NetSec-Analyst問題集、Palo Alto Networks実際の試験問題

質問 1

A network architect is designing a new security posture for a hybrid cloud environment. They have Palo Alto Networks firewalls deployed on-premise and in AWS, Azure, and GCP. The requirement is to have a single pane of glass for security policy management, threat intelligence updates, and centralized logging that can scale with dynamic cloud workloads. Which combination of Palo Alto Networks products and services best fulfills these requirements?

A. Palo Alto Networks GlobaIProtect Cloud Service (GPCS) for all traffic, with no firewalls.

B. VM-Series firewalls in each cloud, managed individually, forwarding logs to a central syslog server.

C. Individual firewall UIs for management, Splunk for logging, and manual threat intelligence updates.

D. Panorama (on-premise), local log collectors, and external threat feeds.

E. Cloud-managed Panorama, Strata Logging Service, and Advanced Threat Prevention (ATP) subscriptions.

正解: E

解説: (PassTest メンバーにのみ表示されます)

質問 2

A global organization uses Panorama to manage its Palo Alto Networks firewalls. They are implementing SD-WAN across multiple regions. A specific requirement states: all inter-region traffic for a custom application 'Global Sync' must use the lowest latency path available between any two regional hubs, regardless of the primary link type (MPLS or Internet VPN). Furthermore, this traffic must be prioritized with guaranteed bandwidth if possible. Which SD-WAN configurations are crucial to meet this requirement efficiently across regions using Panorama?

A. On Panorama, create a 'Template Stack' for each regional hub. Within each stack, define an SD-WAN profile with an SD-WAN policy rule for 'Global_Sync'. This rule should use 'Best Quality' path selection, and the associated 'Path Monitoring' profile for each link must be configured to measure latency accurately.

B. Configure 'VPN Monitoring' on all inter-regional VPN tunnels. Use 'Policy Based Forwarding' (PBF) rules with 'Link State Tracking' to route 'Global_Sync' traffic over the active VPN tunnel with the lowest latency. Apply QOS profiles directly on the PBF rules.

C. At the Panorama Device Group level, create an SD-WAN profile containing an SD-WAN policy rule for 'Global_Sync'. Set its path selection to 'Best Quality' or 'Performance-Based' (with latency-focused SLA). Ensure all relevant inter-regional interfaces/tunnels are included in the 'Path Monitoring' profile, and apply 'QOS profiles' specifically for 'Global_Sync' application.

D. Define a global 'SD-WAN profile' at the Panorama 'Device Group' level, and within it, an SD-WAN policy rule for 'Global_Sync' using 'Performance-Based' path selection. Create a 'Path Quality' profile with very low latency thresholds. For bandwidth, apply QOS policies on the interfaces involved.

E. Implement an 'SD-WAN profile' on Panorama that includes 'Path Monitoring' for all inter-regional links. Define a single SD-WAN policy rule for 'Global_Sync' with 'Best Quality' path selection. Leverage 'Shared Gateways' and 'SD-WAN Hub' configurations for inter-region connectivity. QOS policies would manage bandwidth.

正解: C,E

解説: (PassTest メンバーにのみ表示されます)

質問 3

You are debugging a connectivity issue where an internal application server, running a custom SSH service on port 2222, cannot establish connections to an external cloud logging service. The firewall logs show 'deny' actions with application 'ssh' and service 'application-default', even though a specific policy rule allows 'custom_ssh_app' (a custom App-ID for port 2222) to the logging service. What is the most likely cause and solution?

A. The custom App-ID 'custom_ssh_app' is incorrectly defined and is not identifying the traffic as SSH. The solution is to redefine the custom App-ID to accurately match the SSH handshake on port 2222.

B. The issue is with Application Override. The firewall is incorrectly overriding the custom App-ID with the default 'ssh' App-I The solution is to remove any Application Override rules that might conflict with this custom application.

