice this question →

MCQeasy

What is the primary function of the 'DNS Sinkhole' feature in a DNS Security profile?

A.To encrypt DNS traffic between the firewall and the ISP.

B.To allow a firewall to act as a DNS server for internal clients.

C.To cache DNS queries to improve network performance.

D.To redirect requests for malicious domains to a specific IP address to alert the administrator.

AnswerD

Sinkholing is used to identify and log clients attempting to resolve malicious domains.

Why this answer

DNS Sinkhole redirects a malicious DNS query to a fake IP address to identify compromised hosts.

Practice this question →

Multi-Selectmedium

Which TWO criteria are used by the firewall to match a security policy rule?

Select 2 answers

A.The number of packets in the flow.

B.The total duration of the session.

C.The physical MAC address of the source.

D.Source and Destination Zone.

E.The identified Application (App-ID).

AnswersD, E

Zones are fundamental for policy matching.

Why this answer

Security policies match traffic based on the packet's source/destination and the identified application.

Practice this question →

MCQhard

You are configuring Advanced URL Filtering. Users report that a site is being blocked, but the category is 'Newly Registered Domains'. How can you allow access to this specific site while keeping the policy for other newly registered domains?

A.Add the site to the 'Allow List' in the URL Filtering profile object assigned to the security policy.

B.Move the security policy to the top of the policy list.

C.Add the site to the 'Blocked' list in the URL Filtering profile.

D.Create a new URL category and add the domain to it, then block that category.

AnswerA

The Allow List within a URL Filtering profile overrides category-based blocks.

Why this answer

URL Filtering allows for category overrides within a profile to exempt specific sites from broad category-based blocking.

Practice this question →

MCQmedium

When managing infrastructure, what is the best practice for handling 'Security Profile Groups'?

A.Use a common group for similar traffic types to ensure consistent security policy enforcement.

B.Only apply groups to traffic destined for the Internet.

C.Avoid using groups and always apply individual profiles to rules.

D.Create a unique group for every single security policy rule.

AnswerA

Grouping promotes consistency and reduces administrative burden.

Why this answer

Security Profile Groups allow for standardized enforcement across multiple rules, simplifying management and updates.

Practice this question →

MCQeasy

A user is blocked by a URL Filtering profile. Where can you find the specific log entry that explains why the block occurred?

A.Monitor > Logs > WildFire Submissions

B.Monitor > Logs > URL Filtering

C.Monitor > Logs > Traffic

D.Monitor > Logs > Threat

AnswerB

This log type specifically tracks URL filtering events and reasons.

Why this answer

The URL Filtering logs contain the specific reason and the category that triggered the block.

Practice this question →

MCQmedium

A company is experiencing high false-positive rates with WildFire for custom proprietary executable files. What is the recommended configuration to minimize these while maintaining security?

A.Lower the threat prevention action from block to alert for all executables.

B.Disable WildFire on the specific security policy rule.

C.Create a WildFire analysis profile and add the proprietary file hashes to the WildFire File Exclusion list.

D.Change the WildFire forwarding location to a local WildFire appliance.

AnswerC

File exclusions allow known-good proprietary files to bypass analysis.

Why this answer

Submission of custom binaries to WildFire can be refined using exclusion lists and specific file type profiles.

Practice this question →

Multi-Selecthard

Which THREE types of information can be used to create a custom URL category?

Select 3 answers

A.Application names (App-ID).

B.IP addresses or subnets.

C.Fully Qualified Domain Names (FQDNs).

D.URL patterns (regex).

E.Threat signature IDs.

AnswersB, C, D

IPs can be included in custom categories.

Why this answer

Custom URL categories allow for flexible identification of sites using domains, IP addresses, or URL patterns.

Practice this question →

MCQhard

You need to ensure that the firewall logs identify traffic by the actual application name, even if the traffic is running on a non-standard port. Which mechanism makes this possible?

A.Service-based policy enforcement.

B.SSL Decryption.

C.Port-mapping configuration.

D.App-ID content inspection.

AnswerD

App-ID inspects the traffic flow to identify the application regardless of the port.

Why this answer

App-ID identifies the application based on traffic content, not just the port, ensuring accurate logs.

Practice this question →

Multi-Selectmedium

Which TWO actions should be performed when configuring a new DNS Security profile to protect against DNS-based malware?

Select 2 answers

A.Enable 'Sinkhole' and specify the IP address for the sinkhole.

B.Configure 'DNS over HTTPS' to force all traffic through the firewall.

C.Select the categories to block under the 'DNS Categories' tab.

D.Create a 'DNS Proxy' object for every zone.

E.Enable 'Packet Capture' for all DNS traffic.

AnswersA, C

Sinkholing is essential to identify infected clients.

Why this answer

DNS Security requires a sinkhole action and specific category blocking to be effective.

