[Q68-Q89] Palo Alto Networks NetSec-Analyst Practice Verified Answers – Pass Your Exams For Sure! [2025]

Q68. You are tasked with analyzing the long-term resource usage trends of a Palo Alto Networks firewall to justify a hardware upgrade. You need to gather specific metrics over the past year, including average and peak session counts, CPU utilization (data plane and management plane), and throughput. Which of the following methods provides the MOST comprehensive and historical data for this purpose, assuming the firewall is managed by Panorama?

Periodically log into the firewall CLI and run show running resource-monitor all, then manually compile the data into a spreadsheet.

Extract ‘Resource Monitor’ reports directly from the firewall’s GUI (Monitor > Reports > Resource Monitor) for various timeframes.

Leverage Panorama’s ‘Managed Devices’ tab, navigate to the specific firewall, and view ‘System’ and ‘Network’ dashboards for historical graphs and data summaries.

Configure SNMP traps on the firewall to send resource utilization data to an external monitoring system with long-term data retention capabilities.

Utilize Panorama’s ‘ACC’ (Application Command Center) for ‘GlobalProtect’, ‘Threat’, and ‘Traffic’ monitoring, as these indirectly reflect resource usage.

Q69. A critical application experiences intermittent connectivity issues. The Network Security Analyst suspects a misconfigured security policy on the Palo Alto Networks firewall. The analyst navigates to the Log Viewer and performs a filter for ‘deny’ actions on the application’s destination IP and port, observing several such logs. What are the NEXT logical steps to effectively remediate this issue using the Incidents and Alerts page and Log Viewer data?

Immediately create a new security policy rule at the top of the rulebase to allow all traffic to the application’s IP and port, then monitor for resolution.

Correlate the ‘deny’ logs with any related alerts on the Incidents and Alerts page. Then, analyze the ‘Rule Name’ field in the Log Viewer for the specific deny logs to identify the blocking policy. Based on this, either modify the existing policy or create a new, more specific policy rule placed above the blocking rule.

Disable all Security Profiles associated with the policies affecting the application to see if connectivity is restored, then re-enable them one by one to isolate the issue.

Run a ‘Packet Capture’ on the firewall for the application’s traffic to identify the exact point of failure, then open a support ticket with Palo Alto Networks.

Review the URL Filtering logs for the application’s traffic, as URL filtering is often the cause of application connectivity issues.

Q70. Consider the following XML configuration snippet for a DoS Protection Policy on a Palo Alto Networks firewall:

Assuming this policy is applied to the inbound zone for web traffic, what is the intended behavior and potential limitation of the ‘group- by’ setting in this specific configuration?

The ‘group-by: source-ip’ ensures that the specified thresholds (e.g., TCP flood activation rate) are applied collectively to all traffic originating from a single source IP. This is effective against distributed attacks but might penalize a single legitimate user with multiple connections if thresholds are too low.

The ‘group-by: source-ip’ means that the firewall will aggregate all attack traffic based on destination IP and apply the protection actions. This is suitable for protecting individual web servers from targeted attacks.

The ‘group-by: source-ip’ will apply the ‘packet-based’ and ‘session-based’ thresholds on a per-source IP basis. A limitation is that it does not account for attacks where multiple source IPs contribute to a low-volume but aggregate high-volume attack.

The ‘group-by: source-ip’ is incorrectly configured for a ‘target’ rule type; it should be ‘group-by: destination-ip’ to protect the target web servers.

The ‘group-by: source-ip’ instructs the firewall to calculate DoS thresholds per unique source IP address. While effective for single-source attacks, it is less effective against highly distributed (DDoS) attacks unless combined with additional global thresholds.

Q71. A security analyst is investigating a compromised internal host using Strata Cloud Manager (SCM) to gather evidence. The playbook requires fetching recent logs for specific source and destination IPs, identifying the exact security policy rule that allowed the initial communication, and then temporarily disabling that rule for immediate containment. Which SCM API endpoints and query parameters would be most relevant for accomplishing these tasks efficiently?

Only the SCM GUI for log analysis and policy modification, as API is too complex for incident response.

