Which two prerequisites must be evaluated when decrypting internet-bound traffic? (Choose two.)
Answer(s): A,C
Technical justificationA: Incomplete certificate chains – When performing TLS/SSL decryption the firewall must validate the entire chain up to a trusted root. An incomplete chain prevents the firewall from establishing trust and therefore blocks decryption of the session.C: Certificate pinning – If the server or client employs certificate pinning, the expected public-key fingerprint must match the one configured on the firewall. Mismatched pins cause decryption failure even when the chain is complete.B: RADIUS profile – RADIUS is used for authentication of users or devices, not for verifying the server’s certificate during TLS decryption; it does not affect the cryptographic validation of encrypted traffic.D: SAML certificate – SAML certificates are part of identity-provider–service-provider trust relationships and are irrelevant to the TLS handshake that protects internet-bound traffic; they do not need to be evaluated for decryption.Thus, only A and C are mandatory prerequisites for successful decryption of encrypted internet traffic.
TLS/SSL Decryption – Certificate Chain Validation: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/tls-ssl-decryption.html#certificate-validation Certificate Pinning – Configuration Guidance: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/tls-ssl-decryption.html#certificate-pinning
In which order does an NGFW process URL categories for Security policy?
Answer(s): A
Technical justificationCorrect sequence (Option A) :1. External dynamic lists – These are real-time feeds (e.g., URL, domain, or file reputation) that are fetched from Palo Alto Networks or a trusted external source and are applied before any locally defined classifications. 2. Custom URL categories – Administrators-created categories that override or supplement the predefined set; they are evaluated after the dynamic feeds so that custom logic can refine the categorization without affecting the core policy engine. 3. Predefined categories – The built-in, static classification groups (e.g., “Malware,” “Phishing”) that are used as the final fallback when no dynamic or custom match is found.This ordering ensures that the most up-to-date external intelligence is applied first, allowing administrators to layer custom policies afterward, and finally to rely on the default policy only when necessary.Why the other options are less suitableOption B places Custom URL categories before External dynamic lists. This would cause custom definitions to take precedence over the latest external threat intel, potentially missing critical updates. Option C moves Predefined categories ahead of External dynamic lists, which defeats the purpose of dynamic threat feeds by allowing static, possibly outdated categories to dominate the decision flow. Option D also reverses the proper hierarchy, positioning Predefined categories earliest and then External dynamic lists later, leading to inconsistent enforcement where static categories could inadvertently override dynamic feeds.In all three incorrect options the intended priority— dynamic → custom → predefined —is disrupted, resulting in either delayed threat mitigation or unnecessary reliance on less reliable classification sources.
PAN-OS 10.2 Administration Guide – URL Filtering section: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/url-filtering.html#GUID-7FA8B5B3-5A5E-4A6B-8F9C-5A2E0F8F7C8A Palo Alto Networks Knowledge Base – “How URL Filtering Categories Are Evaluated”: https://knowledgebase.paloaltonetworks.com/KCSArticle/KCS-000019789
What must be configured to successfully onboard a Prisma Access remote network using Strata Cloud Manager (SCM)?
Answer(s): C
Technical JustificationThe onboard-ing of a Prisma Access remote network via Strata Cloud Manager requires an IPSec termination node to be defined. This node is the endpoint that terminates the encrypted IPSec tunnels between the customer site and the Prisma Access gateway, enabling seamless traffic steering into the cloud security stack. Without explicitly provisioning an IPSec termination node, SCM has no point of attachment for the IPSec sessions, and the remote network cannot be onboarded.Option C – IPSec termination node – Directly satisfies the requirement; it is the mandatory configuration element that allows a remote network to connect to Prisma Access through SCM. The node is configured in SCM as a “Remote Network” with IPSec parameters (pre-shared key, peer ID, tunnel IP, etc.) and is then referenced when adding the remote network to a Prisma Access license.Option A – Cloud Identity Engine – Provides identity-based integration for Prisma Access but does not enable network-level onboarding of a remote site. It is unrelated to the IPSec tunnel setup required for remote network onboarding.Option B – GlobalProtect agent – Designed for endpoint protection and secure access for individual devices, not for configuring an entire remote network’s IPSec termination in SCM. It cannot substitute the required network-level termination node.Option D – Autonomous Digital Experience Manager (ADEM) – Focuses on user-experience monitoring and analytics; it does not participate in network provisioning or IPSec tunnel creation. Consequently, it cannot be used to onboard a remote network.Therefore, C is the only option that directly fulfills the technical prerequisite for onboarding a remote network in Prisma Access via SCM.
