Palo Alto Networks NetSec-Analyst Exam Questions 2025

Syslog is the industry-standard protocol for forwarding log messages from network devices to a central logging server, such as a Security Information and Event Management (SIEM) system. Palo Alto Networks firewalls utilize Log Forwarding profiles to direct various log types to a configured Syslog server. While TCP is available for guaranteed delivery, UDP is a very common transport mechanism due to its low overhead, making it efficient for the high volume of logs generated by a firewall. The firewall formats logs into standard Syslog messages, which are then ingested by the SIEM for correlation, analysis, and long-term storage.

B. SMTP: This protocol is used for sending email notifications, not for the continuous, high-volume log streaming required for SIEM integration.

C. SNMP: This is primarily used for network device monitoring and management, sending alerts (traps) rather than detailed, comprehensive log records.

D. FTP: This is a file transfer protocol. It is not a real-time log streaming protocol and is unsuitable for direct, continuous SIEM integration.

1. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2: In the section "Configure Log Forwarding

" it explicitly details the process. "To forward logs to an external service

you must configure a connection between the firewall and a... Syslog server... A Syslog server is typically used to forward logs to a Security Information and Event Management (SIEM) system." The guide then provides instructions for creating a Syslog Server Profile

which includes options for UDP

TCP

and SSL transport. (Reference: Chapter: Monitor > Log Forwarding > Configure Log Forwarding).

2. Palo Alto Networks Documentation - Syslog Server Profile: "The firewall can forward logs to one or more Syslog servers. The firewall uses a Syslog server profile to specify the server IP address

protocol (UDP

TCP

or SSL)

and port number." This confirms Syslog as the designated protocol for this function. (Reference: Device > Server Profiles > Syslog).

SD-WAN functionality on Palo Alto Networks firewalls makes path selection decisions based on real-time network path quality. For applications like video streaming, which are highly sensitive to data loss, the packet loss rate is a critical performance metric. High packet loss directly results in a degraded user experience, causing video artifacts, buffering, and stuttering. An SD-WAN policy for video traffic would use a Path Quality Profile with a stringent packet loss threshold to ensure traffic is routed over the most stable and reliable link, thereby preserving the quality of the stream.

B. Session Timeout: This is a firewall state-table management parameter that determines how long an idle session is maintained; it is not a network path performance metric used for SD-WAN path selection.

C. CPU Utilization: This metric reflects the processing load on the firewall appliance itself, not the quality or performance of the external WAN links that SD-WAN evaluates for path selection.

D. URL Category: This is a traffic identification and policy enforcement criterion. It is used to classify the traffic (e.g., as "streaming-video") so a specific SD-WAN policy can be applied, but it is not the metric used to measure path health.

---

1. Palo Alto Networks

PAN-OS® SD-WAN Administrator’s Guide

Version 10.2

"Path Quality Measurement

" Page 12.

"The firewall measures path quality based on the latency

jitter

and packet loss of the traffic on the link. The firewall uses path quality monitoring to determine the health of the links to an SD-WAN device in a remote site." This document explicitly names packet loss as one of the three core metrics for measuring path quality.

2. Palo Alto Networks

PAN-OS® SD-WAN Administrator’s Guide

Version 10.2

"Configure a Path Quality Profile

" Page 41.

This section details the configuration steps for a Path Quality Profile

which includes setting specific thresholds for "Packet Loss Threshold (%)"

"Latency Threshold (ms)"

and "Jitter Threshold (ms)". This confirms that packet loss is a primary

configurable metric used by the system to make path-forwarding decisions.

3. Kurose

J. F.

& Ross

K. W. (2017). Computer Networking: A Top-Down Approach (7th ed.). Pearson. Chapter 7

"Multimedia Networking."

This standard university textbook explains the network requirements for multimedia applications. In sections discussing streaming video (e.g.

Section 7.2)

it is established that packet loss is a major impairment

as lost packets can result in missing frames or portions of frames

leading to significant visual degradation. This academic source validates the criticality of minimizing packet loss for video applications.

In the Palo Alto Networks firewall's packet processing sequence (the slow path), a session is first created based on Layer 3/4 information (IP addresses and ports). During this initial security policy lookup, the firewall consults its IP-address-to-user mapping table to identify the user (User-ID). If a potential rule matches based on this known information (zone, IP, port, and user), the session is established. As subsequent packets flow through the session, the App-ID engine inspects the payload to identify the specific application. Once the application is identified, the security policy is re-evaluated to ensure the identified application is consistent with the matched rule. This confirms the App-ID check occurs after the initial user mapping and rule match.

A. User-ID is checked after App-ID

This is incorrect. User-ID is derived from the source IP address, which is available immediately and checked against the mapping table during the initial policy lookup, before the application can be identified from the traffic payload.

