27 free Palo Alto Networks Network Security Professional practice questions from the CertStash pack of 108, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 27 free here, all 108 in the pack, and each step includes the one before it.
Get all 108 questions (US$39) · Download the first 10 as a PDF
Question 1
Which two tools can be used to configure Cloud NGFWs for AWS? (Choose two.)
Show answer and explanation
Correct answer: C, D. Cloud service provider (CSP) management console; Panorama
Cloud NGFW for AWS is a managed firewall service that customers subscribe to through AWS Marketplace, so the cloud service provider management console is one of the native places where firewall resources, endpoints and rulestacks are created and configured. Customers who already run Palo Alto Networks firewalls can also link the service to Panorama, which lets them build policy in familiar device groups and templates and push it to Cloud NGFW alongside their other firewalls. Together these two tools cover both the cloud native workflow and the centralized, consistent policy management workflow.
Why the other options are wrong
- A. The Prisma Cloud console is a cloud native application protection platform for posture, workload and code security. It is not used to build Cloud NGFW rulestacks or firewall policy.
- B. Cortex XSIAM is a security operations platform for data analytics, detection and response. It consumes security data but does not configure Cloud NGFW resources.
Question 2
In which two applications can Prisma Access threat logs for mobile user traffic be reviewed? (Choose two.)
Show answer and explanation
Correct answer: B, C. Strata Cloud Manager (SCM); Strata Logging Service
Prisma Access forwards the logs generated by its cloud firewalls, including threat logs for mobile user traffic, to Strata Logging Service, which stores the data centrally and makes it available for querying and analysis. Strata Cloud Manager reads that same log data and presents it in its Log Viewer, dashboards and activity views, so administrators can search and filter threat entries for mobile users directly from the management interface. Strata Logging Service is the log repository, and Strata Cloud Manager is the operational console used to review its contents.
Why the other options are wrong
- A. The Prisma Cloud dashboard covers cloud posture and workload protection for public cloud accounts. It is not where Prisma Access mobile user threat logs are viewed.
- D. A service connection is a Prisma Access component that links the service to headquarters or data center networks. It is not an application for reviewing logs.
Question 3
A network security engineer needs to implement segmentation but is under strict compliance requirements to place security enforcement as close as possible to the private applications hosted in Azure. Which deployment style is valid and meets the requirements in this scenario?
Show answer and explanation
Correct answer: B. On a VM-Series NGFW, configure several Layer 3 zones with Layer 3 interfaces assigned to logically segment the network.
Applications hosted in Azure can only be protected in place by a firewall that runs inside Azure, and the VM-Series is the virtual form factor built for that purpose. Azure virtual networks are routed environments that do not offer Layer 2 adjacency to a virtual appliance, so the VM-Series is deployed with Layer 3 interfaces, each in its own zone and subnet, and user defined routes steer traffic between segments through the firewall. Placing Layer 3 zones on a VM-Series in the same virtual network as the workloads puts enforcement as close as possible to the private applications and is a supported deployment.
Why the other options are wrong
- A. PA-Series firewalls are physical hardware appliances. They cannot run inside Azure, so they cannot place enforcement next to applications hosted there.
- C. Azure networking is Layer 3 routed and does not support the Layer 2 adjacency that Layer 2 interfaces require, so this is not a valid VM-Series design in Azure.
- D. A physical PA-Series appliance cannot be deployed inside Azure, and Layer 2 interfaces would not work in the routed Azure network in any case.
Question 4
When adding a Zero Touch Provisioning (ZTP) firewall to Panorama, when can the firewall be powered on?
Show answer and explanation
Correct answer: C. After all required installation and setup procedures are completed
Palo Alto Networks instructs administrators not to power on a Zero Touch Provisioning firewall until every required installation and setup procedure is finished. Before first boot, the firewall must be registered with its claim key, added to Panorama with the ZTP plugin, and given the configuration it will receive, and the device must be cabled so its management or data interface can reach the internet. Only then is the firewall powered on, at which point it contacts the ZTP service, is directed to its Panorama, and pulls its configuration automatically. Powering it on earlier causes onboarding to fail.