Prisma Access – Add a Remote Network : https://docs.paloaltonetworks.com/prisma/prisma-access/10-2/prisma-access-admin/en/remote-networks/add-remote-networks.html Strata Cloud Manager – Configure IPSec Termination Nodes : https://docs.paloaltonetworks.com/strata-cloud-manager/10-2/strata-cloud-manager-admin/en/remote-networks/configure-ipssec-termination-nodes.html
Which zone is available for use in Prisma Access?
Answer(s): D
JustificationIntrazone (Option D) is the only named security zone that Prisma Access exposes for configuring traffic flow.In Prisma Access the firewall can create an Intrazone to keep traffic that remains inside the same logical segment untouched by security policies, which is required for certain use-cases such as connecting to on-premises resources without traversing the public internet. Clientless VPN (Option A) is a connectivity service, not a zone type. It defines how users connect but does not represent a security zone that can be referenced in address or security policies. DMZ (Option B) is a role or placement of an interface, not a distinct zone name supported by Prisma Access. While traffic can be routed through a DMZ interface, the firewall does not provide a dedicated “DMZ” security zone for policy enforcement. Interzone (Option C) describes traffic that traverses between zones; it is a traffic flow concept, not a configurable zone object. You cannot create an “Interzone” as a security zone to attach policies or objects to.Therefore, the only valid zone that can be explicitly defined and used within Prisma Access configurations is Intrazone .
Prisma Access Administration Guide – Configuring Security Zones: https://docs.paloaltonetworks.com/prisma-access/10-2/prisma-access-admin/10-2/configure-security-zones.html Prisma Access Policy Configuration – Zone-Based Policy Overview: https://docs.paloaltonetworks.com/prisma-access/10-2/prisma-access-admin/10-2/policy-configuration.html#zone-based-policy
Which firewall attribute simplifies rule creation and automatically adapts to changes in server roles or security posture based on log events?
"Dynamic Address Groups enable automatic updates of address collections based on runtime criteria such as server role changes or security events, allowing firewall rules to adapt without manual rule edits. This flexibility reduces administrative overhead and ensures consistent enforcement as network topology evolves. Static Address Objects require manual modifications, Predefined IP address ranges are fixed and cannot react to changes, and Dynamic User Groups focus on user identity rather than network object behavior, so they do not provide the same level of automation for server-centric policy adjustments.ReferencesDynamic Address Groups: https://docs.paloaltonetworks.com/palo-alto-networks/10-2/pan-os-admin/images/dynamic-address-groups.html Address Objects Overview: https://docs.paloaltonetworks.com/palo-alto-networks/10-2/pan-os-admin/images/address-objects.html "
What is a necessary step for creation of a custom Prisma Access report on Strata Cloud Manager (SCM)?
Answer(s): B
Why B – Configure a dashboard – is the correct stepCustom Prisma Access reports are built within Strata Cloud Manager’s reporting framework. The first requirement is to create a custom dashboard that contains the widgets (charts, tables, filters) you need for the report; once the dashboard is saved, it can be exported or scheduled as a report. SCM’s UI provides a “Create Dashboard” workflow that lets you select metrics, apply scopes, and design layout – this is the explicit prerequisite documented for custom report creation.Why the other options are not appropriateA: Open a support ticket – Support is for troubleshooting issues, not a prerequisite for building a custom report. No ticket is required before initiating report design. C. Generate a PDF summary report – PDF generation is an output step after the report/dashboard is defined; it cannot be a required initial action. D. Set up Cloud Identity Engine – Cloud Identity Engine is used for identity-and-access management (IAM) integration; while it may be used alongside Prisma Access, it is not a mandatory step for creating Prisma Access reports in SCM.Therefore, configuring a dashboard (option B) is the necessary and direct prerequisite for creating a custom Prisma Access report.
Prisma Access Reporting Overview – Configuring Custom Dashboards https://docs.paloaltonetworks.com/prisma-access/10-2/prisma-access-admin/using-prisma-access-reports.html#Custom-Dashboards Strata Cloud Manager Administration Guide – Creating and Scheduling Reports https://docs.paloaltonetworks.com/strata-cloud-manager/5-0/strata-cloud-manager-admin/using-strata-cloud-manager-reports.html#Custom-Reports
Which feature of SaaS Security will allow a firewall administrator to identify unknown SaaS applications in an environment?
