Palo Alto Networks NetSec-Pro Practice Test

NetSec-Pro practice test: what's covered

• Network Security Fundamentals
• NGFW & SASE Functionality
• Platform Solutions
• Maintenance & Config
• CDSS & Infrastructure Mgmt
• Connectivity

Free NetSec-Pro sample questions

1. A security engineer captures a session on a PA-5450 and sees that the first packet of a new TCP flow performs route lookup, zone lookup, policy lookup and session creation, while later packets skip most of that work. Which stage of the single-pass architecture handles those later packets?

   • A. The fast path, which uses the existing session table entry and applies Content-ID scanning
   • B. The management plane, which offloads established sessions from the dataplane
   • C. The offload processor, which bypasses all App-ID and Content-ID inspection for the flow
   • D. The slow path, which re-evaluates Security policy on every packet of the session
   Show answer

   Correct: A. Only the first packet takes the slow path (session setup: route, zone, NAT, policy lookup). Subsequent packets take the fast path, matching the existing session and still receiving App-ID and Content-ID inspection. The slow-path option is wrong because policy is not re-evaluated per packet; the management plane never forwards traffic; and offload does not disable inspection for flows that still require content scanning.

2. An administrator writes a Security policy rule allowing application ms-office365 with service application-default. Users report that Office 365 works, but a partner SaaS tool tunnelled over TCP/443 is unexpectedly blocked. Why does application-default cause this behaviour?

   • A. It disables App-ID and reverts the rule to a port-based match on the configured service
   • B. It forces decryption of the session before the application can be identified by App-ID
   • C. It permits the application only on the standard ports the vendor defined for that App-ID
   • D. It permits any application seen on TCP/443 regardless of the App-ID that is identified
   Show answer

   Correct: C. application-default restricts the allowed applications to their standard ports as defined in the App-ID database, so an unrelated application riding TCP/443 is not implicitly permitted by the Office 365 rule. It does not open the port to all applications, it does not disable App-ID, and it has no relationship to decryption policy.

3. A company must inspect outbound HTTPS traffic from employee laptops to the internet, and also inspect inbound HTTPS traffic to a self-hosted web application. Which TWO decryption types should the engineer deploy? (Choose TWO)

   • A. Decryption Broker for both flows, which removes the need for any decryption profile
   • B. No-decrypt policy with a forward-trust certificate applied to both directions
   • C. SSL Forward Proxy for the outbound employee traffic to internet destinations
   • D. SSL Inbound Inspection for the traffic arriving at the self-hosted web application
   • E. SSH Proxy for both flows so that certificates never need to be deployed
   Show answer

   Correct: C and D. SSL Forward Proxy handles client-to-internet sessions by generating a certificate signed by the firewall's forward-trust CA, while SSL Inbound Inspection uses a copy of the server's own certificate and private key to inspect traffic destined for an internally hosted server. SSH Proxy applies only to SSH, Decryption Broker forwards already-decrypted traffic to third-party tools rather than replacing decryption, and a no-decrypt policy performs no inspection at all.

4. A firewall administrator needs Security policy that follows named users rather than IP addresses in an environment with Citrix and Microsoft RDS multi-user servers. Which User-ID component is required for those shared servers?

   • A. The Terminal Server (TS) Agent, which maps source port ranges to individual users
   • B. The Windows User-ID agent reading domain controller security logs only
   • C. Captive Portal with NTLM, which authenticates each terminal server as one identity
   • D. GlobalProtect internal gateway host information profile checks on the server itself
   Show answer

   Correct: A. Multiple users share one source IP on a terminal server, so IP-to-user mapping cannot distinguish them. The TS Agent allocates a distinct source port range per user and reports that mapping to the firewall. Domain controller log reading returns a single mapping per IP, Captive Portal would authenticate only one identity for the shared address, and HIP checks report posture rather than resolving multi-user identity.

5. During a Zero Trust design review a customer asks how the NGFW enforces least privilege beyond source and destination addresses. Which combination of technologies delivers application, user and content level least privilege on a single rule?

   • A. Port numbers, NAT policy and static routing evaluated in the forwarding path
   • B. Zone Protection profiles, DoS Protection profiles and QoS shaping policies
   • C. Interface management profiles, service routes and log forwarding profiles
   • D. App-ID, User-ID and Content-ID evaluated together within one Security policy rule
   Show answer

   Correct: D. Zero Trust least privilege on the NGFW comes from identifying the application (App-ID), the user or group (User-ID) and the content or threat within the flow (Content-ID) in a single rule. Ports and NAT are transport constructs that attackers evade, Zone and DoS Protection defend against flooding rather than granting access, and management profiles and service routes govern the firewall's own traffic, not user access.

Last updated: 2026-09-23

NetSec-Pro practice test FAQ

Related practice tests

• Palo Alto Networks PCXSA practice test
• Palo Alto Networks XSOAR-ANALYST practice test
• Palo Alto Networks NGFW practice test
• Palo Alto PCCET practice test
• Palo Alto Networks PCCSE practice test
• Palo Alto Networks PCDRA practice test