Palo Alto Networks PAN-NSG Online Practice Questions and Exam Preparation

Palo Alto Networks PAN-NSG Online Questions & Answers

• Question 81:

  Which Cloud-Delivered Security Services (CDSS) solution is required to configure and enable Advanced DNS Security?

  A. Advanced WildFire
  B. Enterprise SaaS Security
  C. Advanced Threat Prevention
  D. Advanced URL Filtering
  C. Advanced Threat Prevention

  ---

  Explanation

  Advanced DNS Securityis aCloud-Delivered Security Services (CDSS) solutionthat protects againstDNS-based threatssuch as command-and-control (C2) communications, domain generation algorithms (DGAs), and DNS tunneling. To enableAdvanced DNS Security, theAdvanced Threat Prevention(ATP) license is required, as it includes: Real-time threat analysis of DNS queries Protection against newly registered and malicious domains Detection and blocking of DNS-based attacks ATP extends beyond traditional DNS filteringby usingmachine learningto analyze DNS traffic dynamically.

  Blocks DNS requests to malicious domains in real-time.

  Works in combination with WildFire and Threat Intelligence Cloudto provide up-to-date protection.

  (A) Advanced WildFire - Providessandboxing for malware detection,not DNS security.

  (B) Enterprise SaaS Security - Focuses onSaaS application security,not DNS-based threats.

  (D) Advanced URL Filtering - Controlsweb access, butdoes not analyze DNS traffic.

  Threat Prevention & WildFire - Advanced Threat Prevention includesDNS Securityas akey feature.

  Zero Trust Architectures - Ensures DNS requests arenot blindly trustedbut verified against threat intelligence.

  Why Advanced Threat Prevention is the Correct Answer?Other Answer Choices AnalysisReferences and Justification:Thus,Advanced Threat Prevention (C) is the correct answer, as it is required to enableAdvanced DNS Security.

• Question 82:

  A firewall rule currently allows broad traffic based on ports, and the administrator wants to tighten it by using the applications actually seen over the last several weeks.

  Which tool should be used?

  A. ADEM
  B. Security Lifecycle Review
  C. Policy Optimizer
  D. Data Filtering logs
  C. Policy Optimizer

  ---

  Explanation

  Policy Optimizer analyzes observed traffic and helps administrators identify the applications that have matched existing rules over time. This makes it possible to replace broad port-based rules with more specific App-ID-based controls and improve policy accuracy. The tool is designed specifically to refine rules based on historical application usage.

  Option A is incorrect because ADEM focuses on user and application experience monitoring rather than rule refinement.

  Option B is incorrect because Security Lifecycle Review provides broader assessment information, not detailed policy optimization for observed applications.

  Option D is incorrect because Data Filtering logs relate to content and data-matching activity, not application-based policy tightening.

• Question 83:

  A security team wants to use AIOps for NGFW to reduce configuration drift and detect risky changes across dozens of firewalls managed by Panorama.

  Which AIOps feature directly helps identify and alert on deviations from best practices and policy misconfigurations?

  A. Policy Analyzer
  B. Capacity Analyzer
  C. Host Information Profile analyzer
  D. Decryption Broker
  A. Policy Analyzer

  ---

  Explanation

  AIOps for NGFW providesanalytics and best-practice validationacross firewalls.

  Policy Analyzer (A)

  Inspects existingSecurity policies, objects, and configurationsagainstbest-practice checks.

  Highlightsoverly permissive rules, unused objects, and misconfigurations that increase risk.

  Can triggeralertswhen new changes introducepolicy driftfrom recommended baselines.

  B. Capacity Analyzer Monitors hardware resource utilization, notpolicy correctness.

  C. Host Information Profile analyzer HIP is anendpoint posture feature of GlobalProtect; it is not an AIOps analyzer.

  D. Decryption Broker Relates todecryption traffic distributionand does not evaluate configuration risk. Firewall Deployment - Panorama-managed firewalls are continuously evaluated by AIOps. Security Policies - Policy Analyzer supports ongoinghardeningandcleanup of rules. Zero Trust Architectures - Helps enforce "never trust, always verify" throughleast-privilege policy designs.

