Palo Alto Networks : SecOps-Generalist Questions & Answers

Palo Alto Networks SecOps-Generalist Exam Syllabus Topics:

Palo Alto Networks Security Operations Generalist Sample Questions:

1. A security analyst needs to monitor a Palo Alto Networks Strata NGFW for traffic patterns indicative of potential policy violations, such as unauthorized application usage or unusual data transfer volumes by specific users. They require detailed information about allowed and denied sessions, including source/destination, application, user, and amount of data transferred. Which log type is the primary source for this information?

A) HIP Match logs
B) Threat logs
C) System logs
D) Configuration logs
E) Traffic logs

2. In a Prisma SD-WAN deployment using ION devices, an administrator notices that traffic between two internal subnets assigned to the same Security Zone is not appearing in the traffic logs, even though a logging profile is attached to the relevant Security Policy rules. Traffic between these subnets is successfully flowing. What is the MOST likely reason the traffic logs are missing for this intra-zone communication?

A) The interfaces connected to these subnets are configured in Tap mode instead of Layer 3 mode.
B) A NAT policy rule is incorrectly translating the source or destination IPs, preventing logging.
C) Intra-zone traffic is implicitly allowed by the 'intra-zone-default' rule and bypasses explicit Security Policy rule evaluation, therefore it is not logged by default security policy logging.
D) The Security Policy rule matching this traffic has logging disabled.
E) User-ID is not enabled on the interfaces, preventing logging of user sessions.

3. When analyzing logs from Prisma Access in Cortex Data Lake, an administrator wants to focus specifically on sessions that were blocked due to a URL Filtering policy violation and originated from users in the 'Marketing' user group. Which filtering criteria in the log viewer interface would be MOST effective for this specific investigation?

A) Filter by Log Type 'System' and Event 'URL Block'.
B) Filter by Log Type 'Threat', Category 'url', and Source User 'marketing-group'.
C) Filter by Log Type 'Threat' and Action 'block'.
D) Filter by Log Type 'URL Filtering', Action 'block', and Source User 'marketing-group'.
E) Filter by Log Type 'Traffic', Action 'deny', and Source Zone 'Remote-Networks'.

4. Palo Alto Networks performs software updates and maintenance on the underlying Prisma Access infrastructure periodically. Which of the following statements accurately describe how these updates and maintenance activities are designed to affect the availability and security posture of the Prisma Access service for customers? (Select all that apply)

A) The administrator is responsible for downloading and installing the new Prisma Access software version via the Cloud Management Console.
B) Customers are notified in advance of scheduled maintenance windows for Prisma Access updates.
C) Updates are performed on a per-customer basis, requiring manual scheduling by the administrator.
D) Updates are typically performed in a rolling, non-disruptive manner across the global infrastructure to minimize impact on user connectivity and session state.
E) During updates, security inspection capabilities (App-ID, Threat Prevention) are temporarily disabled to ensure connectivity.

5. A network administrator is configuring a security policy rule on a Palo Alto Networks Strata NGFW for internal user access to a critical server farm zone. The policy should permit access to specific applications only for authenticated users who belong to certain Active Directory groups. The rule configuration uses User-ID in the 'Source User' field. What happens when a user whose IP address is not currently mapped to a username by User-ID attempts to match this security policy rule?

A) The traffic will be processed by the data plane using hardware acceleration without hitting the slow path because identity is not yet determined.
B) The traffic will be explicitly denied because the 'Source User' field is specified, and no matching user is found, effectively defaulting to a deny for unauthenticated/unknown users.
C) The firewall will initiate a Captive Portal authentication request to the user to obtain a mapping before evaluating the policy further.
D) The policy lookup will ignore the 'Source User' field and match the rule based solely on Source Zone, Destination Zone, and Application.
E) The traffic will automatically be matched by a default 'allow any any' rule hidden from view.

Solutions: