Palo Alto Networks PAN-NSG Online Practice Questions and Exam Preparation

Palo Alto Networks PAN-NSG Online Questions & Answers

• Question 21:

  What will collect device information when a user has authenticated and connected to a GlobalProtect gateway?

  A. RADIUS Authentication
  B. IP address
  C. Host informationprofile (HIP)
  D. Session ID
  C. Host informationprofile (HIP)

  ---

  Explanation

  When a user authenticates and connects to aGlobalProtect gateway, the firewall can collect and evaluate device information usingHost Information Profile (HIP). This feature helps enforce security policies based on the device's posture before granting or restricting network access.

  What is HIP?

  Host Information Profile (HIP)is a feature in GlobalProtect that gathers security-related information from the endpoint device, such as: OS version Patch level Antivirus status Disk encryption status Host-based firewall status Running applications

  How Does HIP Work?

  When a user connects to aGlobalProtect gateway, their device submits itsHIP reportto the firewall.

  The firewallevaluatesthis information againstconfigured security policies.

  If the devicemeets security compliance, access is granted; otherwise,remediation actions(e.g., blocking access) can be applied.

  (A) RADIUS Authentication - While RADIUS is used for user authentication, it doesnot collect device security posture. (B) IP Address - The user's IP address is tracked but does not providedevice security information. (D) Session ID - A session ID identifies the user session but does not collect host-based security details.

  Firewall Deployment - HIP profiles help enforce security policies based on device posture.

  Security Policies - Administrators use HIP checks to restrict non-compliant devices.

  Threat Prevention & WildFire - HIP ensures that endpoints are properly patched and protected.

  Panorama - HIP reports can be monitored centrally via Panorama.

  Zero Trust Architectures - HIP enforcesdevice trustin Zero Trust models.

  Why is HIP the Correct Answer?Other Answer Choices AnalysisReferences and Justification:Thus,Host Information Profile (HIP) is the correct answer, as it collects device security information when a user connects to a GlobalProtect gateway.

• Question 22:

  When a user works primarily from a remote location but reports to the corporate office several times a month, what does GlobalProtect use to determine if the user should connect to an internal gateway?

  A. ICMP ping toPanorama management interface
  B. User login credentials
  C. External host detection
  D. Reverse DNS lookup of preconfigured host IP
  C. External host detection

  ---

  Explanation

  GlobalProtectis Palo Alto Networks'VPN and Zero Trust remote access solution. It dynamically determines whether a user shouldconnect to an internal or external gatewaybased onexternal host detection. Preconfigured External Host Detection-The Global Protect agentchecks for a predefinedtrusted external IP address(e.g., the corporate office's public IP). Decision Making-If the detected IPmatches the trusted external host, the GlobalProtect client assumes the user isinside the corporate networkand doesnot establish a VPN connection.

  If the detected IPdoes not match, GlobalProtectinitiates a VPN connectionto an external gateway.

  Improves Performance & Security-Preventsunnecessary VPN connectionswhen users are inside the corporate office.

  Reducesbandwidth overheadby ensuring only external users connect via VPN.

  A. ICMP ping to Panorama management interface.# Incorrect, becauseGlobalProtect does not use ICMP pingsto determine location. Panorama does not play a rolein dynamic gateway selection for GlobalProtect.

  B. User login credentials.# Incorrect, becausecredentials are used for authentication, not for detecting location. Users authenticateregardless of whether they are inside or outside the network.

  D. Reverse DNS lookup of preconfigured host IP.# Incorrect, becauseReverse DNS lookups are not usedfor gateway selection. DNS lookups can beinconsistentand are not areliablemethod for internal/external detection. Firewall Deployment - GlobalProtect works withNGFWsto provide secure remote access. Security Policies - Can enforce different security postures based oninternal vs. external user location. VPN Configurations - Usesdynamic gateway selectionto optimize VPN performance. Threat Prevention - Protects remote users fromphishing, malware, and network-based threats. WildFire Integration - Inspectsfiles uploaded/downloaded via VPNfor threats. Zero Trust Architectures - EnforcesZero Trust Network Access (ZTNA)by verifying user identity and device security before granting access. How External Host Detection Works:Why Other Options Are Incorrect?References to Firewall Deployment and Security Features:Thus, the correct answer is:#C. External host detection.

• Question 23:

  Based on the image below, which source IP address will be seen in the data filtering logs of the Cloud NGFW for AWS with the default rulestack settings?

  

  A. 10.1.1.3
  B. 20.10.10.16
  C. 20.10.10.15
  D. 10.1.1.2
  C. 20.10.10.15

  ---

  Explanation

  Based on the image and default rulestack settings of theCloud NGFW for AWS, the source IP address seen in the data filtering logs will be20.10.10.15, which is the IP address of the load balancer.

  Default Rulestack Behavior: By default, the rulestack settings do not inspect or preserve the original client IP (e.g., 10.1.1.2) in the "X-Forwarded-For" header. Instead, the load balancer's IP (20.10.10.15) is recorded as the source IP. Logging Mechanism: Unless explicitly configured to

  parse the "X-Forwarded-For" header, the firewall's logs will reflect the IP address of the device directly sending the traffic to the NGFW (the load balancer in this case).

