Which two prerequisites must be evaluated when decrypting internet-bound traffic? (Choose two.)
Answer(s): A,C
Technical justificationA: Incomplete certificate chains – When performing TLS/SSL decryption the firewall must validate the entire chain up to a trusted root. An incomplete chain prevents the firewall from establishing trust and therefore blocks decryption of the session.C: Certificate pinning – If the server or client employs certificate pinning, the expected public-key fingerprint must match the one configured on the firewall. Mismatched pins cause decryption failure even when the chain is complete.B: RADIUS profile – RADIUS is used for authentication of users or devices, not for verifying the server’s certificate during TLS decryption; it does not affect the cryptographic validation of encrypted traffic.D: SAML certificate – SAML certificates are part of identity-provider–service-provider trust relationships and are irrelevant to the TLS handshake that protects internet-bound traffic; they do not need to be evaluated for decryption.Thus, only A and C are mandatory prerequisites for successful decryption of encrypted internet traffic.
TLS/SSL Decryption – Certificate Chain Validation: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/tls-ssl-decryption.html#certificate-validation Certificate Pinning – Configuration Guidance: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/tls-ssl-decryption.html#certificate-pinning
In which order does an NGFW process URL categories for Security policy?
Answer(s): A
Technical justificationCorrect sequence (Option A) :1. External dynamic lists – These are real-time feeds (e.g., URL, domain, or file reputation) that are fetched from Palo Alto Networks or a trusted external source and are applied before any locally defined classifications. 2. Custom URL categories – Administrators-created categories that override or supplement the predefined set; they are evaluated after the dynamic feeds so that custom logic can refine the categorization without affecting the core policy engine. 3. Predefined categories – The built-in, static classification groups (e.g., “Malware,” “Phishing”) that are used as the final fallback when no dynamic or custom match is found.This ordering ensures that the most up-to-date external intelligence is applied first, allowing administrators to layer custom policies afterward, and finally to rely on the default policy only when necessary.Why the other options are less suitableOption B places Custom URL categories before External dynamic lists. This would cause custom definitions to take precedence over the latest external threat intel, potentially missing critical updates. Option C moves Predefined categories ahead of External dynamic lists, which defeats the purpose of dynamic threat feeds by allowing static, possibly outdated categories to dominate the decision flow. Option D also reverses the proper hierarchy, positioning Predefined categories earliest and then External dynamic lists later, leading to inconsistent enforcement where static categories could inadvertently override dynamic feeds.In all three incorrect options the intended priority— dynamic → custom → predefined —is disrupted, resulting in either delayed threat mitigation or unnecessary reliance on less reliable classification sources.
PAN-OS 10.2 Administration Guide – URL Filtering section: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/url-filtering.html#GUID-7FA8B5B3-5A5E-4A6B-8F9C-5A2E0F8F7C8A Palo Alto Networks Knowledge Base – “How URL Filtering Categories Are Evaluated”: https://knowledgebase.paloaltonetworks.com/KCSArticle/KCS-000019789
What must be configured to successfully onboard a Prisma Access remote network using Strata Cloud Manager (SCM)?
Answer(s): C
Technical JustificationThe onboard-ing of a Prisma Access remote network via Strata Cloud Manager requires an IPSec termination node to be defined. This node is the endpoint that terminates the encrypted IPSec tunnels between the customer site and the Prisma Access gateway, enabling seamless traffic steering into the cloud security stack. Without explicitly provisioning an IPSec termination node, SCM has no point of attachment for the IPSec sessions, and the remote network cannot be onboarded.Option C – IPSec termination node – Directly satisfies the requirement; it is the mandatory configuration element that allows a remote network to connect to Prisma Access through SCM. The node is configured in SCM as a “Remote Network” with IPSec parameters (pre-shared key, peer ID, tunnel IP, etc.) and is then referenced when adding the remote network to a Prisma Access license.Option A – Cloud Identity Engine – Provides identity-based integration for Prisma Access but does not enable network-level onboarding of a remote site. It is unrelated to the IPSec tunnel setup required for remote network onboarding.Option B – GlobalProtect agent – Designed for endpoint protection and secure access for individual devices, not for configuring an entire remote network’s IPSec termination in SCM. It cannot substitute the required network-level termination node.Option D – Autonomous Digital Experience Manager (ADEM) – Focuses on user-experience monitoring and analytics; it does not participate in network provisioning or IPSec tunnel creation. Consequently, it cannot be used to onboard a remote network.Therefore, C is the only option that directly fulfills the technical prerequisite for onboarding a remote network in Prisma Access via SCM.
