NetSec Analyst Practice Questions & Answers • ExamPrepare

36 questions in this view

Page 1 of 6

Question 1

What is the order of processing when both Policy-Based Forwarding (PBF) policies and routing table entries are involved?

The firewall evaluates PBF policies first; if a packet matches a PBF rule, the specified next-hop in that rule overrides the routing table.
The firewall evaluates the routing table that is using the longest prefix match and then applies any matching PBF rule to override the next-hop.
The firewall evaluates static routes, then dynamic routes, and then it applies PBF policies to adjust the next-hop.
The firewall performs a simultaneous evaluation of both PBF policies and the routing table, and then it chooses the route with the lowest metric.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 2

An organization splits its data center network per policy change mandates. The NGFWs must support both sides of the network on a single high availability (HA) pair. The NGFWs have SD-WAN running for 32 branches, which will be divided into 8 and 24 for the split. The NGFWs also run OSPF and BGP, which prevents the completion of the project to comply with the policy change.

Which action must be taken to resolve this issue?

Select "Enable Multi-VR Support" in the Panorama → SD-WAN → Device section for the HA pair, then create two virtual routers with appropriate routing policy.
Select "Enable Multi-LR Support" in the Strata Cloud Manager → SD-WAN → Device section for the HA pair, then create two virtual routers with appropriate routing policy.
Select "Enable Multi-VR Support" in the Strata Cloud Manager → SD-WAN → Device section for the HA pair, then create two virtual routers with appropriate routing policy.
Select "Enable Multi-LR Support" in the Panorama → SD-WAN → Device section for the HA pair, then create two virtual routers with appropriate routing policy.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 3

An organization hosts a customer portal and wants to use a Palo Alto Networks NGFW to inspect inbound traffic for threats. The portal uses a certificate issued by a public certificate authority (CA).

What is a mandatory requirement for the firewall?

It must be configured as a subordinate CA to the public CA that issued the portal certificate.
A self-signed certificate must be generated on the firewall and pushed to all external clients.
The portal server must be configured to use a Weak Cipher suite that the firewall can easily intercept.
The administrator must install the portal's certificate and private key on the firewall.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 4

An organization uses a load balancer with a single public IP address to distribute inbound traffic to multiple internal servers running a custom application on the non-standard port 8443.

For example, traffic destined to the load balancer IP address 203.0.113.50:8443 needs to be forwarded to 10.20.30.40:9443. The load balancer directs traffic to internal hosts based on the destination port. The company requires the NAT policy to support precise port translation to ensure proper server load balancing and application availability.

Which Destination NAT configuration should be implemented?

Static NAT rule with source translation enabled to translate the public and private IP addresses, leaving port translation unchanged
No NAT rule, because the load balancer dynamically handles the port 8443 to 9443 translation
Static NAT rule that maps the public IP address and port 8443 to the corresponding internal IP address and port 9443
Dynamic IP and Port (DIPP) NAT rule that automatically handles port translation and translates the destination IP address

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 5

A security team experiencing alert fatigue from its NGFWs needs to set parameters to receive notifications for the highest risk alerts only. The team must maintain the same level of security efficacy after this change.

Which configuration of the Strata Cloud Manager (SCM) "Incidents and Alerts" tab will meet the requirements?

Notification Rules: create a notification rule with the following parameters: “Severity = Critical" and "Domain = NGFW,” add a name, description, and email recipient, save rule
Automatic Support Case: enter the default contact information of a user who will be notified for all the supported alerts, and apply
Incident and Alerts Settings: change the anomaly sensitivity setting from "High" to "Low," no overrule conditions needed
Log Viewer: change the search to firewall/threat, enter this query into the header: “From Zone = trust AND to Zone = untrust AND Severity = Critical," and save filter

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 6

In an environment with SSL Forward Proxy decryption policies and applications that use certificate pinning, which configuration step is essential to prevent application failures due to strict certificate validation?

Use a wildcard certificate to bypass certificate validation issues.
Enable SSL/TLS 1.3 to ensure compatibility with modern applications.
Create SSL decryption exclusions for applications that use certificate pinning.
Increase the key length of the SSL Forward Proxy certificate to enhance security.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.