Why the other options are wrong
- A. License activation is one of the preparation tasks; powering on partway through it means the firewall boots before its ZTP onboarding is ready.
- B. This describes only part of the preparation, and it does not match the documented rule, which waits for all installation and setup procedures to be completed.
- D. Powering on during installation boots the firewall before registration, Panorama setup and cabling are complete, so ZTP onboarding fails.
Question 5
Which profile can help prevent the transmission of sensitive information to internet applications?
Show answer and explanation
Correct answer: B. Data Filtering
A Data Filtering profile is the Security profile that inspects content leaving the network for sensitive information. It uses data patterns, such as predefined patterns for credit card or Social Security numbers, regular expressions and file properties, and it applies alert or block thresholds when matches are found. Attached to a Security policy rule that governs traffic to internet applications, it can stop users from uploading or posting confidential data to those applications, which makes it the profile designed to prevent sensitive data from being transmitted out of the organization.
Why the other options are wrong
- A. An Antivirus profile detects and blocks malware in files and traffic. It does not look for sensitive data patterns being sent out.
- C. An Anti-Spyware profile detects command and control traffic and spyware activity on compromised hosts. It does not identify confidential content in outbound transfers.
- D. A URL Filtering profile controls access to websites by category. It does not inspect the content users send for sensitive data patterns.
Question 6
How do template stacks help manage firewall configurations in Panorama?
Show answer and explanation
Correct answer: A. By grouping templates across multiple firewalls
In Panorama, templates hold network and device settings such as interfaces, zones, routing and server profiles. A template stack combines several templates into one ordered set and is assigned to the firewalls that need it, so each firewall receives the merged settings of every template in the stack. When the same setting appears in more than one template, the template higher in the stack takes priority. This lets administrators keep common settings in shared templates and add location or model specific templates, reducing duplication while keeping configuration consistent across many firewalls.
Why the other options are wrong
- B. Template variables let one template supply device specific values such as IP addresses. They are a feature used within templates and stacks, not the function a stack provides.
- C. Template stacks hold configuration and do not produce network diagrams or topology views of the managed firewalls.
- D. Software and content updates for managed firewalls are deployed through Panorama device deployment functions, not through template stacks.
Question 7
Which subscription sends non-file format-based traffic that matches Data Filtering profile criteria to a cloud service to render a verdict?
Show answer and explanation
Correct answer: B. Enterprise DLP
Enterprise DLP works through the Data Filtering profile on the firewall. When traffic matches the profile criteria, the firewall forwards the content to the cloud based Enterprise DLP service, which applies data patterns, machine learning detection and data profiles and returns a verdict. The firewall then enforces the configured action, such as alert or block. Enterprise DLP covers not only uploaded files but also non-file traffic, such as text submitted in web forms or posted to applications, which is the content described in the stem.
Why the other options are wrong
- A. SaaS Security Inline discovers SaaS applications and assesses their risk to support policy. It does not render verdicts on Data Filtering profile matches.
- C. Advanced URL Filtering analyzes and categorizes web destinations in the cloud. It evaluates URLs, not sensitive content matched by Data Filtering criteria.
- D. Advanced WildFire analyzes files and links for malware. It does not inspect non-file traffic for sensitive data.
Question 8
A cloud security architect is designing a certificate management strategy for Strata Cloud Manager (SCM) across hybrid environments. Which practice ensures optimal security with low management overhead?
Show answer and explanation
Correct answer: D. Deploy centralized certificate automation with standardized protocols and continuous monitoring.