• Question 84:

  An IT security administrator is maintaining connectivity and security between on-premises infrastructure, private cloud, and public cloud environments in Strata Cloud Manager (SCM).

  Which set of practices must be implemented to effectively manage certificates and ensure secure communication across these segmented environments?

  A. Use a centralized certificate management solution. Regularly renew and update certificates. Employ strong encryption protocols.
  B. Use self-signed certificates for all environments. Renew certificates manually once a year. Avoid automating certificate management to maintain control.
  C. Rely on the cloud provider's default certificates. Avoid renewing certificates to reduce overhead and complexity. Manage certificate deployment manually.
  D. Implement different certificate authorities (CAs) for each environment. Use default certificate settings. Renew certificates only when they expire to reduce overhead and complexity.
  A. Use a centralized certificate management solution. Regularly renew and update certificates. Employ strong encryption protocols.

  ---

  Explanation

  When managingconnectivity and securitybetweenon-premises, private cloud, and public cloud environmentsinStrata Cloud Manager (SCM),proper certificate managementis essential to: Ensure encrypted communication across segmented environments Prevent expired or weak certificates from becoming security vulnerabilities Simplify management across multiple cloud and on-premise networks

  A centralized solutionautomatescertificate deployment, renewal, and monitoring.

  Regular renewal prevents security gapscaused by expired certificates.

  Strong encryption ensures secure communicationbetween environments.

  (B) Use self-signed certificates, renew manually, and avoid automation-High security risk: Self-signed certificatesare not trustedacross hybrid environments. Manual renewal is error-proneand can lead to outages. (C) Rely on cloud provider's default certificates, avoid renewal-Cloud provider certificates do not cover on-premises security.

  Avoiding renewalincreases the risk of certificate expiration and security breaches.

  (D) Use different CAs for each environment, renew only when expired-Managing multiple CAs increases complexityand does not provide unified security.

  Delaying renewal can result in expired certificates causing outages.

  Firewall Deployment & Security Policies - Secure communicationrequires valid, trusted certificates.

  Zero Trust Architectures-Consistent certificate management enforces encrypted, trusted communication.

  Why is Centralized Certificate Management the Correct Choice?Other Answer Choices AnalysisReferences and Justification:Thus,A centralized certificate management solution (A) is the correct answer, as it ensuressecure, automated, and regularly updated encryptionacrosson-prem, private, and public cloud environments.

• Question 85:

  After a Best Practice Assessment (BPA) is complete, it is determined that dynamic updates for Cloud-Delivered Security Services (CDSS) used by company branch offices do not match recommendations. The snippet used for dynamic updates is currently set to download and install updates weekly.

  Knowing these devices have the Precision Al bundle, which two statements describe how the settings need to be adjusted in the snippet? (Choose two.)

  A. Applications and threats should be updated daily.
  B. Antivirus should be updated daily.
  C. WildFire shouldbe updated every five minutes.
  D. URL filtering should be updated hourly.
  A. Applications and threats should be updated daily.
  C. WildFire shouldbe updated every five minutes.

  ---

  Explanation

  ABest Practice Assessment (BPA)evaluates firewall configurations against Palo Alto Networks' recommendedbest practices. In this case, theCloud-Delivered Security Services (CDSS)update settings do not align with best practices, as they are currently set toweekly updates, whichdelays threat prevention.

  Applications and Threats - Update Daily Regular updates ensure the firewalldetects and blocks the latest exploits, vulnerabilities, and malware.

  Weekly updates aretoo slowand leave the network vulnerable to newly discovered attacks.

  WildFire - Update Every Five Minutes

  WildFire is Palo Alto Networks' cloud-based malware analysis engine, whichidentifies and mitigates new threats in near real-time.

  Updating every five minutesensures that newly discovered malware signatures are applied quickly.

  A weekly update would significantlydelaythreat response. (B) Antivirus should be updated daily.

  While frequent updates are recommended,Antivirus in Palo Alto firewalls is updated hourly by default(not daily). (D) URL Filtering should be updated hourly.

