CertArea
All Palo Alto Networks exams

Free Network Security Professional (formerly Network Security Generalist) practice test: 30 questions with answers

30 original questions for Network Security Professional (formerly Network Security Generalist), drawn from every topic area. Answer each one to see whether you got it right and why. No sign-up.

Free questions
30
Full bank
112 questions

Network Security Professional (formerly Network Security Generalist) exam guide: topics, cost and format

All 30 Network Security Professional (formerly Network Security Generalist) questions with answers

The same questions as the test above, grouped by exam topic. Open any question to see the answer and explanation.

Firewall deployment and initial configuration (5 questions)

  1. Question 1

    A new PA-Series firewall must be managed from a dedicated network that is separate from its traffic interfaces. Which setting achieves this?

    1. ADisabling the management interface so that the device is configured only through the serial console port
    2. BPlacing the management interface in the same zone as the internet-facing traffic interface for simpler routing
    3. CGiving the management interface its own IP address, and restricting access to it with an interface management profile
    4. DGiving the management interface a public address and relying on the security policy to block unwanted access
    Show answer and explanation
    Correct answer: C

    A dedicated management IP address with an interface management profile limits which services and networks can reach the management plane, which keeps administration separate from traffic. Sharing a zone with internet traffic mixes the two networks. Management access is not controlled by the security policy, so a public address relies on the wrong control.

  2. Question 2

    Before a changed firewall configuration is applied to production, which step should the administrator take first?

    1. ACommitting the configuration straight away, then reviewing and fixing any issue that users report later
    2. BValidating the candidate configuration and reviewing the pending changes before committing them
    3. CDisabling all security profiles until the firewall has run for a month without any change to its rules
    4. DExporting the running configuration to a USB drive and deleting the candidate configuration afterwards
    Show answer and explanation
    Correct answer: B

    Validating the candidate configuration and reviewing the pending changes catches errors before they take effect. Committing first relies on users to find faults, and disabling profiles reduces protection. Deleting the candidate configuration discards the change the administrator intended to make.

  3. Question 3

    A firewall connects to a switch port that carries a trunk with several VLANs, each with its own subnet. Which configuration fits?

    1. AA tap mode interface, which copies traffic for monitoring and cannot forward traffic to the network
    2. BA virtual wire interface, which passes traffic straight through without routing or switching it
    3. CA Layer 2 interface with VLAN-tagged subinterfaces, one subinterface for each VLAN carried on the trunk
    4. DA loopback interface used only for routing protocol peering, with no traffic forwarding permitted at all
    Show answer and explanation
    Correct answer: C

    A Layer 2 interface with a tagged subinterface for each VLAN lets the firewall receive and inspect traffic for every VLAN on the trunk. Tap mode only observes traffic, virtual wire passes it without VLAN handling, and a loopback interface does not forward data traffic.

  4. Question 4

    Which zone should be assigned to the firewall interface that connects to the internet?

    1. AAn internal zone with the default trust setting, used for all traffic that originates on the local network
    2. BAn untrust zone, which holds the internet-facing interface and receives traffic arriving from outside
    3. CA management zone, which is reserved for administrative access to the firewall itself and nothing else
    4. DA DMZ zone, which holds servers that must be reachable from the internet with restricted access
    Show answer and explanation
    Correct answer: B

    The untrust zone is used for the internet-facing interface, where inbound traffic from outside the network arrives and is treated as untrusted. An internal zone is for internal users, a DMZ holds servers exposed to the internet, and a management zone is for administrative access rather than internet traffic.

  5. Question 5

    Which TWO statements about initial firewall setup are correct? (Choose two.)

    1. AThe default administrator password should be changed, and stronger authentication should be set for administrators
    2. BInterfaces can carry traffic without being assigned to any zone, because zone assignment is optional for them
    3. CDynamic content updates such as threat signatures should be scheduled, so the device stays current with new threats
    4. DThe management interface must be connected to the internet for the firewall to apply any security policy
    5. EFactory defaults permit all traffic from the internet to reach the management address of the device
    Show answer and explanation
    Correct answer: A, C

    Changing default credentials and scheduling content updates are core initial steps for a secure, current firewall. Traffic interfaces need a zone to be used by policy, the management connection need not reach the internet to apply policy, and factory defaults do not expose the management address to the internet.

Security and NAT policy (5 questions)

  1. Question 6

    A security rule must allow only a specific user group to reach web sites on the internet. Which element identifies the group in the rule?

