netsec-generalist Sample Questions & Answers

Panorama uses a hierarchical structure for policies with Pre-rules, Local rules, and Post-rules. Pre-rules are evaluated first and are inherited by all lower-level device groups. To enforce a global blocking rule that cannot be overridden by local administrators, the best practice is to place it in the Pre-rules of the top-level device group. This ensures it is applied consistently across all 500 firewalls and takes precedence over any more specific, local rules.

This statement is false. Enterprise DLP requires a multi-step configuration. First, you define a Data Pattern (e.g., for credit card numbers). Second, you add this pattern to a Data Filtering Profile and set the action to 'block'. Finally, this Data Filtering Profile must be attached to the relevant Security policy rule. Simply having the data pattern defined and attached to a rule without the profile and action is insufficient to block exfiltration.

Palo Alto Networks IoT Security learns the normal behavior of devices and can automatically generate security policy recommendations based on this baseline. This feature creates highly specific rules using Device-ID, App-ID, and known destinations. By importing and applying this recommended policy, the administrator can create a rule that allows only the legitimate, expected traffic for the 'Infusion Pump' device profile and implicitly denies all other traffic, such as the anomalous SSH connection, without disrupting its core medical functions.

The WildFire Analysis profile determines which files get sent to the sandbox for analysis, but it does not block files based on verdicts. The blocking action is handled by other security profiles. When WildFire identifies a file as malicious, it generates a new signature and categorizes it under the 'wildfire-virus' subtype. To proactively block future downloads of this and other WildFire-identified malware, the Antivirus profile must be configured to block (e.g., 'reset-both') this specific subtype. This ensures that once a verdict is known, subsequent attempts to download the same file are immediately blocked.

The core advantage of App-ID over port-based rules is its ability to identify the true application regardless of the port it uses. When a rule is configured with a service object like 'service-http' (port 80), it allows any application to use that port. This creates a significant security gap, as malicious or unwanted applications (e.g., peer-to-peer file sharing, remote access tools) can tunnel their traffic over port 80 to bypass security controls. Using App-ID ensures that only the intended application (e.g., 'web-browsing') is allowed, effectively closing this gap.

The correct and safest procedure is to first back up the current state by exporting the configuration. Then, the new PAN-OS version is downloaded and installed (this does not activate it). The firewall is then rebooted to load the new version. After the reboot, it is critical to verify that the firewall is operating as expected. Only after confirming operational status should the latest content versions (like Applications and Threats) be downloaded and installed to ensure compatibility with the new OS.

Zero Touch Provisioning is designed to automate the initial setup. For it to work, the administrator must first 'claim' the device in the cloud-based Prisma SD-WAN portal using its serial number and assign it to a pre-configured site. At the physical site, the only requirements are to plug in power and connect a WAN port to an internet link that provides an IP address via DHCP. The device will then automatically connect to the portal, authenticate itself, and download its full configuration.

The 'Enforce GlobalProtect Connection for Network Access' feature is specifically designed for this purpose. When enabled in the GlobalProtect agent settings, it ensures that if the VPN tunnel to Prisma Access is disconnected for any reason, all network traffic on the endpoint is blocked (with exceptions for captive portal detection, etc.). This prevents the device from falling back to an unprotected state on a local network (e.g., at a coffee shop or hotel) and maintains the intended security posture.

Strata Cloud Manager (and Panorama) uses a hierarchical folder structure for managing configurations. To create an object like a custom URL category that can be reused and inherited by multiple devices, it should be created in the 'Objects' tab at the appropriate folder level (e.g., a shared or global folder). Objects created here are available to any security policy within that folder and its sub-folders, promoting consistency and reusability.

The fundamental method for network segmentation on a Palo Alto Networks firewall is the use of security zones. By assigning the student network interface to a 'Students' zone and the faculty network interface to a 'Faculty' zone, the firewall's default intra-zone allow and inter-zone deny posture can be leveraged. A security policy would be required to explicitly allow traffic from the 'Students' zone to the 'Faculty' zone. By not creating such a policy, traffic between them is implicitly denied, achieving the required segmentation. Separate policies can then be created to allow each zone to access the 'Internet' zone.