3.1 Explain the Security Efficacy of Palo Alto Networks NGFW and Prisma SASE Products (e.g., Security and NAT Policy, User-ID, App-ID, Decryption, Monitoring and Logging) NETWORK-SECURITY-PROFESSIONAL Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company is deploying a Palo Alto Networks NGFW and wants to block a specific application that uses a custom protocol over TLS. The application is not yet identified by App-ID. What is the most effective way to block this application?

   • AUse User-ID to identify the users of the application and block them.
   • BUse a custom App-ID signature to identify the application, and then create a security policy to block it.
   • CDisable SSL decryption to prevent the application from being encrypted.
   • DBlock all traffic on the port the application uses.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   In Palo Alto Networks NGFW, what is the primary purpose of a NAT policy in relation to a security policy?

   • ATo translate the source or destination address/port of traffic before it is evaluated by the security policy
   • BTo replace the security policy for traffic that matches the NAT rule
   • CTo block traffic that does not match any security policy rule
   • DTo log all traffic that passes through the firewall
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A security team has enabled SSL decryption on their Palo Alto Networks NGFW and is now seeing an increase in false positives from the threat prevention profiles. They suspect that the decryption is causing the issue. What is the most likely reason for the false positives?

   • AUser-ID is not enabled for the users generating the decrypted traffic.
   • BThe threat prevention profiles are not updated to handle decrypted traffic, or the decryption is causing the firewall to misidentify benign traffic as malicious.
   • CThe NAT policy is not translating the decrypted traffic correctly.
   • DThe security policy is not allowing the decrypted traffic to be inspected.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security analyst is investigating a security incident and needs to determine which users accessed a specific internal server and what actions they performed. The firewall is configured with User-ID and App-ID. Which logs should the analyst query to get the most complete picture?

   • AApp-ID logs, which show application identification events.
   • BSecurity policy logs, which show which policies matched traffic.
   • CTraffic logs, which include user, application, and session details.
   • DUser-ID logs, which show user authentication events.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the primary function of User-ID in Palo Alto Networks NGFW?

   • ATo decrypt SSL/TLS traffic for inspection
   • BTo map users to IP addresses so security policies can be user-based
   • CTo log all user activity on the network
   • DTo identify the application being used regardless of port
   Reveal Solution Discussion Select an answer first