Across hybrid environments managed from Strata Cloud Manager, the strongest and least labor intensive approach is to centralize certificate management and automate it. A single, standardized process for issuing, deploying and renewing certificates gives every environment the same trust model and the same protocols, and continuous monitoring detects certificates that are approaching expiration or are misconfigured before they cause an outage or weaken security. Automation removes repetitive manual steps and the errors that come with them, so security stays consistent while administrative effort stays low.
Why the other options are wrong
- A. Separate certificate authorities with independent rules for each cloud create inconsistent trust and multiply the systems to maintain, raising overhead.
- B. Manual deployment with quarterly reviews is labor intensive and leaves long gaps in which expired or weak certificates can go unnoticed.
- C. Provider default certificates with localized renewal fragment control across environments and give no unified view, which works against consistent security.
Question 9
Which two prerequisites must be evaluated when decrypting internet-bound traffic? (Choose two.)
Show answer and explanation
Correct answer: A, C. Incomplete certificate chains; Certificate pinning
Before decrypting internet-bound traffic with SSL Forward Proxy, administrators should evaluate conditions that cause decryption to break sites and applications. Servers that send an incomplete certificate chain cannot be validated by the firewall unless the missing intermediate certificates are available, so such sites may be treated as untrusted and blocked or show errors. Applications that use certificate pinning accept only a specific server certificate, so they reject the forward proxy certificate the firewall presents and fail to connect. Identifying both conditions lets administrators add decryption exclusions or fixes before enforcing decryption.
Why the other options are wrong
- B. A RADIUS server profile defines servers used for administrator or user authentication. It has no bearing on whether internet-bound sessions can be decrypted successfully.
- D. A SAML certificate is used to sign or verify messages with an identity provider for single sign-on. It is not a factor in decrypting internet-bound traffic.
Question 10
In which order does an NGFW process URL categories for Security policy?
Show answer and explanation
Correct answer: B. 1. Custom URL categories 2. External dynamic lists 3. Predefined categories
When a firewall categorizes a URL for policy, it checks the sources it controls before the vendor database. Custom URL categories, which administrators define directly on the firewall, are evaluated first. External dynamic lists of type URL, which import entries from an external source, are evaluated next. Only if neither contains a match does the firewall rely on the predefined categories from PAN-DB. This order lets organizations override the default categorization of a site with their own definitions and threat feeds.
Why the other options are wrong
- A. This places external dynamic lists ahead of custom URL categories, but custom categories are evaluated before external dynamic lists.
- C. This puts predefined categories ahead of external dynamic lists, but the firewall checks external dynamic lists before falling back to predefined categories.
- D. This reverses the order. Predefined categories are the last source checked, not the first.
What people say about the full Network Security Professional pack 4.8 from 4
Fantastic online study questions for preparing NetSec-Pro exam! I gave my NetSec-Pro exam with the questions and passed. You can too!
100% valid online study resource. I gave my NetSec-Pro exam and passed. Thanks.
Question 11
How does a firewall behave when SSL Inbound Inspection is enabled?
Show answer and explanation
Correct answer: B. It acts as meddler-in-the-middle between the client and the internal server.
With SSL Inbound Inspection, the firewall acts as a meddler-in-the-middle in TLS sessions between external clients and an internal server that the organization controls. The administrator imports the server's certificate and private key onto the firewall, which lets it decrypt the session, inspect the cleartext for threats with its Security profiles, and pass the traffic on to the server. The client sees the real server certificate, so no forged certificate is needed, but the firewall is still actively decrypting the conversation between the two endpoints.
Why the other options are wrong
- A. SSH decryption is a separate SSH Proxy feature; SSL Inbound Inspection handles TLS traffic destined for an internal server.
- C. Decrypting and inspecting the session is an active role, not a transparent pass-through of encrypted traffic.
- D. Decrypting traffic from internal clients to external servers describes SSL Forward Proxy, not inbound inspection.
Question 12
How does Strata Logging Service help resolve ever-increasing log retention needs for a company using Prisma Access?
