Palo Alto Networks PAN-NSG Online Practice Questions and Exam Preparation

Palo Alto Networks PAN-NSG Online Questions & Answers

• Question 1:

  Which zone is available for use in Prisma Access?

  A. DMZ
  B. Interzone
  C. Intrazone
  D. Clientless VPN
  D. Clientless VPN

  ---

  Explanation

  Prisma Access, a cloud-delivered security platform by Palo Alto Networks, supports specific predefined zones to streamline policy creation and enforcement. The se zones are integral to how traffic is managed and secured within the service.

  Available Zones in Prisma Access: Trust Zone:This zone encompasses all trusted and onboarded IP addresses, service connections, ormobile users within the corporate network. Traffic originating from these entities is considered trusted. Untrust Zone:This zone includes all untrusted IP addresses, service connections, or mobile users outside the corporate network. By default, any IP address or mobile user that is not designated as trusted falls into this category. Clientless VPN Zone:Designed to provide secure remote access to common enterprise web applications that utilize HTML, HTML5, and JavaScript technologies. This feature allows users to securely access applications from SSL-enabled web browsers without the need to install client software, which is particularly useful for enabling partner or contractor access to applications and for safely accommodating unmanaged assets, including personal devices. Notably, the Clientless VPN zone is mapped to the trust zone by default, and this setting cannot be changed.

  Analysis of Options:

  A. DMZ:A Demilitarized Zone (DMZ) is a physical or logical subnetwork that separates an internal local area network (LAN) from other untrusted networks, typically the internet. While traditional network architectures often employ a DMZ to add an extra layer of security, Prisma Access does not specifically define or utilize a DMZ zone within its predefined zone structure.

  B. Interzone:In the context of Prisma Access, "interzone" is not a predefined zone available for user configuration. However, it's worth noting that Prisma Access logs may display a zone labeled "inter-fw," which pertains to internal communication within the Prisma Access infrastructure and is not intended for user-defined policy application.

  C. Intrazone:Intrazone typically refers to traffic within the same zone. While security policies can be configured to allow or deny intrazone traffic, "Intrazone" itself is not a standalone zone available for configuration in Prisma Access.

  D.

  Clientless VPN:As detailed above, the Clientless VPN is a predefined zone in Prisma Access, designed to facilitate secure, clientless access to web applications.

  Conclusion:

  Among the options provided,D. Clientless VPNis the correct answer, as it is an available predefined zone in Prisma Access.

  References:

  Palo Alto Networks. "Prisma Access Zones." (https://docs.paloaltonetworks.com/prisma-access/administration/prisma-access-setup/prisma-access-zones)

• Question 2:

  What is the primary role of Advanced DNS Security in protecting against DNS-based threats?

  A. It replaces traditional DNS servers with more reliable and secure ones.
  B. It centralizes all DNS management and simplifies policy creation.
  C. It automatically redirects all DNS traffic through encrypted tunnels.
  D. It uses machine learning (ML) to detect and block malicious domains in real-time.
  D. It uses machine learning (ML) to detect and block malicious domains in real-time.

  ---

  Explanation

  Advanced DNS Securityin Palo Alto Networks providesreal-time protection against DNS-based threatsusingmachine learning (ML) and threat intelligence. Detects and Blocks Malicious Domains in Real-Time-Identifiesphishing, malware command-and-control (C2), and data exfiltration attemptsusingML models.

  Preventszero-day DNS attacksthat traditional static methods fail to detect.

  Analyzes DNS Traffic to Identify Malicious Patterns-Monitors DNS queriesfor suspicious behaviors, such asalgorithm-generated domain names (DGAs)used by botnets.

  Enhances Network Security Without Affecting Performance-DNS Security operates inlineto block threatsbefore malicious domains can be accessed.

  Workswithout disrupting legitimate DNS traffic.

  A. It replaces traditional DNS servers with more reliable and secure ones.# Incorrect, becauseAdvanced DNS Security does not replace DNS servers-itanalyzes DNS traffic for threats.

  B. It centralizes all DNS management and simplifies policy creation.# Incorrect, becauseAdvanced DNS Security is not a DNS management solution, but athreat prevention feature.