C. The firewall is correctly identifying the traffic as standard SSH (App-ID: ssh) despite the custom port. The solution is to modify the allowing rule to explicitly allow 'ssh' application and 'tcp/2222' as the service.

D. The security policy rule for 'custom_ssh_app' has a lower priority than a generic 'deny all SSH' rule. The solution is to move the 'custom_ssh_app' rule to a higher priority.

E. The traffic is being identified as 'application-incomplete' before the custom App-ID can classify it. The solution is to allow 'application-incomplete' for the destination IP, then refine the rule.

正解: C

解説: (PassTest メンバーにのみ表示されます)

質問 4

A large manufacturing facility is deploying thousands of new IoT sensors for predictive maintenance. These sensors communicate over MQTT and generate sensitive operational data'. The security team needs to implement a robust IoT security profile on their Palo Alto Networks Next-Generation Firewall (NGFW) to ensure data confidentiality, integrity, and device authentication. Which of the following approaches is MOST effective for establishing a strong IoT security posture for these sensors, assuming they cannot support complex PKI or client certificates initially?

A. Create a new 'IoT Security Profile' object, enable 'Device Identification' for MQTT, configure a custom 'IoT Policy Rule' to permit MQTT traffic based on device attributes identified by the NGFW, and utilize 'Device Group' segmentation.

B. Rely solely on network segmentation (VLANs) to isolate IoT devices, with no specific application or device-aware security policies.

C. Deploy a dedicated IoT gateway for all sensor traffic, configure static NAT for each sensor, and apply a standard 'Antivirus' and 'Anti-Spyware' profile to the gateway's outbound traffic.

D. Use GlobalProtect VPN to secure each individual sensor's connection to the corporate network, requiring pre-shared keys for authentication.

E. Implement a custom URL filtering profile to block all non-MQTT traffic and apply a default Security Policy for all IoT zones.

正解: A

解説: (PassTest メンバーにのみ表示されます)

質問 5

After deploying a new WildFire analysis profile, users report that legitimate executable files downloaded from a trusted internal server are being quarantined by the firewall, showing up in the WildFire submission logs as 'malicious'. The WildFire Verdict is 'Malicious'. What is the most appropriate action to resolve this false positive?

A. Configure a custom Antivirus signature to bypass scanning for these specific files.

B. Adjust the WildFire analysis profile's thresholds to be less aggressive for executable files.

C. Submit the quarantined files to WildFire for re-analysis, categorizing them as 'benign' and requesting a new verdict.

D. Disable WildFire analysis for all internal traffic to prevent further quarantines.

E. Create a new security policy rule to explicitly allow the download of these specific files.

正解: C

解説: (PassTest メンバーにのみ表示されます)

質問 6

During a firmware upgrade on a Palo Alto Networks firewall, the process halts unexpectedly, and the device reboots multiple times before reverting to the previous firmware version. The logs show entries similar to:

What is the PRIMARY action the analyst should take to resolve this issue?

A. Restart the management server process on the firewall.

B. Clear old log files and unnecessary configurations to free up disk space, then retry the upgrade.

C. Check the hardware health of the firewall, specifically the RAM modules.

D. Downgrade to an older, smaller firmware version that might fit.

E. Verify network connectivity to the update server and retry the download.

正解: B

解説: (PassTest メンバーにのみ表示されます)

質問 7

A Palo Alto Networks Network Security Engineer is developing an automated remediation script to respond to specific, repeatable 'DLP Violation' incidents. The script needs to retrieve the 'source-user' and 'destination-IP' from the incident, dynamically create a new security policy rule to block the 'source-user' from accessing the 'destination-IP', and then commit the changes. Assuming the script can query the Incidents and Alerts page API (using XSOAR or custom code) for active incidents and interact with the firewall via its XML API/REST API, what is the MOST critical data point to extract from the incident, and which API operation would be necessary for creating the blocking rule?