    1. AA static route to the internet gateway configured separately for the subnet of each member of the group
    2. BUser-ID mapping, so that the rule can reference the directory group rather than individual IP addresses
    3. CA DHCP reservation for each workstation used by the members of the group, configured on the firewall
    4. DA NAT rule that rewrites the source port of each workstation used by the members of the group
    Show answer and explanation
    Correct answer: B

    User-ID maps users and groups from the directory to IP addresses, so a rule can match the group rather than addresses. Static routes, DHCP reservations and port rewriting do not identify who the traffic belongs to, and they do not control access by group.

  2. Question 7

    A security rule is placed after a broader allow rule, so the traffic it targets is never matched. What is this condition called?

    1. AA shadowed rule, which can never match because an earlier rule already matches the same traffic first
    2. BA rule override, which is applied automatically to every rule when the policy is committed to the device
    3. CA NAT exemption, which removes the traffic from the security policy altogether for the session's life
    4. DA zone protection flood threshold that drops packets before they reach any of the security rules
    Show answer and explanation
    Correct answer: A

    Security rules are evaluated top to bottom and the first match applies, so a rule placed after a broader matching rule is shadowed and never used. A rule override, a NAT exemption and a flood threshold are different features and do not describe rules that can never match.

  3. Question 8

    Which NAT type lets many internal hosts share one public IP address, using different source ports for each session?

    1. AStatic destination NAT, which maps one public address to one internal server and nothing else
    2. BBidirectional NAT, which translates both source and destination for the same mapping every time
    3. CDynamic source NAT with port address translation, which shares one public IP across many internal hosts
    4. DDestination NAT with port forwarding, which maps an inbound port on a public address to an internal server
    Show answer and explanation
    Correct answer: C

    Dynamic source NAT with port address translation maps many internal hosts onto one public address and distinguishes them with source ports. Static and bidirectional mappings are one-to-one, and destination NAT with port forwarding handles inbound traffic to servers rather than outbound sharing.

  4. Question 9

    A rule must allow a business application, and the business must still record every session of it for auditing. Which configuration fits?

    1. ASetting the rule action to deny with logging disabled, so that the traffic is blocked and not recorded at all
    2. BRemoving the log-at-session-end option from every rule to save log storage on the firewall's disk
    3. CUsing a discard action with logging turned off, so that connections are dropped silently with no record
    4. DKeeping the allow action and enabling logging at session end on the rule that matches the application
    Show answer and explanation
    Correct answer: D

    Keeping the allow action with logging at session end records every completed session while still permitting the application. Deny or discard actions block the traffic, and removing logging removes the audit trail the business requires.

  5. Question 10

    Which TWO are valid reasons to match traffic with a service object rather than an application filter? (Choose two.)

    1. ATo match the traffic by application signature, regardless of which port the application happens to use
    2. BTo match traffic by a fixed protocol and port, when the application is unknown or not needed in the rule
    3. CTo apply threat prevention profiles to the application's traffic as it passes through the rule
    4. DTo restrict a rule to a particular port and protocol, such as TCP 443 for one specific service
    5. ETo group applications into dynamic categories that are updated automatically by the vendor over time
    Show answer and explanation
    Correct answer: B, D

    A service object matches a fixed protocol and port, which suits traffic where the application does not need to be identified or where a specific port must be restricted. Matching by application signature is the App-ID approach, and threat profiles and dynamic categories belong to other features.

App-ID, User-ID and Content-ID (5 questions)

  1. Question 11

    Which feature identifies applications from their traffic characteristics, even when they run on non-standard ports?

    1. ANAT, which translates the addresses of packets that cross the firewall between two zones of the network
    2. BURL filtering, which categorises the web addresses requested by users so that policy can act on them
    3. CZone protection, which limits the rate of SYN packets that reach the firewall from any single source
    4. DApp-ID, which identifies applications from traffic signatures and behaviour, regardless of the port in use
    Show answer and explanation
    Correct answer: D

    App-ID identifies applications from signatures and behaviour regardless of port, which is what makes port-independent policy possible. URL filtering categorises web addresses, zone protection limits floods, and NAT translates addresses. None of them identifies the application itself.

  2. Question 12

    Which security profile sends unknown files to a cloud analysis service that returns a verdict on whether they are malicious?

    1. AVulnerability protection, which blocks attempts to exploit known weaknesses in installed software
    2. BData filtering, which blocks patterns of sensitive information from leaving the network in outgoing traffic
    3. CWildFire analysis, which sends unknown files to the cloud service and applies the verdict it returns
    4. DAnti-spyware, which blocks command-and-control traffic from infected hosts on the internal network
    Show answer and explanation
    Correct answer: C

    WildFire analysis sends unknown files to the cloud service for analysis and applies the verdict it returns. Vulnerability protection targets exploit attempts, data filtering targets sensitive content, and anti-spyware targets command-and-control traffic. None of them analyses unknown files in the cloud.

