Palo Alto Networks PAN-NSG Online Practice Questions and Exam Preparation

Palo Alto Networks PAN-NSG Online Questions & Answers

• Question 41:

  A security administrator is adding a new sanctioned cloud application to SaaS Data Security.

  After authentication, how does the tool gain API access for monitoring?

  A. It transmits the configured SAML user profile to the cloud application for security event attribution.
  B. It establishes an encrypted key pair with the cloud application to safely transmit user data.
  C. It generates a certificate and sends it to the cloud application for TLS decryption and inspection.
  D. It receives a token from the cloud application for establishing and maintaining a secure connection.
  D. It receives a token from the cloud application for establishing and maintaining a secure connection.

  ---

  Explanation

  When adding a new sanctioned cloud application toSaaS Data Security, the tool establishes API access by receiving anOAuth tokenor a similar type of token from the cloud application.

  API Integration: The token allows the SaaS Data Security solution to authenticate itself with the cloud application, enabling secure monitoring and management of user activity, data flow, and security events.

  Token Usage: The token maintains the connection between the SaaS application and the security tool, ensuring seamless communication while enforcing access policies and monitoring for anomalies.

  Security: This method ensures that API access is secure and prevents unauthorized access to the cloud application.

  References:

  Palo Alto Networks SaaS Security API Documentation OAuth Authentication and API Access

• Question 42:

  What are two ways to create an App-ID for unknown applications? (Choose two.)

  A. Provide a packet capture to Palo Alto Networks and request an App-ID.
  B. Create a custom application by using signatures.
  C. Create a security profile that maps the signature to the unknown application.
  D. Use WildFire API to map signatures to the unknown application.
  A. Provide a packet capture to Palo Alto Networks and request an App-ID.
  B. Create a custom application by using signatures.

  ---

  Explanation

  Providing a Packet Capture to Palo Alto Networks: You can collect traffic data of the unknown application and send it to Palo Alto Networks for App-ID development. The team analyzes the packet capture and creates an official App-ID that can be used by all customers.

  Creating a Custom Application Using Signatures: Administrators can define a custom application by developing specific traffic signatures. This approach allows immediate recognition and control of the unknown application without waiting for an official App-ID from Palo Alto Networks.

  The se methods ensure that unknown or proprietary applications can be identified, monitored, and controlled within the network using App-ID technology.

  References:

  Palo Alto Networks App-ID Customization Custom Applications and Signatures

• Question 43:

  Which two cloud deployment high availability (HA) options would cause a firewall administrator to use Cloud NGFW? (Choose two.)

  A. Automated autoscaling
  B. Terraform to automate HA
  C. Dedicated vNIC for HA
  D. Deployed with load balancers
  A. Automated autoscaling
  D. Deployed with load balancers

  ---

  Explanation

  Cloudhigh availability (HA)strategies differ from traditional HA deployments in physical firewalls.Cloud NGFWprovidescloud-nativehigh availability options that align withcloud architectures, particularly inAWS and Azure environments.

  Cloud NGFW automatically scales up or downbased ontraffic demandandload conditions.

  This ensuresconsistent security enforcementwithout manual intervention.

  Auto-scaling is managed by cloud-native services (AWS Auto Scaling, Azure Virtual Machine Scale Sets, etc.).

  Cloud NGFW can beintegrated with cloud-native load balancers(AWS Elastic Load Balancing, Azure Load Balancer) to distribute traffic.

  This helps ensurehigh availabilityandfailoverin case of firewall instance failures.

  B. Terraform to automate HA# Terraform automates infrastructure provisioning, but itdoes not inherently provide HA. Ithelps automate HA configuration, butdoes not directly provide HA functionality.

