Palo Alto Networks PAN-NSG Online Practice Questions and Exam Preparation

Palo Alto Networks PAN-NSG Online Questions & Answers

• Question 61:

  Which object would an administrator create to block access to all high-risk applications?

  A. HIP profile
  B. application filter
  C. application group
  D. Vulnerability Protection profile
  B. application filter

  ---

  Explanation

  References:

  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClKECA0

• Question 62:

  A branch firewall is deployed with multiple virtual systems (VSYS) to separate traffic for different business units.

  Which benefit does this design provide when combined with Panorama or Strata Cloud Manager?

  A. Each VSYS can have a different PAN-OS version running simultaneously
  B. Virtual systems allow complete physical isolation of hardware resources per tenant
  C. Each VSYS can be managed with independent Security policies, objects, and logs while sharing the same hardware
  D. VSYS automatically eliminate the need for interzone Security policies
  C. Each VSYS can be managed with independent Security policies, objects, and logs while sharing the same hardware

  ---

  Explanation

  Virtual systems (VSYS) enablelogical multitenancyon a single physical firewall.

  Per-VSYS policy and log separation (C)

  Each VSYS maintains itsown Security policies, objects, routing, and logs.

  Panorama or Strata Cloud Managercan centrally manageand report onseparate VSYSinstances as if they were independent firewalls.

  Hardware is shared, butlogical isolationis maintained between business units or tenants.

  A. Different PAN-OS per VSYS All VSYS on a device sharethe same PAN-OS image; versioning is per device, not per VSYS.

  B. Complete physical isolation of hardware VSYS shareCPU, memory, and interfaces; they provide logical, not physical, separation.

  D. VSYS automatically eliminate interzone policies Traffic betweensecurity zones (even across VSYS) still requiresexplicit Security policies. Firewall Deployment - VSYS enablecost-effective multitenancyon a single hardware platform. Security Policies - Per-tenant or per-business-unit policies are centrally managed via Panorama. Zero Trust Architectures - Enforcesstrong segmentationbetween business units with separate zones and VSYS.

• Question 63:

  Which Panorama centralized management feature allows native and third-party integrations to monitor VM-Series NGFW logs and objects?

  A. Plugin
  B. Template
  C. Device Group
  D. Log Forwarding profile
  A. Plugin

  ---

  Explanation

  InPanorama centralized management,Pluginsenablenative and third-party integrationsto monitorVM-Series NGFW logs and objects. Native Integrations - Panorama plugins providebuilt-in support for cloud environmentslikeAWS, Azure, GCP, as well asVM-Series firewalls. Third-Party Integrations - Plugins allow Panorama tosend logs and security telemetryto third-party systems likeSIEMs, SOARs, and IT automation tools. Log Monitoring & Object Management - Plugins helpexport logs, monitor firewall events, and manage dynamic firewall configurationsin cloud deployments.

  Automation and API Support - Pluginsextend Panorama's capabilitiesby integrating with external systems via APIs.

  B. Template# Incorrect, becauseTemplates are used for configuring firewall settingslike network interfaces, not forlog monitoring or third-party integrations.

  C. Device Group# Incorrect, becauseDevice Groups manage firewall policies and objects, but donot handle log forwarding or third-party integrations.

  D. Log Forwarding Profile# Incorrect, becauseLog Forwarding Profiles define how logs are sent, butdo not provide integration capabilities with third-party tools. Firewall Deployment-Panoramauses pluginsto integrate VM-Series NGFWs with cloud platforms. Security Policies - Plugins supportpolicy-based log forwarding and integrationwith external security tools. VPN Configurations - Cloud-based VPNs can bemanaged and monitored using plugins. Threat Prevention - Plugins enableSIEM integrationto monitor threat logs. WildFire Integration - Some plugins supportautomated malware analysis and reporting. Zero Trust Architectures - Supportslog-based security analyticsfor Zero Trust enforcement. How Plugins Enable Integrations in PanoramaWhy Other Options Are Incorrect?References to Firewall Deployment and Security Features:Thus, the correct answer is:#A. Plugin

• Question 64:

  When a firewall acts as an application-level gateway (ALG), what does it require in order to establish a connection?

  A. Pinhole
  B. Dynamic IP and Port (DIPP)
  C. Session Initiation Protocol (SIP)
  D. Payload
  A. Pinhole

  ---

  Explanation

  When a firewall functions as anApplication-Level Gateway (ALG), it intercepts, inspects, and dynamically manages traffic at theapplication layerof the OSI model. The primary role of an ALG is to providedeep packet inspection (DPI), address translation, and protocol complianceenforcement.

