Palo Alto Networks PAN-NSG Online Practice Questions and Exam Preparation

Palo Alto Networks PAN-NSG Online Questions & Answers

• Question 31:

  An administrator wants to create a NAT policy to allow multiple source IP addresses to be translated to the same public IP address.

  What is the most appropriate NAT policy to achieve this?

  A. Dynamic IP and Port
  B. Dynamic IP
  C. Static IP
  D. Destination
  A. Dynamic IP and Port

• Question 32:

  An administrator would like to create a URL Filtering log entry when users browse to any gambling website.

  What combination of Security policy and Security profile actions is correct?

  A. Security policy = drop, Gambling category in URL profile = allow
  B. Security policy = deny. Gambling category in URL profile = block
  C. Security policy = allow, Gambling category in URL profile = alert
  D. Security policy = allow. Gambling category in URL profile = allow
  C. Security policy = allow, Gambling category in URL profile = alert

• Question 33:

  Infrastructure performance issues and resource constraints have prompted a firewall administrator to monitor hardware NGFW resource statistics.

  Which AlOps feature allows the administrator to review these statistics for each firewall in the environment?

  A. Capacity Analyzer
  B. Host information profile (HIP)
  C. Policy Analyzer
  D. Security Posture Insights
  A. Capacity Analyzer

  ---

  Explanation

  The Capacity Analyzerfeature in Palo Alto Networks' AIOps for NGFW (Next-Generation Firewall) provides administrators with insights into hardware resource statistics for each firewall in the environment. It helps identify infrastructure performance issues and resource constraints, such as CPU usage, session capacity, and throughput levels.

  Capacity Monitoring: It enables real-time and historical monitoring of resource usage to ensure optimal performance.

  Proactive Issue Detection: Administrators can proactively address resource constraints before they impact the network.

  Unified Visibility: With AIOps, the Capacity Analyzer aggregates data from all managed firewalls, providing centralized visibility into resource utilization across the environment.

  References:

  Palo Alto Networks AIOps Documentation Capacity Analyzer Overview

• Question 34:

  Which two SSH Proxy decryption profile configurations will reduce network attack surface? (Choose two.)

  A. Allow sessions if resources not available.
  B. Allow sessions with unsupported versions.
  C. Block sessions on certificate errors.
  D. Block sessions with unsupported versions.
  C. Block sessions on certificate errors.
  D. Block sessions with unsupported versions.

  ---

  Explanation

  AnSSH Proxy decryption profileallowsPalo Alto Networks NGFWsto inspect encrypted SSH traffic and preventexploitationby attackers.

  Toreduce the network attack surface, the two best security settings are:

  Block Sessions on Certificate Errors (##Correct)

  Prevents attackers from usingself-signed or fraudulent certificates to by pass security inspections.

  Ensures that SSH connections use valid and trusted certificatesonly.

  Block Sessions with Unsupported Versions (##Correct)

  Older SSH versions (e.g., SSH-1) arevulnerable to exploits and weak encryption.

  Ensures thatonly secure SSH protocols (e.g., SSH-2) are allowed.

  A. Allow sessions if resources not available.# Incorrect, becausethis weakens security-attackers could exploit times when decryption is unavailable.

  B. Allow sessions with unsupported versions.# Incorrect, becauseallowing outdated SSH versionsexposes the network toknown vulnerabilities. Firewall Deployment - SSH Proxy decryption preventsSSH-based malware tunnels. Security Policies - Enforcesstrict SSH version control and certificate validation. VPN Configurations - PreventsSSH tunneling inside VPN connections. Threat Prevention - Protects againstSSH brute-force attacks and exploits. WildFire Integration - EnsuresSSH-based file transfers are inspected for malware. Zero Trust Architectures - Prevents unauthorized SSH sessions withstrict security controls. Why Other Options Are Incorrect?References to Firewall Deployment and Security Features:Thus, the correct answers are:#C. Block sessions on certificate errors.#D. Block sessions with unsupported versions.

• Question 35:

  An administrator must ensure that IoT devices on a flat Layer 2 network are identified and monitored without changing the existing IP addressing or cabling.

  Which Palo Alto Networks capability should be enabled on the NGFW to achieve this?

