Palo Alto Networks PAN-NSG Online Practice Questions and Exam Preparation

Palo Alto Networks PAN-NSG Online Questions & Answers

• Question 91:

  Which two pieces of information are needed prior to deploying server certificates from a trusted third-party certificate authority (CA) to GlobalProtect components? (Choose two.)

  A. Encrypted private key and certificate (PKCS12)
  B. Subject Alternative Name (SAN)
  C. Certificate and key files
  D. Passphrase for private key
  A. Encrypted private key and certificate (PKCS12)
  B. Subject Alternative Name (SAN)

  ---

  Explanation

  Before deployingserver certificatesfrom atrusted third-party Certificate Authority (CA)forGlobalProtect components, two critical pieces of information are required: Encrypted Private Key and Certificate (PKCS12) (##Correct)

  The PKCS12 (.p12 or .pfx) filecontains theprivate key and certificatein an encrypted format.

  This ensuressecure installation of the certificateon GlobalProtect portals and gateways.

  Subject Alternative Name (SAN) (##Correct)

  The SAN field in the certificateensures that it supportsmultiple domain names and IP addresses.

  Necessary forGlobalProtect clients to trust the server certificatewhen connecting to different GlobalProtect portals or gateways.

  C. Certificate and Key Files# While important, certificate and key files aloneare not always sufficient for installation. UsingPKCS12 format (A) is the best practicesince itencrypts both the private key and certificatetogether.

  D. Passphrase for Private Key# Not always requiredunlessthe private key is encrypted with a passphrase. PKCS12 formatalreadyincludes encryption and can be protected with a passphraseif needed. Firewall Deployment - SSL/TLS certificates secureGlobalProtect VPN portals and gateways. Security Policies - Ensuressecure certificate-based authenticationfor VPN users. VPN Configurations - Required forIPsec/SSL VPN authentication and encryption. Threat Prevention - Protects againstman-in-the-middle (MITM) attacksusingvalid certificates. WildFire Integration - Ensurescertificate-based security is not bypassed by malware-infected connections. Panorama - Centralized management ofcertificate deployments across multiple firewalls. Zero Trust Architectures - Enforcesidentity-based authentication using trusted certificates. Why Other Options Are Incorrect?References to Firewall Deployment and Security Features:Thus, the correct answers are:#A. Encrypted private key and certificate (PKCS12)#B. Subject Alternative Name (SAN)

• Question 92:

  Which network design for internet of things (loT) Security allows traffic mirroring from the switch to a TAP interface on the firewall to monitor traffic not otherwise seen?

  A. DHCP server on firewall
  B. Firewall as DHCP relay
  C. Firewall in DHCP path
  D. Firewall outside DHCP path
  D. Firewall outside DHCP path

  ---

  Explanation

  To monitor traffic for Internet of Things (IoT) devices that may not otherwise be visible, the network design should place the firewalloutside the DHCP pathand use traffic mirroring from the switch to a TAP (Test Access Point) interface on the firewall.

  Traffic Mirroring: Switches mirror the traffic to the firewall's TAP interface, enabling the firewall to inspect the traffic without directly interfering with the device communication.

  IoT Monitoring: Many IoT devices use lightweight communication protocols or non-standard methods, making direct interception difficult. Traffic mirroring allows passive monitoring for behavioral analysis, anomaly detection, and threat prevention.

  Firewall Placement: Keeping the firewall outside the DHCP path ensures that monitoring does not disrupt IoT device communications while still providing visibility into their network activity.

  References:

  Palo Alto Networks IoT Security Best Practices Traffic Mirroring and TAP Interfaces

• Question 93:

  A network engineer needs to configure a Prisma SD-WAN environment to optimize and secure traffic flow between branch offices and the data center.

  Which action should the engineer prioritize to achieve the most operationally efficient communication?

  A. Ensure all branch office traffic is routed through acentral hub for inspection.
  B. Create NAT policies to translate internal branch IP addresses to public IP addresses.
  C. Define security zones for branch offices and the data center.
  D. Configure dynamic path selection based on network performance metrics.
  D. Configure dynamic path selection based on network performance metrics.

