VendorsExamsEnterprise
Support
Request an ExamContact UsFAQ

Palo Alto Networks Certified Network Security Professional Free Sample Questions

Description

Covers application layer inspection and packet decryption, NGFW, SASE and Prisma SD-WAN functionality, Cloud-Delivered Security Services and AIOps, and firewall and Prisma Access configuration.

12 free sample questions120 in the full practice test Other version: netsec-generalist(259)

Try simulator

NetSec-Pro Sample Questions

  1. Question 1

    Intermediate

    Network Security Fundamentals · Decryption on Strata and SASE

    A security architect is designing a decryption strategy for a high-security financial institution. The organization requires inspection of outbound SSL/TLS traffic to detect data exfiltration. However, strict privacy regulations mandate that personal banking and healthcare traffic must NEVER be decrypted. Which configuration strategy optimally balances security visibility with regulatory compliance?

    Answer and explanation

    Correct answer: D

    Palo Alto Networks firewalls process decryption policy rules from top to bottom. To satisfy the requirement, specific traffic (sensitive categories) must be explicitly excluded from decryption using a 'No Decrypt' action before the general rule that decrypts remaining traffic is evaluated. Blocking the categories would prevent business continuity, not just stop decryption.

  2. Question 2

    Advanced

    Network Security Fundamentals · Application Layer Inspection

    A network administrator is troubleshooting an issue where a specific custom application is being identified as 'ssl' instead of its unique App-ID 'custom-corp-app'. The application runs over HTTPS (port 443). The administrator has verified that the custom App-ID signature is correctly defined. What is the most likely cause of this identification failure?

    flowchart LR Client -->|HTTPS/443| Firewall Firewall -->|HTTPS/443| Server subgraph Firewall_Logic A[Packet In] --> B{Decryption?} B -->|No| C[App-ID: ssl] B -->|Yes| D[App-ID: custom-corp-app] end
    Answer and explanation

    Correct answer: B

    App-ID uses application signatures to identify traffic. When a session is SSL/TLS and no Decryption policy rule matches it, the firewall sees only the TLS handshake, so it usually identifies the session as ssl and not as the application inside. When a Decryption policy rule decrypts the session (SSL Forward Proxy for outbound traffic, or SSL Inbound Inspection for your own server), App-ID runs the signatures again on the decrypted flow, and the custom-corp-app signature can match. Adding the application to the Security policy rule doesn't change how it is identified. Unencrypted HTTP that can't be identified more specifically appears as web-browsing, not as ssl.

  3. Question 3

    IntermediateMultiple answers

    Network Security Fundamentals · Network Hardening Methods

    Which TWO components are essential for implementing a Zero Trust architecture using Palo Alto Networks NGFWs to ensure user identity is verified before granting resource access? (Select TWO)

    Answer and explanation

    Correct answers: B, D

    User-ID is the fundamental component that maps IP addresses to users, allowing policies to be written based on identity rather than IP.

    To enforce Zero Trust, security policies must explicitly allow access only to specific users or groups (Least Privilege), rather than allowing 'Any' user.

  4. Question 4

    Advanced

    Network Security Fundamentals · Slow Path and Fast Path Packet Inspection

    During the packet processing flow on a Palo Alto Networks NGFW, at which stage is the Destination Zone determined for a new session?

    Answer and explanation

    Correct answer: A

    In the packet flow, after ingress processing and before security policy lookup, the firewall performs a forwarding (route) lookup using the destination IP. The interface associated with the matching route determines the Destination Zone.

  5. Question 5

    Intermediate

    NGFW and SASE Solution Functionality · Prisma Access Functionality

    A multinational corporation is deploying Prisma Access to secure its mobile workforce. They need to ensure that users in Germany connect to a gateway in Frankfurt, while users in Japan connect to a gateway in Tokyo. Which Prisma Access configuration concept handles this geographic distribution of user connections?

    Answer and explanation

    Correct answer: C

    In the Prisma Access mobile users (GlobalProtect) setup, you choose the Prisma Access Locations to deploy. The locations are grouped by region, and each region offers several locations, for example Germany Central (Frankfurt) and Japan Central (Tokyo). The GlobalProtect app then connects each user to the best available deployed location, normally the closest one, so users in Germany connect through Frankfurt and users in Japan through Tokyo. Administrators control which locations and regions are deployed (and can exclude regions for policy or regulatory reasons), but they can't pin a user to a specific Prisma Access gateway. Service connections, User-ID redistribution and zone protection profiles don't determine which location mobile users connect to.

  6. Question 6

    Beginner

    NGFW and SASE Solution Functionality · NGFW Firewall Types and Functions

    Which statement accurately describes the function of the 'CN-Series' firewall in the Palo Alto Networks portfolio?

    Answer and explanation

    Correct answer: D

    CN-Series is the containerized form factor of the NGFW, specifically built to be deployed as a DaemonSet or Service in Kubernetes clusters to provide Layer 7 visibility and protection for container traffic.

Register free for 6 more questions

Or unlock all 120 NetSec-Pro questions with explanations, timed mode and flashcards.

Related practice tests

All Palo Alto Networks practice exams