Free netsec-generalist sample questions

Correct answer: The Security policy rule is missing a HIP Profile that specifies the compliance criteria.

In a Zero Trust model using GlobalProtect, enforcing device compliance requires both collecting HIP data and applying it in policy. While the Security policy rule correctly identifies the user group via User-ID, it is ineffective at checking device posture without a HIP Profile attached. The HIP Profile defines what constitutes a 'compliant' device, and adding this profile to the rule ensures that traffic will only match if both the user and the device posture criteria are met.

Correct answers: Import the web server's private key and certificate onto the firewall and use it in the Decryption policy.; Import the root certificate of the internal CA onto the firewall and mark it as a Trusted Root CA.

For SSL Inbound Inspection to work, the firewall must be able to act as the destination web server. This requires importing the server's certificate and its corresponding private key. Additionally, because the server's certificate is signed by an internal CA, the firewall itself does not inherently trust this CA. You must import the internal root CA certificate onto the firewall and explicitly configure it as a Trusted Root CA to validate the server certificate's chain of trust.

Correct answer: A Source NAT (SNAT) policy has not been configured on the firewall for traffic from the spoke zone.

In a hub-and-spoke topology where traffic is forced through a firewall, the private IP addresses from the spoke VNet are not routable on the public internet. The firewall must translate the source IP addresses of the traffic from the spoke VNet to its own public-facing IP address before sending it to the internet. This requires a Source NAT (SNAT) policy. Without it, return traffic from the internet will not know how to get back to the originating private IP in the spoke VNet.

Correct answer: The MPLS link's health check is failing, causing Prisma SD-WAN to mark the path as unusable.

Prisma SD-WAN continuously monitors the health of all available paths based on metrics like latency, jitter, and packet loss. If a path, such as the MPLS link, fails to meet the configured health thresholds, it will be marked as down or degraded. Even if a path policy explicitly directs traffic to that link, the SD-WAN controller will automatically reroute the traffic to the next-best available path (the broadband link) to maintain connectivity, bypassing the preferred path.

Correct answers: A Service Connection configured for the AWS VPC in `us-east-1`.; Remote Network connections for the corporate offices in North America and Asia.; GlobalProtect deployed on user endpoints for mobile user access.

A complete Prisma Access solution requires several components. A Service Connection is essential to connect the Prisma Access backbone to the private applications in the AWS VPC. Remote Network connections are needed to securely connect the physical office locations to Prisma Access. Finally, GlobalProtect must be deployed on user devices to provide secure access for mobile and remote users, ensuring they connect to the nearest Prisma Access node for low-latency performance.

Correct answer: Create the rule in the highest-level (e.g., 'Global') Pre-Rules of the Device Group hierarchy.

Panorama uses a hierarchical structure for policies with Pre-rules, Local rules, and Post-rules. Pre-rules are evaluated first and are inherited by all lower-level device groups. To enforce a global blocking rule that cannot be overridden by local administrators, the best practice is to place it in the Pre-rules of the top-level device group. This ensures it is applied consistently across all 500 firewalls and takes precedence over any more specific, local rules.

Correct answer: False

This statement is false. Enterprise DLP requires a multi-step configuration. First, you define a Data Pattern (e.g., for credit card numbers). Second, you add this pattern to a Data Filtering Profile and set the action to 'block'. Finally, this Data Filtering Profile must be attached to the relevant Security policy rule. Simply having the data pattern defined and attached to a rule without the profile and action is insufficient to block exfiltration.

Correct answer: Use the IoT Security portal to recommend a new Security policy, then import and apply it on the firewall.

Palo Alto Networks IoT Security learns the normal behavior of devices and can automatically generate security policy recommendations based on this baseline. This feature creates highly specific rules using Device-ID, App-ID, and known destinations. By importing and applying this recommended policy, the administrator can create a rule that allows only the legitimate, expected traffic for the 'Infusion Pump' device profile and implicitly denies all other traffic, such as the anomalous SSH connection, without disrupting its core medical functions.

Correct answer: In the Antivirus profile, set the action for the 'wildfire-virus' subtype to 'reset-both'.

The WildFire Analysis profile determines which files get sent to the sandbox for analysis, but it does not block files based on verdicts. The blocking action is handled by other security profiles. When WildFire identifies a file as malicious, it generates a new signature and categorizes it under the 'wildfire-virus' subtype. To proactively block future downloads of this and other WildFire-identified malware, the Antivirus profile must be configured to block (e.g., 'reset-both') this specific subtype. This ensures that once a verdict is known, subsequent attempts to download the same file are immediately blocked.

Correct answer: It allows evasive applications to tunnel over standard ports, bypassing security inspection.

The core advantage of App-ID over port-based rules is its ability to identify the true application regardless of the port it uses. When a rule is configured with a service object like 'service-http' (port 80), it allows any application to use that port. This creates a significant security gap, as malicious or unwanted applications (e.g., peer-to-peer file sharing, remote access tools) can tunnel their traffic over port 80 to bypass security controls. Using App-ID ensures that only the intended application (e.g., 'web-browsing') is allowed, effectively closing this gap.