Free Palo Alto Networks Network Security Analyst Practice Questions

Sample Practice Questions

Try these 10 sample questions from the Palo Alto Networks Network Security Analyst practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1An analyst configures inspection for allowed network traffic to detect attempts to exploit a buffer overflow in a server application. Which type of security profile is designed for this threat?

   1. A.Antivirus
   2. B.Vulnerability protectionCorrect answer: B
   3. C.Anti-spyware
   4. D.File blocking

   Explanation: The vulnerability profile guidance says, "Vulnerability Protection profiles help protect against buffer overflows, illegal code execution, and other attempts to exploit system vulnerabilities." The other choices are real security profile types but address different primary inspection objectives.

   Reference: Security Profile: Vulnerability Protection — Vulnerability Protection overview

2. 2A first-match security rulebase has a broad deny rule for HTTPS from 10.2.0.0/16 above an allow rule for HTTPS from 10.2.7.0/24. A connection from 10.2.7.40 matches both rules. Which decision applies?

   1. A.Allow by the narrower allow rule
   2. B.Deny by the broader deny ruleCorrect answer: B
   3. C.Allow by the default rule
   4. D.Deny by the default rule

   Explanation: The rule documentation states, "A packet is matched against the first rule that meets the defined criteria and, after a match is triggered, subsequent rules are not evaluated." The first matching rule is the broader deny, even though the later allow is more specific.

   Reference: Security Policy Rules — Rule evaluation order

3. 3A management hierarchy has a common parent folder with East and West child folders. Both children inherit variables from the parent, and neither overrides them. Where should an analyst define one variable value shared by both children?

   1. A.The East child folder
   2. B.The West child folder
   3. C.The common parent folderCorrect answer: C
   4. D.A single device under East

   Explanation: The configuration guide states, "When you create a variable for a folder, the variable is inherited by all folders nested under the folder." Defining the value at the common parent makes it available to both child folders.

   Reference: Configuration: Variables — Variable inheritance

4. 4A server presents its leaf certificate, issued by a subordinate CA, but no other certificates. The client trusts the root CA and cannot build a chain from the leaf to that root. Which certificate is needed to connect the chain?

   1. A.The subordinate CA certificateCorrect answer: A
   2. B.The server leaf certificate
   3. C.The trusted root CA certificate
   4. D.The requesting client certificate

   Explanation: The decryption guidance discusses "automatic fetching of missing intermediate certificates when server certificates contain the Authority Information Access (AIA) extension." The missing intermediate connects the presented leaf to the trusted root.

   Reference: Fetch Certificates from Authority Information Access URL — Incomplete certificate chains

5. 5A vulnerability inspection profile flags a login burst when failed attempts during one minute exceed its configured count. A test contains 12 failed attempts. What is the highest listed threshold that would still trigger the profile?

   1. A.8 failed attempts
   2. B.10 failed attemptsCorrect answer: B
   3. C.12 failed attempts
   4. D.15 failed attempts

   Explanation: NIST explains, "A threshold is a value that sets the limit between normal and abnormal behavior." Under the stated strictly-greater comparison, 12 exceeds 10 and 8, but not 12 or 15; 10 is the highest triggering threshold.

   Reference: NIST SP 800-94: Guide to Intrusion Detection and Prevention Systems — Section 3.2.3, Detection Capabilities, Thresholds

6. 6An analyst wants a security rule to use the authenticated person associated with an observed client address. Which mapping provides the required identity context?

   1. A.IP address to hostname
   2. B.IP address to geographic region
   3. C.IP address to usernameCorrect answer: C
   4. D.IP address to autonomous system

   Explanation: The authentication documentation says, "User-ID creates a new IP address-to-username mapping or updates the existing mapping for that user". That mapping associates the observed client address with a user for identity-aware policy.

   Reference: Authentication Policy — Authentication and user mapping

7. 7Several sites use one shared firewall configuration but require a different internal subnet at each site. Which value strategy lets the same configuration select the subnet assigned to the current site?

   1. A.A configuration variableCorrect answer: A
   2. B.A configuration snippet
   3. C.A configuration folder
   4. D.A configuration snapshot

   Explanation: The documentation explains that "Variables are an advanced tool that allows you to standardize your configurations while giving you the flexibility to accommodate unique configuration values that are device or deployment specific." A variable lets the shared configuration reference the appropriate subnet at each site.

   Reference: Configuration: Variables — Variables overview

8. 8A managed firewall rejects a configuration push because of an address-object capacity limit. The push includes 650 distinct shared objects and 500 distinct objects inherited from an ancestor, with no overlap. How many delivered objects should the analyst compare with the device limit?

   1. A.500 objects
   2. B.650 objects
   3. C.1,150 objectsCorrect answer: C
   4. D.1,650 objects

   Explanation: The troubleshooting guide says to "Count address objects across Shared scope and each ancestor Device Group to determine the combined total that was delivered to the firewall." The total is 650 + 500 = 1,150 objects.

   Reference: Troubleshoot Push Failures Caused by Firewall Capacity Limits — Confirm total object count

9. 9An analyst is configuring TLS certificate checks for a session actively decrypted by a proxy. The organization wants to reject sessions when the server certificate is issued by a certificate authority outside its trust store. Which check addresses that condition?

   1. A.Block certificates with unknown revocation status
   2. B.Block sessions with untrusted issuersCorrect answer: B
   3. C.Block sessions with expired certificates
   4. D.Block certificate name mismatches

   Explanation: For the untrusted-issuer check, the documentation states, "This option blocks sessions with servers that have untrusted certificate issuers." The other checks address revocation status, expiration, or the server name rather than issuer trust.

   Reference: Decryption Profiles — Decryption Profile Settings, Server Certificate Verification

10. 10A security analyst wants to identify an application even when it uses an unusual transport port. Which identification basis directly examines recognizable application behavior or content?

    1. A.Application signaturesCorrect answer: A
    2. B.Source IP geolocation
    3. C.Destination port number
    4. D.Transport protocol number

    Explanation: The policy guidance states that "App-ID is based on signatures instead of port and protocol (which can be spoofed)". Signature-based application identification can examine traffic characteristics rather than relying only on the transport port.

    Reference: Security Policy Rule Best Practices — Applications and Services