10 free Palo Alto Networks Network Security Professional practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 90 questions. Work through them, then open each answer to check your reasoning.
Get all 90 questions (US$39) · Download these 10 as a PDF
Question 1
Which two tools can be used to configure Cloud NGFWs for AWS? (Choose two.)
Show answer and explanation
Correct answer: C, D
C. Cloud service provider (CSP) management console D. Panorama Cloud NGFWs for AWS can be configured through two primary methods: the Cloud service provider (CSP) management console (AWS console) for infrastructure and resource management, and Panorama for centralized policy and security management. Prisma Cloud is used for cloud security posture management rather than NGFW configuration, and Cortex XSIAM is a security operations platform, not a configuration tool for Cloud NGFWs.
Why the other options are wrong
- A. Prisma Cloud manages cloud security posture and compliance, not Cloud NGFW configuration.
- B. Cortex XSIAM is a security operations and incident response platform, not a NGFW configuration tool.
Question 2
In which two applications can Prisma Access threat logs for mobile user traffic be reviewed? (Choose two.)
Show answer and explanation
Correct answer: B, C
B. Strata Cloud Manager (SCM) C. Strata Logging Service Prisma Access threat logs for mobile user traffic can be reviewed in Strata Cloud Manager (SCM), which serves as the unified management interface for Prisma Access, and in Strata Logging Service, which provides centralized log collection and analysis. Prisma Cloud dashboard focuses on cloud security posture management, and Service connection firewall is not a log review application.
Why the other options are wrong
- A. Prisma Cloud dashboard is for cloud security posture and compliance, not Prisma Access threat log review.
- D. Service connection firewall is an infrastructure component, not an application for reviewing threat logs.
Question 3
A network security engineer needs to implement segmentation but is under strict compliance requirements to place security enforcement as close as possible to the private applications hosted in Azure.
Which deployment style is valid and meets the requirements in this scenario?
Show answer and explanation
Correct answer: B. On a VM-Series NGFW, configure several Layer 3 zones with Layer 3 interfaces assigned to logically segment the network.
For Azure environments with strict compliance requirements to place security enforcement as close as possible to private applications, a VM-Series NGFW with Layer 3 zones and Layer 3 interfaces is the appropriate choice. VM-Series is designed for virtualized and cloud environments like Azure, while PA-Series is for on-premises deployments. Layer 3 interfaces provide logical segmentation at the network layer closest to the applications, meeting the proximity and compliance requirements.
Why the other options are wrong
- A. PA-Series firewalls are designed for on-premises deployments, not Azure cloud environments.
- C. While VM-Series in Azure is correct, Layer 2 zones provide bridge-mode segmentation rather than the logical Layer 3 network segmentation needed for this scenario.
- D. PA-Series is not suitable for Azure deployments, and Layer 2 zones are not the appropriate segmentation method for this requirement.
Question 4
When adding a Zero Touch Provisioning (ZTP) firewall to Panorama, when can the firewall be powered on?
Show answer and explanation
Correct answer: B. After activating registration and completing license deployment profile
When adding a Zero Touch Provisioning (ZTP) firewall to Panorama, the firewall can be powered on after activating registration and completing the license deployment profile. The ZTP process requires proper registration activation and license profile configuration before the device is fully operational. This sequence ensures the device is properly prepared to receive configurations and policies from Panorama.
Why the other options are wrong
- A. License activation occurs after the firewall is powered on and registered, not before it can be powered on.
- C. The firewall can be powered on before all installation procedures are completed; specific steps (registration and license profile) are the prerequisites.
- D. The firewall should not be powered on during the initial installation phase; it must first complete the ZTP registration and licensing process.
Question 5
Which profile can help prevent the transmission of sensitive information to internet applications?
Show answer and explanation
Correct answer: B. Data Filtering
The Data Filtering profile is specifically designed to prevent the transmission of sensitive information to internet applications by identifying and blocking data that matches predefined patterns and criteria. It inspects traffic for sensitive data such as credit card numbers, social security numbers, and other personally identifiable information. Antivirus, Anti-spyware, and URL Filtering focus on malware protection and access control rather than sensitive data protection.
Why the other options are wrong
- A. Antivirus profiles protect against malicious files and malware, not sensitive data transmission.
- C. Anti-spyware profiles detect and block spyware and malicious applications, not sensitive data exposure.
- D. URL Filtering controls access to websites based on categories, not the transmission of sensitive information within allowed applications.
Question 6
How do template stacks help manage firewall configurations in Panorama?
