Palo Alto Networks PAN-NSG Online Practice Questions and Exam Preparation

Palo Alto Networks PAN-NSG Online Questions & Answers

• Question 51:

  What should be reviewed when log forwarding from an NGFW to Strata Logging Service becomes disconnected?

  A. Device certificates
  B. Decryption profile
  C. Auth codes
  D. Software warranty
  A. Device certificates

  ---

  Explanation

  When log forwarding from aPalo Alto Networks NGFWto theStrata Logging Service (formerly Cortex Data Lake)becomes disconnected, the primary aspect to review isdevice certificates. This is because the firewall usescertificatesfor mutual authentication with the logging service. If these certificates are missing, expired, or invalid, the firewall will fail to establish a secure connection, preventing log forwarding. Authentication Requirement - The NGFW uses a Palo Alto Networks-issued device certificate for authentication before it can send logs to the Strata Logging Service. Expiration Issues - If the certificate has expired, the NGFW will be unable to authenticate, causing a disconnection. Misconfiguration or Revocation - If the certificate is not properly installed, revoked, or incorrectly assigned, the logging service will reject log forwarding attempts. Cloud Trust Relationship - The firewall relies on secure cloud-based authentication, where certificates validate the NGFW's identity before log ingestion. Check Certificate Status Navigate toDevice > Certificatesin the NGFW web interface. Verify the presence of a validPalo Alto Networks device certificate. Look for expiration dates and renew if necessary.

  Reinstall Certificates

  If the certificate is missing or invalid, reinstall it by retrieving the correct device certificate from thePalo Alto Networks Customer Support Portal (CSP).

  Ensure Correct Certificate Chain

  Verify that the correct root CA certificate is installed and trusted by the firewall.

  Confirm Connectivity to Strata Logging Service Ensure that outbound connections to the logging service are not blocked due to misconfigured security policies, firewalls, or proxies. (B) Decryption Profile - SSL/TLS decryption settings affect traffic inspection but have no impact on log forwarding. (C) Auth Codes - Authentication codes are used during theinitial device registrationwith Strata Logging Service but do not impact ongoing log forwarding.

  (D) Software Warranty - The firewall'swarrantydoes not influence log forwarding; however, anactive support licenseis required for continuous access to Strata Logging Service.

  Firewall Deployment - Certificates are fundamental to secure NGFW cloud communication.

  Security Policies - Proper authentication ensures logs are securely transmitted.

  Threat Prevention & WildFire - Logging failures could impact threat visibility and WildFire analysis.

  Panorama - Uses the same authentication mechanisms for centralized logging.

  Zero Trust Architectures - Requires strict identity verification, including valid certificates. Key Reasons.

  Why Device Certificates Are CriticalHow to Verify and Fix Certificate IssuesOther Answer Choices AnalysisReferences and Justification:Thus,Device Certificates (A)is the correct answer, as log forwarding depends on a valid, authenticated certificate to establish connectivity with Strata Logging Service.

• Question 52:

  Which action is only taken during slow path in the NGFW policy?

  A. Session lookup
  B. SSUTLS decryption
  C. Layer 2-Layer 4 firewall processing
  D. Security policy lookup
  B. SSUTLS decryption

  ---

  Explanation

  In Palo Alto Networks Next-Generation Firewall (NGFW), packet processing is categorized into thefast path (also known as theaccelerated path) and theslow path(also known asdeep inspection processing). The slow pathis responsible for handling operations that require deep content inspection and policy enforcement beyond standard Layer 2-4 packet forwarding. Slow Path Processing and SSL/TLS DecryptionSSL/TLS decryption is performedonly during the slow pathbecause it involves computationally intensive tasks such as: Intercepting encrypted trafficand performing man-in-the-middle (MITM) decryption.

  Extracting the SSL handshakeand certificate details for security inspection.

  Inspecting decrypted payloadsfor threats, malicious content, and compliance with security policies.

  Re-encrypting the trafficbefore forwarding it to the intended destination.

  This process is critical in environments whereencrypted threatscan bypass traditional security inspection mechanisms. However, it significantly impacts firewall performance, making it a slow path action. (A) Session Lookup - This occurs in thefast pathas part of session establishment before any deeper inspection. It checks whether an incoming packet belongs to an existing session. (C) Layer 2-Layer 4 Firewall Processing - The se arestateless or stateful filtering actions(e.g., access control, NAT, and basic connection tracking), handled in the fast path. (D) Security Policy Lookup - This is also in thefast path, where the firewall determines whether to allow, deny, or perform further inspection based on the defined security policy rules. Firewall Deployment - SSL/TLS decryption is part of the firewall's deep packet inspection and Zero Trust enforcement strategies. Security Policies - NGFWs use SSL decryption to enforce security policies, ensuring compliance and blocking encrypted threats.