Q72. An organization is migrating its cloud applications from a public internet connection to a dedicated AWS Direct Connect link through a Palo Alto Networks firewall. To achieve this, all traffic to AWS public IP ranges (e.g., EC2, S3) from the internal network must be forwarded over the Direct Connect interface (ethernet1/3) with a specific next-hop router. Other internet-bound traffic should continue using the primary internet uplink (ethernet1/1 ). Which of the following PBF actions are critical to ensure that if the Direct Connect link fails, the AWS-bound traffic automatically fails over to the primary internet uplink without manual intervention?

Configure a PBF rule with ‘Action: Forward’, ‘Egress Interface: ethernet1/3’, ‘Next Hop: AWS_Router_IP’, and enable ‘Monitor Link Group’ for ethernet1/3 to trigger a route removal.

Create a PBF rule with ‘Action: Forward’, ‘Egress Interface: ethernet1/3’, ‘Next Hop: AWS_Router_IP’, and specify ‘Fall back to: Yes’ with the primary internet uplink’s virtual router and next-hop.

Implement an ECMP route for the AWS public IP ranges, distributing traffic between ethernet1/3 and ethernet1/1 based on load.

Configure a PBF rule with ‘Action: Forward’, ‘Egress Interface: ethernet1/3’, ‘Next Hop: AWS Router_IP’, and then create a second PBF rule with a higher priority for the same AWS destinations pointing to ethernet1/1 , which will only activate manually.

Set up a static route for the AWS ranges with ethernet1/3 as the next hop, and configure BIDirectional Forwarding Detection (BFD) on the Direct Connect interface.

Q73. A large financial institution uses Panorama to manage their firewall estate. They are implementing a strict change management process where all policy modifications, object creations, or deletions must be reviewed and approved before being committed and pushed. They want to ensure that only approved changes are present in the ‘candidate config’ before a commit, and that deviations are easily identifiable. Which Panorama feature, when combined with a robust operational process, helps enforce this requirement and identify discrepancies?

Utilize ‘Admin Roles’ to restrict non-approved users from making any changes to the candidate configuration.

Implement ‘Config Locks’ before making changes, ensuring only one administrator can modify the configuration at a time.

Leverage the ‘Validate’ function before committing to check for syntax errors, combined with regular ‘Config Audits’ and comparing the running configuration with a golden configuration stored externally.

Use ‘Shared Policy’ and ‘Device Group Policy’ hierarchies effectively, combined with the ‘Revert’ option for the candidate configuration if unapproved changes are found.

Regularly export the candidate configuration (XML) and compare it against a baseline configuration using an external diff tool, then use ‘Load Named Configuration’ if a rollback is needed.

Q74. A Palo Alto Networks firewall is configured to protect a DMZ segment hosting multiple web servers. The security team wants to implement a ‘positive security model’ for application control and threat prevention. This means explicitly allowing only known good applications and blocking everything else, coupled with comprehensive threat inspection for allowed traffic. They also need to ensure that any attempt to use deprecated or high-risk applications (even if ‘allowed’ by a broader rule earlier) is blocked. How do you structure the Security Policy Rules and Security Profiles to achieve this stringent positive security posture?

Create a security policy rule allowing only specific ‘known good’ applications (e.g., web-browsing, ssl) from the untrust zone to the DMZ, with a comprehensive Security Profile Group (Antivirus, Anti-Spyware, Vulnerability Protection, URL Filtering). Below this, create a ‘deny all’ rule with no applications specified. This is sufficient for a positive security model.

Create a security policy rule allowing specific ‘known good’ applications from untrust to DMZ. Apply a Security Profile Group with Antivirus, Anti-Spyware, Vulnerability Protection, and WildFire. Configure App-ID ‘Block’ on known high-risk applications (e.g., ‘bittorrent’, ‘tor’) within the Application Filter, ensuring these are globally blocked. The final rule should be a ‘deny any’.

Define explicit security policy rules for each ‘known good’ application or application group (e.g., ‘web-browsing’ to web servers, ‘ssh’ to jump hosts). To each of these ‘allow’ rules, apply a Security Profile Group containing Antivirus, Anti-Spyware, Vulnerability Protection (with ‘strict’ profiles), and URL Filtering. Below these allow rules, create a ‘negative’ security rule that explicitly blocks ‘risk-apps’ application filter and ‘high-risk’ application characteristics. The very last rule should be a ‘deny any’ rule.