C. User-ID is ignored if App-ID matches

This is incorrect. If a security policy rule specifies criteria for both User-ID and App-ID, both conditions must be met for the rule to be enforced on the traffic.

D. Both are simultaneously ignored during first packet

This is incorrect. The firewall does not "ignore" these criteria. It immediately begins the process of identification, using the source IP to look up the user mapping and allowing the session to proceed so App-ID can identify the application.

---

1. Palo Alto Networks

"PAN-OS® Administrator’s Guide 10.2" (December 2021).

Section: Packet Flow Sequence in PAN-OS > Slow Path.

The documentation outlines the packet flow

showing that during the initial session setup (slow path)

a security policy lookup is performed. This lookup uses the source IP to query the User-ID mapping. Application identification occurs after the session is established and traffic begins to flow

which may trigger a policy re-match. This supports that App-ID is determined after the initial user mapping and rule match.

2. Palo Alto Networks

"User-ID™ Technology Overview" (2018).

Page 4

Section: "User-ID and Security Policy Enforcement".

The document states

"When a user sends traffic through the firewall

the firewall checks its IP address-to-user mapping table... The firewall then checks the security policy to see if there is a rule that matches the user and the other traffic attributes (source/destination zone

source/destination address

and application)." This confirms user mapping is part of the initial policy check.

3. Palo Alto Networks

"App-ID™ Technology Overview" (2018).

Page 3

Section: "How App-ID Works".

This resource explains that App-ID uses multiple techniques

including signature analysis of the traffic payload

which requires multiple packets. It states

"Once the application is identified

the security policy is applied." This demonstrates that the definitive App-ID check follows the initial session setup.

To enforce GDPR compliance by preventing the upload of sensitive data, you must configure a Data Filtering profile. This profile inspects traffic for specific data patterns. Palo Alto Networks provides two primary methods for this:

1. Predefined data patterns: These are built-in patterns for common sensitive information types, such as EU national identity numbers, financial data (IBANs), and other personally identifiable information (PII) covered under GDPR.

2. Custom regex expressions: For organization-specific or unique data formats not covered by predefined patterns, you can create custom data patterns using regular expressions (regex) to match and identify the specific data you need to protect.

C. IoT security profiles: IoT Security profiles are designed to identify, classify, and enforce policy on Internet of Things (IoT) devices, not to inspect file content for sensitive data.

D. Antivirus signatures: Antivirus signatures are used to detect and block malware based on known malicious code patterns, not to identify and prevent the exfiltration of sensitive personal data.

1. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2:

Section: Objects > Security Profiles > Data Filtering

Content: This section details the configuration of Data Filtering profiles. It explicitly states

"For each data filtering profile

you can specify the action to take when the firewall detects a match. You can filter based on predefined data patterns

or you can create custom data patterns..." This directly supports the use of both predefined and custom patterns (A and B).

2. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2:

Section: Objects > Custom Objects > Data Patterns > Create a Custom Data Pattern Object

Content: This section explains how to create custom patterns. It states

"You can create custom data patterns using regular expressions (regex) to define patterns for sensitive information that is unique to your organization..." This confirms that custom regex expressions (B) are a core component of the data filtering feature.

3. Palo Alto Networks Datasheet: Enterprise Data Loss Prevention (DLP):

Section: Key Capabilities > Detect Sensitive Data with High Accuracy

Content: The document states

"Enterprise DLP comes with a comprehensive library of predefined data patterns... For proprietary and unique data

you can easily create custom data patterns using regular expressions (regex) and validate them with the built-in regex validator." This source validates both predefined patterns (A) and custom regex (B) as the primary methods for data detection.

Palo Alto Networks SD-WAN (Prisma SD-WAN) improves the performance of SaaS applications like Office 365 by using application-aware routing. It continuously monitors the performance metrics of all available network paths, including latency, jitter, and packet loss. Based on predefined application policies (App-SLAs), the SD-WAN solution dynamically steers traffic for a specific application onto the path that currently offers the best performance. This ensures a consistent and high-quality user experience by avoiding network congestion and suboptimal routing, which is critical for latency-sensitive SaaS applications.

A. Encrypts all SaaS traffic: SaaS traffic is typically already encrypted by the application provider using TLS/SSL. While SD-WAN encrypts its overlay tunnels, this is not its unique or primary benefit for SaaS.

C. Blocks malicious domains automatically: This is a function of a security service, such as DNS Security or a Next-Generation Firewall (NGFW), not a core networking capability of SD-WAN itself.

D. Reduces the need for antivirus scanning: SD-WAN is a network routing and optimization technology. It does not perform file inspection and therefore does not replace or reduce the need for antivirus solutions.

---

1. Palo Alto Networks. (2023). Prisma SD-WAN Datasheet.

Page 2

"Key Features

" Section: "Application-defined SD-WAN policies": "Prisma SD-WAN enables you to create application-based policies that consider application performance

security

and link cost. This allows you to steer traffic to the preferred path to meet application SLAs." This directly supports the concept of routing based on application performance metrics.

2. Palo Alto Networks. (2022). Prisma SD-WAN At-a-Glance.

Page 1

Section: "Improve End-User Experience": "Improve end-user experience for cloud and SaaS applications by leveraging application-defined policies that steer traffic based on real-time link performance." This statement explicitly links SD-WAN's performance-based routing to the benefit for SaaS applications.

3. Palo Alto Networks. (2023). Prisma SD-WAN Design Guide.

Section: "Application Path and QoS Policy

" Subsection: "Path Selection": The guide details how policies are configured to measure path quality (MOS-v

latency

jitter

loss) and select the best-performing path for specific applications to ensure the application performance requirements are met. This technical detail underpins the functionality described in the correct answer.

Palo Alto Networks PAN-OS provides robust decryption capabilities to inspect encrypted traffic for threats. The two primary modes for handling SSL/TLS traffic are SSL Forward Proxy and SSL Inbound Inspection.

SSL Forward Proxy decrypts outbound traffic from internal clients to external web servers. The firewall acts as a trusted man-in-the-middle, allowing inspection of user traffic for malware, command-and-control, and data exfiltration.

SSL Inbound Inspection decrypts inbound traffic destined for an organization's internal servers (e.g., web servers). This allows the firewall to inspect traffic for attacks or malware before it reaches the protected server.

These two methods provide comprehensive visibility and control over encrypted traffic entering and leaving the network.

C. GRE Decryption:

GRE is a tunneling protocol, not an encryption protocol. PAN-OS inspects traffic within GRE tunnels but does not perform "GRE decryption."

D. SSH Proxy:

While PAN-OS does support SSH Proxy to decrypt and inspect SSH traffic, SSL Forward Proxy and Inbound Inspection are the two fundamental modes for the more prevalent SSL/TLS protocol.

1. Palo Alto Networks. (2021). PAN-OS® Administrator's Guide

Version 10.2. "Decryption Concepts". This section explicitly lists and describes SSL Forward Proxy and SSL Inbound Inspection as key decryption deployment modes.

2. Palo Alto Networks. (2021). PAN-OS® Administrator's Guide

Version 10.2. "Configure SSL Forward Proxy". This chapter details the configuration and use case for decrypting outbound client traffic.

3. Palo Alto Networks. (2021). PAN-OS® Administrator's Guide

Version 10.2. "Configure SSL Inbound Inspection". This chapter details the configuration for decrypting traffic destined for an internal server.

4. Palo Alto Networks. (2021). PAN-OS® Administrator's Guide

Version 10.2. "Configure SSH Proxy". This section confirms SSH Proxy is a supported feature

distinct from the primary SSL/TLS decryption modes.

A DoS Protection Profile is the specific Palo Alto Networks feature designed to mitigate denial-of-service attacks, including volumetric floods. This profile protects network resources by monitoring the rate of new sessions for various protocols (e.g., TCP-SYN, UDP, ICMP). When traffic rates exceed a configured threshold, indicating a potential flood attack, the firewall can take protective actions such as dropping packets. This directly addresses the requirement to protect a public web server from being overwhelmed by high-volume, malicious traffic.

B. Data Filtering Profile: This profile is used for Data Loss Prevention (DLP) to prevent sensitive information, such as credit card numbers or social security numbers, from leaving the network.

C. Antivirus Profile: This profile inspects traffic for known malware, viruses, and spyware within file transfers and application content. It does not protect against network-layer flood attacks.

D. SD-WAN Policy: This is used for traffic engineering and path selection across multiple WAN links to optimize application performance and availability, not for mitigating security attacks like DoS floods.

1. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide

Version 11.0. "DoS Protection." In the "DoS Protection Overview" section

it states: "DoS protection defends your network against flooding of new sessions that can overwhelm your server’s ability to respond to new connection requests... Flood protection helps protect your network from SYN

UDP

ICMP

and other IP-based flooding attacks."

2. Palo Alto Networks. (2023). Technical Documentation: DoS Protection Profiles. "Flood Protection" section. This document details the mechanism: "Flood protection detects and prevents traffic that floods the firewall or specific hosts... The firewall measures traffic in connections-per-second (CPS) and drops connections that exceed the configured Activate Rate threshold."

3. Palo Alto Networks. (2021). Palo Alto Networks Certified Network Security Analyst (PCNSA) Study Guide. "Module 5: Securing Traffic with Security Profiles." This official study guide describes DoS Protection as the feature to "protect against common flood attacks." It contrasts this with other profiles like Antivirus (for malware) and Data Filtering (for DLP).