  URL Filtering databases are updated dynamically in the cloud, and do not require fixed hourly updates.

  URL filtering effectiveness depends on cloud integration rather than frequent updates.

  Firewall Deployment - Ensuring dynamic updates align with best practices enhances security.

  Security Policies - Applications, Threats, and WildFire updates are critical for enforcing protection policies.

  Threat Prevention & WildFire - Frequent updates reduce the window of exposure to new threats.

  Panorama - Updates can be managed centrally for branch offices.

  Zero Trust Architectures - Requires real-time threat intelligence updates.

  Best Practices for Dynamic Updates in the Precision AI BundleOther Answer Choices AnalysisReferences and Justification:Thus,Applications & Threats (A) should be updated daily, and WildFire (C) should be updated every five minutesto maintainoptimal security posturein accordance with BPA recommendations.

• Question 86:

  Which two policies in Strata Cloud Manager (SCM) will ensure the personal data of employees remains private while enabling decryption for mobile users in Prisma Access? (Choose two.)

  A. SSH Decryption
  B. SSL Inbound Inspection
  C. SSL Forward Proxy
  D. No Decryption
  C. SSL Forward Proxy
  D. No Decryption

  ---

  Explanation

  InStrata Cloud Manager (SCM), policies need to balanceprivacywhile ensuringsecure decryption for mobile users in Prisma Access. The correct approach involves: SSL Forward Proxy (C) - Enablesdecryption of outbound SSL traffic, allowing security inspection while ensuring unauthorized data does not leave the network. No Decryption (D)-Excludes personal data from being decrypted, ensuring compliance withprivacy regulations(e.g., GDPR, HIPAA) and protecting sensitive employee information. SSL Forward Proxy (C) Decrypts outbound SSL trafficfrom mobile users. Inspects traffic for malware, data exfiltration, and compliance violations. Ensurescorporate security policiesare enforced on user traffic.

  No Decryption (D)

  Ensuresprivacy-sensitive traffic(e.g., online banking, healthcare portals) remainsuntouched.

  Exclusionscan be defined based oncategories, user groups, or destinations.

  Helps maintainregulatory compliancewhile still securing other traffic.

  (A) SSH Decryption - Not relevant in this context, as SSH traffic is typically used for administrative access rather than mobile user web browsing. (B) SSL Inbound Inspection - Used forinbound traffic to company-hosted servers, not for securing outbound traffic from mobile users.

  Firewall Deployment - SSL Forward Proxy enables traffic visibility, No Decryption protects privacy.

  Security Policies - Defines what traffic should or should not be decrypted.

  Threat Prevention & WildFire - Decryption helps detect hidden threats while excluding sensitive personal data.

  Zero Trust Architectures - Ensuresleast-privilege access while maintaining privacy compliance.

  Why The se Two Policies?Other Answer Choices AnalysisReferences and Justification:Thus,SSL Forward Proxy (C) and No Decryption (D) are the correct answers, as they balance security and privacy for mobile users in Prisma Access.

• Question 87:

  A firewall administrator needs to reduce the volume of logs sent to Strata Logging Service while preserving high-value security events for investigation.

  Which two approaches align with best practices? (Choose two.)

  A. Configure log suppression for repeated identical threat events within a short period
  B. Disable logging on Security policies that "allow" traffic between any internal zones
  C. Use log forwarding filters to forward only critical, high, and medium severity events
  D. Disable URL Filtering logs and rely completely on Threat logs for web activity
  A. Configure log suppression for repeated identical threat events within a short period
  C. Use log forwarding filters to forward only critical, high, and medium severity events

  ---

  Explanation

  Efficient logging keepsuseful signalwhile minimizing noise and storage consumption.

  Log suppression (A)

  Prevents repeated logging ofidentical events(same source, destination, threat ID) within a short window.

  Reduces log volume fromnoisy or recurring threatswithout losing visibility of the pattern.

  Severity-based log forwarding filters (C)

  Strata Logging Service can receiveonly critical/high/medium eventsfor certain log types.