Create an ‘Application Filter’ for ‘known-good-apps’ and another for ‘high-risk-apps’. Create a security policy rule allowing ‘known-good-apps’ to the DMZ with a full Security Profile Group. Above this, create a security policy rule blocking ‘high-risk-apps’ from untrust to DMZ, with logging only. Below all specific rules, have a ‘deny all’ rule.

Create a security policy rule allowing ‘web-browsing’ and ‘SSI’ applications from untrust to DMZ, applying a comprehensive Security Profile Group. Create a second security policy rule specifically blocking applications categorized as ‘network-utility’ or ‘file-sharing’ or ‘proxy-avoidance’, positioned above the ‘allow’ rule. Ensure a ‘deny all’ rule at the very bottom of the policy.

Q75. An administrator is troubleshooting intermittent decryption failures for a specific set of websites. The logs show ‘SSL Protocol Error’ or ‘Unsupported Protocol Version’ frequently. The current decryption profile uses default settings for protocol versions. Upon investigation, it’s discovered these websites are still using TLS 1.0 or TLS 1.1 , while the firewall is configured to prefer TLS 1.2 and above by default. Which of the following actions, or combination of actions, could resolve this issue while minimizing security compromises?

Create a new Decryption Profile. In the ‘SSL Protocol Settings’ section, set the ‘Minimum Protocol Version’ to ‘TLS 1.0’. Apply this new profile to a security policy rule specific to these problematic websites, placed above the general decryption rule.

Disable SSL decryption entirely for these specific websites using an exclusion list.

Modify the existing Decryption Profile’s ‘Minimum Protocol Version’ to ‘TLS 1.0’ globally.

Add the problematic websites to a custom URL category and configure a ‘No Decryption’ policy for this category.

Install the certificates of these websites as trusted CAS on the firewall.

Q76. A Security Architect is designing a new firewall policy for a cloud environment where applications communicate using REST APIs over HTTP/S. They need to ensure that API traffic is strictly controlled and protected. Specifically, they want to: 1 . Allow only specific API methods (e.g., GET, POST, PUT) and block others (e.g., DELETE, TRACE) unless explicitly authorized. 2. Inspect API payloads for XML/JSON injection attacks and enforce schema validation. 3. Prevent file uploads larger than IOMB to API endpoints. 4. Log all successful API calls and block/log all denied calls. Which combination of Security Profiles and features should be used, and how are they applied to achieve this?

Create a URL Filtering profile to block unwanted HTTP methods. Use a Vulnerability Protection profile to detect XML/JSON injection. Configure a File Blocking profile to limit upload sizes. Apply these to a Security Profile Group on the API security policy rule. Logging is default.

Leverage a custom URL Category for ‘allowed-api-methods’ and ‘blocked-api-methods’ within a URL Filtering profile. Use a Data Filtering profile to enforce schema validation and detect injection, and a separate File Blocking profile for upload size. Apply all of these within a Security Profile Group to the API policy rule. Ensure session logging is enabled on the rule.

Create a custom application for API traffic. Define a custom signature for HTTP methods within the Threat Prevention profile (Vulnerability Protection) to block specific methods. Use a Vulnerability Protection profile with signatures for XML/JSON injection and a File Blocking profile for upload size. Data Filtering for schema validation is not natively supported for XML/JSON. Ensure logging on the security rule.

Configure an HTTP Header Insertion Profile to enforce allowed methods. Use a Vulnerability Protection profile with specific attack signatures and a custom Data Pattern in a Data Filtering profile for schema validation of API payloads (e.g., regex for required fields). Utilize a File Blocking profile for size limits. Apply these through a Security Profile Group to the API security policy rule. Create a custom URL category for each API endpoint to apply granular controls.

Define a Security Policy Rule that explicitly allows HTTP/S traffic to API endpoints. Within the ‘Application’ section of this rule, use ‘http-method’ application filters (e.g., allow ‘http-get’, ‘http-post’). Apply a Vulnerability Protection profile with signatures for injection attacks. Use a File Blocking profile for upload size limits. For payload inspection and schema validation, configure a Data Filtering profile with custom regex patterns for the expected API structure. Attach all to a Security Profile Group on the API rule.