SYN Cookies are a stateless mechanism used to mitigate TCP SYN flood attacks. When a server or firewall receives a SYN request, instead of allocating memory for a new connection (which is what a SYN flood exploits), it sends back a SYN-ACK packet with a specially crafted sequence number (the "cookie"). This cookie contains encoded information about the initial SYN request. The firewall then discards the SYN request state. If a legitimate client responds with an ACK, the firewall can validate the cookie from the ACK packet and establish the connection, all without having to maintain a large state table of half-open connections, thus preventing server resource exhaustion.

B. Application Override: This feature is used to force traffic classification to a specific application, bypassing App-ID. It does not mitigate network-layer DoS attacks.

C. Antivirus Signature Matching: This security profile inspects traffic for known malware signatures. A SYN flood attack does not involve malware and is not detected by this mechanism.

D. File Blocking: This security profile prevents the transfer of specific file types. It operates at the application layer and is irrelevant to TCP handshake-level attacks.

1. Palo Alto Networks PAN-OS® Administrator's Guide 10.2: In the section on DoS Protection

it states

"For a SYN Flood attack

the firewall can use SYN cookies to validate that a client is legitimate before it allows a session to be established." This directly confirms the use of SYN cookies to handle SYN floods.

Reference: Palo Alto Networks. (2021). PAN-OS® Administrator's Guide 10.2. "DoS Protection Concepts

" section "SYN Flood Protection."

2. Internet Engineering Task Force (IETF) RFC 4987: This document provides a detailed technical explanation of SYN flood attacks and mitigation techniques. It describes SYN cookies as a primary defense.

Reference: Eddy

W. (2007). TCP SYN Flooding Attacks and Common Mitigations. RFC 4987. Section 3.2

"SYN Cookies." DOI: 10.17487/RFC4987.

3. Stanford University CS 155 Courseware: University-level network security courses cover SYN floods and SYN cookies as fundamental concepts.

Reference: Boneh

D. (n.d.). CS 155: Computer and Network Security. Stanford University. Lecture notes on "Network Security

" section on "Denial of Service Attacks." (Specific course materials often detail how SYN cookies create a stateless initial handshake to prevent resource depletion).

The Palo Alto Networks User-ID feature can obtain user-to-IP address mappings from several sources to enforce user-based policies.

GlobalProtect: When a user authenticates to a GlobalProtect portal or gateway, the firewall directly learns the user's identity and the IP address assigned to their endpoint, creating a mapping.

Syslog Parsing: The firewall or User-ID agent can act as a syslog listener. When AAA servers (like RADIUS) send syslog messages containing successful user authentication events, the firewall parses these messages to extract the username and associated IP address.

XML API: The User-ID XML API allows external systems, such as third-party identity providers or custom scripts, to directly push user mapping information to the firewall. This is a direct and programmatic method for creating mappings.

C. URL Filtering logs: These logs are a consumer of User-ID information, not a source. They record user and IP data for traffic that has already been identified using a pre-existing mapping.

1. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide 10.2. "User-ID Concepts > Methods for Mapping Users to IP Addresses". This section explicitly lists GlobalProtect

Syslog

and the XML API as distinct methods the firewall uses to map users to IP addresses.

2. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide 10.2. "Configure User-ID to Monitor a Syslog Sender for User Mappings". This chapter details the configuration for using syslog messages from external devices like AAA servers as a source for user mappings.

3. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide 10.2. "Send User Mappings to the Firewall Using the XML API". This section provides the technical details for how external systems can use the XML API to directly submit user-to-IP address mappings to the firewall.

4. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide 10.2. "GlobalProtect". The documentation explains that upon successful user authentication

GlobalProtect registers the user and their assigned IP address with the firewall for policy enforcement.

A Security Profile Group is a feature in PAN-OS that bundles multiple Security Profiles into a single object for streamlined application to Security policy rules. The profiles that can be included are Antivirus, Anti-Spyware, Vulnerability Protection, URL Filtering, File Blocking, and WildFire Analysis. This grouping simplifies administration by allowing a single, consistent set of security inspections to be applied to traffic matching a policy rule, rather than attaching each profile individually. Antivirus and Anti-Spyware are both standard Security Profiles that can be included in such a group.

B. Application Override: This is a distinct policy type, configured separately from Security Profiles, used to reclassify traffic to a specific application.

D. Authentication Policy: This is a separate policy type used to enforce user authentication for accessing network resources, not a security inspection profile.

1. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide 10.2. "Objects > Security Profile Groups". The documentation states

"A Security Profile Group is a set of Security Profiles that you can apply to a Security policy rule... The group can include one of each type of security profile: Antivirus

Anti-Spyware

Vulnerability Protection

URL Filtering

File Blocking

and WildFire Analysis." This explicitly includes Antivirus and Anti-Spyware and excludes other policy types.