Cisco®
CompTIA
Checkpoint
ISC
EC-Council
EXIN
Fortinet
ITIL®
Juniper
Microsoft
VMware
Avaya
SAP
Google
Salesforce
Amazon
Palo Alto Networks
ISC2
All Vendors
  2. Home
  3. Exams
  4. Palo Alto Networks
  5. NetSec-Pro

Free Palo Alto Networks NetSec-Pro Exam Questions (page: 3)

Page 3 of 16
PDF with 60 Questions

Using Prisma Access, which solution provides the most security coverage of network protocols for the mobile workforce?

  1. Explicit proxy
  2. Client-based VPN
  3. Enterprise browser
  4. Clientless VPN

Answer(s): B

Explanation:

Client-based VPN solutions like GlobalProtect provide full coverage for the mobile workforce by extending the enterprise security stack to remote endpoints. It establishes a secure tunnel, allowing consistent security policies across the enterprise perimeter and the mobile workforce.

"GlobalProtect is a client-based VPN that provides secure, consistent protection for mobile users by extending the security capabilities of Prisma Access to remote endpoints, covering all network protocols."

(Source: GlobalProtect Admin Guide)



Which two prerequisites must be evaluated when decrypting internet-bound traffic? (Choose two.)

  1. RADIUS profile
  2. Incomplete certificate chains
  3. Certificate pinning
  4. SAML certificate

Answer(s): B,C

Explanation:

When implementing SSL Forward Proxy decryption for outbound traffic, two key challenges that must be evaluated are:

Incomplete certificate chains: This occurs when the firewall cannot validate the entire certificate chain for a site, which may cause decryption failures.

Certificate pinning: Applications like banking apps may use certificate pinning to prevent MITM (man-in-the-middle) attacks, and these applications will break if SSL Forward Proxy is used.

"When decrypting outbound SSL traffic, you must consider incomplete certificate chains, which can cause decryption to fail if the firewall cannot validate the entire chain. Also, be aware of certificate pinning in applications that prevents decryption by rejecting forged certificates."

(Source: Palo Alto Networks Decryption Concepts)



Which firewall attribute can an engineer use to simplify rule creation and automatically adapt to changes in server roles or security posture based on log events?

  1. Address objects
  2. Dynamic Address Groups
  3. Dynamic User Groups
  4. Predefined IP addresses

Answer(s): B

Explanation:

Dynamic Address Groups enable the firewall to automatically adjust security policies based on tags assigned dynamically (via log events, API, etc.). This eliminates the need for manual updates to policies when server roles or IPs change.

"Dynamic Address Groups allow you to create policies that automatically adapt to changes in the environment. These groups are populated dynamically based on tags, enabling automated security policy updates without manual intervention."

(Source: Dynamic Address Groups)



How does a firewall behave when SSL Inbound Inspection is enabled?

  1. It acts transparently between the client and the internal server.
  2. It decrypts inbound and outbound SSH connections.
  3. It decrypts traffic between the client and the external server.
  4. It acts as meddler-in-the-middle between the client and the internal server.

Answer(s): D

Explanation:

SSL Inbound Inspection allows the firewall to decrypt incoming encrypted traffic to internal servers (e.g., web servers) by acting as a man-in-the-middle (MITM). The firewall uses the private key of the server to decrypt the session and apply security policies before re-encrypting the traffic.

"SSL Inbound Inspection requires you to import the server's private key and certificate into the firewall. The firewall then acts as a man-in-the-middle (MITM) to decrypt inbound sessions from external clients to internal servers for inspection."

(Source: SSL Inbound Inspection)



Viewing page 3 of 16
Viewing questions 9 - 12 out of 60 questions



Post your Comments and Discuss Palo Alto Networks NetSec-Pro exam prep with other Community members:

NetSec-Pro Exam Discussions & Posts