  C. It automatically redirects all DNS traffic through encrypted tunnels.# Incorrect, becauseit does not encrypt DNS traffic, butanalyzes it for malicious activity. Firewall Deployment - Protects againstDNS-based attacksvia inline inspection. Security Policies - Enforcesmalicious domain blocking. VPN Configurations - SecuresDNS queries even from remote users. Threat Prevention - Blocksmalicious DNS requests before they resolve. WildFire Integration - IdentifiesDNS-based malware C2 communication. Zero Trust Architectures - Preventsthreat actors from leveraging DNS tunneling for data exfiltration. Why Machine Learning-Based Detection is Critical?Why Other Options Are Incorrect?References to Firewall Deployment and Security Features:Thus, the correct answer is:#D. It uses machine learning (ML) to detect and block malicious domains in real-time.

• Question 3:

  A hospital system allows mobile medical imaging trailers to connect directly to the internal network of its various campuses. The network security team is concerned about this direct connection and wants to begin implementing a Zero Trust approach in the flat network.

  Which solution provides cost-effective network segmentation and security enforcement in this scenario?

  A. Deploy edge firewalls at each campus entry point to monitor and control various traffic types through direct connection with the trailers.
  B. Manually inspect large images like holograms and MRIs, but permit smaller images to pass freely through the campus core firewalls.
  C. Configure separate zones to isolate the imaging trailer's traffic and apply enforcement using the existing campus core firewalls.
  D. Configure access control lists on the campus core switches to control and inspect traffic based on image size, type, and frequency.
  C. Configure separate zones to isolate the imaging trailer's traffic and apply enforcement using the existing campus core firewalls.

  ---

  Explanation

  In aZero Trust Architecture (ZTA), network segmentation is critical toprevent unauthorized lateral movementwithin a flat network. Since the hospital system allowsmobile medical imaging trailersto connect directly to its internal network, this poses asignificant security risk, as these trailers may introducemalware, vulnerabilities, or unauthorized accessto sensitive medical data. The mostcost-effectiveandpracticalsolution in this scenario is: Creating separate security zonesfor the imaging trailers. Applying access control and inspection policiesvia the hospital'sexisting core firewallsinstead of deploying new hardware. Implementing strict policy enforcementto ensure that only authorized communication occurs between the trailers and the hospital's network. Network Segmentation for Zero Trust By placing the medical imaging trailers in theirown firewall-enforced zone, they areisolated from the main hospital network. Thisreduces attack surfaceand prevents an infected trailer from spreading malware to critical hospital systems. Granular security policies ensureonly necessary communicationsoccur between zones.

  Cost-Effective Approach

  Usesexisting core firewallsinstead of deploying costly additional edge firewalls at every campus.

  Reduces complexityby leveraging the current security infrastructure.

  Visibility & Security Enforcement

  The firewall enforces security policies, such asallowing only medical imaging protocolswhile blocking unauthorized traffic. Integration withThreat Prevention and WildFireensures that malicious files or traffic anomalies are detected.

  Logging and monitoring via Panoramahelps the security team track and respond to threats effectively. (A) Deploy edge firewalls at each campus entry point.

  This is an expensive approach, requiring multiple hardware firewalls at every hospital location. While effective, it isnot the most cost-efficientsolution when existingcore firewallscan enforce the necessary segmentation and policies. (B) Manually inspect large images like holograms and MRIs Thisdoes not align with Zero Trust principles.

  Manual inspection is impractical, as it slows down medical workflows.

  Threats do not depend on image size; malware can be embedded in small and large files alike.

  (D) Configure access control lists (ACLs) on core switches ACLs are limited in security enforcement, as they operate atLayer 3/4and do not providedeep inspection(e.g., malware scanning, user authentication, or Zero Trust enforcement).

  Firewalls offerapplication-layer visibility, which ACLs on switches cannot provide.

  Switches do not log and analyze threatslike firewalls do.

  Firewall Deployment - Firewall-enforced network segmentation is akey practice in Zero Trust.

  Security Policies-Granular policiesensure medical imaging traffic is controlled and monitored.

  VPN Configurations-If remote trailers are involved, secure VPN access can be enforced within the zones.

  Threat Prevention & WildFire - Firewalls can scan imaging files (e.g., DICOM images) for malware.