  VPN Configurations - SSL VPNs and IPsec VPNs also undergo decryption processing in specific security enforcement zones.

  Threat Prevention - Palo Alto's Threat Prevention engine analyzes decrypted traffic for malware, C2 (Command-and-Control) connections, and exploit attempts.

  WildFire - Inspects decrypted traffic for zero-day malware and sandboxing analysis.

  Panorama - Provides centralized logging and policy enforcement for SSL decryption events.

  Zero Trust Architectures - Decryption is a crucial Zero Trust principle, ensuring encrypted traffic is not blindly trusted. Other Answer Choices AnalysisReferences and Justification:Thus,SSL/TLS decryption is the correct answeras it is performed exclusively in the slow path of Palo Alto Networks NGFWs.

• Question 53:

  Which step is necessary to ensure an organization is using the inline cloud analysis features in its Advanced Threat Prevention subscription?

  A. Configure Advanced Threat Prevention profiles with default settings and only focus on high-risk traffic to avoid affecting network performance.
  B. Enable SSL decryption in Security policies to inspect and analyze encrypted traffic for threats.
  C. Update or create a new anti-spyware security profile and enable the appropriate local deep -learning models.
  D. Disable anti-spyware to avoid performance impacts and rely solely on external threat intelligence.
  B. Enable SSL decryption in Security policies to inspect and analyze encrypted traffic for threats.

  ---

  Explanation

  The inline cloud analysis featurein theAdvanced Threat Preventionsubscription enablesreal-time threat detection using machine learning (ML) and deep-learning models. However, for it to be effective, the firewall mustdecrypt encrypted trafficto analyze potential threats hidden withinTLS/SSL connections.

  Threat actors often hide malware and exploits in encrypted traffic.

  Without SSL decryption, inline cloud analysis cannot inspect encrypted threats.

  Decryption allows full visibility into traffic for inline deep-learning threat detection.

  A. Configure Advanced Threat Prevention profiles with default settings and only focus on high-risk traffic to avoid affecting network performance.# Incorrect, becausedefault settings may not enable inline cloud analysis, and focusingonly on high-risk traffic reduces security effectiveness.

  C. Update or create a new anti-spyware security profile and enable the appropriate local deep-learning models.# Incorrect, becauseAnti-Spyware profiles detect command-and-control (C2) traffic, butinline cloud analysis requires inspecting full packet content, which requires SSL decryption.

  D. Disable anti-spyware to avoid performance impacts and rely solely on external threat intelligence.# Incorrect, becausedisabling anti-spyware would leave the network vulnerable. Inline cloud analysis worksin conjunction with threat intelligence and local prevention capabilities. Firewall Deployment - Ensuresencrypted traffic is inspected for threats. Security Policies - RequiresSSL decryption policies to apply Advanced Threat Prevention. VPN Configurations - Ensuresdecryption and inspection apply to VPN traffic. Threat Prevention - Works alongsideAdvanced WildFire and inline ML models. WildFire Integration - Inspectsunknown threats in decrypted files. Zero Trust Architectures - Enforcescontinuous inspection of all encrypted traffic. Why SSL Decryption is Necessary?Why Other Options Are Incorrect?References to Firewall Deployment and Security Features:Thus, the correct answer is:#B. Enable SSL decryption in Security policies to inspect and analyze encrypted traffic for threats.

• Question 54:

  Which subscription sends non-file format-based traffic that matches Data Filtering Profile criteria to a cloud service to render a verdict?

  A. Enterprise DLP
  B. SaaS Security Inline
  C. Advanced URL Filtering
  D. Advanced WildFire
  A. Enterprise DLP

  ---

  Explanation

  The Enterprise Data Loss Prevention (Enterprise DLP) subscriptionis responsible for sendingnon-file format-based trafficthat matchesData Filtering Profile criteriato acloud servicefor further inspection and verdict determination. Monitors and Prevents Sensitive Data Loss-Detects sensitive data patterns(e.g.,PII, credit card numbers, social security numbers) innon-file-based trafficsuch as HTTP, SMTP, and FTP.

  Preventsaccidental or intentional data leaksfrom corporate environments.

  Cloud-Based Verdict Analysis-Enterprise DLPforwards suspicious traffic to a cloud-based analysis engineto classify and enforce policies onstructured and unstructured data.

  Works acrossSaaS, web, and emailenvironments.

  B. SaaS Security Inline# Incorrect, becauseSaaS Security Inline focuses on SaaS application traffic controlrather thanDLP for non-file-based traffic.

  C. Advanced URL Filtering# Incorrect, becauseAdvanced URL Filtering focuses on web-based threat protection(e.g.,malicious URLs, phishing sites), notDLP inspection.