A. Critical Data Point: 'source-user' and 'destination-ipt (as directly available fields from the incident object). API Operation:

B. Critical Data Point: 'user' (from incident context) and 'destination' (from incident context). API Operation:

C. Critical Data Point: 'src' (from log data within incident) and 'dst' (from log data within incident). API Operation:

D. Critical Data Point: 'incident-id' and 'log-entry-count'. API Operation:

E. Critical Data Point: 'threat-id'. API Operation:

正解: A

解説: (PassTest メンバーにのみ表示されます)

質問 8

Consider the following XML snippet representing a partial SD-WAN template configuration in Panorama for a new branch template stack:

Which of the following statements accurately describe the implications or missing crucial components for this SD-WAN template to effectively manage application-specific traffic with performance objectives, specifically for a VoIP' application?

A. The 'path-quality-profiles' are correctly defined, but 'Rule_1' is too generic. A new SD-WAN policy rule specifically for 'VoIP' is required, linked to the 'High_Quality_Voice' profile, and positioned at a higher priority.

B. The 'Rule_1' entry needs to be modified to specify 'application: VoIP' and its 'path-selection' changed to reference 'High_Quality_Voice' for performance-based routing.

C. The template is missing the definition of 'Path Monitoring' profiles, which are essential for the 'path-quality-profiles' to gather real-time link metrics.

D. The 'High_Quality_Voice' profile needs to be applied to specific interfaces or zones for it to take effect, which is not shown in this SD-WAN profile snippet.

E. While 'High_Quality_Voice' defines performance thresholds, it does not explicitly define which links or paths are preferred for an application, only what constitutes 'high quality'.

正解: A,C,E

解説: (PassTest メンバーにのみ表示されます)

質問 9

Consider a scenario where a Palo Alto Networks firewall is deployed in a datacenter. A critical application, 'Internal ERP', runs on a custom TCP port 8443. This application needs to be accessed only by users in the 'Finance' Active Directory group, but specifically, only from their corporate laptops. How would you construct the Security Policy rule and leverage Palo Alto Networks features to enforce this granular access and device posture check?

A. Source Zone: Internal, Source Address: Corporate_Laptop_lP_Range, Source User: Finance_AD_Group, Destination Zone: Internal, Destination Address: Internal_ERP Server_lP, Application: tcp/8443, Service: application-default, Action: allow.

B. Source Zone: Internal, Source Address: any, Source User: Finance_AD_Group, Source Hip Profile: Corporate_Laptops_HlP, Destination Zone: Internal, Destination Address: Internal_ERP Server_lP, Application: Internal_ERP_App_lD (custom), Service: application-default, Action: allow.

C. Source Zone: Internal, Source Address: any, Source User: any, Destination Zone: Internal, Destination Address: Internal_ERP_Server_lP, Application: Internal_ERP_App_lD (custom), Service: tcp/8443, Action: allow, coupled with a GlobalProtect HIP match policy on the gateway.

D. Source Zone: Internal, Source Address: any, Source User: Finance_AD_Group, Source User-ID Agent: All, Destination Zone: Internal, Destination Address: Internal_ERP_Server_lP, Application: Internal_ERP_App_lD (custom), Service: application-default, Action: allow, User-ID setup for Finance_AD_Group.

E. Source Zone: Internal, Source Address: any, Source User: Finance_AD_Group, Destination Zone: Internal, Destination Address: Internal_ERP_Server_lP, Application: any, Service: tcp/8443, Action: allow.

正解: B

解説: (PassTest メンバーにのみ表示されます)

質問 10

A Palo Alto Networks firewall configured with GlobalProtect VPN is experiencing an issue where remote users can establish a VPN connection but cannot access any internal network resources. Troubleshooting steps confirm that client-side routing is correct, and the VPN tunnel is established. The GlobalProtect gateway security policy logs show 'deny' actions with 'Application: incomplete' and 'Service: unknown-tcp'. Which combination of factors is most likely contributing to this problem?

A. Certificate validation failure between the GlobalProtect client and the gateway, preventing session establishment beyond the initial handshake.