  Panorama - Centralized visibility into all traffic between hospital zones and trailers.

  Zero Trust Architectures-This solutionfollows Zero Trust principlesby segmenting untrusted devices and enforcing least privilege access.

  Why Separate Zones with Enforcement is the Best Solution?

  Other Answer Choices AnalysisReferences and Justification:Thus,Configuring separate zones (C) is the correct answer, as it providescost-effective segmentation, Zero Trust enforcement, and security visibilityusing existing firewall infrastructure.

• Question 4:

  Which NGFW function can be used to enhance visibility, protect, block, and log the use of Post-quantum Cryptography (PQC)?

  A. DNS Security profile
  B. Decryption policy
  C. Security policy
  D. Decryption profile
  B. Decryption policy

  ---

  Explanation

  ADecryption policyenables the NGFW to enhance visibility into encrypted traffic, including traffic that may use post-quantum cryptography (PQC). By decrypting SSL/TLS traffic, the firewall can analyze, block, and log the use of PQC and other advanced cryptographic methods. Decryption policies ensure that all encrypted communications are inspected for malicious content, preventing attackers from hiding threats within encrypted traffic. This process allows administrators to enforce security and compliance while also gaining better insights into network activities involving PQC.

  References:

  Palo Alto Networks Decryption Policy Overview SSL Decryption Best Practices

• Question 5:

  Which action must a firewall administrator take to incorporate custom vulnerability signatures into current Security policies?

  A. Create custom objects.
  B. Download WildFire updates.
  C. Download threat updates.
  D. Create custom policies.
  A. Create custom objects.

  ---

  Explanation

  To incorporate custom vulnerability signatures into current Security policies, administrators must create custom objects. The se objects define the specific signature patterns for vulnerabilities, and they can then be applied to security profiles or policies.

  Custom Objects: Allow administrators to define and configure unique vulnerability signatures tailored to the organization's specific needs. Integration into Security Policies: Once created, these custom objects can be referenced in Security policies to detect and mitigate the specified vulnerabilities effectively. This approach ensures that custom threats not covered by default threat signatures are adequately addressed, enhancing the firewall's threat prevention capabilities.

  References:

  Custom Vulnerability Signatures in Palo Alto Networks Threat Prevention Customization

• Question 6:

  Which two configurations are required when creating deployment profiles to migrate a perpetual VM-Series firewall to a flexible VM? (Choose two.)

  A. Choose "Fixed vCPU Models" for configuration type.
  B. Allocate the same number of vCPUs as the perpetual VM.
  C. Deploy virtual Panorama for management.
  D. Allow only the same security services as the perpetual VM.
  A. Choose "Fixed vCPU Models" for configuration type.
  C. Deploy virtual Panorama for management.

  ---

  Explanation

  Migrating a perpetual VM-Series firewall license to a flexible VM-Series license involves specific configurations to ensure a seamless transition. The process requires careful planning and execution to align with Palo Alto Networks' licensing models and deployment strategies.

  A. Choose "Fixed vCPU Models" for configuration type.When creating a deployment profile for the migration, selecting the appropriate configuration type is crucial. Palo Alto Networks offers two configuration types: Fixed vCPU Models and Flexible vCPU Models. Fixed vCPU Models: This configuration aligns with traditional VM-Series models (e.g., VM-300, VM-500) and is suitable for environments where the firewall's resource allocation remains consistent. Choosing this option ensures that the migrated firewall retains a familiar resource profile, simplifying the transition from a perpetual license. Flexible vCPU Models: This configuration allows for dynamic allocation of vCPUs, providing scalability based on varying workload demands. While offering flexibility, it requires careful planning to match resource allocation with licensing entitlements. For a straightforward migration that maintains existing resource allocations, selecting "Fixed vCPU Models" is recommended. This choice ensures compatibility with the perpetual VM's configuration and simplifies the licensing transition.

