Network Security Professional (formerly Network Security Generalist)

Last checked October 22, 2026 against the official Palo Alto Networks exam page.

1. Question 1Firewall deployment and initial configuration

   A new PA-Series firewall must be managed from a dedicated network that is separate from its traffic interfaces. Which setting achieves this?

   1. ADisabling the management interface so that the device is configured only through the serial console port
   2. BPlacing the management interface in the same zone as the internet-facing traffic interface for simpler routing
   3. CGiving the management interface its own IP address, and restricting access to it with an interface management profile
   4. DGiving the management interface a public address and relying on the security policy to block unwanted access
   Show answer and explanationHide answer

   Correct answer: C

   A dedicated management IP address with an interface management profile limits which services and networks can reach the management plane, which keeps administration separate from traffic. Sharing a zone with internet traffic mixes the two networks. Management access is not controlled by the security policy, so a public address relies on the wrong control.

2. Question 2Security and NAT policy

   A security rule must allow only a specific user group to reach web sites on the internet. Which element identifies the group in the rule?

   1. AA static route to the internet gateway configured separately for the subnet of each member of the group
   2. BUser-ID mapping, so that the rule can reference the directory group rather than individual IP addresses
   3. CA DHCP reservation for each workstation used by the members of the group, configured on the firewall
   4. DA NAT rule that rewrites the source port of each workstation used by the members of the group
   Show answer and explanationHide answer

   Correct answer: B

   User-ID maps users and groups from the directory to IP addresses, so a rule can match the group rather than addresses. Static routes, DHCP reservations and port rewriting do not identify who the traffic belongs to, and they do not control access by group.

3. Question 3App-ID, User-ID and Content-ID

   Which feature identifies applications from their traffic characteristics, even when they run on non-standard ports?

   1. ANAT, which translates the addresses of packets that cross the firewall between two zones of the network
   2. BURL filtering, which categorises the web addresses requested by users so that policy can act on them
   3. CZone protection, which limits the rate of SYN packets that reach the firewall from any single source
   4. DApp-ID, which identifies applications from traffic signatures and behaviour, regardless of the port in use
   Show answer and explanationHide answer

   Correct answer: D

   App-ID identifies applications from signatures and behaviour regardless of port, which is what makes port-independent policy possible. URL filtering categorises web addresses, zone protection limits floods, and NAT translates addresses. None of them identifies the application itself.

4. Question 4GlobalProtect and Panorama management

   A remote user's laptop must connect to the corporate network before the user signs in, so that the machine can receive policy and updates. Which GlobalProtect feature supports this?

   1. APre-logon connection, which establishes the tunnel before user sign-in, using machine authentication
   2. BClientless VPN, which opens internal web applications in a browser without any client software installed
   3. CCaptive portal, which redirects users on the local network to a login page before web access is allowed
   4. DA site-to-site IPsec tunnel between two branch firewalls, with no individual user connection involved at all
   Show answer and explanationHide answer

   Correct answer: A

   Pre-logon connects the GlobalProtect tunnel before user sign-in using machine authentication, so the device can receive policy and updates. Clientless VPN and captive portals serve different access scenarios, and a site-to-site tunnel connects networks rather than individual laptops.

5. Question 5Decryption

   Which decryption type lets the firewall inspect HTTPS traffic from internal users to external websites?

   1. ASSL Forward Proxy decryption, where the firewall presents a certificate for the destination to the client
   2. BSSL Inbound Inspection, which is used for traffic from the internet to a server that the company hosts itself
   3. CNo decryption, which relies on the URL alone and cannot be combined with threat prevention profiles at all
   4. DSSH Proxy, which inspects the encrypted shell sessions that internal users open to remote hosts directly
   Show answer and explanationHide answer

   Correct answer: A

   SSL Forward Proxy decryption applies to outbound HTTPS from internal clients: the firewall presents a certificate for the destination, so it can inspect the session. Inbound inspection applies to servers the company hosts, no decryption cannot inspect the content, and SSH proxy covers shell sessions rather than HTTPS.