  A. DHCP relay on the firewall
  B. IoT Security with passive device discovery and cloud-based profiling
  C. VRRP between the firewall and core switch
  D. GlobalProtect with host information profile (HIP) checks
  B. IoT Security with passive device discovery and cloud-based profiling

  ---

  Explanation

  IoT environments often cannot tolerate disruptive network redesigns.

  IoT Security with passive discovery (B)

  Usespassive traffic analysisandcloud-based device fingerprintingto identify IoT devices.

  Requires no change toIP scheme or physical cabling; devices remain on theexisting VLAN.

  Profiles device behaviorand assigns risk scores for further policy enforcement.

  A. DHCP relay Helps forward DHCP requests but doesnot provide device-type identification and profiling.

  C. VRRP Offersredundant default gatewaycapabilities; unrelated to IoT identification and monitoring.

  D. GlobalProtect with HIP Targetsmanaged endpoints, notunmanaged IoT deviceswithout agents. Firewall Deployment - NGFW receives traffic mirrored or inline from IoT segments for classification. Threat Prevention - IoT device profiles enablepolicy control and anomaly detection. Zero Trust Architectures - Treats IoT devices asuntrusted and controlled viaidentity-aware policies.

• Question 36:

  Which two content updates can be pushed to next-generation firewalls from Panorama? (Choose two.)

  A. GlobalProtect data file
  B. WildFire
  C. Advanced URL Filtering
  D. Applications and threats
  B. WildFire
  D. Applications and threats

  ---

  Explanation

  WildFire and Applications and Threats content updates can be pushed to next-generation firewalls from Panorama.

  WildFire: WildFire is a cloud-based malware analysis and prevention service that delivers frequent and automated updates to defend against unknown threats. Panorama facilitates pushing WildFire signatures to managed firewalls, ensuring a proactive defense.

  Applications and Threats: This category encompasses updates for App-ID, vulnerability signatures, anti-virus, and anti-spyware definitions. By pushing these updates from Panorama, you ensure that all firewalls are equipped with the latest definitions, keeping the network protected from evolving threats.

  References:

  Palo Alto Networks Documentation - Panorama WildFire Integration Applications and Threats Update

• Question 37:

  Which five Zero Trust concepts does a Palo Alto Networks firewall apply to achieve an integrated approach to prevent threats? (Choose five.)

  A. User identification
  B. Filtration protection
  C. Vulnerability protection
  D. Antivirus
  E. Application identification
  F. Anti-spyware
  A. User identification
  C. Vulnerability protection
  D. Antivirus
  E. Application identification
  F. Anti-spyware

• Question 38:

  A security administrator needs to ensure that sensitive healthcare records are not uploaded to unsanctioned cloud storage while still allowing general web browsing for users.

  Which two Security profiles should be combined and applied to the relevant Security policy? (Choose two.)

  A. Data Filtering profile with patterns for healthcare data (HIPAA)
  B. DoS Protection profile with strict SYN flood thresholds
  C. URL Filtering profile blocking "online-storage" and "personal-sites" categories
  D. Antivirus profile focusing on PE file inspection
  A. Data Filtering profile with patterns for healthcare data (HIPAA)
  C. URL Filtering profile blocking "online-storage" and "personal-sites" categories

  ---

  Explanation

  Preventing data exfiltration to unsanctioned cloud storage requirescontent inspectionandcategory-based control.

  Data Filtering (A)

  Detectshealthcare-specific patterns(PHI/patient IDs, medical record numbers).

  Canblock or alerton uploads containing protected health information.

  URL Filtering (C)

  Blocks or limits access tocategoriesassociated with personal cloud storageand consumer file-sharing sites.

  Reduces the chance that sensitive data is sent to unsanctioned destinations.

  B. DoS Protection Addressesavailability attacks, not data exfiltration or cloud storage use.

  D. Antivirus Detects malware; it doesnot directly detect structured healthcare data patterns. Firewall Deployment - Security policies combineURL Filtering and Data Filtering for outbound web traffic. Threat Prevention - Data-aware filtering reducesrisk of accidental or malicious PHI exfiltration. Zero Trust Architectures - Enforcesprinciple of least privilegefor both destinations and content.

• Question 39:

  Which functionality does an NGFW use to determine whether new session setups are legitimate or illegitimate?