  C. Deploy virtual Panorama for management.Effective management of VM-Series firewalls, especially during a migration, necessitates acentralized management platform. Panorama, Palo Alto Networks' centralized management solution, provides comprehensive tools for configuration, monitoring, and licensing management. Centralized Management: Panorama offers a single interface to manage multiple firewalls, streamlining policy updates and configuration changes. Licensing Management: During the migration to a flexible VM-Series license, Panorama facilitates the application of new licenses and ensures compliance across all managed devices. Visibility and Reporting: With Panorama, administrators gain enhanced visibility into traffic patterns and security events, which is crucial during transitional periods. Deploying a virtual Panorama instance ensures that the migration process is managed efficiently, reducing the risk of configuration errors and ensuring that all firewalls operate under the correct licensing model. Incorrect Options:

  B. Allocate the same number of vCPUs as the perpetual VM. While maintaining the same number of vCPUs might seem logical, the flexible licensing model allows for dynamic allocation based on current needs. Strictly matching the perpetual VM's vCPU count may not leverage the benefits of the flexible model.

  D. Allow only the same security services as the perpetual VM. The flexible licensing model provides an opportunity to reassess and potentially enhance the security services in use. Restricting to the same services may limit the advantages offered by the new licensing structure.

  References:

  Palo Alto Networks Documentation on Migrating to a Flexible VM-Series License: docs.paloaltonetworks.com Palo Alto Networks Knowledge Base Article on License Migration: knowledgebase.paloaltonetworks.com Palo Alto Networks Professional Services Flex Licensing Migration Lab: github.com By selecting the appropriate configuration type and utilizing Panorama for centralized management, organizations can ensure a smooth and efficient migration from a perpetual VM-Series firewall license to a flexible VM-Series license.

• Question 7:

  An organization wants to host multiple business units on a single firewall while keeping each unit's policies, objects, and logs logically separate.

  Which capability provides this design?

  A. DHCP relay
  B. Virtual systems
  C. SSL Inbound Inspection
  D. WildFire forwarding
  B. Virtual systems

  ---

  Explanation

  Virtual systems provide logical multitenancy on a single physical firewall by allowing separate business units or tenants to maintain independent configurations, policies, and logging. This approach supports isolation while still using shared hardware resources, making it well suited to environments that need separation without separate appliances. It is the standard design choice for logical segmentation of management and inspection contexts on the same device.

  Option A is incorrect because DHCP relay is used to forward DHCP messages and does not create tenant separation.

  Option C is incorrect because SSL Inbound Inspection is a decryption function, not a multitenancy mechanism.

  Option D is incorrect because WildFire forwarding is related to threat analysis and does not separate tenants or policy domains.

• Question 8:

  A security engineer wants to ensure that inline deep-learning protections from Advanced Threat Prevention can effectively analyze encrypted outbound web traffic.

  Which two steps are required? (Choose two.)

  A. Enable SSL Forward Proxy for outbound traffic
  B. Configure SSL Inbound Inspection for the organization's public web servers
  C. Attach Advanced Threat Prevention profiles to Security policies that match decrypted traffic
  D. Disable URL Filtering to prevent overlapping categorization with threat prevention
  A. Enable SSL Forward Proxy for outbound traffic
  C. Attach Advanced Threat Prevention profiles to Security policies that match decrypted traffic

  ---

  Explanation

  Inline deep-learning protectionsrequire visibility into theplaintext payload.

  SSL Forward Proxy (A)

  Decryptsoutbound SSL/TLS trafficso that inline models can inspect HTTP and HTTP/2 content.

  Re-encrypts traffic toward the internet after inspection.

  Advanced Threat Prevention profiles on relevant policies (C)

  The profiles must be attached to Security policiesthat match the decrypted sessions.

  This enables inline cloud analysis, ML-based detection, and signature-based preventionon web traffic.

  B. SSL Inbound Inspection Targets trafficcoming intointernal servers, not general outbound browsing traffic.

  D. Disable URL Filtering URL Filtering complements Advanced Threat Prevention with category and reputation-based controls; disabling it reduces protection. Firewall Deployment - Decryption and Advanced Threat Prevention work together for full inspection. Threat Prevention - Inline ML and deep-learning engines detectunknown and evasive threats. Zero Trust Architectures - Assumes encrypted traffic can carry threats and must be inspected.

• Question 9:

  When using the perfect forward secrecy (PFS) key exchange, how does a firewall behave when SSL Inbound Inspection is enabled?