  3. Question 13

    Which statement about URL filtering on a Palo Alto Networks firewall is correct?

    1. AURL filtering works only on plain HTTP, so HTTPS sessions are never categorised by any firewall at all
    2. BURL filtering is set in the NAT policy, so that each category rewrites the destination address of the session
    3. CURL filtering blocks every request to an uncategorised site by default, with no option to change that behaviour
    4. DURL filtering is attached to a security rule through a profile, and applies category-based actions to matching traffic
    Show answer and explanation
    Correct answer: D

    URL filtering is attached to security rules through a profile, and actions are applied by category to the matching traffic. It is not limited to HTTP, it is not configured in NAT policy, and the action for uncategorised sites can be set rather than fixed.

  4. Question 14

    Which User-ID method maps users to IP addresses when people sign in to a Windows domain?

    1. AA static route that points each user's address to the correct subnet for routing decisions
    2. BA User-ID agent or agentless integration that reads domain login events and shares the mapping with the firewall
    3. CA DHCP lease event from the router, which records only the device's MAC address and nothing about the user
    4. DA certificate on each workstation carrying the user's name, which the firewall reads for each session
    Show answer and explanation
    Correct answer: B

    A User-ID agent or agentless integration reads domain login events and shares the user-to-IP mapping with the firewall, which is the standard method for domain sign-ins. Static routes, workstation certificates and DHCP events do not provide the user identity that policy needs.

  5. Question 15

    Which TWO statements about Content-ID are correct? (Choose two.)

    1. AContent-ID inspects traffic against threat signatures and profiles that are attached to security rules
    2. BContent-ID replaces App-ID, so application identification is no longer needed when writing policy at all
    3. CContent-ID works only on management plane traffic and cannot inspect the data carried by user sessions
    4. DContent-ID is only a logging feature, and it has no effect on the traffic that it observes on the network
    5. EVulnerability protection profiles are part of Content-ID and can block exploit attempts on allowed traffic
    Show answer and explanation
    Correct answer: A, E

    Content-ID inspects traffic using profiles attached to rules, including vulnerability protection, which blocks exploit attempts on traffic that is otherwise allowed. Content-ID does not replace App-ID, it does inspect user session data, and it actively enforces its profiles rather than only logging.

GlobalProtect and Panorama management (5 questions)

  1. Question 16

    A remote user's laptop must connect to the corporate network before the user signs in, so that the machine can receive policy and updates. Which GlobalProtect feature supports this?

    1. APre-logon connection, which establishes the tunnel before user sign-in, using machine authentication
    2. BClientless VPN, which opens internal web applications in a browser without any client software installed
    3. CCaptive portal, which redirects users on the local network to a login page before web access is allowed
    4. DA site-to-site IPsec tunnel between two branch firewalls, with no individual user connection involved at all
    Show answer and explanation
    Correct answer: A

    Pre-logon connects the GlobalProtect tunnel before user sign-in using machine authentication, so the device can receive policy and updates. Clientless VPN and captive portals serve different access scenarios, and a site-to-site tunnel connects networks rather than individual laptops.

  2. Question 17

    Which GlobalProtect component provides the gateway configuration to the client, and authenticates the user before the tunnel is set up?

    1. AThe GlobalProtect gateway, which carries the encrypted tunnel traffic and never sees the user's credentials
    2. BThe Panorama log collector, which stores the client's session logs in a separate database for reporting
    3. CThe GlobalProtect portal, which provides the gateway configuration to the client and authenticates the user
    4. DThe Prisma Access connector, which joins the on-premises network to the cloud service for routing purposes
    Show answer and explanation
    Correct answer: C

    The GlobalProtect portal provides the gateway configuration and authenticates the user before the client connects to a gateway. The gateway carries the tunnel traffic, while the log collector and connector serve logging and cloud connectivity.

  3. Question 18

    What is the purpose of Host Information Profile (HIP) checks in GlobalProtect?

    1. ABalancing traffic between GlobalProtect gateways across several data centres for resilience
    2. BAssessing the endpoint's posture, such as patch level or disk encryption, before access is granted
    3. CCompressing the tunnel traffic so that remote users consume less bandwidth on their connections
    4. DAssigning IP addresses to remote users from the internal DHCP scope configured on the firewall
    Show answer and explanation
    Correct answer: B

    HIP checks assess endpoint posture, such as patch level, antivirus status or disk encryption, and policy can grant access only to compliant devices. Load balancing, compression and address assignment are separate functions.

  4. Question 19

    What are Panorama device groups used for?

    1. APushing shared policy objects and rules from one central place to a set of managed firewalls
    2. BGrouping user accounts that share the same password policy, so that the policy is set once for them
    3. CGrouping the traffic interfaces of a single firewall into one aggregate link for higher bandwidth
    4. DGrouping firewalls by licence type so that subscriptions can be renewed together with one purchase order
    Show answer and explanation
    Correct answer: A

    Device groups let Panorama push shared objects and rules to a set of managed firewalls from one place, keeping policy consistent. Licence grouping, password policy and interface aggregation are separate concerns.

  5. Question 20

    Which TWO are benefits of centralised management with Panorama? (Choose two.)

    1. AEach firewall must be configured by hand, one at a time, which gives the most local control in practice
    2. BConsistent policy and objects can be applied across many firewalls from one place, reducing drift
    3. CLogs from many firewalls can be collected and reported centrally, for analysis by one team
    4. DPanorama removes the need for any firewall to keep its own management interface and address
    5. EChanges are applied to all devices without any review or commit process, so rollout is immediate
    Show answer and explanation
    Correct answer: B, C

    Panorama applies consistent policy across many firewalls and collects their logs centrally, which reduces configuration drift and supports reporting. Manual per-device configuration, removal of management interfaces and changes without review or commit all work against centralised management.

Decryption (5 questions)

  1. Question 21

    Which decryption type lets the firewall inspect HTTPS traffic from internal users to external websites?

    1. ASSL Forward Proxy decryption, where the firewall presents a certificate for the destination to the client
    2. BSSL Inbound Inspection, which is used for traffic from the internet to a server that the company hosts itself
    3. CNo decryption, which relies on the URL alone and cannot be combined with threat prevention profiles at all
    4. DSSH Proxy, which inspects the encrypted shell sessions that internal users open to remote hosts directly
    Show answer and explanation
    Correct answer: A

    SSL Forward Proxy decryption applies to outbound HTTPS from internal clients: the firewall presents a certificate for the destination, so it can inspect the session. Inbound inspection applies to servers the company hosts, no decryption cannot inspect the content, and SSH proxy covers shell sessions rather than HTTPS.

  2. Question 22

    A web server behind the firewall receives inbound HTTPS requests from the internet. Which decryption type inspects that traffic?

    1. ASSL Inbound Inspection, which uses the server's own certificate and private key on the firewall
    2. BSSL Forward Proxy, which decrypts outbound sessions by re-signing server certificates for the clients
    3. CPacket capture on the server, which records the encrypted payload of the sessions without decrypting it
    4. DA decryption exclusion, which disables inspection for every inbound session that is sent to the server
    Show answer and explanation
    Correct answer: A

    SSL Inbound Inspection uses the server's certificate and private key on the firewall, which lets it decrypt inbound sessions to that server. Forward proxy re-signs certificates for outbound traffic, packet capture does not decrypt anything, and an exclusion turns inspection off.

  3. Question 23

    Which situation is a good reason to create a decryption exclusion?

    1. AA user who asks for faster internet access and wants to avoid all inspection of the traffic on their connection
    2. BA server whose encrypted sessions must be inspected for threats, but which the team wants left out of decryption
    3. CA banking site that uses certificate pinning, where decryption breaks the application for the users who access it
    4. DA website that the company wants inspected for data loss as part of its routine policy for outbound traffic
    Show answer and explanation
    Correct answer: C

    An exclusion is appropriate for applications such as banking sites that use certificate pinning, which fail when their traffic is decrypted. Excluding traffic for speed, excluding servers that must be inspected, or inspecting a site for data loss works against the security policy.

  4. Question 24

    Which item must be deployed so that decrypted outbound traffic does not show users untrusted certificate warnings in their browsers?

    1. AA firewall management certificate that lists the public address of each internal user in its subject field
    2. BA public certificate for every internal host, purchased in advance from a commercial certificate authority
    3. CA port mirror on the Layer 2 switch that sends a copy of each certificate to the users' browsers as it arrives
    4. DA forward trust certificate installed in the trust store of each client's browser or operating system
    Show answer and explanation
    Correct answer: D

    The firewall re-signs decrypted sessions with a forward trust certificate, and clients trust it only if the certificate is installed in their trust store. A management certificate, public host certificates or a switch mirror do not provide the trust the clients need for re-signed sessions.