Show answer and explanation
Correct answer: C. It scales to meet the capacity needs of new locations as business grows.
Strata Logging Service is a cloud-based logging service, so storage capacity is purchased and expanded as a service rather than tied to on-premises log collectors. As a company adds Prisma Access locations, mobile users and remote networks, the log volume grows, and the service scales to absorb that additional capacity without the company deploying and maintaining more logging hardware. Retention can be increased by adjusting the storage allocated to the service, which directly addresses ever-increasing retention requirements.
Why the other options are wrong
- A. Log forwarding does not reduce retention needs by consuming Prisma Access licensed bandwidth; that is not how the service addresses storage growth.
- B. The data storage region is chosen during activation, and region selection is not what solves growing retention needs.
- D. The benefit is centralized, elastic cloud storage, not decentralized collection and storage of logs.
Question 13
Which Security policy on a data center NGFW will block intrazone traffic in Zone Colorado for the Dynamic User Group "Testers" and custom application "Payment System"?
Show answer and explanation
Correct answer: A. Source & Destination Zone = Colorado - Users = Testers - Application = Payment System - Action = Deny
Intrazone traffic starts and ends in the same zone, so the rule must use Colorado as both the source and destination zone. Setting Users to the Dynamic User Group Testers limits the rule to members of that group, and setting Application to the custom application Payment System limits it to that one application. With the action set to Deny, the rule blocks exactly the traffic described in the requirement and leaves other applications and users in the zone unaffected.
Why the other options are wrong
- B. Using Any as the application blocks every application for Testers in Colorado, which is far broader than blocking only Payment System.
- C. A destination zone of LA makes this an interzone rule, so it does not match traffic that stays within Colorado.
- D. This rule is interzone because the destination is LA, and it also blocks all applications instead of only Payment System.
Question 14
What is the recommended upgrade path from PAN-OS 9.1 to PAN-OS 11.2?
Show answer and explanation
Correct answer: C. 9.1 --> 10.0 --> 11.0 --> 11.2
A firewall running PAN-OS 9.1 cannot skip a feature release, so after the preferred 9.1 maintenance release its next step must be the 10.0 base image and its preferred maintenance release. That rules out any path that leaves 9.1 for an 11.x release directly. From later releases, the Skip Software Version Upgrade feature lets a firewall move ahead more than one feature release at a time, so the path does not have to stop at every intermediate train before 11.2. Of the paths listed, the one through 10.0 and 11.0 to 11.2 keeps the mandatory 10.0 step and reaches the target with the fewest stops.
Why the other options are wrong
- A. Leaving 9.1 directly for 11.2 skips the 10.0 feature release, which a 9.1 firewall must install next.
- B. Going from 9.1 straight to 11.0 skips the 10.0 feature release, which a 9.1 firewall must install next.
- D. Stopping at 11.1 adds an unnecessary step, because a firewall on 11.0 can skip directly to 11.2.
Question 15
In which order is Prisma SD-WAN dynamic path selection performed?
Show answer and explanation
Correct answer: A. 1. Determine potential paths based on policy. 2. Determine link quality. 3. Measure application performance. 4. Measure link capacity.
Prisma SD-WAN first applies policy to decide which paths an application is allowed to use, because no path outside that set should ever be considered. It then evaluates the quality of each candidate link, such as latency, jitter and packet loss. Next it measures how the application performs on those links, and finally it considers link capacity so that traffic is placed where bandwidth is available. Working from policy down to capacity in this way lets the device choose the best compliant path for each application session.
Why the other options are wrong
- B. This begins with measurements and ends with policy, but policy must first define the allowed paths before any measurement is meaningful.
- C. This measures application performance before link quality, which is not the order in which the evaluation proceeds.
- D. This leaves policy until last, so paths that policy would exclude would be measured and considered first.