  A. SYN flood protection
  B. SYN bit
  C. Random Early Detection (RED)
  D. SYN cookies
  A. SYN flood protection

  ---

  Explanation

  AnNGFW (Next-Generation Firewall)determines whethernew session setups are legitimate or illegitimateby usingSYN flood protection, which is a key component ofDoS/DDoS mitigation. Detects High SYN Traffic Rates - SYN flood attacks occur when a large number ofhalf-open TCP connectionsare created, overwhelming a server or firewall. Implements SYN Cookies or Rate-Limiting - To mitigate attacks, the NGFW appliesSYN cookies or connection rate limitsto filter out illegitimate connection attempts.

  Maintains a Secure State Table - The firewall trackslegitimate and suspicious SYN requests, ensuring onlygenuine connectionsare allowed through. Protects Against TCP-Based Attacks - Preventsresource exhaustioncaused byattackers flooding SYN packetswithout completing the TCP handshake.

  B. SYN bit# Incorrect, because theSYN bitis just aflag in the TCP headerused to initiate a connection-it does not helpdistinguish between legitimate and illegitimate sessions.

  C. Random Early Detection (RED)# Incorrect, becauseRED is used in congestion avoidancefor queuing mechanisms, not forTCP session validation.

  D. SYN cookies# Incorrect, becauseSYN cookies are a method used within SYN flood protection, but they are justone part of the larger SYN flood protection mechanismimplemented in NGFWs. Firewall Deployment - SYN flood protection is acore featureof Palo Alto NGFWs. Security Policies - Helps enforcerate-limiting and SYN cookie mechanismsto prevent DoS attacks. VPN Configurations - Prevents SYN flood attacks from affectingIPsec VPN gateways. Threat Prevention-Works alongsideintrusion prevention systems (IPS) to block TCP-based attacks. WildFire Integration - Not directly related but ensuresmalware-infected botsdon't launch SYN flood attacks. Zero Trust Architectures - Protectstrusted network zonesby preventingunauthorized connection attempts. How SYN Flood Protection Works in an NGFW:Why Other Options Are Incorrect?References to Firewall Deployment and Security Features:Thus, the correct answer is:#A. SYN flood protection

• Question 40:

  A firewall administrator wants to segment the network traffic and prevent noncritical assets from being able to access critical assets on the network.

  Which action should the administrator take to ensure the critical assets are in a separate zone from the noncritical assets?

  A. Create a deny Security policy with "any" set for both thesource and destination zones.
  B. Create an allow Security policy with "any" set for both thesource and destination zones.
  C. Logically separate physical and virtual interfaces to control the traffic that passes across the interface.
  D. Assign a single interface to multiple security zones.
  C. Logically separate physical and virtual interfaces to control the traffic that passes across the interface.

  ---

  Explanation

  To properlysegment network traffic and prevent noncritical assets from accessing critical assets, thebest practice is to logically separate trafficusingdifferent physical or virtual interfaces.

  Creates Secure Network Segmentation-Firewalls canassign critical and noncritical assets to separate security zones.

  Traffic betweensecurity zones is explicitly controlled via Security Policies.

  Allows Granular Security Control-Critical assets (e.g., databases, financial systems)can be placed ina high-security zone.

  Noncritical assets (e.g., guest networks, IoT devices)can be placed ina lower-security zone.

  Enhances Network Performance and Compliance-Reduces attack surface by limiting access between critical and noncritical assets.

  Ensures regulatory compliance(e.g., PCI-DSS, HIPAA) by isolating sensitive systems.

  A. Create a deny Security policy with "any" set for both the source and destination zones.# Incorrect, becausethis would block all traffic, preventingeven authorized communications.

  B. Create an allow Security policy with "any" set for both the source and destination zones.# Incorrect, becausethis would permit all traffic, violatingnetwork segmentation principles.

  D. Assign a single interface to multiple security zones.# Incorrect, becausea single interface cannot belong to multiple zones-itmust be logically separated to enforce security policies effectively. Firewall Deployment - Ensurescritical and noncritical assets are securely segmented. Security Policies - Enforcesaccess control between different security zones. VPN Configurations - EnsuresVPN access does not bypass network segmentation. Threat Prevention - Preventslateral movement between network segments. WildFire Integration - Scanscross-zone traffic for malware threats. Zero Trust Architectures - Implementsstrict access control between different security domains. Why Logical Separation of Interfaces is the Correct Answer?Why Other Options Are Incorrect?References to Firewall Deployment and Security Features:Thus, the correct answer is:#C. Logically separate physical and virtual interfaces to control the traffic that passes across the interface.