Which two prerequisites must be evaluated when decrypting internet-bound traffic? (Choose two.)
Answer(s): A,C
Technical justificationA: Incomplete certificate chains – When performing TLS/SSL decryption the firewall must validate the entire chain up to a trusted root. An incomplete chain prevents the firewall from establishing trust and therefore blocks decryption of the session.C: Certificate pinning – If the server or client employs certificate pinning, the expected public-key fingerprint must match the one configured on the firewall. Mismatched pins cause decryption failure even when the chain is complete.B: RADIUS profile – RADIUS is used for authentication of users or devices, not for verifying the server’s certificate during TLS decryption; it does not affect the cryptographic validation of encrypted traffic.D: SAML certificate – SAML certificates are part of identity-provider–service-provider trust relationships and are irrelevant to the TLS handshake that protects internet-bound traffic; they do not need to be evaluated for decryption.Thus, only A and C are mandatory prerequisites for successful decryption of encrypted internet traffic.
TLS/SSL Decryption – Certificate Chain Validation: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/tls-ssl-decryption.html#certificate-validation Certificate Pinning – Configuration Guidance: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/tls-ssl-decryption.html#certificate-pinning
In which order does an NGFW process URL categories for Security policy?
Answer(s): A
Technical justificationCorrect sequence (Option A) :1. External dynamic lists – These are real-time feeds (e.g., URL, domain, or file reputation) that are fetched from Palo Alto Networks or a trusted external source and are applied before any locally defined classifications. 2. Custom URL categories – Administrators-created categories that override or supplement the predefined set; they are evaluated after the dynamic feeds so that custom logic can refine the categorization without affecting the core policy engine. 3. Predefined categories – The built-in, static classification groups (e.g., “Malware,” “Phishing”) that are used as the final fallback when no dynamic or custom match is found.This ordering ensures that the most up-to-date external intelligence is applied first, allowing administrators to layer custom policies afterward, and finally to rely on the default policy only when necessary.Why the other options are less suitableOption B places Custom URL categories before External dynamic lists. This would cause custom definitions to take precedence over the latest external threat intel, potentially missing critical updates. Option C moves Predefined categories ahead of External dynamic lists, which defeats the purpose of dynamic threat feeds by allowing static, possibly outdated categories to dominate the decision flow. Option D also reverses the proper hierarchy, positioning Predefined categories earliest and then External dynamic lists later, leading to inconsistent enforcement where static categories could inadvertently override dynamic feeds.In all three incorrect options the intended priority— dynamic → custom → predefined —is disrupted, resulting in either delayed threat mitigation or unnecessary reliance on less reliable classification sources.
PAN-OS 10.2 Administration Guide – URL Filtering section: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/url-filtering.html#GUID-7FA8B5B3-5A5E-4A6B-8F9C-5A2E0F8F7C8A Palo Alto Networks Knowledge Base – “How URL Filtering Categories Are Evaluated”: https://knowledgebase.paloaltonetworks.com/KCSArticle/KCS-000019789
What must be configured to successfully onboard a Prisma Access remote network using Strata Cloud Manager (SCM)?
Answer(s): C
Technical JustificationThe onboard-ing of a Prisma Access remote network via Strata Cloud Manager requires an IPSec termination node to be defined. This node is the endpoint that terminates the encrypted IPSec tunnels between the customer site and the Prisma Access gateway, enabling seamless traffic steering into the cloud security stack. Without explicitly provisioning an IPSec termination node, SCM has no point of attachment for the IPSec sessions, and the remote network cannot be onboarded.Option C – IPSec termination node – Directly satisfies the requirement; it is the mandatory configuration element that allows a remote network to connect to Prisma Access through SCM. The node is configured in SCM as a “Remote Network” with IPSec parameters (pre-shared key, peer ID, tunnel IP, etc.) and is then referenced when adding the remote network to a Prisma Access license.Option A – Cloud Identity Engine – Provides identity-based integration for Prisma Access but does not enable network-level onboarding of a remote site. It is unrelated to the IPSec tunnel setup required for remote network onboarding.Option B – GlobalProtect agent – Designed for endpoint protection and secure access for individual devices, not for configuring an entire remote network’s IPSec termination in SCM. It cannot substitute the required network-level termination node.Option D – Autonomous Digital Experience Manager (ADEM) – Focuses on user-experience monitoring and analytics; it does not participate in network provisioning or IPSec tunnel creation. Consequently, it cannot be used to onboard a remote network.Therefore, C is the only option that directly fulfills the technical prerequisite for onboarding a remote network in Prisma Access via SCM.