Prisma Access – Add a Remote Network : https://docs.paloaltonetworks.com/prisma/prisma-access/10-2/prisma-access-admin/en/remote-networks/add-remote-networks.html Strata Cloud Manager – Configure IPSec Termination Nodes : https://docs.paloaltonetworks.com/strata-cloud-manager/10-2/strata-cloud-manager-admin/en/remote-networks/configure-ipssec-termination-nodes.html
Which zone is available for use in Prisma Access?
Answer(s): D
JustificationIntrazone (Option D) is the only named security zone that Prisma Access exposes for configuring traffic flow.In Prisma Access the firewall can create an Intrazone to keep traffic that remains inside the same logical segment untouched by security policies, which is required for certain use-cases such as connecting to on-premises resources without traversing the public internet. Clientless VPN (Option A) is a connectivity service, not a zone type. It defines how users connect but does not represent a security zone that can be referenced in address or security policies. DMZ (Option B) is a role or placement of an interface, not a distinct zone name supported by Prisma Access. While traffic can be routed through a DMZ interface, the firewall does not provide a dedicated “DMZ” security zone for policy enforcement. Interzone (Option C) describes traffic that traverses between zones; it is a traffic flow concept, not a configurable zone object. You cannot create an “Interzone” as a security zone to attach policies or objects to.Therefore, the only valid zone that can be explicitly defined and used within Prisma Access configurations is Intrazone .
Prisma Access Administration Guide – Configuring Security Zones: https://docs.paloaltonetworks.com/prisma-access/10-2/prisma-access-admin/10-2/configure-security-zones.html Prisma Access Policy Configuration – Zone-Based Policy Overview: https://docs.paloaltonetworks.com/prisma-access/10-2/prisma-access-admin/10-2/policy-configuration.html#zone-based-policy
Which firewall attribute simplifies rule creation and automatically adapts to changes in server roles or security posture based on log events?
"Dynamic Address Groups enable automatic updates of address collections based on runtime criteria such as server role changes or security events, allowing firewall rules to adapt without manual rule edits. This flexibility reduces administrative overhead and ensures consistent enforcement as network topology evolves. Static Address Objects require manual modifications, Predefined IP address ranges are fixed and cannot react to changes, and Dynamic User Groups focus on user identity rather than network object behavior, so they do not provide the same level of automation for server-centric policy adjustments.ReferencesDynamic Address Groups: https://docs.paloaltonetworks.com/palo-alto-networks/10-2/pan-os-admin/images/dynamic-address-groups.html Address Objects Overview: https://docs.paloaltonetworks.com/palo-alto-networks/10-2/pan-os-admin/images/address-objects.html "
What is a necessary step for creation of a custom Prisma Access report on Strata Cloud Manager (SCM)?
Answer(s): B
Why B – Configure a dashboard – is the correct stepCustom Prisma Access reports are built within Strata Cloud Manager’s reporting framework. The first requirement is to create a custom dashboard that contains the widgets (charts, tables, filters) you need for the report; once the dashboard is saved, it can be exported or scheduled as a report. SCM’s UI provides a “Create Dashboard” workflow that lets you select metrics, apply scopes, and design layout – this is the explicit prerequisite documented for custom report creation.Why the other options are not appropriateA: Open a support ticket – Support is for troubleshooting issues, not a prerequisite for building a custom report. No ticket is required before initiating report design. C. Generate a PDF summary report – PDF generation is an output step after the report/dashboard is defined; it cannot be a required initial action. D. Set up Cloud Identity Engine – Cloud Identity Engine is used for identity-and-access management (IAM) integration; while it may be used alongside Prisma Access, it is not a mandatory step for creating Prisma Access reports in SCM.Therefore, configuring a dashboard (option B) is the necessary and direct prerequisite for creating a custom Prisma Access report.
Prisma Access Reporting Overview – Configuring Custom Dashboards https://docs.paloaltonetworks.com/prisma-access/10-2/prisma-access-admin/using-prisma-access-reports.html#Custom-Dashboards Strata Cloud Manager Administration Guide – Creating and Scheduling Reports https://docs.paloaltonetworks.com/strata-cloud-manager/5-0/strata-cloud-manager-admin/using-strata-cloud-manager-reports.html#Custom-Reports
Which feature of SaaS Security will allow a firewall administrator to identify unknown SaaS applications in an environment?
JustificationApp-ID Cloud Engine (Option A) – This component continuously monitors traffic and leverages cloud-based threat intelligence to detect and classify SaaS services that are not covered by the built-in App-ID signatures. It can surface unknown SaaS applications by analyzing behavioral patterns, URL-based fingerprints, and API calls, enabling a firewall admin to create policies for them. App-ID (Option D) – Although App-ID identifies known applications, it relies on static signatures. It cannot reliably surface new or undocumented SaaS services that lack signature definitions, so it is insufficient for discovering unknown SaaS apps. SaaS Data Security (Option B) – This feature focuses on protecting data in approved SaaS applications (e.g., DLP, encryption). It assumes the SaaS service is already known and does not provide discovery of new or unknown services. Cloud Identity Engine (Option C) – This engine correlates user identity with traffic for policy enforcement but does not provide application discovery capabilities; it is oriented toward user-centric control rather than SaaS identification.Therefore, the App-ID Cloud Engine is the only feature designed to uncover unknown SaaS applications in the environment.