Question 16
An administrator wants to implement additional Cloud-Delivered Security Services (CDSS) on a data center NGFW that already has one enabled. What benefit does the NGFW's single-pass parallel processing (SP3) architecture provide?
Show answer and explanation
Correct answer: C. There will be no additional performance degradation.
Single-pass parallel processing (SP3) is designed so that each packet is processed once. Networking, policy lookup, application identification, decoding and signature matching are performed in a single pass, and content scanning for all enabled threat services uses a common, stream-based signature engine. Because the traffic is not handed from one engine to the next for separate scans, enabling another Cloud-Delivered Security Service on the firewall does not add another inspection pass. Palo Alto Networks positions this as the reason additional services can be turned on without further performance degradation.
Why the other options are wrong
- A. Application-level inspection comes from App-ID and is a basic NGFW capability; it is not the specific benefit SP3 gives when adding more services.
- B. A minor reduction is what serial, multi-pass designs suffer as each engine is added; SP3 avoids that extra cost.
- D. SP3 is an internal processing architecture of one firewall, not a way of chaining additional inspection appliances inline.
Question 17
Using Prisma Access, which solution provides the most security coverage of network protocols for the mobile workforce?
Show answer and explanation
Correct answer: C. Client-based VPN
A client-based VPN, using the GlobalProtect app with Prisma Access, builds a tunnel from the endpoint that can carry traffic for any application, port and protocol, not just web traffic. Because all of that traffic reaches Prisma Access, it is inspected and enforced with the full set of Security policy and threat prevention services. This makes the client-based approach the option with the broadest protocol coverage for mobile users, compared with methods that handle only browser or proxy traffic.
Why the other options are wrong
- A. An enterprise browser secures activity inside the browser. Traffic from other applications and non-web protocols falls outside its protection.
- B. Explicit proxy secures web traffic sent through the proxy, mainly HTTP and HTTPS, so other protocols are not covered.
- D. Clientless VPN provides browser access to selected internal web applications, so it covers only a narrow set of web protocols.
Question 18
How many places will a firewall administrator need to create and configure a custom data loss prevention (DLP) profile across Prisma Access and the NGFW?
Show answer and explanation
Correct answer: A. One
Enterprise DLP is a cloud-delivered service, so data patterns and data profiles are defined once in the cloud and shared with every enforcement point that uses the service. NGFWs and Prisma Access both reference the same centrally stored profile, which means the administrator creates and configures the custom DLP profile in one place. Any later change to that profile is applied consistently across the NGFW and Prisma Access without rebuilding it on each platform, which keeps detection logic identical and reduces administrative effort.
Why the other options are wrong
- B. Two places would imply separate profiles for the NGFW and for Prisma Access, but Enterprise DLP shares one cloud-defined profile across both.
- C. Three configuration points are not needed because the custom profile lives centrally in the Enterprise DLP cloud service.
- D. Four separate configurations would defeat the purpose of a unified cloud service that applies one profile everywhere.
Question 19
Where does an administrator update the collection of infected hosts in Strata Cloud Manager (SCM) when isolating an identified endpoint from a network?
Show answer and explanation
Correct answer: A. Quarantined device list
In Strata Cloud Manager, the collection of compromised hosts is maintained as the Quarantined Device List policy object, found under the NGFW and Prisma Access configuration objects. The administrator adds a device by its Host ID and serial number, or devices can be added automatically based on tags. Security rules then reference quarantined devices as a source or destination match, so an isolated endpoint stays blocked from network resources until it is explicitly removed from the list after remediation.
Why the other options are wrong
- B. Quarantine devices describes the action of isolating hosts, but the place where the host collection is updated is the Quarantined Device List.
- C. Actions is a general term for responses, not the SCM object that stores the infected hosts.
- D. Host information profiles evaluate endpoint posture for policy matching; they are not the list of quarantined hosts.
Question 20
Which GlobalProtect configuration is recommended for granular security enforcement of remote user device posture?