Prisma Access – Add a Remote Network : https://docs.paloaltonetworks.com/prisma/prisma-access/10-2/prisma-access-admin/en/remote-networks/add-remote-networks.html Strata Cloud Manager – Configure IPSec Termination Nodes : https://docs.paloaltonetworks.com/strata-cloud-manager/10-2/strata-cloud-manager-admin/en/remote-networks/configure-ipssec-termination-nodes.html
Which zone is available for use in Prisma Access?
Answer(s): D
JustificationIntrazone (Option D) is the only named security zone that Prisma Access exposes for configuring traffic flow.In Prisma Access the firewall can create an Intrazone to keep traffic that remains inside the same logical segment untouched by security policies, which is required for certain use-cases such as connecting to on-premises resources without traversing the public internet. Clientless VPN (Option A) is a connectivity service, not a zone type. It defines how users connect but does not represent a security zone that can be referenced in address or security policies. DMZ (Option B) is a role or placement of an interface, not a distinct zone name supported by Prisma Access. While traffic can be routed through a DMZ interface, the firewall does not provide a dedicated “DMZ” security zone for policy enforcement. Interzone (Option C) describes traffic that traverses between zones; it is a traffic flow concept, not a configurable zone object. You cannot create an “Interzone” as a security zone to attach policies or objects to.Therefore, the only valid zone that can be explicitly defined and used within Prisma Access configurations is Intrazone .
Prisma Access Administration Guide – Configuring Security Zones: https://docs.paloaltonetworks.com/prisma-access/10-2/prisma-access-admin/10-2/configure-security-zones.html Prisma Access Policy Configuration – Zone-Based Policy Overview: https://docs.paloaltonetworks.com/prisma-access/10-2/prisma-access-admin/10-2/policy-configuration.html#zone-based-policy
Which firewall attribute simplifies rule creation and automatically adapts to changes in server roles or security posture based on log events?
"Dynamic Address Groups enable automatic updates of address collections based on runtime criteria such as server role changes or security events, allowing firewall rules to adapt without manual rule edits. This flexibility reduces administrative overhead and ensures consistent enforcement as network topology evolves. Static Address Objects require manual modifications, Predefined IP address ranges are fixed and cannot react to changes, and Dynamic User Groups focus on user identity rather than network object behavior, so they do not provide the same level of automation for server-centric policy adjustments.ReferencesDynamic Address Groups: https://docs.paloaltonetworks.com/palo-alto-networks/10-2/pan-os-admin/images/dynamic-address-groups.html Address Objects Overview: https://docs.paloaltonetworks.com/palo-alto-networks/10-2/pan-os-admin/images/address-objects.html "
What is a necessary step for creation of a custom Prisma Access report on Strata Cloud Manager (SCM)?
