Free Paloalto Networks NetSec-Pro Practice Exam with Questions & Answers

Advanced DNS Security uses a signature policy to sinkhole malicious DNS queries and prevent them from resolving.

“The DNS Security service integrates with Anti-Spyware profiles, and you must configure signature policy settings to sinkhole malicious queries. This proactively stops traffic to known malicious domains.”

(Source: Configure DNS Security)

Sinkholing ensures that DNS queries to malicious FQDNs are redirected to a safe IP, preventing compromise.

SCM compliance and best practice reporting aligns with security frameworks such as NIST and CIS to help evaluate configuration posture.

When migrating from a perpetual VM-Series firewall license to a flexible VM licensing model , two critical steps are needed:

Allocate same number of vCPUs – This ensures that the VM-Series capacity remains consistent and avoids resource bottlenecks.

“When migrating perpetual VM-Series licenses to flexible VM licensing, allocate the same vCPU and memory resources to ensure equivalent performance.”

(Source: VM-Series Flexible Licensing Migration)

Limit to same security services – Flexible licensing requires maintaining the same security services to preserve licensing compliance.

“Ensure that you allow only the same security services on the flexible VM instance as were licensed on the perpetual VM.”

(Source: Flexible Licensing and Service Subscriptions)

App-ID Cloud Engine (ACE) in SaaS Security uses cloud-based signatures to detect unknown and unsanctioned SaaS applications in the environment.

“App-ID Cloud Engine (ACE) uses real-time cloud intelligence to identify SaaS applications, including previously unknown or newly introduced applications.”

(Source: ACE for SaaS Visibility)

This feature is key for comprehensive SaaS visibility beyond static signatures.

Proxy mode and Hybrid mode support coexistence with third-party VPN environments, allowing phased migration where some users access applications through GlobalProtect while others continue using another VPN.

Prisma Access for secure remote access

“Prisma Access extends consistent security and optimized connectivity to branch locations, enabling secure access for mobile and branch users.”

(Source: Prisma Access Overview)

Centralized management for consistent policy enforcement

“Centralized management using Strata Cloud Manager or Panorama ensures security policies and updates are uniformly applied across distributed locations, preventing policy drift and security gaps.”

(Source: Strata Cloud Manager Best Practices)

These two practices are foundational for modern, distributed enterprise networks to maintain security posture and performance.

To connect a remote network to Prisma Access via Strata Cloud Manager (SCM), the remote network requires an IPSec termination node . This acts as the VPN endpoint, ensuring secure connectivity between branch locations and Prisma Access.

“To onboard a remote network, configure the IPSec termination node on the customer’s premises. This VPN endpoint establishes the secure tunnel to Prisma Access for traffic backhauling.”

(Source: Onboard Remote Networks)

Key takeaway:

The IPSec termination node is fundamental for secure, encrypted connectivity.

Prisma SD-WAN device inventory can show statuses such as Unclaimed , Offline , and Online-Restricted to indicate onboarding and communication state.

Protecting against malicious and misconfigured domains requires two critical services:

Advanced Threat Prevention

Provides signature-based and advanced analysis to identify threats, including DNS-based attacks.

“Advanced Threat Prevention enables the NGFW to detect and prevent exploits and malware-based communications, including those leveraging DNS.”

(Source: Advanced Threat Prevention)

Advanced DNS Security

Specifically designed to detect and sinkhole malicious and misconfigured DNS queries.

“DNS Security uses real-time intelligence to block DNS-based threats, protect against data exfiltration, and automatically sinkhole suspicious domain lookups.”

(Source: DNS Security)

By combining these services in security policies, NGFWs ensure robust protection against domain-based threats and misconfigurations.

Panorama allows engineers to create custom reports and generate PDF summary formats for consistent reporting across NGFWs.

Custom Reports

“Custom Reports provide tailored reporting based on URL categories, application usage, and threat visibility. They are generated within Panorama and can include data on newly categorized AI URL types.”

(Source: Panorama Reports)

PDF Summaries

“You can generate PDF summary reports to distribute these insights across branch firewalls, providing an easy-to-read format for compliance and operational review.”

(Source: Export Reports as PDF)

Together, these options provide a consistent, standardized method to push insights about AI-based URL categories to branch devices.