  5. Question 25

    Users see certificate warnings for some decrypted sites after SSL forward proxy is enabled. Which cause is most likely?

    1. AThe NAT pool is exhausted, so the firewall cannot allocate any ports to the session it is decrypting
    2. BThe log forwarding profile is not configured for the decryption logs, so the warnings are not recorded
    3. CThe session timeout is set too high for long-lived connections, so the certificate cache keeps old entries
    4. DThe forward trust certificate is not trusted by the browsers, or the site uses a certificate that the app pins
    Show answer and explanation
    Correct answer: D

    Warnings appear when clients do not trust the forward trust certificate, or when an app pins the site's own certificate, so decryption cannot be presented as trusted. NAT exhaustion, session timeouts and log forwarding do not produce certificate warnings in the browser.

Prisma Access and troubleshooting (5 questions)

  1. Question 26

    Which Palo Alto Networks product delivers firewall and security services from the cloud to remote users and branch sites, as a SASE offering?

    1. APanorama, which manages on-premises firewalls but does not itself deliver services from the cloud
    2. BCortex XDR, which focuses on endpoint detection and response on the workstations of the organisation
    3. CPrisma Cloud, which focuses on the security of cloud workloads and the posture of cloud accounts
    4. DPrisma Access, which delivers firewall and security services from the cloud for remote users and sites
    Show answer and explanation
    Correct answer: D

    Prisma Access delivers SASE, with firewall and security services from the cloud for remote users and branches. Cortex XDR protects endpoints, Prisma Cloud secures cloud workloads and accounts, and Panorama manages firewalls on premises.

  2. Question 27

    A user reports that an application is blocked. Which tool shows the security rule that matched the session and the action it took?

    1. AThe traffic log, which records the name of the rule that matched each session and the action that was taken
    2. BThe configuration audit report, which lists every rule with its last modification date and nothing more
    3. CThe NTP status page, which shows the time synchronisation state of the firewall and its upstream servers
    4. DThe SNMP trap configuration, which lists the alerts that the managed devices send to the monitoring server
    Show answer and explanation
    Correct answer: A

    The traffic log records each session with the rule that matched and the action taken, which is the evidence needed to explain a block. A configuration audit, time synchronisation status and SNMP trap settings do not describe individual sessions.

  3. Question 28

    Which CLI command shows which security rule a described flow would match, without sending any traffic?

    1. Ashow interface all, which lists the link state and speed of each interface on the firewall
    2. Btest security-policy-match, which shows the rule that matches a flow described by its source, destination and application
    3. Cshow system info, which displays the model, serial number and software version of the firewall
    4. Ddebug dataplane packet-diag, which captures the packets of an active session for later analysis on a host
    Show answer and explanation
    Correct answer: B

    test security-policy-match reports which rule a described flow would hit, without generating traffic, which is what the question asks for. Interface, system information and packet capture commands show other things, such as link state, device details or the packets of live sessions.

  4. Question 29

    Which TWO are valid steps when troubleshooting a blocked or unexpected traffic flow? (Choose two.)

    1. ADisabling all security profiles and leaving them off permanently, so that the traffic is not blocked again
    2. BDeleting the security policy and recreating it from a backup, without first checking the logs at all
    3. CChecking the threat and traffic logs for the session, and the rule and profile that matched it
    4. DRebooting the firewall before any logs are collected, so that the logs start from a clean state
    5. EUsing the policy test or session lookup to confirm which rule and profile the flow would hit
    Show answer and explanation
    Correct answer: C, E

    Checking the logs for the matched rule and profile, and confirming the rule with a policy test or session lookup, identify the cause without changing protection. Permanently disabling profiles, deleting policy without checking the logs and rebooting before collecting logs all destroy evidence or weaken security.

  5. Question 30

    Which Prisma Access capability connects a branch office's network to the cloud service with an always-on tunnel?

    1. AA clientless VPN link that a branch user opens in a browser each morning to reach internal applications
    2. BA remote network connection, which builds an IPsec tunnel from the branch to the Prisma Access service
    3. CA captive portal on the branch's Wi-Fi network, which asks each visitor to sign in before connecting
    4. DA DHCP relay agent that gives the branch's devices their addresses from the cloud service directly
    Show answer and explanation
    Correct answer: B

    A remote network connection builds an always-on IPsec tunnel from the branch to Prisma Access, which is how branch networks join the service. Clientless links are for individual users, captive portals handle Wi-Fi visitors, and a DHCP relay does not connect the branch network to the cloud.