NetSec-Analyst by Palo Alto Networks Actual Free Exam Questions And Answers

Question 1

There are intermittent connectivity issues between two internal zones on a PA-Series firewall.
Although the Security policies appear correctly configured, traffic between the zones is experiencing unexpected drops. Which troubleshooting step will isolate the root cause of this behavior?

A. Use the CLI command show system info to monitor CPU and memory usage, ensuring that resource constraints are not causing interfaces to drop packets between zones.

B. Use the CLI command show system state filter sys.s1.* | match Error to find interface errors across all the interfaces.

C. Use the PAN-OS GUI Troubleshooting tool to review interface status, verify zone assignments, and confirm that all links are operational.

D. Use the CLI command tcpdump filter and set the source and destination zones in the filter to capture and analyze traffic flows between zones, checking for packet loss on the data plane.

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 2

An analyst is configuring a "WildFire Analysis Profile." Which file types can be sent to the WildFire cloud for sandbox analysis?

A. Only Microsoft Office documents.

B. Only .exe and .msi files.

C. Only encrypted files that cannot be decrypted locally.

D. All file types supported by the Content-ID engine, including PDFs and APKs.

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 3

An analyst is configuring a security policy to allow an application that uses a dynamic range of ports. Instead of opening a wide range of ports, which Palo Alto Networks feature should be leveraged to identify the application based on its unique payload?

A. Custom URL Categories

B. App-ID

C. Dynamic Address Groups

D. Service Objects

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 4

Which two actions can be taken by a Data Filtering profile when sensitive data is detected?
(Choose two.)

A. Encrypt

B. Block

C. Alert

D. Captive Portal

Discussion 0

Correct Answer: B,C Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 5

A user reports that they are being blocked from a website with a "Certificate Error." Which log will help the analyst determine if the firewall is blocking the session because the web server is using an expired certificate?

A. Decryption Log

B. Threat Log

C. Traffic Log

D. System Log

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 6

A malware incident involving compromised internal hosts communicating with a command-and- control (C2) server has been resolved. In response, the C2 IP address is blocked. Which two actions using the Log Viewer will ensure the incident has been fully mitigated? (Choose two.)

A. Review the authentication alerts on the affected devices.

B. Review the audit alerts and check for integrity protection alerts on the affected devices.

C. Continue to monitor for traffic going to the C2 server's IP address.

D. Build and save a custom filter based on the affected endpoints and continue to monitor for suspicious traffic from the endpoints.

Discussion 0

Correct Answer: C,D Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 7

A company requires that all file transfers only over HTTP (tcp/80 and tcp/8080) to SaaS storage must be inspected for data exfiltration. Traffic to encrypted HTTPS SaaS storage cannot be inspected based on the company decryption restrictions. When using a security profile group, which Security policy configuration meets this requirement?

A. One with data filtering and the service set to tcp/80 and tcp/8080, then verify block threshold is set to "1" to stop exfiltration.

B. One with data filtering to inspect all HTTP traffic on the web-browsing application using application-default for the service.

C. One with data filtering and an application filter that matches "file-sharing" applications, then set the service to tcp/80 and tcp/8080.

D. One with URL filtering and file blocking to block all file uploads to the URL category online- storage-and-backup, then set the service to tcp/80 and tcp/8080.

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 8

A security administrator is building out Decryption policies and wants to decrypt according to Palo Alto Networks best practices. Which URL categories should the administrator add to the policies?

A. AI website generator, Command and Control, compromised website, encrypted DNS, and dynamic DNS.

B. Online storage and backup web-based email web hosting, personal sites and blogs, content delivery networks, and high-risk URL.

C. Proxy avoidance and anonymizers, ransomware unknown, web-based email, web advertisements, and not resolved.

D. Newly registered domains, internet communications and telephony, high-risk URL, insufficient content, hacking, and grayware.

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 9

In Panorama, which feature allows an analyst to group multiple Template Stacks together to push a common set of network configurations to a large number of firewalls simultaneously?

A. Template Groups

B. Managed Collectors

C. Variables

D. Device Groups

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Palo Alto Networks Network Security Analyst - NetSec-Analyst Exam Practice Test

Contact Us

Useful Links

Latest Updated