NetSec-Analyst practice questions 11–20

1. Question 11 · 21 in bank

   There are intermittent connectivity issues between two internal zones on a PA-Series firewall. Although the Security policies appear correctly configured, traffic between the zones is experiencing unexpected drops. Which troubleshooting step will isolate the root cause of this behavior?

   • AUse the PAN-OS GUI Troubleshooting tool to review interface status, verify zone assignments, and confirm that all links are operational.
   • BUse the CLI command show system state filter sys.s1.* | match Error to find interface errors across all the interfaces.
   • CUse the CLI command tcpdump filter and set the source and destination zones in the filter to capture and analyze traffic flows between zones, checking for packet loss on the data plane.
   • DUse the CLI command show system info to monitor CPU and memory usage, ensuring that resource constraints are not causing interfaces to drop packets between zones.

   Show answer

   Answer: C

   Next question

2. Question 12 · 21 in bank

   A company requires that all employees connecting through GlobalProtect VPN are allowed access only to approved web browsing and email applications. These sessions must undergo strict content inspection, and user access must be authenticated based on their Active Directory group membership. Which Security policy configuration meets these requirements?

   • AConfigure GlobalProtect split tunneling to provide access to web browsing and email applications through the GlobalProtect Gateway, override the default interzone policy action to allow, and attach the strict security profile group.
   • BConfigure a User-ID Access profile on the source zone, use App-ID to provide access to approved applications, and attach the strict security profile group.
   • CConfigure a source user group to authorize GlobalProtect users, use App-ID to provide access to only the approved applications, and attach a best practice security profile group.
   • DConfigure group mapping to authorize GlobalProtect users, use App-ID to restrict access to only email-base and web browsing applications, and attach a best practice security profile group.

   Show answer

   Answer: C

   Next question

3. Question 13 · 21 in bank

   Following a configuration change, the management interface of a PA-Series NGFW becomes unreachable, and no data plane interface is configured with a management profile. Which troubleshooting step will help identify recent changes?

   • ALog into an alternate management port and review the commit history via the PAN-OS GUI to pinpoint changes affecting the management interface.
   • BAccess the device via the serial console and use the CLI command show config diff to compare the running configuration with a saved backup.
   • CAccess the device via the serial console and use the CLI command show config audit info to identify recent configuration changes.
   • DExport a named configuration snapshot and compare it manually using a text editor from the remote management portal.

   Show answer

   Answer: C

   Next question

4. Question 14 · 21 in bank

   Which aspect of a network’s current health does the Strata Cloud Manager (SCM) Device Health dashboard provide?

   • AHealth trends based on which CVEs are not remediated.
   • BHealth score based on current physical hardware issues detected.
   • CHealth score based on security profile feature adoption.
   • DHealth trends for firewalls filtered by how long the issue has been experienced.

   Show answer

   Answer: D

   Next question

5. Question 15 · 21 in bank

   Which log type should be checked first using Log Viewer when a user reports being unable to access a specific website?

   • AFirewall/URL
   • BFirewall/Traffic
   • CFirewall/Threat
   • DFirewall/DNS Security

   Show answer

   Answer: B

   Next question

6. Question 16 · 21 in bank

   What is the most granular method for ensuring that traffic to a firewall’s public IP address on the public interface is translated to the private IP address of the web server?

   • ACreate one NAT policy, ensure the policy has original packet destination IP as the public IP address and translated packet destination IP as the private IP address, and mark Bi-directional as "Yes."
   • BCreate one NAT policy, set the source address to the public IP address and destination address to the private IP address, and ensure Bi-directional is checked.
   • CCreate two static NAT policies, ensure one policy has original packet destination IP as the public IP address and translated packet destination IP as the private IP address, ensure the other policy has original packet source IP as the private IP address and the translated packet source IP as the public IP address.
   • DCreate one NAT policy, ensure the policy has original packet source IP as the private IP address and the translated packet source IP as the public IP address, and mark Bi-directional as "Yes."

   Show answer

   Answer: C

   Next question

7. Question 17 · 21 in bank

   Select 2

   What are two valid pattern types in a Data Filtering profile? (Choose two.)

   • ACustom Dictionary
   • BProximity Pattern
   • CFile Properties
   • DRegular Expression

   Show answer

   Answer: CD

   Next question

8. Question 18 · 21 in bank

   A Palo Alto Networks NGFW for a high-security environment is being configured and requires a security profile group that includes vulnerability protection. When configuring the action based on the severity of the threat types, what does Palo Alto Networks recommend?

   • AUse action "allow" for critical high, and medium vulnerabilities.
   • BUse action "alert" for critical, high, and medium vulnerabilities.
   • CUse action "default" for critical, high, and medium vulnerabilities.
   • DUse action "reset-both" for critical, high, and medium vulnerabilities.

   Show answer

   Answer: D

   Next question

9. Question 19 · 21 in bank

   A firewall administrator is creating an application override rule to bypass Layer 7 inspection for a pre-defined application. What is the expected behavior for Content-ID checks for this application?

   • ADNS Security will have degraded performance for advanced features.
   • BWildFire will only use inline-ML checks instead of sending items to WildFire Cloud.
   • CNo additional security checks will occur due to there being only Layer 4 handling.
   • DThreat inspection will occur if the pre-defined application supports threat inspection.

   Show answer

   Answer: C

   Next question

10. Question 20 · 21 in bank

    Which action ensures that a Panorama push will not fail due to pending local firewall changes?

    • ACommit configurations locally on the device and then repeat the same configuration from Panorama.
    • BDisable "Merge with Device Candidate Config."
    • CEnable "Force Template Values."
    • DEnable both options "Include Device and Network Templates" and "Include Firewall Clusters."

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

NetSec-Analyst practice, question 11. 21 questions available.