3.1 Explain the Security Efficacy of Palo Alto Networks NGFW and Prisma SASE Products (e.g., Security and NAT Policy, User-ID, App-ID, Decryption, Monitoring and Logging) NETWORK-SECURITY-PROFESSIONAL Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   An application uses port 443 (HTTPS) but is actually a peer-to-peer file-sharing tool. How can Palo Alto Networks NGFW identify this application?

   • ABy using User-ID to map the user to the application
   • BBy using the destination port number
   • CBy using NAT to translate the port to a known application port
   • DBy using App-ID to inspect traffic signatures and behavior
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security team has enabled SSL decryption on their Palo Alto Networks NGFW to inspect all outbound HTTPS traffic. They are now experiencing performance degradation and some users report that certain websites are not loading. Which action is most appropriate to address these issues while maintaining security efficacy?

   • AExclude traffic to specific high-risk or non-business sites from decryption and ensure the decryption policy is optimized.
   • BIncrease the firewall's logging level to capture more details about decrypted traffic.
   • CDisable SSL decryption entirely to improve performance.
   • DChange the security policy to allow all HTTPS traffic without decryption.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the primary purpose of decryption in Palo Alto Networks NGFW?

   • ATo inspect encrypted traffic for threats and enforce policies
   • BTo encrypt traffic between the firewall and the internet
   • CTo translate encrypted traffic to a different port
   • DTo allow encrypted traffic to bypass security policies
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which security policy match criterion is made possible by User-ID in Palo Alto Networks NGFW?

   • ASource IP address
   • BUser or group
   • CDestination port
   • DApplication
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company is deploying a Palo Alto Networks NGFW and wants to ensure that all outbound web traffic is inspected for threats. They have enabled SSL decryption and created a security policy that allows HTTP and HTTPS traffic. However, they notice that some HTTPS traffic is not being inspected. What is the most likely reason?

   • AThe decryption policy is not configured to decrypt HTTPS traffic, or the traffic is excluded from decryption.
   • BThe security policy is blocking HTTPS traffic before it can be decrypted.
   • CThe firewall's NAT policy is not translating the HTTPS traffic.
   • DUser-ID is not enabled for the users generating the HTTPS traffic.
   Reveal Solution Discussion Select an answer first