Palo Alto Networks NetSec-Pro Exam Questions Instant Access

Question 1

Which two GlobalProtect modes allow partial users to access internal apps via GlobalProtect while other users access internal apps through third-party VPN?

AProxy

BHybrid, Proxy + Tunnel

CClientless VPN only

DAlways-On Tunnel only

Answer : A, B

Proxy mode and Hybrid mode support coexistence with third-party VPN environments, allowing phased migration where some users access applications through GlobalProtect while others continue using another VPN.

https://docs.paloaltonetworks.com/prisma-access/

Question 2

Which file type supports WildFire inline detection?

AAPK files

BPE files

CPDF files

DZIP files

Answer : B

WildFire inline ML detection supports PE files, which are Windows Portable Executable files such as .exe and .dll.

https://docs.paloaltonetworks.com/wildfire/

Question 3

Which configurations on hosts are supported for detection by HIP?

AAnti-malware

BDisk Encryption

CVLAN ID

DBGP peer state

Answer : A, B

GlobalProtect HIP checks can evaluate host posture information including anti-malware status, disk encryption, patch levels, firewall status, and other endpoint security attributes.

https://docs.paloaltonetworks.com/globalprotect/

Question 4

When a firewall registers to Panorama via ZTP, what pre-configurations are required on Panorama before the firewall powers on?

ARegister the firewall on Panorama with serial number and claim key

BConfirm the firewall is properly registered in CSP

CConfigure Template, Template Stack, Device Group, and interfaces

DDisable Panorama authentication profiles

Answer : A, B, C

For Zero Touch Provisioning, the firewall must be registered and claimed, CSP registration must be valid, and Panorama must have the required device group and template configuration prepared before onboarding.

https://docs.paloaltonetworks.com/panorama/

Question 5

Using Prisma Access, which solution provides the most security coverage of network protocols for the mobile workforce?

AExplicit proxy

BClient-based VPN

CEnterprise browser

DClientless VPN

Answer : B

Client-based VPN solutions like GlobalProtect provide full coverage for the mobile workforce by extending the enterprise security stack to remote endpoints. It establishes a secure tunnel, allowing consistent security policies across the enterprise perimeter and the mobile workforce.

''GlobalProtect is a client-based VPN that provides secure, consistent protection for mobile users by extending the security capabilities of Prisma Access to remote endpoints, covering all network protocols.''

(Source: GlobalProtect Admin Guide)

Question 6

Which two tools can be used to configure Cloud NGFWs for AWS? (Choose two.)

ACortex XSIAM

BPrisma Cloud management console

CPanorama

DCloud service provider's management console

Answer : C, D

Cloud NGFW for AWS can be configured using Panorama for centralized management, as well as the AWS management console for native integration and configuration.

''You can configure Cloud NGFW for AWS using Panorama for centralized security management, or directly through the AWS management console to deploy and manage security services for your AWS resources.''

(Source: Cloud NGFW for AWS Guide)

Question 7

How often does the firewall retrieve signature database updates from Advanced WildFire?

AReal-time

BWithin 5 to 10 minutes

C10 to 20 minutes

DEvery 24 hours

Answer : B

Advanced WildFire provides faster signature delivery than standard WildFire. Firewalls receive new protections within minutes, commonly within 5 to 10 minutes.

https://docs.paloaltonetworks.com/wildfire/

Palo Alto Networks Certified Network Security Professional NetSec-Pro Exam Questions