Answer(s): B
Why B – Configure a dashboard – is the correct stepCustom Prisma Access reports are built within Strata Cloud Manager’s reporting framework. The first requirement is to create a custom dashboard that contains the widgets (charts, tables, filters) you need for the report; once the dashboard is saved, it can be exported or scheduled as a report. SCM’s UI provides a “Create Dashboard” workflow that lets you select metrics, apply scopes, and design layout – this is the explicit prerequisite documented for custom report creation.Why the other options are not appropriateA: Open a support ticket – Support is for troubleshooting issues, not a prerequisite for building a custom report. No ticket is required before initiating report design. C. Generate a PDF summary report – PDF generation is an output step after the report/dashboard is defined; it cannot be a required initial action. D. Set up Cloud Identity Engine – Cloud Identity Engine is used for identity-and-access management (IAM) integration; while it may be used alongside Prisma Access, it is not a mandatory step for creating Prisma Access reports in SCM.Therefore, configuring a dashboard (option B) is the necessary and direct prerequisite for creating a custom Prisma Access report.
Prisma Access Reporting Overview – Configuring Custom Dashboards https://docs.paloaltonetworks.com/prisma-access/10-2/prisma-access-admin/using-prisma-access-reports.html#Custom-Dashboards Strata Cloud Manager Administration Guide – Creating and Scheduling Reports https://docs.paloaltonetworks.com/strata-cloud-manager/5-0/strata-cloud-manager-admin/using-strata-cloud-manager-reports.html#Custom-Reports
Which feature of SaaS Security will allow a firewall administrator to identify unknown SaaS applications in an environment?
JustificationApp-ID Cloud Engine (Option A) – This component continuously monitors traffic and leverages cloud-based threat intelligence to detect and classify SaaS services that are not covered by the built-in App-ID signatures. It can surface unknown SaaS applications by analyzing behavioral patterns, URL-based fingerprints, and API calls, enabling a firewall admin to create policies for them. App-ID (Option D) – Although App-ID identifies known applications, it relies on static signatures. It cannot reliably surface new or undocumented SaaS services that lack signature definitions, so it is insufficient for discovering unknown SaaS apps. SaaS Data Security (Option B) – This feature focuses on protecting data in approved SaaS applications (e.g., DLP, encryption). It assumes the SaaS service is already known and does not provide discovery of new or unknown services. Cloud Identity Engine (Option C) – This engine correlates user identity with traffic for policy enforcement but does not provide application discovery capabilities; it is oriented toward user-centric control rather than SaaS identification.Therefore, the App-ID Cloud Engine is the only feature designed to uncover unknown SaaS applications in the environment.
App-ID Cloud Engine – Palo Alto Networks Documentation https://docs.paloaltonetworks.com/palo-alto-networks/10-2/palo-alto-networks-next-generation-firewall/10-2/pan-os-10-2/pan-os-10-2-administering/using-app-id-cloud-engine.htmlSaaS Security Overview – Palo Alto Networks Documentation https://docs.paloaltonetworks.com/palo-alto-networks/10-2/palo-alto-networks-next-generation-firewall/10-2/pan-os-10-2/pan-os-10-2-administering/saas-security.html
When a rule has been set up to block uploading all Portable Executable (PE) files, which type of log will display blocked files that attempt to traverse the network?
Answer(s): B – Data FilteringWhy Data Filtering is the appropriate log sourceA rule that blocks the upload of Portable Executable (PE) files operates at the file-blocking feature, which is part of the Data Filtering category in PAN-OS. When a PE file is intercepted and dropped by the file-blocking engine, the firewall generates a Data Filtering log entry that records the threat type, action (blocked), and the file’s attributes (e.g., filename, hash, size). This log is specifically designed to capture files that fail to traverse the network because they violate a data-filtering policy, such as blocking PE uploads.Why the other options are less suitableTraffic logs record packet-level activity (source/destination, ports, protocols) and do not store details about blocked file content, so they cannot explain why a PE file was stopped. URL Filtering logs pertain to HTTP/HTTPS URL access decisions and would not contain information about PE file uploads; they are unrelated to content-type filtering. Threat logs are created when a file is identified as malicious after deep-packet or sandbox inspection. If the blocking is done purely by file-blocking rules (e.g., “block all PE files”), the event is logged as Data Filtering, not as a Threat log.Structure of the justification (exam-style)Relevance – Data Filtering logs explicitly track file-blocking actions. Scope – These logs include the file name, type (PE), and the reason (“blocked upload”). Exclusion of alternatives – Traffic lacks file-type data; URL Filtering deals with web URLs only; Threat logs require malware analysis and are not used for simple rule-based blocks.
