1.1 Create and Apply Security Profiles and Security Profile Groups NETWORK-SECURITY-ANALYST Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   In an antivirus security profile, what does the 'Action' setting for a threat signature control?

   • AThe response the firewall takes when it detects a matching threat, such as alert, drop, or reset
   • BWhether the firewall logs the traffic or not
   • CThe maximum file size that can be scanned
   • DThe source and destination zones the profile applies to
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A firewall administrator needs to create a new security profile group that is similar to an existing group but with a different URL filtering profile. The existing group is used by several security policy rules. What should the administrator do to avoid affecting the existing rules?

   • AModify the existing group to use the different URL filtering profile.
   • BCreate a new security policy rule and attach the existing group to it.
   • CClone the existing group, modify the clone to use the different URL filtering profile, and apply the clone to the new rules.
   • DDelete the existing group and recreate it with the new URL filtering profile.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   When you modify an existing security profile that is already applied to a security policy rule, what happens?

   • AThe change requires you to reapply the profile to the rule manually
   • BThe change takes effect immediately after the firewall commits the configuration
   • CThe change only affects new security policy rules, not existing ones
   • DThe change is automatically reverted after the next reboot
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A security team is configuring security profiles for a firewall that will be used in a production environment. They want to follow Palo Alto Networks best practices to ensure effective protection while minimizing false positives. Which approach should they take?

   • ASet all actions to 'alert' to avoid false positives.
   • BSet all actions to 'block' to maximize protection.
   • CDisable security profiles for internal traffic to reduce false positives.
   • DUse the 'default' action for all security profiles and rely on the vendor's recommended settings.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A firewall administrator needs to update the antivirus profile used by a security profile group that is applied to several rules. The update should change the action for a specific threat category from 'alert' to 'block'. What is the most efficient way to implement this change?

   • AClone the antivirus profile, modify the clone, and update the group to use the clone.
   • BDelete the group and recreate it with a new antivirus profile.
   • CEdit the antivirus profile directly and change the action for the threat category.
   • DCreate a new antivirus profile and apply it directly to each rule.
   Reveal Solution Discussion Select an answer first