3.2 Use Command Center, Activity Insights, and Policy Optimizer to Improve Security Posture NETWORK-SECURITY-ANALYST Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   An organization is investigating a potential insider threat. Activity Insights shows that a user has been accessing a database application during off-hours and downloading large amounts of data. The user's manager states this is for a legitimate project. What additional data from Activity Insights would be MOST useful to validate or refute the manager's claim?

   • AReview the user's web browsing history for the same period.
   • BCompare the user's activity pattern to that of other users in the same department.
   • CExamine the firewall's threat logs for the user's IP address.
   • DCheck the user's total number of logins to the firewall.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An analyst is reviewing the Command Center dashboard and notices that the 'Top Applications' widget shows a sudden appearance of a new application that was not present in previous weeks. What is the MOST appropriate initial action?

   • ACheck the Policy Optimizer report to see if the application is in any rules.
   • BInvestigate the new application in Activity Insights to see which users are using it and how much traffic it generates.
   • CImmediately create a rule to block the new application.
   • DIgnore it because the dashboard is showing a false positive.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   An organization is planning to block a specific social media application. Before implementing the block, the administrator wants to understand the potential impact on users. Which Activity Insights data would be MOST useful for this impact analysis?

   • AThe number of security rules that currently allow the application.
   • BThe firewall's uptime and performance metrics.
   • CThe total number of threats prevented on the firewall.
   • DThe number of unique users and the total time spent on the application.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the primary role of Policy Optimizer in Palo Alto Networks security management?

   • ATo monitor real-time traffic for threats
   • BTo manage user authentication and access control
   • CTo automatically enforce new security policies
   • DTo identify unused, shadow, and overly permissive policies
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A network administrator is setting up the Command Center for the first time. After logging in, the dashboards are empty. What is the MOST likely reason for this?

   • AThe administrator does not have the correct role to view the dashboards.
   • BThe firewalls have not been added to the Command Center or are not forwarding logs.
   • CThe Command Center requires a license that has not been activated.
   • DThe firewall's threat prevention profile is disabled.
   Reveal Solution Discussion Select an answer first