Free NetSec-Pro sample questions

Correct answer: Create a Decryption Policy rule with action 'No Decrypt' targeting the 'Financial Services' and 'Health and Medicine' URL categories, placed above a general 'Decrypt' rule for all other traffic.

Palo Alto Networks firewalls process decryption policy rules from top to bottom. To satisfy the requirement, specific traffic (sensitive categories) must be explicitly excluded from decryption using a 'No Decrypt' action before the general rule that decrypts remaining traffic is evaluated. Blocking the categories would prevent business continuity, not just stop decryption.

Correct answer: There is no Decryption Policy rule matching this traffic, preventing App-ID from inspecting the encrypted payload to match the custom signature.

App-ID uses application signatures to identify traffic. When a session is SSL/TLS and no Decryption policy rule matches it, the firewall sees only the TLS handshake, so it usually identifies the session as ssl and not as the application inside. When a Decryption policy rule decrypts the session (SSL Forward Proxy for outbound traffic, or SSL Inbound Inspection for your own server), App-ID runs the signatures again on the decrypted flow, and the custom-corp-app signature can match. Adding the application to the Security policy rule doesn't change how it is identified. Unencrypted HTTP that can't be identified more specifically appears as web-browsing, not as ssl.

Correct answers: User-ID agents or Cloud Identity Engine to map IP addresses to usernames; Security Policy rules with source 'User' fields defined instead of 'Any'

User-ID is the fundamental component that maps IP addresses to users, allowing policies to be written based on identity rather than IP.

To enforce Zero Trust, security policies must explicitly allow access only to specific users or groups (Least Privilege), rather than allowing 'Any' user.

Correct answer: During the forwarding lookup stage, based on the route to the destination IP address.

In the packet flow, after ingress processing and before security policy lookup, the firewall performs a forwarding (route) lookup using the destination IP. The interface associated with the matching route determines the Destination Zone.

Correct answer: Locations and Regions in the Mobile Users setup

In the Prisma Access mobile users (GlobalProtect) setup, you choose the Prisma Access Locations to deploy. The locations are grouped by region, and each region offers several locations, for example Germany Central (Frankfurt) and Japan Central (Tokyo). The GlobalProtect app then connects each user to the best available deployed location, normally the closest one, so users in Germany connect through Frankfurt and users in Japan through Tokyo. Administrators control which locations and regions are deployed (and can exclude regions for policy or regulatory reasons), but they can't pin a user to a specific Prisma Access gateway. Service connections, User-ID redistribution and zone protection profiles don't determine which location mobile users connect to.

Correct answer: It is a containerized NGFW designed to secure traffic within Kubernetes environments (East-West) and at the boundary (North-South).

CN-Series is the containerized form factor of the NGFW, specifically built to be deployed as a DaemonSet or Service in Kubernetes clusters to provide Layer 7 visibility and protection for container traffic.