Show answer and explanation
Correct answer: B. Configuring host information profile (HIP) checks for all mobile users
Host information profile (HIP) checks are how GlobalProtect enforces device posture. The GlobalProtect app collects host information such as operating system and patch level, antimalware and firewall status, disk encryption and other attributes, and reports it to the gateway. Administrators define HIP objects and HIP profiles that describe a compliant device, then reference those profiles in Security policy rules so that access to internal applications depends on the posture of each device. Applying HIP checks to all mobile users gives granular, per-device enforcement rather than a simple allow or deny.
Why the other options are wrong
- A. Logging at session end improves visibility and reporting but does not evaluate or enforce anything about the endpoint's posture.
- C. Preventing users from disabling GlobalProtect keeps the tunnel up but does not assess whether the device itself is compliant.
- D. Multi-factor authentication strengthens verification of user identity, but it does not examine the security state of the device.
Question 21
What must be configured to successfully onboard a Prisma Access remote network using Strata Cloud Manager (SCM)?
Show answer and explanation
Correct answer: C. IPSec termination node
A Prisma Access remote network connects a branch to the service through an IPSec tunnel from the branch firewall or router. During onboarding in Strata Cloud Manager, the administrator selects the Prisma Access location and the IPSec termination node, which is the Prisma Access endpoint that terminates the branch tunnel and allocates bandwidth for the site. The administrator then defines the tunnel and IKE settings and the branch subnets or routing. Without an IPSec termination node, the remote network has no tunnel endpoint in Prisma Access and cannot be onboarded.
Why the other options are wrong
- A. Cloud Identity Engine supplies user and group information for identity-based policy. It is not required to onboard a remote network site.
- B. The GlobalProtect agent connects individual mobile users to Prisma Access. Remote networks connect a whole site through an IPSec device, not an endpoint agent.
- D. ADEM provides digital experience monitoring for users and applications. It is an optional add-on, not part of remote network onboarding.
Question 22
A Prisma Access administrator wants to attach the same set of Security profiles to each new rule created. How can the administrator automate the profiles to be attached to new rules?
Show answer and explanation
Correct answer: B. Create a security profile group and name it "default."
A security profile group named default is automatically attached to every new Security policy rule that is created. By building one group that contains the required Antivirus, Anti-spyware, Vulnerability Protection, URL Filtering, File Blocking and WildFire profiles and naming it default, the administrator ensures each new rule inherits the same protections without having to select them manually. Existing rules are not changed, but every rule added afterward starts with the standard set of profiles, which reduces the risk of rules being created without threat inspection.
Why the other options are wrong
- A. Naming individual profiles default does not cause them to be attached to new rules; the automatic behavior applies to a profile group named default.
- C. AIOps provides health monitoring and best practice assessment; it does not attach profile groups to rules as they are created.
- D. Policy Analyzer reviews rules for redundancy, shadowing and other issues; it does not add profiles to new rules.
Question 23
After a firewall is associated with Strata Cloud Manager (SCM), which two additional actions are required to enable management of the firewall from SCM? (Choose two.)
Show answer and explanation
Correct answer: A, C. Install a device certificate; Configure NTP and DNS servers for the firewall.
Strata Cloud Manager authenticates a managed firewall using its device certificate, so after the firewall is associated with Strata Cloud Manager, the administrator must install a device certificate on it before the secure management connection can be established. The firewall also needs working DNS to resolve Palo Alto Networks cloud service names and accurate time from NTP so that certificate validation succeeds. With the certificate installed and NTP and DNS configured, the firewall can connect and be managed from Strata Cloud Manager.
Why the other options are wrong
- B. The firewall reaches Strata Cloud Manager through its management connection. A Security policy rule permitting that domain for all users is not what enables management.
- D. Service connections are Prisma Access components linking the service to headquarters or data centers. They are not needed to manage a firewall from Strata Cloud Manager.