  Low-severity or informational events can be kept locally or discarded based on risk appetite.

  B. Disable logging on "allow" rules between internal zones Thiscan mask lateral movementand internal recon activity; not a safe practice.

  D. Disable URL Filtering logs Loses visibility intouser web behaviorand policy violations; Threat logs do not fully replace URL logs. Firewall Deployment - Log forwarding profiles control how much and what type of data is sent to Strata Logging Service. Security Operations - SOC teams rely onprioritized, high-quality logsfor detection and investigation. Zero Trust Architectures - Visibility intointernal and external flows remains essential, even with tuned logging.

• Question 88:

  A branch deployment is being migrated from a hub-and-spoke WAN design to Prisma SD-WAN. The goal is to improve performance for SaaS and inter-branch traffic by avoiding unnecessary backhaul through the data center.

  Which capability should be enabled?

  A. Dynamic path selection
  B. Static route redistribution only
  C. SSL Inbound Inspection
  D. Server certificate pinning
  A. Dynamic path selection

  ---

  Explanation

  Dynamic path selection allows Prisma SD-WAN to choose traffic paths based on real-time performance measurements such as latency, loss, and jitter. This enables more efficient routing for branch-to-internet and branch-to-branch traffic and helps avoid the performance penalties of always backhauling through a central hub. It directly addresses the requirement to improve operational efficiency and application experience.

  Option B is incorrect because static routing alone does not provide performance-based path decisions.

  Option C is incorrect because SSL Inbound Inspection is unrelated to WAN path optimization.

  Option D is incorrect because certificate pinning is not a Prisma SD-WAN traffic-steering capability.

• Question 89:

  A network security engineer wants to forward Strata Logging Service data to tools used by the Security Operations Center (SOC) for further investigation.

  In which best practice step of Palo Alto Networks Zero Trust does this fit?

  A. Implementation
  B. Report and Maintenance
  C. Map and Verify Transactions
  D. Standards and Designs
  B. Report and Maintenance

  ---

  Explanation

  ForwardingStrata Logging Service datatoSecurity Operations Center (SOC) toolsaligns with the"Report and Maintenance"phase ofPalo Alto Networks Zero Trust best practices.

  Continuous Monitoring - Security teamsanalyze logs and alerts from Strata Logging Serviceto detect threats.

  Incident Response - SOC teams uselog data for forensic investigationsand attack mitigation.

  Threat Intelligence Correlation - Strata logsintegrate with SIEM/SOAR platformsforautomated threat detection.

  Compliance & Auditing - Logssupport regulatory compliance effortsby maintainingdetailed activity records.

  A. Implementation# Incorrect, becauseImplementation focuses on configuring and deploying security controls, notongoing log analysis.

  C. Map and Verify Transactions# Incorrect, becausethis step involves identifying and mapping network transactions, rather thanreporting on security events.

  D. Standards and Designs# Incorrect, becausethis step involves setting security baselines, butdoes not include log monitoring and reporting. Why Report and Maintenance?Why Other Options Are Incorrect?

• Question 90:

  Which feature is available in both Panorama and Strata Cloud Manager (SCM)?

  A. Template stacks
  B. Configuration snippets
  C. Policy Optimizer
  D. Plug-ins
  C. Policy Optimizer

  ---

  Explanation

  Both Panorama and Strata Cloud Manager (SCM) offer the Policy Optimizer feature, which assists administrators in refining and enhancing security policies. Policy Optimizer identifies overly permissive or unused security rules and provides recommendations to convert them into more specific, application-based rules, thereby strengthening the organization's security posture. In Panorama, Policy Optimizer analyzes traffic logs to detect security rules that are too broad or unused.

  It then suggests modifications to these rules, enabling administrators to implement more precise policies that align with actual network traffic patterns.

  Similarly, Strata Cloud Manager incorporates Policy Optimizer to help organizations clean up and streamline their security policies. It offers insights into rule usage and provides actionable recommendations to replace broad rules with more specific ones, ensuring that security policies are both effective and efficient.