Free NetSec-Pro sample questions

Correct answer: There is no Decryption Policy rule matching this traffic, preventing App-ID from inspecting the encrypted payload to match the custom signature.

App-ID uses application signatures to identify traffic. When a session is SSL/TLS and no Decryption policy rule matches it, the firewall sees only the TLS handshake, so it usually identifies the session as ssl and not as the application inside. When a Decryption policy rule decrypts the session (SSL Forward Proxy for outbound traffic, or SSL Inbound Inspection for your own server), App-ID runs the signatures again on the decrypted flow, and the custom-corp-app signature can match. Adding the application to the Security policy rule doesn't change how it is identified. Unencrypted HTTP that can't be identified more specifically appears as web-browsing, not as ssl.

Correct answers: User-ID agents or Cloud Identity Engine to map IP addresses to usernames; Security Policy rules with source 'User' fields defined instead of 'Any'

User-ID is the fundamental component that maps IP addresses to users, allowing policies to be written based on identity rather than IP.

To enforce Zero Trust, security policies must explicitly allow access only to specific users or groups (Least Privilege), rather than allowing 'Any' user.

Correct answer: During the forwarding lookup stage, based on the route to the destination IP address.

In the packet flow, after ingress processing and before security policy lookup, the firewall performs a forwarding (route) lookup using the destination IP. The interface associated with the matching route determines the Destination Zone.

Correct answer: Locations and Regions in the Mobile Users setup

In the Prisma Access mobile users (GlobalProtect) setup, you choose the Prisma Access Locations to deploy. The locations are grouped by region, and each region offers several locations, for example Germany Central (Frankfurt) and Japan Central (Tokyo). The GlobalProtect app then connects each user to the best available deployed location, normally the closest one, so users in Germany connect through Frankfurt and users in Japan through Tokyo. Administrators control which locations and regions are deployed (and can exclude regions for policy or regulatory reasons), but they can't pin a user to a specific Prisma Access gateway. Service connections, User-ID redistribution and zone protection profiles don't determine which location mobile users connect to.

Correct answer: It is a containerized NGFW designed to secure traffic within Kubernetes environments (East-West) and at the boundary (North-South).

CN-Series is the containerized form factor of the NGFW, specifically built to be deployed as a DaemonSet or Service in Kubernetes clusters to provide Layer 7 visibility and protection for container traffic.

Correct answer: Performance Policy rule (performance SLA with a 30 ms jitter threshold and the Move Flows action)

On ION 6.3.1 and later, Prisma SD-WAN Performance Policy measures link-quality metrics (latency, packet loss, jitter) and application metrics against a performance SLA (threshold profile). When the SLA is violated, the Move Flows action moves flows to a compliant path among the active and backup paths allowed by the Path Policy; FEC and incident generation are other available actions. 'Path Quality Profile' and 'Error Correction Profile' are PAN-OS SD-WAN (NGFW) objects, not Prisma SD-WAN objects, and Prisma SD-WAN QoS policy assigns priority classes rather than moving traffic between links.