Question 24
Which security profile provides real-time protection against threat actors who exploit the misconfigurations of DNS infrastructure and redirect traffic to malicious domains?
Show answer and explanation
Correct answer: A. Anti-spyware
DNS Security is configured in the Anti-spyware security profile, under its DNS policies settings. With the subscription enabled, the firewall uses machine learning based analysis of DNS queries and responses to identify malicious and hijacked domains in real time, including domains reached because of misconfigured DNS infrastructure. The profile can block, sinkhole or alert on those queries, and DNS sinkholing also helps identify infected hosts. Attaching the Anti-spyware profile to Security policy rules is what applies this protection to DNS traffic.
Why the other options are wrong
- B. URL Filtering controls access to web URLs by category; DNS Security policies are configured in the Anti-spyware profile.
- C. Antivirus scans files and content for malware and does not analyze DNS queries for malicious domains.
- D. Vulnerability Protection blocks exploits of software vulnerabilities, not malicious domain resolution caused by DNS misconfiguration.
Question 25
When physical ION devices are allocated, in which two states are they displayed on the Prisma SD-WAN web interface under "Devices"? (Choose two.)
Show answer and explanation
Correct answer: A, C. Offline; Unclaimed
When physical ION devices are allocated to a tenant, they appear in the Prisma SD-WAN web interface under Devices before they are put into service. A newly allocated device is shown as unclaimed until the administrator claims it and assigns it to a site, and it is shown as offline when it has not yet connected to the controller, for example before it is powered on and cabled with internet access. Once the device is online and claimed, it can be configured and brought into operation at its site.
Why the other options are wrong
- B. Standby describes a high availability role, not the state in which newly allocated devices are listed.
- D. Needs attention is not one of the states displayed for newly allocated ION devices under Devices.
Question 26
Which two content updates can be pushed to NGFWs from Panorama? (Choose two.)
Show answer and explanation
Correct answer: A, B. WildFire; Applications and threats
Panorama can download dynamic content packages once and deploy them to the managed firewalls it controls, which keeps signature versions consistent across the estate. Applications and Threats updates deliver new and modified App-IDs along with threat signatures used by Vulnerability Protection and Anti-spyware, and WildFire updates deliver the signatures generated from WildFire analysis of new malware. Both are scheduled or installed from Panorama's device deployment dynamic updates and pushed to selected firewalls, so administrators do not have to manage each firewall's content individually.
Why the other options are wrong
- C. Advanced URL Filtering relies on cloud lookups and inline analysis of URLs; it is not delivered as a content package that Panorama pushes.
- D. The GlobalProtect data file supplies host attribute data for HIP evaluation on gateways and is not one of the content updates (Applications, Applications and Threats, Antivirus, WildFire) that Panorama deploys to managed firewalls.
Question 27
How does PAN-OS identify App-IDs to perform application-layer inspection?
Show answer and explanation
Correct answer: D. From multiple classification mechanisms - application signatures, application protocol decoding, and heuristics
App-ID classifies traffic by applying several identification techniques to every flow, regardless of port, protocol or encryption. Application signatures match unique patterns in the traffic, application protocol decoding understands protocols such as HTTP so the firewall can find applications tunneled inside them and keep tracking changes during the session, and heuristics identify evasive applications that cannot be recognized by signatures alone. Combined with protocol detection and decryption, these mechanisms let the firewall name the actual application and then apply Security policy and content inspection to it.
Why the other options are wrong
- A. IP address and port rules are the traditional port-based approach that App-ID was designed to replace, since applications can use any port.
- B. Certificate inspection and manual classification are not the App-ID identification engine; App-ID relies on signatures, protocol decoding and heuristics.
- C. Categorizing web traffic by domain describes URL Filtering, which works alongside App-ID but does not identify applications.
That was 27 of 108.
The full Palo Alto Networks Network Security Professional pack has all 108 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 54 free as one PDF by email. Get the Half Pack →