Courseiva
Free · No account needed · No credit card

Certified Network Security Professional (NetSec-Pro) Practice Test

272 questions with instant explanations, domain breakdown, and wrong-answer analysis. Built for the real exam.

Instant feedback after each answer
Full explanations included
Domain score breakdown
Pass mark: 860 (scaled 300–1,000)

Sample questions with explanations

This is exactly what you see during practice — question, options, and a full explanation after you answer.

Q1Connectivity And Securityhard
Full explanation →

An administrator notices intermittent packet loss in a GlobalProtect deployment where users connect via IPv6. Which configuration change is likely to resolve the issue if MTU fragmentation is suspected?

Decrease the MTU size on the tunnel interface.Correct
BIncrease the GlobalProtect timeout value.
CDisable hardware offloading for IPv6.
DEnable IPv6 transition mechanisms on the external interface.

Intermittent packet loss in IPv6 GlobalProtect tunnels is often caused by MTU fragmentation issues because IPv6 does not allow routers to fragment packets. Decreasing the MTU size on the tunnel interface reduces the packet size, preventing fragmentation and the resulting drops. T…Read full explanation

Q2Connectivity And Securityeasy
Full explanation →

An administrator wants to use DHCP to assign IP addresses to GlobalProtect clients. Where is this setting configured?

AObjects > Addresses
Network > GlobalProtect > Gateways > Client SettingsCorrect
CNetwork > DHCP > Server
DDevice > Setup > Management

In Palo Alto Networks GlobalProtect, DHCP address assignment for clients is configured under Network > GlobalProtect > Gateways > [Gateway] > Client Settings, where the administrator specifies the IP pool and can select DHCP as the address assignment method. This is where the gat…Read full explanation

Q3Connectivity And Securityeasy
Full explanation →

Which CLI command is most effective for verifying if a specific packet is being blocked by a security policy in real-time?

Adebug dataplane packet-diag
test security-policy-match source <ip> destination <ip> protocol <proto>Correct
Cshow running security-policy
Dshow session all filter source <ip>

The 'test security-policy-match' command simulates a packet against the current security policy and shows which rule would match, including whether it would be allowed or denied. It is the most direct CLI tool for verifying real-time policy enforcement for a specific flow.

What's covered

Questions are tagged by exam domain. Practice a specific domain or mix them all.

Untimed Practice

Answer at your own pace. Explanation and domain tag shown immediately after each answer.

Timed Practice

Countdown timer starts immediately. Results and domain scores shown at the end — just like the real exam.

Why practice here?

Full explanations on every question

Not just the right answer — you get exactly why each wrong option is wrong, so you learn the concept, not the answer.

Domain score breakdown

After each session see your score by exam domain so you know exactly where to focus study time.

100% free, forever

No subscription, no trial, no email wall. Start a session in under 10 seconds.

Exam-style questions

Scenario-based, precise wording, realistic distractors — written to match what you actually see on exam day.

← All NetSec-Pro questionsNetSec-Pro exam guideStudy guidePractice by domain