Free NetSec-Analyst sample questions

Correct answer: Antivirus, Anti-Spyware, and URL Filtering

The Antivirus profile handles blocking malicious files (malware). The Anti-Spyware profile is responsible for detecting and blocking command-and-control (C2) beacons. The URL Filtering profile controls access to web categories like gambling. Combining these creates the required protection stack.

Correct answer: Create a 'No Decrypt' policy rule for 'Financial-Services' and 'Health-and-Medicine' categories placed above a general 'Decrypt' rule for all other traffic.

The best practice is to handle exclusions via policy logic. By placing a 'No Decrypt' rule for sensitive categories higher in the policy list, the firewall processes these first and bypasses decryption. A subsequent rule then catches and decrypts remaining traffic. This is cleaner than managing profile-based exclusions for broad categories.

Correct answer: The firewall does not trust the Certificate Authority (CA) that signed the web server's certificate.

When an EDL is hosted on an HTTPS server, the firewall acts as a client. It must validate the server's certificate. If the server uses a private CA or a certificate not in the firewall's trusted root store, the connection will fail, preventing the list fetch.

Correct answer: Add `partner.example.com` and `*.partner.example.com` to the category, and ensure `test.partner.example.com` is added to a different category with a higher priority action in the security policy.

Custom URL categories do not support 'exclude' logic directly within the object definition itself in a single line. The standard approach is to define the broad match (`partner.example.com` and `*.partner.example.com`) in the custom category. The exclusion is handled operationally by placing `test.partner.example.com` in a separate category (or relying on its default categorization) and ensuring the policy logic or category match preference handles it appropriately. However, strictly speaking about the object definition, you define what IS included. To 'exclude' effectively in policy, you often need a specific allow/block rule for the specific subdomain before the wildcard rule.

Correct answer: Create a Log Forwarding Profile, add a match list for 'Threat' logs, set the Filter to `(severity eq high) or (severity eq critical)`, and select the SIEM syslog server profile.

Log Forwarding Profiles allow granular filtering using the filter builder. By creating a match list specifically for the 'Threat' log type and applying a filter for specific severities, only those matching logs are sent to the configured forwarding destination (Syslog).

Correct answers: Latency; Jitter

Path Quality Profiles use metrics like Latency, Jitter, and Packet Loss to determine if a path meets the SLA requirements for an application.

Jitter is a key metric in SD-WAN Path Quality profiles.