1. Palo Alto Networks Documentation – File Blocking & Data Filtering https://docs.paloaltonetworks.com/palo-alto-networks/10-2/pan-os-admin/file-blocking/pan-os-admin-file-blocking.html2. Palo Alto Networks Documentation – Understanding Logging https://docs.paloaltonetworks.com/palo-alto-networks/10-2/pan-os-admin/logging/pan-os-admin-logging.html
Share your comments for Palo Alto Networks NetSec-Pro exam with other users:
Which statement is true about using default environment variables? The environment variables can be read in workflows using the ENV: variable_name syntax. The environment variables created should be prefixed with GITHUB_ to ensure they can be accessed in workflows The environment variables can be set in the defaults: sections of the workflow The GITHUB_WORKSPACE environment variable should be used to access files from within the runner.Correct answer: The statement "The GITHUB_WORKSPACE environment variable should be used to access files from within the runner." is true. Why the others are false:
${{ env.VARIABLE }}
$VARIABLE
GITHUB_
defaults:
run
GITHUB_WORKSPACE
${{ github.workspace }}
$GITHUB_WORKSPACE/...
${{ github.workspace }}/...
As an administrator for this subscription, you have been tasked with recommending a solution that prohibits users from copying corporate information from managed applications installed on unmanaged devices. Which of the following should you recommend? Windows Virtual Desktop. Microsoft Intune. Windows AutoPilot. Azure AD Application Proxy.
Question 34:
Policy
function of appnav in sdwan
Question 1:
Question 5:
Why this is correct
Question 7:
Question 104:
clustering keys
Q23: Fabric Admin is correct. Because Domain admin cannot create domains. Only Fabric Admin can among the given options. Q51: Wrapping @pipeline.parameter.param1 inside {} will return a string. But question requires the expression to return Int, so correct answer should be @pipeline.parameter.param1 (no {})
Question 62:
ZDX
Analyze Score
Y Engine
Question 32:
Question 3:
date = sys.argv[1]
sys.argv[1]
date = spark.conf.get("date")
input()
date = dbutils.notebooks.getParam("date")
dbutils.notebook.run
Question 528:
Question 23:The correct answer is Domain admin (option B), not Fabric admin.
Question 2:For question 2, the key concept is the Longest Prefix Match. Routers pick the route whose subnet mask is the most specific (largest prefix length) that still matches the destination IP. From the options:
Question 129:Correct answer: CNAME
compute.osAdminLogin
enable-oslogin
Question 2:
Recommend using AI for Solutions rather the Answer(s) submitted here
This is very interesting
Are these the same questions you have to pay for in ExamTopics?
For Question 7 - while the answer description indicates the correct answer, the option no. mentioned is incorrect. Nice and Comprehensive. Thankyou
This is very good and accurate. Explanation is very helpful even thou some are not 100% right but good enough to pass.
The DP-900 exam can be tricky if you aren't familiar with Microsoft’s specific cloud terminology. I used the practice questions from free-braindumps.com and found them incredibly helpful. The site breaks down core data concepts and Azure services in a way that actually mirrors the real test. As a resutl I passed my exam.
interesting
Passed this exam 2 days ago. These questions are in the exam. You are safe to use them.
Helpful to test your preparedness before giving exam
Really helped
Good explanation
very helpful
Question 1, Ans is - Developer,Standard,Professional Direct and Premier
Keeping this site free takes real effort. We constantly battle automated scraping and unauthorized content copying. A quick account helps us protect the community and keep the site free.
To continue studying for your NetSec-Pro, please sign in or create a free account.