3.1 Explain the Security Efficacy of Palo Alto Networks NGFW and Prisma SASE Products (e.g., Security and NAT Policy, User-ID, App-ID, Decryption, Monitoring and Logging) NETWORK-SECURITY-PROFESSIONAL Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the primary purpose of monitoring and logging in Palo Alto Networks NGFW?

   • ATo encrypt all network traffic
   • BTo replace the need for security policies
   • CTo provide visibility into traffic, threats, and policy effectiveness
   • DTo automatically block all malicious traffic
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security analyst needs to generate a report showing which applications are consuming the most bandwidth on the network. Which Palo Alto Networks feature provides this data?

   • AUser-ID logs, which show user authentication events.
   • BNAT logs, which show address translations.
   • CSecurity policy logs, which show which policies matched traffic.
   • DTraffic logs, which can be filtered and aggregated by application.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An organization uses a Palo Alto Networks NGFW and wants to enforce a policy that restricts access to a sensitive application to only members of the 'Finance' group. User-ID is configured with an Active Directory domain controller. However, some Finance users report being blocked even though they are in the correct group. Which action is most likely to resolve the issue?

   • AConfigure a NAT policy to translate the users' IP addresses to a single address.
   • BEnsure the User-ID agent is collecting user-to-IP mappings from the domain controller and that the firewall is using the correct group mapping.
   • CChange the security policy to allow all traffic and rely on the application's own authentication.
   • DDisable User-ID and use IP-based policies instead.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A network administrator is configuring a Palo Alto Networks NGFW and wants to create a security policy that blocks a specific application that is known to use dynamic ports. Which approach is most effective?

   • AUse App-ID to identify the application in the security policy.
   • BBlock all traffic on the ports the application typically uses.
   • CUse User-ID to identify the users of the application and block them.
   • DCreate a NAT policy to change the application's traffic to a blocked port.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security team is concerned about malware hiding in encrypted traffic. They have enabled SSL decryption on their Palo Alto Networks NGFW. What additional step is necessary to ensure that decrypted traffic is inspected for threats?

   • AEnsure that threat prevention profiles are applied to the security policy that handles the decrypted traffic.
   • BConfigure a NAT policy to translate the decrypted traffic to a different interface.
   • CEnable User-ID to identify the users sending the encrypted traffic.
   • DEnable App-ID to identify the applications in the decrypted traffic.
   Reveal Solution Discussion Select an answer first