  D. Advanced WildFire# Incorrect, becauseWildFire is designed to analyze files for malware, notdata loss prevention in non-file-based traffic. Firewall Deployment - Enterprise DLP integrates withNGFW policies to prevent data leaks. Security Policies - Enforcesdata protection policies across multiple traffic types. VPN Configurations - InspectsVPN traffic for sensitive data leaks. Threat Prevention - Works alongsideIPS to prevent unauthorized data exfiltration. WildFire Integration - While WildFire analyzes files,Enterprise DLP inspects non-file-based data patterns. Zero Trust Architectures - Ensuresstrict controls over sensitive data movement. Why Enterprise DLP is the Correct Answer?Why Other Options Are Incorrect?References to Firewall Deployment and Security Features:Thus, the correct answer is:#A. Enterprise DLP

• Question 55:

  A company currently uses Prisma Access for its mobile users. A use case is discovered in which mobile users will need to access an internal site, but there is no existing network communication between the mobile users and the internal site.

  Which Prisma Access functionality needs to be deployed to enable routing between the mobile users and the internal site?

  A. Interconnect license
  B. Service connection
  C. Autonomous Digital Experience Manager (ADEM)
  D. Security processing node
  B. Service connection

  ---

  Explanation

  Prisma Access providessecure remote accessformobile users, but by default, mobile userscannot access internal sites unless explicitly configured.

  Service Connection establishes a secure tunnelbetween Prisma Access and the internal network.

  Allows direct routing between mobile users and internal applications.

  Enables access without requiring additional VPN connections.

  Ensures that Prisma Access can securely route trafficbetween mobile users and the internal site.

  A. Interconnect license# Interconnect provides higher bandwidth connectionsbetween Prisma Access and multiple regions, but itdoes not create routing to internal networks.

  C. Autonomous Digital Experience Manager (ADEM)# ADEM is used for network experience monitoring, not for routing or connectivity.

  D. Security Processing Node# Security processing nodes handle threat inspection, but theydo not create routing connectionsbetween Prisma Access and internal networks. Firewall Deployment - Service connectionsextend internal network access. Security Policies - Enforces policies on traffic betweenmobile users and internal resources. VPN Configurations - Ensuressecure IPsec/GRE tunnelsbetween Prisma Access and on-prem networks. Threat Prevention - Inspects mobile-to-internal traffic for threats. WildFire Integration - Scans transferred files betweenmobile users and internal sites. Zero Trust Architectures - Ensuressecure access control for mobile users accessing internal applications. How Service Connection Enables Routing Between Mobile Users and Internal Sites:Why Other Options Are Incorrect?References to Firewall Deployment and Security Features:Thus, the correct answer is:#B. Service connection

• Question 56:

  A company uses Prisma Access for mobile users and needs those users to reach an internal application hosted in the data center. There is currently no path between Prisma Access and the internal network.

  What must be deployed to provide that connectivity?

  A. Service connection
  B. Dynamic User Group
  C. Security processing node
  D. Clientless VPN zone
  A. Service connection

  ---

  Explanation

  A service connection creates the secure path between Prisma Access and the internal network so that mobile-user traffic can be routed to internal resources. This enables users connected through Prisma Access to access applications hosted in the data center or other internal environments. It is the required feature when routing between Prisma Access and internal destinations does not already exist.

  Option B is incorrect because Dynamic User Groups are used for user-based policy decisions, not network connectivity.

  Option C is incorrect because a security processing node handles inspection functions rather than establishing routing to internal networks.

  Option D is incorrect because a Clientless VPN zone is not the mechanism used to build general network connectivity from Prisma Access to internal applications.

• Question 57:

  Which two components of a Security policy, when configured, allow third-party contractors access to internal applications outside business hours? (Choose two.)

  A. User-ID
  B. Schedule
  C. Service
  D. App-ID
  A. User-ID
  B. Schedule

  ---

  Explanation

  To allowthird-party contractors access to internal applications outside business hours, theSecurity Policymust include: User-ID-Identifies specific users (e.g., third-party contractors) and applies access rules accordingly.

  Ensures that onlyauthenticated usersfrom the contractor group receive access.

  Schedule-Specifies theallowed access time frame(e.g., outside business hours:6 PM - 6 AM).

  Ensures that contractorscan only access applications during designated off-hours.

  C. Service# Incorrect, becauseService defines ports and protocols, not user identity or time-based access control.

  D. App-ID# Incorrect, becauseApp-ID identifies and classifies applications, but doesnot restrict access based on user identity or time. Firewall Deployment - Ensurescontractors access internal applications securelyvia User-ID and Schedule. Security Policies - Implementsgranular time-based and identity-based access control. VPN Configurations - Third-party contractors may access applicationsthrough GlobalProtect VPN. Threat Prevention - Reduces attack risks by limitingaccess windows for third-party users. WildFire Integration - Ensures downloaded contractor files are scanned for threats. Zero Trust Architectures - Supportsleast-privilege access based on user identity and time restrictions. Why Other Options Are Incorrect?References to Firewall Deployment and Security Features:Thus, the correct answers are:#A. User-ID#B. Schedule

• Question 58:

  Which Security profile can you apply to protect against malware such as worms and Trojans?