JustificationApp-ID Cloud Engine (Option A) – This component continuously monitors traffic and leverages cloud-based threat intelligence to detect and classify SaaS services that are not covered by the built-in App-ID signatures. It can surface unknown SaaS applications by analyzing behavioral patterns, URL-based fingerprints, and API calls, enabling a firewall admin to create policies for them. App-ID (Option D) – Although App-ID identifies known applications, it relies on static signatures. It cannot reliably surface new or undocumented SaaS services that lack signature definitions, so it is insufficient for discovering unknown SaaS apps. SaaS Data Security (Option B) – This feature focuses on protecting data in approved SaaS applications (e.g., DLP, encryption). It assumes the SaaS service is already known and does not provide discovery of new or unknown services. Cloud Identity Engine (Option C) – This engine correlates user identity with traffic for policy enforcement but does not provide application discovery capabilities; it is oriented toward user-centric control rather than SaaS identification.Therefore, the App-ID Cloud Engine is the only feature designed to uncover unknown SaaS applications in the environment.
App-ID Cloud Engine – Palo Alto Networks Documentation https://docs.paloaltonetworks.com/palo-alto-networks/10-2/palo-alto-networks-next-generation-firewall/10-2/pan-os-10-2/pan-os-10-2-administering/using-app-id-cloud-engine.htmlSaaS Security Overview – Palo Alto Networks Documentation https://docs.paloaltonetworks.com/palo-alto-networks/10-2/palo-alto-networks-next-generation-firewall/10-2/pan-os-10-2/pan-os-10-2-administering/saas-security.html
When a rule has been set up to block uploading all Portable Executable (PE) files, which type of log will display blocked files that attempt to traverse the network?
Answer(s): B – Data FilteringWhy Data Filtering is the appropriate log sourceA rule that blocks the upload of Portable Executable (PE) files operates at the file-blocking feature, which is part of the Data Filtering category in PAN-OS. When a PE file is intercepted and dropped by the file-blocking engine, the firewall generates a Data Filtering log entry that records the threat type, action (blocked), and the file’s attributes (e.g., filename, hash, size). This log is specifically designed to capture files that fail to traverse the network because they violate a data-filtering policy, such as blocking PE uploads.Why the other options are less suitableTraffic logs record packet-level activity (source/destination, ports, protocols) and do not store details about blocked file content, so they cannot explain why a PE file was stopped. URL Filtering logs pertain to HTTP/HTTPS URL access decisions and would not contain information about PE file uploads; they are unrelated to content-type filtering. Threat logs are created when a file is identified as malicious after deep-packet or sandbox inspection. If the blocking is done purely by file-blocking rules (e.g., “block all PE files”), the event is logged as Data Filtering, not as a Threat log.Structure of the justification (exam-style)Relevance – Data Filtering logs explicitly track file-blocking actions. Scope – These logs include the file name, type (PE), and the reason (“blocked upload”). Exclusion of alternatives – Traffic lacks file-type data; URL Filtering deals with web URLs only; Threat logs require malware analysis and are not used for simple rule-based blocks.
1. Palo Alto Networks Documentation – File Blocking & Data Filtering https://docs.paloaltonetworks.com/palo-alto-networks/10-2/pan-os-admin/file-blocking/pan-os-admin-file-blocking.html2. Palo Alto Networks Documentation – Understanding Logging https://docs.paloaltonetworks.com/palo-alto-networks/10-2/pan-os-admin/logging/pan-os-admin-logging.html
Share your comments for Palo Alto Networks NetSec-Pro exam with other users:
i think answer of q 462 is variance analysis
hi i need see questions
best study material for exam
very interesting repository
american history 1
good level of questions
i need this dump kindly upload it
do we need c# coding to be az204 certified
excellent topics covered
are these really financial cloud questions and answers, seems these are basic admin question and answers
are these comments real
please upload the latest dumps
a company runs its workloads on premises. the company wants to forecast the cost of running a large application on aws. which aws service or tool can the company use to obtain this information? pricing calculator ... the aws pricing calculator is primarily used for estimating future costs
looks interesting
thanks! that’s amazing
the exam dumps are helping me get a solid foundation on the practical techniques and practices needed to be successful in the auditing world.
q 14 should be dmz sever1 and notepad.exe why does note pad have a 443 connection
question # 108, correct answers are business growth and risk reduction.
are these valid chfi questions
question: 162 should be dlp (b)
good exam questions
I have to say this is really close to real exam. Passed my exam with this.
good analytics question
this looks accurate
question 46, the answer should be data "virtualization" (not visualization).
its useful.
Pass this exam 3 days ago. The PDF version and the Xengine App is quite useful.
informative for me.
question 134s answer shoule be "dlp"
in 72 the answer must be [sys_user_has_role] table.
i appreciated the mix of multiple-choice and short answer questions. i passed my exam this morning.
great to find this website, thanks
examination questions seem to be relevant.
planning to take psm test
Keeping this site free takes real effort. We constantly battle automated scraping and unauthorized content copying. A quick account helps us protect the community and keep the site free.
To continue studying for your NetSec-Pro, please sign in or create a free account.