  C. Dedicated vNIC for HA# Cloud NGFW does not use dedicated vNICs for HA-it relies oncloud-native failover mechanisms. Dedicated vNICs aremore relevant for on-prem HA deployments. Firewall Deployment - Cloud NGFW supportsHA through autoscaling and load balancing. Security Policies - Ensurespolicies remain enforced across dynamically scaled instances. VPN Configurations - Works withIPsec VPNs in cloud deployments. Threat Prevention - Maintains security inspection even duringautoscaling events. WildFire Integration - Ensuresmalware inspection is consistently available. Zero Trust Architectures - EnforcesZero Trust security at scale. 1. Automated Autoscaling (## Correct) 2. Deployed with Load Balancers (## Correct) Why Other Options Are Incorrect?References to Firewall Deployment and Security Features:Thus, the correct answers are:#A. Automated autoscaling#D. Deployed with load balancers

• Question 44:

  In conjunction with Advanced URL Filtering, which feature can be enabled after usemame-to-IP mapping is set up?

  A. Host information profile (HIP)
  B. Credential phishing prevention
  C. Client probing
  D. Indexed data matching
  B. Credential phishing prevention

  ---

  Explanation

  WhenAdvanced URL Filteringis enabled,Credential Phishing Preventioncan be activated toprotect against phishing attacksby blocking unauthorized credential submissions.

  Uses Username-to-IP Mapping - Identifies usersbased on their IP and login credentials.

  Prevents Credential The ft - Blocks users from submitting corporate credentials tountrusted or malicious websites.

  Works Alongside Advanced URL Filtering - Detects and categorizesphishing domains in real-time, stopping credential leaks.

  Can Enforce Action-Based Policies - Configures policies toalert, block, or validate credential submissions.

  A. Host Information Profile (HIP)# Incorrect, becauseHIP checks device healthbut does notprevent credential phishing.

  C. Client Probing# Incorrect, becauseClient Probing is used for User-ID mapping, notphishing prevention.

  D. Indexed Data Matching# Incorrect, becauseIndexed Data Matching is used for DLP (Data Loss Prevention), not for credential protection. Firewall Deployment - Protectsuser credentials from phishing attacks. Security Policies - Ensuresusers do not submit credentials to malicious sites. VPN Configurations - Protectsremote users connecting via GlobalProtectfrom credential theft. Threat Prevention - Works withThreat Intelligenceto detect new phishing sites. WildFire Integration - Scansunknown websites for phishing behaviors. Panorama - Centralized enforcement ofCredential Phishing Prevention policies. Zero Trust Architectures - Ensuresonly legitimate authentication events occur within trusted environments. How Credential Phishing Prevention Works:Why Other Options Are Incorrect?References to Firewall Deployment and Security Features:Thus, the correct answer is:#B. Credential phishing prevention

• Question 45:

  Which type of traffic can a firewall use for proper classification and visibility of internet of things (loT) devices?

  A. DHCP
  B. RTP
  C. RADIUS
  D. SSH
  A. DHCP

  ---

  Explanation

  To properly classify and gain visibility intoInternet of Things (IoT) devices, a firewall can analyzeDHCP traffic, asIoT devices frequently use DHCP for network connectivity. IoT Devices Often Use DHCP for IP Assignment-Most IoT devices (smart cameras, sensors, medical devices, industrial controllers)dynamically obtain IP addressesviaDHCP. Firewalls caninspect DHCP requests to identify device typesbased onDHCP Option 55 (Parameter Request List)andOption 60 (Vendor Class Identifier). Enhances IoT Security with Granular Policies-Palo Alto NetworksIoT Securityuses DHCP data toassign risk scores, enforce access control policies, and detect anomalies. Does Not Require Deep Packet Inspection-

  UnlikeRTP, RADIUS, or SSH, which focus onspecific protocols for media streaming, authentication, and encryption,DHCP data is lightweight and easily analyzed.

  B. RTP (Real-Time Transport Protocol)# Incorrect, becauseRTP is used for media streaming (VoIP, video conferencing), notdevice classification.

  C. RADIUS (Remote Authentication Dial-In User Service)# Incorrect, becauseRADIUS is an authentication protocol, nota traffic type used for IoT device classification.