Q77. A network security analyst needs to investigate a series of successful brute-force attacks detected against a critical web server. The attacks spanned several hours and originated from various public IP addresses. Using Strata Logging Service, what specific search query and visualization approach would be most effective to quickly identify the source IPs, target users, and timestamps of these events?

Q78. A Security Administrator reports that users are unable to access certain web applications after a recent Panorama template push. The applications use non-standard ports, and the security policy explicitly allows traffic on these ports. Traffic logs show sessions being dropped with the reason ‘application-default’. Which of the following is the most probable cause of this misconfiguration?

The application identification (App-ID) for the custom web applications is incorrectly defined or not being learned.

The security policy is missing the ‘service’ object for the non-standard ports, defaulting to ‘application-default’ port inspection.

The Zone Protection Profile applied to the ingress zone is blocking non-standard application traffic.

The decryption profile is not applied, preventing proper App-ID classification for SSL/TLS encrypted traffic.

The Panorama template push contained a commit scope error, not applying the new policies to the correct device group.

Q79. A Palo Alto Networks firewall has a Log Forwarding Profile configured to send all logs to a syslog server. The security team needs to monitor ‘wildfire’ verdicts in real-time. To facilitate this, they request that the forwarded ‘wildfire’ logs include additional custom fields that are not part of the default syslog format. Specifically, they need the ‘file-hash’ and ‘file-type’ from WildFire logs to be explicitly included. How can this be achieved within the Log Forwarding Profile configuration?

Under ‘Log Forwarding Profile > Syslog Server > Custom Log Format’, use

In the Log Forwarding Profile, you cannot add custom fields to existing log types like WildFire. This functionality is only available for User-ID mapping or custom applications.

Under ‘Log Forwarding Profile > Syslog Server > CEF Format’, enable the ‘WildFire’ log type and then add new custom entries under ‘Custom Fields’ for ‘file- hash’ and ‘file-type’.

Within the Log Forwarding Profile, select ‘WildFire’ log type. Under ‘Syslog Fields’, you can add custom fields. For ‘Field Name’, enter ‘file-hash’ and for ‘Value’, use the predefined variable for file hash. Repeat for ‘file-type’.

In the Log Forwarding Profile, configure the syslog destination to use ‘Custom Log Format’. Then, in the format string, manually specify the desired fields using predefined variables. For WildFire logs, this would include variables like

Q80. A Palo Alto Networks Network Security Analyst is tasked with optimizing security posture by decommissioning legacy, unused firewall rules. The challenge is identifying rules that genuinely have no active sessions or hit counts over an extended period (e.g., 6 months), distinguishing them from rules that might be critical but rarely triggered (e.g., a failover rule). Additionally, the analyst needs to propose a phased deprecation process to minimize risk. Which approach, integrating Command Center, Activity Insights, and Policy Optimizer, is most robust?

Use Policy Optimizer’s ‘Rule Usage’ to identify rules with zero hit count over 6 months. 2. Delete these rules. 3. Monitor Command Center for any service disruptions.

1. In Activity Insights, generate a report of all ‘Application Usage’ and ‘User Activity’ over 6 months to understand baseline traffic. 2. In Policy Optimizer, use the ‘Security Policy Rule Optimization’ dashboard to filter for rules with low hit counts over the last 6 months. 3. For these rules, change the action to ‘Deny with Logging’ and observe Command Center for new ‘deny’ logs. 4. If no legitimate denies, decommission the rule.

1. In Policy Optimizer, specifically target ‘any-any’ rules with low hit counts. 2. For these rules, change action to ‘Alert Only’ and review Command Center daily for a week. 3. If no alerts, proceed with deletion.

1. Utilize Command Center to view real-time session information for all active rules. 2. Identify rules with no active sessions. 3. Use Activity Insights to confirm these rules haven’t had recent activity. 4. Delete the confirmed unused rules.

1. In Policy Optimizer, use the ‘Security Policy Rule Optimization’ dashboard to identify rules with ‘Low Usage’. 2. For rules identified as ‘Low Usage’ and having an ‘any’ source, destination, or service, change the rule’s action to ‘No Action’ (or a similar audit mode if available) with logging enabled. 3. Monitor Command Center and Activity Insights over 3-6 months for any unintended traffic disruptions or legitimate session attempts hitting the ‘No Action’ rule. 4. If no issues, transition the rule to ‘Deny’ and then eventually delete after another grace period.