  References:

  Cloud NGFW for AWS Documentation Data Filtering Logs and Source IP Behavior

• Question 24:

  An administrator wants to prevent users from submitting corporate credentials in a phishing attack.

  Which Security profile should be applied?

  A. antivirus
  B. anti-spyware
  C. URL filtering
  D. vulnerability protection
  C. URL filtering

• Question 25:

  A healthcare organization wants to stop users from uploading protected health information to unsanctioned cloud storage services while still allowing normal browsing to approved sites.

  Which two Security profiles should be applied to the relevant Security policy? (Choose two.)

  A. Data Filtering
  B. Antivirus
  C. URL Filtering
  D. DoS Protection
  A. Data Filtering
  C. URL Filtering

  ---

  Explanation

  Data Filtering is used to inspect traffic for sensitive content patterns and can detect protected healthcare-related data during uploads. URL Filtering complements this by controlling access to categories associated with unsanctioned cloud storage or personal file-sharing destinations. Together, these profiles address both the content being sent and the type of destination receiving it.

  Option B is incorrect because Antivirus is designed to detect malicious files or malware, not structured sensitive-data patterns.

  Option D is incorrect because DoS Protection mitigates flood and availability attacks rather than preventing data exfiltration to cloud storage.

• Question 26:

  Which two security profiles must be updated to prevent data exfiltration in outbound traffic on NGFWs? (Choose two.)

  A. Data Filtering
  B. DoS Protection
  C. File Blocking
  D. Antivirus
  A. Data Filtering
  C. File Blocking

  ---

  Explanation

  To preventdata exfiltration in outbound traffic,Next-Generation Firewalls (NGFWs)must have the followingsecurity profiles configured and updated: Data Filtering (##Correct)

  Detects and preventssensitive data leaksin outbound traffic.

  Monitors forPersonally Identifiable Information (PII), financial data, and intellectual property.

  Canalert, block, or quarantineattempts to send confidential information externally.

  File Blocking (##Correct)

  Preventsunauthorized file transfersover email, cloud storage, and web uploads.

  Blocks file typescommonly used for exfiltration, such as.zip, .docx, .csv, and .txt.

  Helps stopcovert data exfiltration through disguised files.

  B. DoS Protection# Incorrect, becauseDoS Protection prevents volumetric attacksbut does not stopdata exfiltration attempts.

  D. Antivirus# Incorrect, becauseAntivirus detects malware, notsensitive data transfers. Firewall Deployment - Preventsunauthorized data leaksthrough outbound connections. Security Policies - Enforcescontent-based and file-based exfiltration prevention. VPN Configurations - Ensuresencrypted VPNs do not become data exfiltration channels. Threat Prevention - Monitors forinsider threats and advanced persistent threats (APTs)attempting exfiltration. WildFire Integration - Detectsmalware that might be exfiltrating data. Zero Trust Architectures - Preventsunauthorized data movement across network zones. Why Other Options Are Incorrect?References to Firewall Deployment and Security Features: Thus, the correct answers are:#A. Data Filtering#C. File Blocking

• Question 27:

  An administrator wants remote users on company laptops to avoid building a VPN tunnel when they are physically connected to the corporate LAN, while still requiring protected access when they are off-site.

  Which configuration should be used?

  A. Force all users to connect only to external gateways
  B. Enable internal host detection so the agent can determine whether the endpoint is on the internal network
  C. Configure split tunneling so only web traffic uses the tunnel
  D. Disable internal gateways and rely on manual user connection
  B. Enable internal host detection so the agent can determine whether the endpoint is on the internal network

  ---

  Explanation

  Internal host detection allows the GlobalProtect agent to check for a known internal resource and determine whether the endpoint is inside the corporate network. When the internal host is reachable, the agent does not need to establish the remote-access tunnel; when it is not reachable, the agent connects remotely through the appropriate gateway. This behavior reduces unnecessary tunneling for on-premises users while preserving protection for remote users.

  Option A is incorrect because forcing all users to external gateways creates unnecessary tunnels for internal users.

  Option C is incorrect because split tunneling controls which traffic uses the tunnel, not whether the tunnel is established.

  Option D is incorrect because manual connection does not provide the automatic internal-versus-remote decision required in this scenario.

• Question 28:

  An administrator is configuring a NAT rule.

  At a minimum, which three forms of information are required? (Choose three.)

  A. name
  B. source zone
  C. destination interface
  D. destination address
  E. destination zone
  A. name
  B. source zone
  E. destination zone

• Question 29:

  Assume that traffic matches a Security policy rule but the attached Security Profiles is configured to block matching traffic.

  Which statement accurately describes how the firewall will apply an action to matching traffic?

  A. If it is an allowed rule, then the Security Profile action is applied last
  B. If it is a block rule then the Security policy rule action is applied last
  C. If it is an allow rule then the Security policy rule is applied last
  D. If it is a block rule then Security Profile action is applied last
  A. If it is an allowed rule, then the Security Profile action is applied last

• Question 30:

  An internal host wants to connect to servers of the internet through using source NAT.

  Which policy is required to enable source NAT on the firewall?

  A. NAT policy with source zone and destination zone specified
  B. post-NAT policy with external source and any destination address
  C. NAT policy with no source of destination zone selected
  D. pre-NAT policy with external source and any destination address
  A. NAT policy with source zone and destination zone specified