  A. data filtering
  B. antivirus
  C. vulnerability protection
  D. anti-spyware
  B. antivirus

  ---

  Explanation

  References:

  https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/policy/security-profiles#:~:text=Antivirus%20profiles%20protect%20against%20viruses,as%20well%20as%20spyware%20downloads

• Question 59:

  Which two tools can be used to configure Cloud NGFWs for AWS? (Choose two.)

  A. Cortex XSIAM
  B. Cloud service provider's management console
  C. Prisma Cloud management console
  D. Panorama
  B. Cloud service provider's management console
  D. Panorama

  ---

  Explanation

  Cloud NGFW for AWSis amanaged next-generation firewall serviceprovided by Palo Alto Networks, designed tosecure AWS environments. It can be configured usingtwo primary tools: Cloud Service Provider's Management Console (AWS Console) - AWS users can deploy and manageCloud NGFW for AWSdirectly from theAWS Marketplace or

  AWS Management Console.

  The AWS console allowsintegration with AWS native services, such asVPCs, security groups, and IAM policies.

  Panorama - Panorama provides centralized policy and configuration managementfor Cloud NGFW instances deployed across AWS. It enablesconsistent security policy enforcement, log aggregation, and seamless integration withon-premises and multi-cloud firewalls.

  A. Cortex XSIAM# Incorrect, becauseCortex XSIAM is an AI-driven security operations platform, not a tool forCloud NGFW configuration. It focuses onSOC automation, threat detection, and responserather than firewall policy management.

  C. Prisma Cloud Management Console# Incorrect, becausePrisma Cloudis designed forcloud security posture management (CSPM) and compliance. While Prisma Cloudmonitors security risks in AWS, itdoes not configure or manage Cloud NGFW policies. Firewall Deployment - Cloud NGFW integrates withAWS network architecture. Security Policies - Panorama enforcessecurity policies across AWS workloads. VPN Configurations - Cloud NGFW supportsAWS-based VPN traffic inspection. Threat Prevention - Protects AWS workloads frommalware, exploits, and network threats. WildFire Integration - Detectsunknown threats within AWSenvironments. Zero Trust Architectures - SecuresAWS cloud workloads using Zero Trust principles. Why Other Options Are Incorrect?References to Firewall Deployment and Security Features:Thus, the correct answers are:#B. Cloud service provider's management console#D. Panorama

• Question 60:

  Which tool will help refine a security rule by specifying the applications it has viewed in past weeks?

  A. Security Lifecycle Review (SLR)
  B. Custom Reporting
  C. Autonomous Digital Experience Management (ADEM)
  D. Policy Optimizer
  D. Policy Optimizer

  ---

  Explanation

  The Policy Optimizertool helps refine security rules byanalyzing historical traffic dataandidentifying the applications observed over past weeks. It is designed to: Improve Security Policies - Identifiesoverly permissive rulesand suggestsspecific application-based security policies.

  Enhance Rule Accuracy - Helpsreplace port-based ruleswithApp-ID-based security rules, reducing the risk ofunintended access. Use Historical Traffic Data-Analyzes past network activityto determinewhich applications should be explicitly allowed or denied.

  Simplify Rule Management - Reducesredundant or outdated policies, leading tomore effective firewall rule enforcement.

  A. Security Lifecycle Review (SLR)# Incorrect, becauseSLR provides a high-level security assessment, not a tool for refining specific security rules. It focuses onidentifying security gapsrather thanoptimizing security policiesbased on past traffic data.

  B. Custom Reporting# Incorrect, becauseCustom Reportinggeneratessecurity insights and compliance reports, but doesnot analyze policy rules.

  C. Autonomous Digital Experience Management (ADEM)# Incorrect, becauseADEM is designed for network performance monitoring, not firewall rule refinement. It helps measureend-user digital experiencesrather thansecurity policy optimizations. Firewall Deployment - Policy Optimizer improves firewallefficiency and accuracy. Security Policies - Refines rules based onactual observed application traffic. VPN Configurations - Helps optimizesecurity policies for VPN traffic. Threat Prevention - Ensures thatunused or unnecessary policiesdo not create security risks. WildFire Integration - Works alongsideWildFire threat detectionto fine-tune application security rules. Zero Trust Architectures - Supportsleast-privilege access controlby definingspecific App-ID-based rules. Why Other Options Are Incorrect?References to Firewall Deployment and Security Features:Thus, the correct answer is:#D. Policy Optimizer