  ---

  Explanation

  In aPrisma SD-WAN environment, themost operationally efficient waytooptimize and secure trafficbetween branch offices and the data center is toconfigure dynamic path selection. Monitors Real-Time Network Performance - Prisma SD-WAN continuously measureslatency, jitter, and packet lossacross multiple WAN links. Automatically Chooses the Best Path - It dynamically routes traffic throughthe best-performing linktomaintain high application performance.

  Improves Reliability and Redundancy - If a link degrades,failover occurs seamlesslyto another available path.

  Enhances Security - Works inconjunction with security policiesto route sensitive traffic throughtrusted paths.

  A. Ensure all branch office traffic is routed through a central hub for inspection.# Incorrect, because ahub-and-spoke model introduces unnecessary latencyand reducesnetwork efficiency. Prisma SD-WAN is designed to enabledirect and secure branch-to-branch communicationwithout forcing all traffic through acentralized data center.

  B. Create NAT policies to translate internal branch IP addresses to public IP addresses.# Incorrect, becauseNAT policies do not optimize network performance-they are used foraddress translation. Prisma SD-WAN dynamically selects pathsbased on performance metrics, not just address translation.

  C. Define security zones for branch offices and the data center.# Incorrect, becausesecurity zones provide segmentation and control, but they do notdirectly optimize network performance. Whilesecurity zoning is essential, it does not solve the problem ofchoosing the best network path dynamically. Firewall Deployment - Prisma SD-WANintegrates with NGFWsfor secure traffic routing. Security Policies - Ensures traffic is optimizedwhile maintaining security compliance. VPN Configurations-Works withIPsec VPN tunnelsto choosethe best available path dynamically. Threat Prevention-Prevents attacks bydynamically routing traffic away from compromised paths. WildFire Integration - Monitors suspicious trafficbefore dynamically selecting paths. Zero Trust Architectures - Enforcessecure network segmentationwhileoptimizing branch-to-data center communication. How Dynamic Path Selection Optimizes Traffic:Why Other Options Are Incorrect?References to Firewall Deployment and Security Features:Thus, the correct answer is:#D. Configure dynamic path selection based on network performance metrics.

• Question 94:

  A network administrator is using DNAT to map two servers to one public IP address. Traffic will be directed to a specific server based on the application, where Host A (10.1.1.100) receives HTTP traffic and Host B (10.1.1.101) receives SSH traffic.

  

  Which two sets of Security policy rules will accomplish this configuration? (Choose two.)

  A. Source: Untrust (Any) Destination: Untrust Application(s): web-browsing Action: allow
  B. Source: Untrust (Any) Destination: Trust Application(s): web-browsing, ssh Action: allow
  C. Source: Untrust (Any) Destination: DMZ Application(s): web-browsing Action: allow
  D. Source: Untrust (Any) Destination: DMZ Application(s): ssh Action: allow
  C. Source: Untrust (Any) Destination: DMZ Application(s): web-browsing Action: allow
  D. Source: Untrust (Any) Destination: DMZ Application(s): ssh Action: allow

  ---

  Explanation

  In this DNAT setup, HTTP and SSH traffic are directed to specific servers in the DMZ. The configuration ensures precise policy rules align with the DNAT mapping.

  Rule C: Allows HTTP (web-browsing application) traffic from the Untrust zone to the DMZ. The NAT configuration maps this to Host A (10.1.1.100).

  Rule D: Allows SSH traffic from the Untrust zone to the DMZ. The NAT configuration maps this to Host B (10.1.1.101).

  This design segments and secures traffic while ensuring the correct mapping of applications to the servers. Both rules work in conjunction with the destination NAT policy to ensure seamless traffic flow and application-specific routing.

  References:

  Palo Alto Networks DNAT Configuration Security Policies Best Practices

• Question 95:

  A security team wants to reduce the number of events sent to Strata Logging Service without losing visibility into important security incidents.

  Which two actions should be taken? (Choose two.)