Show answer and explanation
Correct answer: A. By grouping templates across multiple firewalls
Template stacks in Panorama help manage firewall configurations by grouping templates across multiple firewalls, allowing administrators to organize and apply consistent policy configurations to different sets of devices. This hierarchical structure enables efficient management of large-scale deployments. Template variables are used within templates for dynamic configuration values, network diagrams are separate visualization tools, and firmware updates are managed through device management features rather than template stacks.
Why the other options are wrong
- B. Template variables are created within templates for configuration flexibility, not the primary function of template stacks themselves.
- C. Network diagrams are separate visualization tools in Panorama; template stacks manage configurations, not visual representations.
- D. Firmware updates are handled through Panorama's device management and software update features, not through template stacks.
Question 7
Which subscription sends non-file format-based traffic that matches Data Filtering profile criteria to a cloud service to render a verdict?
Show answer and explanation
Correct answer: D. Advanced WildFire
Advanced WildFire is the subscription that sends non-file format-based traffic matching Data Filtering profile criteria to a cloud service for verdict determination. This subscription extends WildFire capabilities to analyze content beyond traditional file formats, providing cloud-based analysis for a broader range of data types. SaaS Security Inline focuses on SaaS application security, Enterprise DLP is on-device data loss prevention, and Advanced URL Filtering categorizes URLs rather than analyzing data content.
Why the other options are wrong
- A. SaaS Security Inline protects SaaS applications and users, not non-file format data analysis.
- B. Enterprise DLP performs on-device data filtering based on policies, not cloud-based verdict analysis for non-file formats.
- C. Advanced URL Filtering categorizes and controls access to websites, not clou-ased analysis of data content.
Question 8
A cloud security architect is designing a certificate management strategy for Strata Cloud Manager (SCM) across hybrid environments.
Which practice ensures optimal security with low management overhead?
Show answer and explanation
Correct answer: D. Deploy centralized certificate automation with standardized protocols and continuous monitoring.
For optimal security with low management overhead in hybrid environments, deploying centralized certificate automation with standardized protocols and continuous monitoring is the best practice. This approach ensures consistent security posture across all environments while reducing manual effort and human error. Centralized automation enables efficient scaling, standardized renewal processes, and real-time visibility into certificate lifecycle management. Separate authorities increase complexity, manual deployment increases overhead, and relying on cloud provider defaults may not meet security standards or compliance requirements.
Why the other options are wrong
- A. Separate certificate authorities for each environment increases complexity and management overhead rather than reducing it.
- B. Manual certificate deployment with quarterly reviews is labor-intensive and does not meet the low overhead requirement.
- C. Relying on cloud provider defaults reduces control over security policies and may not meet specific compliance or organizational standards.
Question 9
Which two prerequisites must be evaluated when decrypting internet-bound traffic? (Choose two.)
Show answer and explanation
Correct answer: A, C
A. Incomplete certificate chains C. Certificate pinning When decrypting internet-bound traffic, two critical prerequisites must be evaluated: incomplete certificate chains, which can cause decryption failures if the full chain cannot be validated, and certificate pinning, which is an application-level security mechanism that may reject decrypted traffic if the certificate presented does not match the pinned certificate. Both must be assessed to prevent connectivity issues and security bypasses during traffic inspection.
Why the other options are wrong
- B. RADIUS profiles are authentication mechanisms unrelated to the prerequisites for decrypting TLS traffic.
- D. SAML certificates are used for identity federation and single sign-on, not for evaluating TLS decryption prerequisites.
Question 10
In which order does an NGFW process URL categories for Security policy?
Show answer and explanation
Correct answer: A. 1. External dynamic lists 2. Custom URL categories 3. Predefined categories
Predefined categories An NGFW processes URL categories in a specific priority order: first External Dynamic Lists (EDLs), which provide real-time threat intelligence; second Custom URL Categories, which contain organization-specific categorizations; and third Predefined Categories, which are the default built-in categories from the vendor. This ordering allows the most specific and current threat information to be evaluated first, with fallback to custom definitions and then vendor defaults.
Why the other options are wrong
- B. This order incorrectly prioritizes custom categories before external dynamic lists, missing the real-time threat intelligence advantage.
- C. This order incorrectly places external dynamic lists last, preventing real-time threat data from being evaluated with highest priority.
- D. This order incorrectly prioritizes predefined categories first, which would bypass more specific custom and dynamic threat intelligence.
That was 10 of 90.
The full Palo Alto Networks Network Security Professional pack has all 90 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.