6.1 Explain the Configuration and Maintenance of Network Security for On-Premises, Cloud, and Hybrid Networks (e.g., Network Segmentation, Policies, Monitoring and Logging, Certificates) NETWORK-SECURITY-PROFESSIONAL Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the primary purpose of logging in a network security context?

   • ATo automatically block all malicious traffic
   • BTo replace the need for security monitoring tools
   • CTo improve network performance by reducing traffic
   • DTo provide a record of events for analysis and incident response
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the primary purpose of a digital certificate in network communications?

   • ATo replace the need for passwords
   • BTo encrypt all data transmitted over the network
   • CTo authenticate the identity of the communicating parties
   • DTo speed up network connections
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following is a common practice for maintaining effective monitoring and logging in a hybrid network?

   • ACentralizing logs from all environments into a single monitoring system
   • BStoring logs only on the devices that generate them
   • CDisabling logging for high-volume traffic to save storage
   • DReviewing logs only after a security incident occurs
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A Palo Alto Networks firewall administrator is troubleshooting why traffic from the internal 'Sales' zone to the 'DMZ' zone is being denied, even though a rule that allows this traffic exists. The rule is placed at the bottom of the security policy rulebase. What is the most likely cause of the denial?

   • AThe firewall's management profile is blocking the traffic because logging is not enabled on the rule.
   • BAn earlier rule with a broader match (e.g., any-to-any deny) is matching the traffic before the intended allow rule is evaluated.
   • CThe rule's source zone is set to 'DMZ' instead of 'Sales'.
   • DThe 'Sales' zone is not assigned to any interface, so the firewall cannot route traffic from it.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A Palo Alto Networks firewall administrator is troubleshooting a security policy issue. The policy has a rule that allows HTTP traffic from the 'Internal' zone to the 'Web' zone. However, users are reporting that HTTP traffic is being blocked. The administrator checks the firewall logs and sees that the traffic is being denied by a different rule. What is the most likely reason?

   • AThe allow rule's source zone is set to 'Web' instead of 'Internal'.
   • BThe allow rule is placed below a deny rule that matches the same traffic.
   • CThe allow rule's action is set to 'Deny' instead of 'Allow'.
   • DThe allow rule's destination is set to 'Any' instead of the 'Web' zone.
   Reveal Solution Discussion Select an answer first