Q81. An organization is deploying a new application that uses a custom TCP-based protocol over a non-standard port (e.g., TCP/8000). Despite creating a custom application signature, defining a service object for TCP/8000, and allowing it in a security policy, the application fails to establish connections. Packet captures on the client side show SYN packets being sent, but no SYN-ACKs are received. Debugging on the Palo Alto Networks firewall (debug flow basic and debug flow session) indicates the initial SYN packet is received by the firewall and matched to the correct security policy, but no session is established or forwarded. The firewall is in virtual wire mode between two internal segments. What advanced, context-specific misconfiguration or state is the most likely culprit?

The custom application signature is incorrectly defined, causing the App-ID engine to delay classification indefinitely, leading to a session timeout before forwarding.

The security policy allows the service (TCP/8000), but the ‘application’ field is set to ‘any’, and the firewall’s default application-to-port mapping for ‘any’ application is blocking TCP/8000.

The firewall is performing IP-address-based session-stickiness or asymmetric routing is occurring for the specific port/protocol, causing return traffic to be sent out a different interface or to be dropped.

The custom application signature’s timeout value is too aggressive for the application’s initial handshake, leading to session teardown before completion.

The TCP ‘Deny-Unknown’ setting in the Zone Protection profile for the ingress or egress zone is silently dropping traffic for unknown applications or applications on non-standard ports before App-ID can fully classify them, even if a custom signature exists.

This is a very tricky scenario. The clues are: ‘SYN sent, no SYN-ACK’, ‘firewall receives SYN, matches policy, but no session established or fomarded’, and the firewall is in ‘virtual wire mode’. In virtual wire mode, traffic flows very transparently, which makes deeper packet processing issues harder to spot. E (TCP ‘Deny-Unknown’ in Zone Protection): This is the most likely and obscure culprit. Even if you have a custom App-ID and a service object, if the Zone Protection profile applied to the ingress (or egress) zone has ‘TCP Deny-Unknown’ enabled, the firewall will silently drop the initial SYN packet if it cannot immediately identify the application within the first few packets, or if the application is on a non-standard port and is considered ‘unknown’ at that very early stage. This happens before the full App-ID classification can complete or before a session is formally established. The ‘debug flow’ might show it hitting the policy, but the subsequent internal action by Zone Protection prevents forwarding. This feature is a powerful but often misunderstood silent blocker. A (Incorrect Custom App-ID): While a possibility, if the App-ID is truly misconfigured to delay indefinitely, you’d typically see different debug outputs (e.g., continuous re-evaluation, high CPU for App-ID). The key is ‘no session established or forwarded’. B (Application ‘any’ vs. specific): This is a valid general troubleshooting step, but the question states a ‘custom application signature’ was created, implying it should be used in the policy, not ‘any’. C (Asymmetric routing/session stickiness): In virtual wire mode, asymmetric routing is less of a direct issue than in Layer 3 mode. Session stickiness doesn’t prevent the initial SYN from being fomarded. D (Aggressive App-ID timeout): This usually results in a session being established but then timing out prematurely, not preventing the initial forwarding of the SYN. The flow debug implies the SYN isn’t even leaving the firewall towards the server.

Q82. A company is implementing a new BYOD policy and needs to ensure that mobile devices accessing internal resources are protected from known and unknown malware. They have deployed a Palo Alto Networks firewall with WildFire subscriptions. Which configuration steps are essential to leverage WildFire for comprehensive malware analysis and prevention specifically for BYOD traffic, assuming a security policy rule already exists for BYOD access?

Enable WildFire analysis within the existing URL Filtering profile applied to the BYOD security policy. Configure a File Blocking profile to block all executable files, and enable WildFire submission for ‘all’ file types.

Create a new WildFire Analysis profile. Set the ‘File Types’ to ‘all’ and ‘Action’ to ‘upload’ for known good and bad files. Attach this WildFire Analysis profile directly to the BYOD security policy rule. Ensure Antivirus and Anti-Spyware profiles are also applied.

Modify the existing Anti-Spyware profile applied to BYOD traffic to include WildFire signature updates. Configure a Data Filtering profile to detect and block suspicious file transfers from BYOD devices. No separate WildFire Analysis profile is needed.