  A. Suppress repeated identical threat events occurring in a short time window
  B. Disable logging on all allow rules between internal zones
  C. Forward only higher-severity security events based on filtering criteria
  D. Turn off URL-related logs entirely for user web sessions
  A. Suppress repeated identical threat events occurring in a short time window
  C. Forward only higher-severity security events based on filtering criteria

  ---

  Explanation

  Suppressing repeated identical events reduces noise from recurring activity while still preserving meaningful visibility into the issue. Forwarding only higher-severity events with filters is also an effective way to prioritize valuable logs and reduce unnecessary volume in the centralized logging platform. Together, these actions tune logging without removing critical investigation data.

  Option B is incorrect because disabling logging on internal allow traffic can hide lateral movement or other important activity.

  Option D is incorrect because removing URL-related visibility entirely can eliminate useful context for investigations and policy monitoring.

• Question 96:

  Which type of security policy rule will match traffic that flows between the Outside zone and inside zone, but would not match traffic that flows within the zones?

  A. global
  B. intrazone
  C. interzone
  D. universal
  C. interzone

  ---

  Explanation

  References:

  https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/software-and-content-updates/dynamic-contentupdates.html#:~:text=WildFire%20signature%20updates%20are%20made,within%20a%20minute%20of%

• Question 97:

  Which Security profile should be queried when investigating logs for upload attempts that were recently blocked due to sensitive information leaks?

  A. Anti-spyware
  B. Data Filtering
  C. Antivirus
  D. URL Filtering
  B. Data Filtering

  ---

  Explanation

  When investigatinglogs for upload attempts that were recently blocked due to sensitive information leaks, the appropriateSecurity Profileto query isData Filtering. Why Data Filtering?Data Filtering is acontent inspection security profilewithin Palo Alto NetworksNext-Generation Firewalls (NGFWs)that detects and prevents the unauthorized transmission ofsensitive or confidential data. This security profile is designed to inspectfiles, text, and patternsin network traffic and block uploads that matchpredefined data patternssuch as: Personally Identifiable Information (PII) - e.g., Social Security Numbers, Credit Card Numbers, Passport Numbers Financial Data - e.g., Bank Account Numbers, SWIFT Codes Health Information (HIPAA Compliance) - e.g., Patient Medical Records Custom Data Patterns - Organizations can define proprietary data patterns for detection Firewall Policy Application - The Data Filtering profile is attached to Security Policies that inspect file transfers (HTTP, FTP, SMB, SMTP, etc.).

  Traffic Inspection - The firewall scans the payload forsensitive data patternsbefore allowing or blocking the transfer.

  Alert and Block Actions - If sensitive data is detected in an upload, the firewall canalert,block, orquarantinethe file transfer.

  Log Investigation - Security Administrators can analyze Threat Logs (Monitor > Logs > Data Filtering

  Logs to review:

  File Name

  Destination IP

  Source User

  Matched Data Pattern

  Action Taken (Allowed/Blocked)

  Firewall Deployment - Data Filtering is enforced at the firewall level to preventsensitive data exfiltration.

  Security Policies - Configured to enforce Data Filtering rules based onbusiness-critical data classifications.

  VPN Configurations - Ensures encrypted VPN traffic is also subject to data inspection to prevent insider data leaks.

  Threat Prevention - Helps mitigate the risk ofdata theft, insider threats, and accidental exposureof sensitive information.

  WildFire Integration - Data Filtering can work alongsideWildFireto inspect files foradvanced threats and malware.

  Panorama - Providescentralized visibility and managementof Data Filtering logs across multiple firewalls.

  Zero Trust Architectures - Aligns withZero Trustprinciples by enforcing strictcontent inspection and access control policiesto prevent unauthorized data transfers. How Data Filtering Works in Firewall Logs?References to Firewall Deployment and Security Features:Thus, the correct answer isB. Data Filtering, as it directly pertains topreventing and investigating data leaksinupload attemptsblocked by the firewall.

• Question 98:

  An administrator would like to apply a more restrictive Security profile to traffic for file sharing applications. The administrator does not want to update the Security policy or object when new applications are released.

  Which object should the administrator use as a match condition in the Security policy?

  A. the Content Delivery Networks URL category
  B. the Online Storage and Backup URL category
  C. an application group containing all of the file-sharing App-IDs reported in the traffic logs
  D. an application filter for applications whose subcategory is file-sharing
  D. an application filter for applications whose subcategory is file-sharing