  To establish a connection successfully, an ALG requires apinhole-a temporary, dynamically created rule that allows the firewall to permit the return traffic necessary for specific applications (e.g., VoIP, FTP, and SIP-based traffic). The sepinholesare essential because many applications dynamically negotiate port numbers, makingstatic firewall rules ineffective. For example, when aSession Initiation Protocol (SIP)application initiates a connection, the firewalldynamically opens a pinholeto allow the SIP media stream (RTP) to pass through while maintaining security controls. Once the session ends, the pinhole is closed to prevent unauthorized access.

  Firewall Deployment - ALGs are commonly deployed in enterprise network firewalls to manage application-specific connections securely.

  Security Policies - Firewalls use ALG security policies to allow or block dynamically negotiated connections.

  VPN Configurations - Some VPNs rely on ALGs for handling complex applications requiring NAT traversal.

  Threat Prevention - ALGs help detect and prevent application-layer threats by inspecting traffic content.

  WildFire - Not directly related, but deep inspection features like WildFire can work alongside ALG to inspect payloads for malware.

  Panorama - Used for centralized policy management, including ALG-based policies.

  Zero Trust Architectures - ALG enhances Zero Trust by ensuringonly explicitly allowed application trafficis permitted through temporary pinholes. References to Firewall Deployment and Security Features:Thus, the correct answer isA.

  Pinholebecause it enables a firewall to establish application-layer connections securely while enforcing dynamic traffic filtering.

• Question 65:

  A company allows access to its approved Google Workspace tenant but wants to prevent users from signing in to personal or other unauthorized Google Workspace environments.

  Which configuration meets this requirement?

  A. Tenant restrictions
  B. Dynamic Address Groups
  C. URL category override
  D. DoS Protection profile
  A. Tenant restrictions

  ---

  Explanation

  Tenant restrictions are used to allow access to approved SaaS tenants while blocking access to unsanctioned ones. In this case, they provide control over which Google Workspace tenant users may access, helping prevent data movement to personal or unauthorized environments. This is the appropriate control for differentiating between sanctioned and unsanctioned tenants of the same SaaS service.

  Option B is incorrect because Dynamic Address Groups organize IP-based objects and do not control SaaS tenant access.

  Option C is incorrect because URL controls do not provide tenant-level enforcement for approved versus unapproved Google Workspace environments.

  Option D is incorrect because DoS Protection addresses availability attacks, not SaaS tenant restriction.

• Question 66:

  Which security profile will provide the best protection against ICMP floods, based on individual combinations of a packet`s source and destination IP address?

  A. DoS protection
  B. URL filtering
  C. packet buffering
  D. anti-spyware
  A. DoS protection

• Question 67:

  A network engineer is planning to migrate several branch offices from a legacy hub-and-spoke VPN design to Prisma SD-WAN with ION devices.

  Which benefit is achieved by enabling dynamic path selection instead of keeping all traffic pinned to the data center hub?

  A. It ensures that only IPsec tunnels are used for site-to-site connectivity
  B. It allows direct branch-to-internet and branch-to-branch paths based on performance metrics
  C. It removes the need for NGFW inspection on any traffic leaving the branch
  D. It guarantees that all SaaS traffic uses a single, centralized egress point
  B. It allows direct branch-to-internet and branch-to-branch paths based on performance metrics

  ---

  Explanation

  Prisma SD-WAN usesdynamic path selectionto optimize traffic flows.

  Performance-based routing (B)

  ION devices continuously measurelatency, loss, and jitteracross available links.

  Traffic can be sentdirectly from branch to branchor from branch to internet/SaaS destinations without hairpinning through a central hub,improving performance and user experience.

  A. Only IPsec tunnels Prisma SD-WAN can usemultiple transport types(internet, MPLS, etc.); it is not limited to IPsec only.

  C. Removes the need for NGFW inspection Security inspection is still required; traffic can be steered tocloud-delivered securityor NGFWs as part of the design.

  D. Guarantees a single centralized egress Dynamic path selection oftenreduces reliance on a single egress pointby enablinglocal or regional breakout. Firewall Deployment - Prisma SD-WAN integrates with NGFW and Prisma Access forsecure optimized routing. Security Policies - Policies can follow theuser and applicationeven when the network path changes. Zero Trust Architectures - Maintainssecure access while improving performance for distributed users.

• Question 68:

  You receive notification about new malware that infects hosts through malicious files transferred by FTP.

  Which Security profile detects and protects your internal networks from this threat after you update your firewall's threat signature database?

  A. URL Filtering profile applied to inbound Security policy rules.
  B. Data Filtering profile applied to outbound Security policy rules.
  C. Antivirus profile applied to inbound Security policy rules.
  D. Vulnerability Prote ction profile applied to outbound Security policy rules.
  C. Antivirus profile applied to inbound Security policy rules.