Create a WildFire Analysis profile with a ‘Forward’ action for ‘PE’ files. Create a File Blocking profile to block all ‘unknown-file-types’. Group these into a new Security Profile Group and apply it to the BYOD security policy rule. Ensure the firewall has connectivity to the WildFire cloud or appliance.

Create a WildFire Analysis profile configured to ‘Block’ for ‘PE’ files and ‘upload’ for all other file types. Apply this profile within a Security Profile Group along with an Antivirus profile set to ‘reset-both’ for critical severity threats. Ensure the Security Policy rule’s action is ‘allow’.

Q83. A Palo Alto Networks firewall is configured with an External Dynamic List (EDL) sourced from an internal web server. The web server is located in a different security zone. Which of the following security policy rules must be in place to allow the firewall to successfully fetch updates for this EDL?

Allow traffic from the firewall’s management interface to the web server’s IP address on port 80/443.

Allow traffic from the security zone where the firewall’s data plane interfaces are located to the web server’s IP address on port 80/443.

Allow traffic from the ‘untrust’ zone to the web server’s IP address on port 80/443.

No specific security policy rule is needed as EDL fetching is an internal firewall process.

A NAT policy from the web server to the firewall’s management interface is required.

Q84. A global financial institution is implementing Strata Logging Service for their extensive Palo Alto Networks firewall deployment. They face stringent regulatory requirements for data residency and auditability, necessitating that certain log types (e.g., authentication, sensitive data filtering) remain within specific geographic regions while others (e.g., general traffic, threat) can be stored globally Furthermore, auditors require immutable log records for a minimum of 7 years. How can this complex requirement be met using Strata Logging Service and related Palo Alto Networks capabilities?

Use multiple Strata Logging Service instances, each configured for a specific geographic region, and direct firewalls to the appropriate regional instance based on their location. Leverage Strata Logging Service’s native data retention policies for the 7-year requirement.

Configure all firewalls to send logs to a single global Strata Logging Service instance. Use advanced SLQL queries with ‘geo_location’ field filters and export relevant logs to regional SIEMs or long-term storage solutions.

Deploy local Panorama log collectors in each region, forward sensitive logs to them, and then use a global Strata Logging Service for non-sensitive logs. Implement a separate archival solution for 7-year immutability.

Strata Logging Service natively supports data residency through geo-fencing options for specific log types. Enable this feature and set retention to 7 years. For immutability, integrate with a WORM (Write Once Read Many) storage solution provided by Palo Alto Networks.

This requirement cannot be fully met with Strata Logging Service alone due to its global nature; a hybrid approach with dedicated regional syslog servers and a separate immutable archive is the only viable option.

Q85. An enterprise is deploying a new containerized application infrastructure, using Kubernetes, exposed via a dedicated load balancer that sits behind a Palo Alto Networks firewall. The security team anticipates a very high, burstable volume of legitimate traffic, but also expects sophisticated HTTP/2-based DoS attacks that exploit the protocol’s multiplexing capabilities and header compression. The firewall needs to detect and mitigate these without impacting legitimate, high-concurrency connections. Given that standard HTTP/I .1 flood protection might be insufficient, what advanced DoS profile configurations should be prioritized for the Palo Alto Networks firewall to protect this environment, assuming HTTP/2 inspection is enabled?

Enable ‘HTTP Flood’ protection with ‘Per-Request Rate’ and ‘Per-Source IP Rate’ thresholds, and configure ‘Syn-Cookie’ as the action. Also, set a low ‘Client Read Timeout’ in ‘Slow HTTP Protection’ to counter slow HTTP/2 attacks.

Focus on ‘Session Based Attack Protection’ with very high ‘Max Concurrent Sessions’ and ‘Session Rate’ thresholds, coupled with ‘Packet Based Attack Protection’ for TCP and UDP floods to handle general volumetric attacks.

Utilize ‘HTTP Flood’ protection within a DoS Protection Profile, ensuring ‘HTTP/2’ is enabled for inspection on the relevant security policy. Set ‘Per-Request Rate’ and ‘Per-Source IP Rate’ aggressively, and importantly, tune ‘Per-URL Rate’ and ‘URL Query String Length’ thresholds to detect malformed or excessively long HTTP/2 requests/streams.