Practice this question →

Multi-Selectmedium

Which TWO pieces of information are displayed in the 'WildFire Analysis' log?

Select 2 answers

A.The username of the person who downloaded the file.

B.The total bandwidth used by the file transfer.

C.The final verdict (e.g., Malware, Benign).

D.The physical port number used for the upload.

E.The MD5 hash of the file.

AnswersC, E

The verdict is the primary result of the analysis.

Why this answer

The WildFire log provides details on the file hash and the analysis result.

Practice this question →

MCQhard

What is the impact of selecting 'Action: Reset-Both' in a Threat Prevention profile for a detected vulnerability?

A.It triggers an alert but does not interfere with the traffic flow.

B.It blocks the source IP address for a specified duration.

C.It sends a TCP RST to both the client and the server to terminate the connection.

D.It drops the packet but allows the TCP session to continue.

AnswerC

Reset-Both is the most aggressive action to stop a threat.

Why this answer

Reset-Both terminates the TCP session from both the client and the server sides, immediately stopping the malicious traffic.

Practice this question →

MCQmedium

Which feature allows you to block traffic based on a specific geographic region?

A.Policy-based filtering using 'Region' objects.

B.User-ID

C.DNS Security profile.

D.App-ID

AnswerA

Regions are built-in objects used to filter traffic by geography.

Why this answer

Geo-blocking is configured by using 'Region' objects in the Source or Destination fields of a Security Policy rule.

Practice this question →

MCQmedium

When managing WildFire, how can you ensure that you are receiving the latest threat signatures as soon as they are generated?

A.Enable 'Push Notifications' in the Device > Setup menu.

B.Use a local WildFire appliance in 'Synchronous' mode.

C.Set the 'WildFire Update Schedule' to 'Every 1 minute'.

D.Force a manual 'Check Now' every hour.

AnswerC

The 1-minute interval is the fastest available setting.

Why this answer

Setting the 'WildFire Update Schedule' to the most frequent interval (every minute) ensures near-instant signature delivery.

Practice this question →

MCQmedium

You are deploying Advanced URL Filtering. How does the 'Credential Phishing' prevention feature operate?

A.It analyzes the URL to determine if it is a known malicious site.

B.It detects and blocks the submission of enterprise credentials to untrusted or newly registered websites.

C.It requires an agent installed on the endpoint to monitor browser activity.

D.It monitors all inbound traffic for known phishing signatures.

AnswerB

This describes the core mechanism of Credential Phishing prevention.

Why this answer

Advanced URL Filtering inspects HTTP POST requests and uses URL categorization to detect and block credential theft.

Practice this question →

Multi-Selecteasy

Which TWO locations in the PAN-OS web interface are used to check the status of CDSS subscriptions?

Select 2 answers

A.Network > Interfaces.

B.Dashboard > Widgets > General Information.

C.Device > Licenses.

D.Monitor > Logs.

E.Policies > Security.

AnswersB, C

The General Information widget summarizes license status.

Why this answer

Subscription status is typically found in the Dashboard or the Device licensing page.

Practice this question →

MCQeasy

How does the 'Advanced URL Filtering' subscription improve upon standard URL Filtering?

A.It provides real-time, cloud-based analysis of unknown or newly registered domains.

B.It allows the firewall to bypass SSL decryption for certain categories.

C.It includes an integrated VPN client for remote workers.

D.It allows for more custom URL categories.

AnswerA

Real-time categorization is the primary benefit of the Advanced subscription.

Why this answer

Advanced URL Filtering uses real-time analysis rather than just static database lookups to identify malicious sites.

Practice this question →

MCQhard

An administrator needs to enable Threat Prevention to protect against a specific zero-day exploit. How are the signatures for these new threats delivered to the firewall?

A.By manually downloading the threat signature database from the Customer Support Portal.

B.Through the scheduled 'Threats' dynamic update package.

C.Through the daily WildFire update package.

D.By enabling the 'Automatic Update' feature in the Device > Software menu.

AnswerB

The 'Threats' dynamic update contains the latest vulnerability and exploit signatures.

Why this answer

Threat Prevention signatures are delivered via dynamic updates, specifically 'Threats' updates, which are pushed to the firewall.

Practice this question →

MCQmedium

Which action is required to ensure that WildFire analysis results are applied to traffic as quickly as possible?

A.Configure the WildFire profile to use the 'Real-time' analysis mode.

B.Enable 'Packet Capture' for all security policies.

C.Increase the WildFire cloud region to the nearest geographic site.

D.Set the WildFire forwarding to 'Legacy' mode.

AnswerA

Real-time mode minimizes latency in file analysis and protection.

Why this answer

Enabling the 'Real-time' setting in the WildFire profile ensures files are sent and results are acted upon immediately.

Practice this question →