B. Incorrect source NAT configuration on the GlobalProtect security policy and a missing security zone for the VPN tunnel interface.

C. The 'tunnel interface' for GlobalProtect is incorrectly assigned to a virtual router that does not have routes to the internal networks.

D. Missing or incorrect security policy rules allowing traffic from the GlobalProtect tunnel zone to internal zones, combined with a 'Service: application-default' setting that is preventing proper App-ID classification initially.

E. The GlobalProtect gateway is configured for SSL VPN but the client is attempting to connect via IPsec, leading to protocol mismatch and decryption failure.

正解: D

解説: (PassTest メンバーにのみ表示されます)

質問 11

A managed security service provider (MSSP) uses Strata Cloud Manager (SCM) to deliver security services to multiple distinct customers. Each customer requires strict logical separation of their firewall configurations, policies, and logs within SCM, while the MSSP's central operations team needs a consolidated view of all customer environments without cross-customer data leakage. Which SCM design principles and features are paramount for achieving this multi-tenancy with secure isolation?

A. Implementing separate SCM instances for each customer to ensure physical isolation.

B. Utilizing a single SCM instance and relying solely on Application-ID for traffic segmentation.

C. Configuring SD-WAN overlays to segment customer traffic at the network layer.

D. Leveraging SCM's Device Groups for logical separation, combined with granular Role-Based Access Control (RBAC) and explicit permissions per device group.

E. Distributing management tasks to on-premise Panorama instances for each customer.

正解: D

解説: (PassTest メンバーにのみ表示されます)

質問 12

A Palo Alto Networks firewall is configured with IPSec VPN tunnels to multiple branch offices. Users in a specific branch office are reporting intermittent connectivity issues to resources in the main data center. 'show vpn flow' on the main data center firewall shows the VPN tunnel state as 'Up', but the 'Rx Bytes' and 'Tx Bytes' are not incrementing for traffic from the affected branch. 'show log traffic direction equal reverse' on the main firewall also shows no matching traffic for the branch network's return path. What is the MOST complex and difficult-to-diagnose underlying network issue that could cause this scenario?

A. The branch office firewall's local proxy ID or remote proxy ID configuration is incorrect for the main data center's subnets.

B. An upstream ISP routing change or BGP flap on the branch office's internet connection is intermittently black-holing traffic destined for the main data center's public IP address.

C. The 'security-zone' configuration on the tunnel interface on either end of the VPN has been changed or removed, breaking policy enforcement.

D. The pre-shared key (PSK) on one end of the VPN tunnel has been changed, leading to decryption failures.

E. A duplicate IP address conflict exists on the branch office network, causing routing instability.

正解: B

解説: (PassTest メンバーにのみ表示されます)

質問 13

An organization is migrating its data center applications to a hybrid cloud model, where some applications remain on-premises and others move to AWS. SD-WAN is deployed at the on-prem data center (DC-FW) and at a new branch (BR-FW). The requirement is that users at the branch access an on-prem application (App-OnPrem) via an SD-WAN tunnel, prioritizing a direct MPLS link. If MPLS performance degrades, traffic should failover to an IPsec VPN tunnel over the internet. For an AWS-hosted application (App-AWS), users should always use the internet link via SD-WAN, and bypass the MPLS entirely. All SD-WAN tunnels originate from the branch. Which of the following intricate configurations are REQUIRED for this specific scenario?

A. Create two separate 'Path Monitoring' profiles on BR-FW, one for the MPLS tunnel and one for the IPsec tunnel. Configure a 'Path Quality' profile for App-OnPrem that references the MPLS path monitor with an SLA. For App-AWS, a different SD-WAN rule should explicitly route traffic over the internet-based tunnel.

B. On the BR-FW, configure an SD-WAN profile. For App-OnPrem, create a policy rule using 'Link Quality' path selection, specifying the MPLS tunnel as preferred with relevant thresholds. For App-AWS, create a separate policy rule using 'Load Balancing' with 'Session Distribution' across the internet-facing interfaces only.