Implement ‘Zone Protection’ on the ingress zone, enabling ‘Flood Protection’ for ‘HTTP Flood’ and setting ‘Action: Reset’. Complement this with ‘IP Address Block’ for sources exceeding a high connection rate.

Configure ‘DoS Protection Policy’ with ‘Target’ rules for the load balancer IPs. Within these rules, enable ‘HTTP Flood’ protection. Critically, utilize ‘HTTP Header Length’ and ‘HTTP Header Count’ thresholds to detect HTTP/2 ‘HPACK Bomb’ or excessive header attacks. Also, set ‘Client Read Timeout’ for ‘Slow HTTP Protection’ and ensure ‘Action: Protect’ is chosen for relevant thresholds.

Q86. You are deploying a new application on a Palo Alto Networks firewall and need to create a custom Application (App-ID) for it. The application communicates over TCP port 8443, uses TLS, and sends a specific HTTP header ‘X-App-ID: MyWebApp’ in all its requests. The application also uses a unique URI path structure, To ensure the most accurate and robust App-ID, which custom application signature configuration would be most appropriate?

Q87. Consider a large-scale network migration where an organization is transitioning thousands of physical Palo Alto Networks firewalls to a mix of physical and virtual firewalls, all to be managed by Strata Cloud Manager (SCM). The migration plan involves frequent, scheduled policy updates across different device groups. How can an administrator programmatically automate the policy update process and verify successful deployment for multiple device groups using SCM’s API?

Utilize the SCM GUI for batch operations, as API is not suitable for large-scale migrations.

Develop a Python script that leverages SCM’s RESTful API endpoints for configuration management and retrieves job status for deployment validation.

Manually SSH into each firewall and apply policy updates sequentially, then check logs locally.

Implement an SNMP-based monitoring system to push configurations and receive alerts.

Deploy a dedicated firewall management server (Panorama) instead of SCM for such a large migration.

Q88. You are debugging a complex application issue where a server behind a Palo Alto Networks firewall is unable to establish outbound HTTPS connections to specific external APIs, despite a broad security policy allowing HTTPS. Packet captures on the firewall show SYN packets leaving the server’s interface, but no SYN-ACKs are returned from the external API server. The firewall’s session browser shows the session in a ‘PREINIT state for an extended period before eventually aging out. There are no ‘deny’ logs for this traffic. Which of the following is the MOST ADVANCED troubleshooting step to determine where the packets are being dropped or what is delaying the session establishment?

Enable a debug flow on the firewall from the server’s IP to the API IP, specifically looking for drop reasons using debug flow basic < source-ip> <destination- ip> and analyzing the output.

Use tcpdump on the firewall’s ingress and egress interfaces for the specific server and API IP addresses to confirm packet forwarding.

Utilize the ‘Test Policy Match’ tool in the GUI (Policies > Security > Policy Match) for the problematic source/destination/application to verify policy adherence.

Check the NAT policy configuration for this traffic to ensure the correct egress interface is selected and that source NAT is applied appropriately.

Perform a ‘Packet Flow’ analysis on the firewall (Monitor > Packet Flow) for a problematic session, tracing each stage: ingress, ingress processing, lookup, security policy, NAT, egress processing, and egress.

Q89. Consider the following XML configuration snippet for a Palo Alto Networks decryption profile:
yes yes yes block yes
If this ‘CustomDecryptionProfile’ is applied to a security policy, and an internal user attempts to access a legitimate external website whose certificate chain includes an intermediate CA that is not present in the firewall’s trusted CA store, what will be the likely outcome for that connection?

The connection will be allowed and decrypted, as ‘untrusted-cert-action’ only applies to the root C

The connection will be allowed but not decrypted, as the firewall cannot build a trusted chain.

The connection will be blocked due to the ‘untrusted-cert-action’ setting, which implicitly covers intermediate CA trust failures.

The connection will be allowed, and the user will receive a browser warning about an untrusted certificate.

The firewall will attempt to download the missing intermediate CA certificate automatically to complete the chain.

[Q68-Q89] Palo Alto Networks NetSec-Analyst Practice Verified Answers – Pass Your Exams For Sure! [2025]

Leave a Reply Cancel reply