  D. SSH (Secure Shell)# Incorrect, becauseSSH is an encrypted protocolused forremote device access, notidentifying IoT devices. Firewall Deployment - Firewallsuse DHCP fingerprinting for IoT visibility. Security Policies - DHCP data enablesdynamic security policy enforcement for IoT devices. VPN Configurations - EnsuresIoT devices using VPN connections are correctly classified. Threat Prevention - Detectsmalicious IoT devices based on DHCP metadata. WildFire Integration - PreventsIoT devices from being used in botnet attacks.

• Question 46:

  Which action in the Customer Support Portal is required to generate authorization codes for Software NGFWs?

  A. Download authorization codes from the public cloud marketplace.
  B. Create a deployment profile.
  C. Use the Enterprise Support Agreement (ESA) authorization code.
  D. Register the device with the cloud service provider.
  B. Create a deployment profile.

  ---

  Explanation

  To generate authorization codes for Software Next-Generation Firewalls (NGFWs), it is necessary to create a deployment profile within the Palo Alto Networks Customer Support Portal (CSP). This process involves defining the specifics of your deployment, such as the desired firewall model, associated subscriptions, and other relevant configurations.

  Once the deployment profile is established, the CSP generates an authorization code corresponding to the specified configuration. This code is then used during the firewall's activation process to license the software and enable the associated subscriptions.

  It's important to note that authorization codes are not typically obtained directly from public cloud marketplaces or through Enterprise Support Agreement (ESA) codes. Additionally, while registering the device with the cloud service provider is a necessary step, it does not, by itself, generate the required authorization codes.

• Question 47:

  What is the main security benefit of adding a CN-Series firewall to an existing VM-Series firewall deployment when the customer is using containers?

  A. It provides perimeter threat detection and inspection outside the container itself.
  B. It prevents lateral threat movement within the container itself.
  C. It monitors and logs traffic outside the container itself.
  D. It enables core zone segmentation within the container itself.
  B. It prevents lateral threat movement within the container itself.

  ---

  Explanation

  ACN-Series firewallis acontainer-native firewalldesigned to provide security inside Kubernetes environments.

  It is usedin addition toaVM-Series firewall, which primarily protectscloud and virtualized workloads. The main security benefit of CN-Seriesis that itprevents lateral movement of threats within the container itselfby enforcing: Microsegmentation within Kubernetes clusters Deep packet inspection for inter-container communication Zero Trust enforcement inside containerized applications Containers are highly dynamic, and traditional firewallscannot inspect intra-container traffic. The CN-Series firewall enforces microsegmentation, blocking unauthorized communication between compromised containers.

  Prevents malware or attackers from spreading within the Kubernetes environment.

  (A) Provides perimeter threat detection outside the container-This describesVM-Series firewalls, not CN-Series. (C) Monitors and logs traffic outside the container-CN-Seriesmonitors intra-container traffic, not just traffic outside the container. (D) Enables core zone segmentation within the container-The correct term ismicrosegmentation, but the key benefit is preventing lateral movement.

  Zero Trust Architectures - Enforces least-privilege accesswithin containers.

  Threat Prevention & WildFire - Preventsmalware from spreading between containers.

  Why Preventing Lateral Threat Movement is the Correct Answer?Other Answer Choices AnalysisReferences and Justification:Thus,CN-Series Firewall (B) is the correct answer, as it preventslateral threat movement within the container itself.

• Question 48:

  A company is deploying Cloud NGFW for AWS across multiple accounts using a central networking account.

  What is the primary role of the rulestack in this architecture?

  A. It defines the IPSec tunnel parameters between VPCs and Cloud NGFW
  B. It provides a reusable set of Security policies that can be associated with multiple Cloud NGFW endpoints
  C. It stores AWS IAM roles required for Cloud NGFW lifecycle operations
  D. It defines BGP routing policies for traffic between VPCs and the internet
  B. It provides a reusable set of Security policies that can be associated with multiple Cloud NGFW endpoints

  ---

  Explanation

  Cloud NGFW for AWS usesrulestacksto simplify policy management at scale.

