1.3 Create and Apply External Dynamic Lists NETWORK-SECURITY-ANALYST Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   After configuring an External Dynamic List, an analyst notices that the firewall is not blocking traffic from IPs that are listed in the source feed. The analyst checks the EDL object and sees that the 'Last Updated' field shows a time from several hours ago, even though the refresh interval is set to 5 minutes. What is the most likely cause of the issue?

   • AThe security policy rule references the EDL in the Destination Address field instead of the Source Address field.
   • BThe firewall cannot reach the EDL source URL, so the list is not being refreshed.
   • CThe EDL object is configured with a refresh interval of 5 minutes, but the source server only updates the list every hour.
   • DThe EDL type is set to 'IP List' but the source contains domains.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An organization uses an External Dynamic List that is updated every hour by a threat intelligence provider. The security team wants to ensure the firewall has the most current list without overloading the provider's server. What is the best refresh interval to configure on the EDL object?

   • A1 hour
   • B5 minutes
   • C30 minutes
   • D1 day
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which of the following is a supported type of External Dynamic List on a Palo Alto Networks firewall?

   • APort list
   • BApplication ID list
   • CUser list
   • DIP list
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company wants to use an External Dynamic List that contains a mix of IP addresses and domain names to block malicious traffic. The list is provided by a vendor as a single text file. What should the analyst do to use this list effectively?

   • ACreate a single EDL with type 'URL List' and include both IPs and domains.
   • BCreate two separate EDLs: one for IP addresses and one for domain names, and reference both in the security policy.
   • CCreate a single EDL with type 'IP List' and include the domain names as well.
   • DCreate a single EDL with type 'Domain List' and include the IP addresses as well.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An analyst has configured an External Dynamic List and applied it to a security policy rule. To verify that the EDL is working correctly, the analyst checks the firewall logs and notices that traffic from an IP address in the EDL is being allowed. What is the first step the analyst should take to troubleshoot this issue?

   • ADelete the EDL object and recreate it with a different type.
   • BReboot the firewall to force a refresh of the EDL.
   • CCheck the EDL object's status to confirm the list was downloaded and parsed successfully.
   • DChange the security policy rule action from 'Allow' to 'Deny'.
   Reveal Solution Discussion Select an answer first