C. On the BR-FW, define an SD-WAN profile with two SD-WAN policy rules: one for App-OnPrem with a 'Performance-Based' path selection profile prioritizing the MPLS tunnel, and another rule for App-AWS with a 'Performance-Based' path selection profile explicitly excluding the MPLS tunnel.

D. On the BR-FW, define an SD-WAN profile. For App-OnPrem, use a 'Performance-Based' rule with a 'Path Quality' profile. For App-AWS, use a 'Best Quality' rule, ensuring that the Path Monitoring for the MPLS link is configured with very high latency/jitter to effectively 'down-prioritize' it for App-AWS traffic.

E. On the BR-FW, create an SD-WAN policy rule for App-OnPrem, utilizing a 'Performance-Based' path selection with a 'Path Quality' profile and an explicit preferred path set to the MPLS tunnel. For App-AWS, create a separate SD-WAN policy rule with 'Performance-Based' path selection, and ensure the MPLS tunnel is NOT included in the 'Applicable Paths' for this rule.

正解: E

解説: (PassTest メンバーにのみ表示されます)

質問 14

An internal web application (10.1.1.100) hosted in the 'DMZ' zone needs to access a third-party API service (api.example.com) on the internet. Due to compliance requirements, all traffic from this web application to api.example.com must exit through a specific public IP address (SNAT'd via a specific egress interface, ethernet1/4) to satisfy IP whitelisting on the API provider's side. All other internet traffic from the 'DMZ' should use the default internet uplink (ethernet1/1). The public IP for ethernet1/4 is 203.0.113.50. Which set of configurations will correctly implement this policy?

A. 1. Create a Security Policy rule: Source Zone: DMZ, Destination Zone: Untrust, Source Address: 10.1.1.100, Destination Address: api.example.com, Application: web-browsing, ssl, Action: Allow, NAT Tab: Source NAT Type: Static IP, Translated Address: 203.0.113.50.2. Ensure a default route exists via ethernet1/4 with a lower metric than the default route via ethernet1/1 .

B. 1. Create a PBF rule: Source Zone: DMZ, Source Address: 10.1 .1.100, Destination Address: (Resolved IPs for api.example.com), Egress Interface: ethernet1/4, Next Hop: (ISP Gateway for ethernet1/4), Action: Forward. 2. Create a Security Policy rule: Source Zone: DMZ, Destination Zone: Untrust, Source Address: 10.1.1.100, Destination Address: (Resolved IPs for api.example.com), Application: web-browsing, ssl, Action: Allow, NAT Tab: Source NAT Type: Dynamic IP and Port, Interface: ethernet1/4.

C. 1. Create a PBF rule: Source Zone: DMZ, Source Address: 10.1 .1.100, Destination FQDN: api.example.com, Egress Interface: ethernet1/4, Next Hop: (ISP Gateway for ethernet1/4), Action: Forward. 2. Create a Security Policy rule: Source Zone: DMZ, Destination Zone: Untrust, Source Address: 10.1.1.100, Destination Address: api.example.com, Application: web-browsing, ssl, Action: Allow, NAT Tab: Source NAT Type: Dynamic IP and Port, Interface: ethernet1/4, IP Address: 203.0.113.50.

D. 1. Create a PBF rule: Source Zone: DMZ, Source Address: 10.1.1.100, Destination FQDN: api.example.com, Egress Interface: ethernet1/4, Next Hop: (ISP Gateway for ethernet1/4), Action: Forward. 2. Create a NAT Policy rule: Source Zone: DMZ, Destination Zone: Untrust, Source Address: 10.1.1.100, Destination Address: (Resolved IPs for api.example.com), Service: any, Translated Packet Source Address Type: Dynamic IP and Port, Interface: ethernet1/4, IP Address: 203.0.113.50.