  Reusable policy container (B)

  ArulestackholdsSecurity policies, objects, and profiles.

  Multiple Cloud NGFW endpointsin different accounts or VPCs can beassociatedwith the same rulestack, ensuringconsistent security policy enforcement.

  A. IPSec tunnel parameters Cloud NGFW for AWS primarily integrates viaVPC routing and GWLB, not IPSec tunnels, for most designs.

  C. AWS IAM roles IAM roles are defined in AWS, not within the rulestack object.

  D. BGP routing policies Routing is handled byAWS networking components (VGW, TGW, etc.), not by the rulestack. Firewall Deployment - Rulestacks decouplepolicy from individual Cloud NGFW instances. Security Policies - Centralized configuration reduces errors and ensures consistent controls. Zero Trust Architectures - Consistent rulestacks apply uniform controls acrossmulti-account, multi-VPCdeployments.

• Question 49:

  A GlobalProtect deployment uses HIP-based policies to restrict access to certain applications only to endpoints with disk encryption and an up-to-date EDR agent installed.

  What is the primary security benefit of this configuration?

  A. It guarantees that only corporate-owned devices can connect to GlobalProtect
  B. It enforces device posture requirements before granting access to sensitive resources
  C. It prevents any unmanaged device from connecting to the internet
  D. It eliminates the need for multi-factor authentication (MFA)
  B. It enforces device posture requirements before granting access to sensitive resources

  ---

  Explanation

  HIP-based policies adddevice posture awarenessinto access control decisions.

  Device posture enforcement (B)

  The firewall evaluatesHIP reportsfor disk encryption status, EDR agent presence, and other posture checks.

  Access tosensitive applicationsis granted only if the endpoint meets the defined posture requirements.

  A. Guarantees only corporate-owned devices HIP canstrongly indicate posturebut cannot absolutely guarantee ownership without additional controls.

  C. Prevents unmanaged devices from connecting to the internet Policies may allow internet access while restricting access tointernal or high-value applications.

  D. Eliminates MFA HIP and MFA addressdifferent risk dimensions; posture checks do not replaceidentity verification. Firewall Deployment - HIP-based Security policies tie endpoint security state toauthorization decisions. Zero Trust Architectures - Evaluatesuser and device trusttogether before allowing access.

• Question 50:

  An organization wants to adopt a Zero Trust approach for users accessing private applications hosted in multiple public cloud environments.

  Which two design principles must be prioritized when using Prisma Access and ZTNA connectors? (Choose two.)

  A. Allow any traffic from trusted networks and only inspect untrusted networks
  B. Enforce identity-based access and least privilege for every user and application
  C. Rely on static IP address ranges to define trust boundaries
  D. Continuously verify device posture and user behavior before granting access
  B. Enforce identity-based access and least privilege for every user and application
  D. Continuously verify device posture and user behavior before granting access

  ---

  Explanation

  Zero Trust with Prisma Access and ZTNA connectors focuses onidentity and contextinstead of IP-based trust.

  Identity-based access and least privilege (B) ZTNA policy decisions are driven byuser identity, group membership, and application context.

  Access is scoped only toapproved private applicationsrather than the entire network segment.

  Continuous verification of device posture and behavior (D)

  Prisma Access can usedevice posture (HIP), user risk, and behavior analyticsbefore granting or maintaining access.

  Access is not "one-time granted"; it iscontinuously validatedthroughout the session.

  A. Allow any traffic from trusted networks and only inspect untrusted networks This contradicts Zero Trust;trusted networks do not existas an inherent concept in Zero Trust designs.

  C. Rely on static IP address ranges to define trust boundaries IP addresses arepoor indicators of identity, especially in cloud and mobile scenarios; Zero Trust moves away from IP-based trust. Firewall Deployment - Prisma Access and ZTNA connectors expose applications, not networks. Security Policies - Policies are built onuser, app, and device contextinstead of subnets. Zero Trust Architectures - Enforceleast privilegeandcontinuous verificationfor all private app access.