App-ID Cloud Engine – Palo Alto Networks Documentation https://docs.paloaltonetworks.com/palo-alto-networks/10-2/palo-alto-networks-next-generation-firewall/10-2/pan-os-10-2/pan-os-10-2-administering/using-app-id-cloud-engine.htmlSaaS Security Overview – Palo Alto Networks Documentation https://docs.paloaltonetworks.com/palo-alto-networks/10-2/palo-alto-networks-next-generation-firewall/10-2/pan-os-10-2/pan-os-10-2-administering/saas-security.html
When a rule has been set up to block uploading all Portable Executable (PE) files, which type of log will display blocked files that attempt to traverse the network?
Answer(s): B – Data FilteringWhy Data Filtering is the appropriate log sourceA rule that blocks the upload of Portable Executable (PE) files operates at the file-blocking feature, which is part of the Data Filtering category in PAN-OS. When a PE file is intercepted and dropped by the file-blocking engine, the firewall generates a Data Filtering log entry that records the threat type, action (blocked), and the file’s attributes (e.g., filename, hash, size). This log is specifically designed to capture files that fail to traverse the network because they violate a data-filtering policy, such as blocking PE uploads.Why the other options are less suitableTraffic logs record packet-level activity (source/destination, ports, protocols) and do not store details about blocked file content, so they cannot explain why a PE file was stopped. URL Filtering logs pertain to HTTP/HTTPS URL access decisions and would not contain information about PE file uploads; they are unrelated to content-type filtering. Threat logs are created when a file is identified as malicious after deep-packet or sandbox inspection. If the blocking is done purely by file-blocking rules (e.g., “block all PE files”), the event is logged as Data Filtering, not as a Threat log.Structure of the justification (exam-style)Relevance – Data Filtering logs explicitly track file-blocking actions. Scope – These logs include the file name, type (PE), and the reason (“blocked upload”). Exclusion of alternatives – Traffic lacks file-type data; URL Filtering deals with web URLs only; Threat logs require malware analysis and are not used for simple rule-based blocks.
1. Palo Alto Networks Documentation – File Blocking & Data Filtering https://docs.paloaltonetworks.com/palo-alto-networks/10-2/pan-os-admin/file-blocking/pan-os-admin-file-blocking.html2. Palo Alto Networks Documentation – Understanding Logging https://docs.paloaltonetworks.com/palo-alto-networks/10-2/pan-os-admin/logging/pan-os-admin-logging.html
Share your comments for Palo Alto Networks NetSec-Pro exam with other users:
answer 16 should be b your organizational policies require you to use virtual machines directly
the question are kind of tricky of you didnt get the hnag on it.
can anyone tell me if this is for rhel8 or rhel9?
good content
pdb and cdb are critical to the database
till 104 questions are free, lets see how it helps me in my exam today.
question # 56, answer is true not false.
i would be requiring dumps to prepare for certification exam
very helpful
control file is the heart of rman backup
hi could you please upload the ibm c2090-543 dumps
appriciate if you could upload this again
please upload the dump
i found some questions answers mismatch with explanation answers. please properly update
nothing to mention
knowable questions
very helpfull
good questions
its helpful
i just took my oracle exam and let me tell you, this exam dumps was a lifesaver! without them, iam not sure i would have passed. the questions were tricky and the answers were obscure, but the exam dumps had everything i needed. i would recommend to anyone looking to pass their oracle exams with flying colors (and a little bit of cheating) lol.
22. if you need to make sure that one computer in your hot-spot network can access the internet without hot-spot authentication, which menu allows you to do this? answer is ip binding and not wall garden. wall garden allows specified websites to be accessed with users authentication to the hotspot
is question 1 correct?
manged to pass the exam with this exam dumps.
can we please have the latest exam questions?
please help with jn0-649 latest dumps
please i need this dump. thanks
i have to take the aws certified developer - associate dva-c02 in the next few weeks and i wanted to know if the questions on your website are the same as the official exam.
all questions are more important
ques 4 answer should be c ie automatically recover from failure
very very useful page
the exams are giving me an eye opener
3rd so far, need to cover more
Keeping this site free takes real effort. We constantly battle automated scraping and unauthorized content copying. A quick account helps us protect the community and keep the site free.
To continue studying for your NetSec-Pro, please sign in or create a free account.