Palo Alto Networks Certified Network Security Professional Free Sample Questions

In a Zero Trust model using GlobalProtect, enforcing device compliance requires both collecting HIP data and applying it in policy. While the Security policy rule correctly identifies the user group via User-ID, it is ineffective at checking device posture without a HIP Profile attached. The HIP Profile defines what constitutes a 'compliant' device, and adding this profile to the rule ensures that traffic will only match if both the user and the device posture criteria are met.

For SSL Inbound Inspection to work, the firewall must be able to act as the destination web server. This requires importing the server's certificate and its corresponding private key. Additionally, because the server's certificate is signed by an internal CA, the firewall itself does not inherently trust this CA. You must import the internal root CA certificate onto the firewall and explicitly configure it as a Trusted Root CA to validate the server certificate's chain of trust.

In a hub-and-spoke topology where traffic is forced through a firewall, the private IP addresses from the spoke VNet are not routable on the public internet. The firewall must translate the source IP addresses of the traffic from the spoke VNet to its own public-facing IP address before sending it to the internet. This requires a Source NAT (SNAT) policy. Without it, return traffic from the internet will not know how to get back to the originating private IP in the spoke VNet.

Prisma SD-WAN continuously monitors the health of all available paths based on metrics like latency, jitter, and packet loss. If a path, such as the MPLS link, fails to meet the configured health thresholds, it will be marked as down or degraded. Even if a path policy explicitly directs traffic to that link, the SD-WAN controller will automatically reroute the traffic to the next-best available path (the broadband link) to maintain connectivity, bypassing the preferred path.

A complete Prisma Access solution requires several components. A Service Connection is essential to connect the Prisma Access backbone to the private applications in the AWS VPC. Remote Network connections are needed to securely connect the physical office locations to Prisma Access. Finally, GlobalProtect must be deployed on user devices to provide secure access for mobile and remote users, ensuring they connect to the nearest Prisma Access node for low-latency performance.

Panorama uses a hierarchical structure for policies with Pre-rules, Local rules, and Post-rules. Pre-rules are evaluated first and are inherited by all lower-level device groups. To enforce a global blocking rule that cannot be overridden by local administrators, the best practice is to place it in the Pre-rules of the top-level device group. This ensures it is applied consistently across all 500 firewalls and takes precedence over any more specific, local rules.

This statement is false. Enterprise DLP requires a multi-step configuration. First, you define a Data Pattern (e.g., for credit card numbers). Second, you add this pattern to a Data Filtering Profile and set the action to 'block'. Finally, this Data Filtering Profile must be attached to the relevant Security policy rule. Simply having the data pattern defined and attached to a rule without the profile and action is insufficient to block exfiltration.

Palo Alto Networks IoT Security learns the normal behavior of devices and can automatically generate security policy recommendations based on this baseline. This feature creates highly specific rules using Device-ID, App-ID, and known destinations. By importing and applying this recommended policy, the administrator can create a rule that allows only the legitimate, expected traffic for the 'Infusion Pump' device profile and implicitly denies all other traffic, such as the anomalous SSH connection, without disrupting its core medical functions.

The WildFire Analysis profile determines which files get sent to the sandbox for analysis, but it does not block files based on verdicts. The blocking action is handled by other security profiles. When WildFire identifies a file as malicious, it generates a new signature and categorizes it under the 'wildfire-virus' subtype. To proactively block future downloads of this and other WildFire-identified malware, the Antivirus profile must be configured to block (e.g., 'reset-both') this specific subtype. This ensures that once a verdict is known, subsequent attempts to download the same file are immediately blocked.

The core advantage of App-ID over port-based rules is its ability to identify the true application regardless of the port it uses. When a rule is configured with a service object like 'service-http' (port 80), it allows any application to use that port. This creates a significant security gap, as malicious or unwanted applications (e.g., peer-to-peer file sharing, remote access tools) can tunnel their traffic over port 80 to bypass security controls. Using App-ID ensures that only the intended application (e.g., 'web-browsing') is allowed, effectively closing this gap.