  ---

  Explanation

  References:

  https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/policy/security-profiles

• Question 69:

  A company has an ongoing initiative to monitor and control IT-sanctioned SaaS applications. To be successful, it will require configuration of decryption policies, along with data filtering and URL Filtering Profiles used in Security policies.

  Based on the need to decrypt SaaS applications, which two steps are appropriate to ensure success? (Choose two.)

  A. Validate which certificates will be used to establish trust.
  B. Configure SSL Forward Proxy.
  C. Create new self-signed certificates to use for decryption.
  D. Configure SSL Inbound Inspection.
  A. Validate which certificates will be used to establish trust.
  B. Configure SSL Forward Proxy.

  ---

  Explanation

  To successfullymonitor and control IT-sanctioned SaaS applications,decryption policies must be configured, along withData Filtering and URL Filtering Profilesin Security Policies. Validate which certificates will be used to establish trust (##Correct)

  When configuring SSL decryption, the firewall mustestablish trust between endpoints and the proxy certificate. This involvesdeploying a trusted root certificatetointernal user devicesto avoid SSL/TLS warnings.

  Configure SSL Forward Proxy (##Correct) SSL Forward Proxy is required for decrypting outbound HTTPS trafficto SaaS applications.

  It allowspolicy enforcement on SaaS-bound traffic, includingURL filtering, data filtering, and application control.

  C. Create new self-signed certificates to use for decryption.# Incorrect, becauseself-signed certificates are not recommended for large-scale deployments. Enterprise deployments should use an internal CA or a trusted third-party CA.

  D. Configure SSL Inbound Inspection.# Incorrect, becauseSSL Inbound Inspection is used for decrypting traffic destined for internal servers, notSaaS application traffic. SaaS applications areexternal services, soSSL Forward Proxyis required instead. Firewall Deployment - EnforcesSSL decryption policies on SaaS traffic. Security Policies - AppliesURL filtering, threat prevention, and data filtering on decrypted traffic. VPN Configurations - EnsuresGlobalProtect users' traffic is inspected securely. Threat Prevention - Detectsmalware, credential theft, and unauthorized data exfiltration in SaaS traffic. WildFire Integration - Analyzesdecrypted files for malware threats. Panorama - Providescentralized management of SaaS decryption policies. Zero Trust Architectures - Ensuresonly approved SaaS applications are accessed securely. Why The se Two Steps Are Necessary?Why Other Options Are Incorrect?References to Firewall Deployment and Security Features:Thus, the correct answers are:#A. Validate which certificates will be used to establish trust.#B. Configure SSL Forward Proxy.

• Question 70:

  Why would an enterprise architect use a Zero Trust Network Access (ZTNA) connector instead of a service connection for private application access?

  A. It controls traffic from the mobile endpoint to any of the organization's internal resources.
  B. It functions as the attachment point for IPSec-based connections to remote site or branch networks.
  C. It supports traffic sourced from on-premises or public cloud-based resources to mobile users and remote networks.
  D. It automatically discovers private applications and suggests Security policy rules for them.
  D. It automatically discovers private applications and suggests Security policy rules for them.

  ---

  Explanation

  AZero Trust Network Access (ZTNA) connectoris used instead of aservice connectionforprivate application accessbecause it providesautomatic application discovery and policy enforcement.

  Discovers Private Applications

  The ZTNA connectorautomatically identifiespreviously unknown or unmanagedprivate applications running in adata center or cloud environment.

  Suggests Security Policy Rules

  After discovering applications, itsuggests appropriate security policiesto control user access, ensuringZero Trust principlesare followed.

  Granular Access Control

  It enforcesleast-privilege accessand appliesidentity-based security policiesfor private applications.

  (A) Controls traffic from the mobile endpoint to any of the organization's internal resources.

  This describesZTNA enforcement, butdoes not explain why a ZTNA connector is preferred over a service connection. (B) Functions as the attachment point for IPsec-based connections to remote site or branch networks.

  This describes aservice connection, which is different from aZTNA connector. (C) Supports traffic sourced from on-premises or public cloud-based resources to mobile users and remote networks.

  This aligns more withPrisma Access service connections, not ZTNA connectors.

  Zero Trust Architectures - ZTNA ensures that private applications arediscovered, classified, and protected.

  Firewall Deployment & Security Policies - ZTNA connectors automateprivate application security.

  Threat Prevention & WildFire - Provides additional security layers for private apps.

  Why is ZTNA Connector the Right Choice?Other Answer Choices AnalysisReferences and Justification:Thus, ZTNA Connector (D) is the correct answer, as itautomatically discovers private applications and suggests security policy rules for them.