  A. It acts as meddler-in-the-middle between the client and the internal server.
  B. It acts transparently between the client and the internal server.
  C. It decrypts inboundand outbound SSH connections.
  D. It decrypts traffic between the client and the external server.
  A. It acts as meddler-in-the-middle between the client and the internal server.

  ---

  Explanation

  Perfect Forward Secrecy (PFS)is a cryptographic feature inSSL/TLS key exchangethat ensures each session uses a unique key that isnot derived from previous sessions. This prevents attackers from decrypting historical encrypted traffic even if they obtain the server's private key.

  WhenSSL Inbound Inspectionis enabled on a Palo Alto NetworksNext-Generation Firewall (NGFW), the firewalldecrypts inbound encrypted trafficdestined for an internal server to inspect it for threats, malware, or policy violations. Meddler-in-the-Middle (MITM) Role - Since PFSprevents session key reuse, the firewallcannot use static keysfor decryption. Instead, it must act as aman-in-the-middle (MITM)between theclient and the internal server.

  Decryption Process-The firewallterminates the SSL session from the external client.

  It thenestablishes a new encrypted sessionbetween itself and the internal server.

  This allows the firewall todecrypt, inspect, and then re-encrypt trafficbefore forwarding it to the server.

  Security Implications-

  This approach ensuresthreat detection and policy enforcementbefore encrypted traffic reaches critical internal servers.

  However, itbreaks end-to-end encryptionsince the firewall acts as an intermediary.

  B. It acts transparently between the client and the internal server.# Incorrect, because SSL Inbound Inspection requires the firewall toactively terminate and re-establish SSL connections, making it anon-transparent MITM.

  C. It decrypts inbound and outbound SSH connections.# Incorrect, becauseSSL Inbound Inspection applies only to SSL/TLS traffic, not SSH connections. SSH decryption requires a different feature (e.g., SSH Proxy).

  D. It decrypts traffic between the client and the external server.# Incorrect, becauseSSL Inbound Inspectionis designed to inspecttraffic destined for an internal server, not external connections.SSL Forward Proxywould be used for outbound traffic decryption. Firewall Deployment - SSL Inbound Inspection is used inenterprise environmentsto monitor encrypted traffic heading to internal servers. Security Policies - Decryption policies control which inbound SSL sessions are decrypted. VPN Configurations-PFS is commonly used inIPsec VPNs, ensuring that keys change per session. Threat Prevention - Enables deep inspection ofSSL/TLS trafficto detect malware, exploits, and data leaks. WildFire Integration - Extracts potentially malicious files from encrypted traffic foradvanced sandboxing and malware detection. Panorama - Providescentralized management of SSL decryption logs and security policies. Zero Trust Architectures - Ensures encrypted traffic iscontinuously inspected, aligning withZero Trust security principles. Firewall Behavior with PFS and SSL Inbound InspectionWhy Other Options Are Incorrect?References to Firewall Deployment and Security Features:Thus, the correct answer is:#A. It acts as meddler-in-the-middle between the client and the internal server.

• Question 10:

  An administrator wants Advanced Threat Prevention to inspect encrypted outbound web traffic so inline deep-learning analysis can evaluate the session content.

  Which two steps are required? (Choose two.)

  A. Enable SSL Forward Proxy for the outbound traffic
  B. Configure SSL Inbound Inspection for internal web servers
  C. Attach Advanced Threat Prevention profiles to Security policies matching the decrypted traffic
  D. Disable URL Filtering so the threat engine can work independently
  A. Enable SSL Forward Proxy for the outbound traffic
  C. Attach Advanced Threat Prevention profiles to Security policies matching the decrypted traffic

  ---

  Explanation

  SSL Forward Proxy is required to decrypt outbound encrypted traffic so the firewall can inspect the session content before re-encrypting it. After decryption is available, the relevant Security policy must have the Advanced Threat Prevention profile attached so the traffic can be inspected by the inline threat-prevention engines. Both steps are necessary for encrypted outbound web traffic to be analyzed effectively.

  Option B is incorrect because SSL Inbound Inspection is used for traffic destined to internal servers, not general outbound browsing sessions.

  Option D is incorrect because URL Filtering complements threat inspection and does not need to be disabled for Advanced Threat Prevention to function.