E. 1. Create a PBF rule: Source Zone: DMZ, Source Address: 10.1.1.100, Destination FQDN: api.example.com, Egress Interface: ethernet1/4, Next Hop: (ISP Gateway for ethernet1/4), Action: Forward. 2. Create a NAT Policy rule: Source Zone: DMZ, Destination Zone: Untrust, Source Address: 10.1.1.100, Destination Address: any, Service: any, Translated Packet Source Address Type: Static IP, Translated Address: 203.0.113.50, Egress Interface: ethernet1/4.

正解: D

解説: (PassTest メンバーにのみ表示されます)

質問 15

A cloud security architect is integrating a Palo Alto Networks firewall with a custom-developed SRE (Site Reliability Engineering) platform. The platform needs to dynamically adjust DoS protection profiles based on real-time application performance metrics and observed attack patterns. Specifically, when the platform detects a significant increase in application latency coupled with a surge in unknown TCP connections, it should programmatically enable and fine-tune a specific DoS protection profile. Consider the following Python code snippet using the pan -os -python library:

Which of the following code additions would correctly complete the 'Missing code for adding TCP Flood thresholds' section within the DoSProtectionProfile object, ensuring it configures a TCP SYN flood protection with 'activation-rate' from 'threshold rate' and 'action: syn-cookie', and integrates with the overall dynamic deployment logic?

A.

B.

C.

D.

E. The

正解: D

解説: (PassTest メンバーにのみ表示されます)

質問 16

A large enterprise has implemented strict outbound traffic control. They want to prevent the transfer of any executable files (.exe, .msi, .dll) to external cloud storage services (e.g., Dropbox, Google Drive, OneDrive) unless the file has been explicitly scanned and deemed safe by WildFire. Additionally, they need to ensure that no archived files (.zip, .rar) containing executables are uploaded. Which Palo Alto Networks configuration objects and their precise application would best achieve this, considering the need for both file type and content inspection?

A. Create a 'File Blocking' profile: Rule 1: 'Direction: upload', 'File Type: exe, msi, dll', 'Action: Block'. Rule 2: 'Direction: upload', 'File Type: zip, rar', 'Action: Block'. Apply this profile to an outbound security policy for URL category 'cloud-storage'. Also enable 'WildFire Analysis' on the same policy for all file types.

B. Create a 'Data Filtering' profile with predefined patterns for executables and archives. Create a 'File Blocking' profile to block 'exe, msi, dll, zip, rar' on upload. Apply both to the outbound security policy for cloud storage, ensuring the 'Data Filtering' profile's action is 'Block'.

C. Configure a 'Security Policy' rule with 'Source Zone: internal', 'Destination Zone: external', 'URL Category: cloud-storage', 'Action: Allow'. Within this rule, apply a 'File Blocking' profile with a rule for 'upload' of 'exe, msi, dll' and 'Action: block' if not 'WildFire Verdict: benign'. Also, apply a 'Data Filtering' profile with a 'Nested File Blocking' rule to detect executables within archives and block.

D. Create a 'WildFire Analysis' profile: Set 'Analysis: all' for relevant zones. Create a 'File Blocking' profile: Rule 1: 'Direction: upload', 'File Type: exe, msi, dll', 'Action: Allow' with 'WildFire Action: Continue and wait for result'. Rule 2: 'Direction: upload', 'File Type: zip, rar', 'Action: Block'. Apply both to the security policy for 'cloud-storage' URL category.

E. Create a 'File Blocking' profile: Rule 1: 'Direction: upload', 'File Type: exe, msi, dll', 'Action: Continue' with 'WildFire Action: Block'. Rule 2: 'Direction: upload', 'File Type: zip, rar', 'Action: Block'. Ensure 'WildFire Analysis' is enabled on the security policy for these file types. The 'Block' for archives prevents nested executables without explicit nested file inspection by WildFire.

正解: E

解説: (PassTest メンバーにのみ表示されます)

Palo Alto Networks Network Security Analyst - NetSec-Analyst 模擬練習