Palo Alto Networks Certified Network Security Professional Free Sample Questions

Palo Alto Networks firewalls process decryption policy rules from top to bottom. To satisfy the requirement, specific traffic (sensitive categories) must be explicitly excluded from decryption using a 'No Decrypt' action before the general rule that decrypts remaining traffic is evaluated. Blocking the categories would prevent business continuity, not just stop decryption.

App-ID uses application signatures to identify traffic. When a session is SSL/TLS and no Decryption policy rule matches it, the firewall sees only the TLS handshake, so it usually identifies the session as ssl and not as the application inside. When a Decryption policy rule decrypts the session (SSL Forward Proxy for outbound traffic, or SSL Inbound Inspection for your own server), App-ID runs the signatures again on the decrypted flow, and the custom-corp-app signature can match. Adding the application to the Security policy rule doesn't change how it is identified. Unencrypted HTTP that can't be identified more specifically appears as web-browsing, not as ssl.

User-ID is the fundamental component that maps IP addresses to users, allowing policies to be written based on identity rather than IP.

To enforce Zero Trust, security policies must explicitly allow access only to specific users or groups (Least Privilege), rather than allowing 'Any' user.

In the packet flow, after ingress processing and before security policy lookup, the firewall performs a forwarding (route) lookup using the destination IP. The interface associated with the matching route determines the Destination Zone.

In the Prisma Access mobile users (GlobalProtect) setup, you choose the Prisma Access Locations to deploy. The locations are grouped by region, and each region offers several locations, for example Germany Central (Frankfurt) and Japan Central (Tokyo). The GlobalProtect app then connects each user to the best available deployed location, normally the closest one, so users in Germany connect through Frankfurt and users in Japan through Tokyo. Administrators control which locations and regions are deployed (and can exclude regions for policy or regulatory reasons), but they can't pin a user to a specific Prisma Access gateway. Service connections, User-ID redistribution and zone protection profiles don't determine which location mobile users connect to.

CN-Series is the containerized form factor of the NGFW, specifically built to be deployed as a DaemonSet or Service in Kubernetes clusters to provide Layer 7 visibility and protection for container traffic.