Palo Alto Networks NetSec-Analyst Exam Questions 2025

B. Zone-Based: This describes the method of application (DoS Protection profiles are applied to zones), not the type of policy rule itself.

D. GlobalProtect: This is a Palo Alto Networks product for securing remote and mobile users (VPN), not a type of DoS Protection policy.

1. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide 10.2.

Section: DoS Protection > DoS Protection Policy Rules.

Content: "You can configure two types of DoS protection policies: Classified and Aggregate. A classified policy applies to a group of classified addresses (source or destination IP addresses). An aggregate policy applies to all traffic that matches the policy."

2. Palo Alto Networks. (n.d.). TechDocs: DoS Protection Against Flooding of New Sessions.

Section: DoS Protection Policy Types.

Content: The document explicitly details the functionality and configuration of "Aggregate DoS Protection" and "Classified DoS Protection" as the two primary policy types for mitigating flood attacks. It explains that Aggregate policies use a single bucket for all traffic, while Classified policies use separate buckets for each destination IP.

A. Terminating SSL sessions is a function of Decryption policies and profiles, not the RED mechanism within a DoS profile.

C. Blocking specific URL categories is the primary function of a URL Filtering security profile, which operates at the application layer.

D. Filtering sensitive data is performed by Data Filtering profiles or a Data Loss Prevention (DLP) solution, not by DoS protection mechanisms.

1. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2. In the section on DoS Protection, under Flood Protection, the guide describes the Protect action. It states for Random Early Drop (RED): "The firewall begins to drop packets when the incoming packet rate reaches the Activate Rate threshold. The drop rate increases as the packet rate approaches the Maximum Rate threshold." This confirms that dropping starts preemptively at the "Activate" rate before the "Maximum" rate is exceeded. (Reference: Objects > Security Profiles > DoS Protection > Flood Protection).

2. Palo Alto Networks Beacon Courseware, EDU-210: Firewall 10.2 Essentials: Configuration and Management. Module 9, "Denial-of-Service (DoS) Protection," explains that DoS Protection profiles use thresholds (Alarm, Activate, Maximum) to mitigate flood attacks. The RED action is detailed as a method that starts dropping packets at the Activate rate to proactively manage the attack traffic before the hard limit (Maximum rate) is reached.

A. Maximum Concurrent Sessions: This is a feature of Zone Protection Profiles, not DoS Protection profiles. It limits session table resources, not the packet rate characteristic of a volumetric flood.

B. Max Bandwidth per User: This is a Quality of Service (QoS) policy feature used for traffic shaping and bandwidth management, not a security mechanism within a DoS Protection profile.

1. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2, "DoS Protection" Chapter:

Section: DoS Protection Profiles and Policy Rules > Configure DoS Protection > Flood Protection

Content: The documentation explicitly details the configuration of flood protection within a DoS Protection profile. It states, "The firewall provides flood protection for SYN, UDP, ICMP, ICMPv6, and other IP protocols... For each type of flood, you can set three thresholds... Activate Rate (CPS)... Max Rate (CPS)." This directly supports that SYN and UDP flood thresholds are the configurable parameters for mitigating such attacks.

2. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2, "Zone Protection and DoS Protection" Chapter:

Section: Zone Protection Profiles > Configure Zone Protection to Prevent Floods

Content: This section describes the settings for a Zone Protection Profile, which include "TCP Port Scan," "Host Sweep," and session limits based on source or destination IP. It clarifies that "Maximum Concurrent Sessions" is a zone-level protection, distinct from the resource-specific DoS Protection profile.

3. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2, "Quality of Service" Chapter:

Section: QoS Concepts > QoS for Applications and Users

Content: This chapter details how QoS policies are used to "manage bandwidth by setting a guaranteed bandwidth and a maximum bandwidth for a user, an application, or a service." This confirms that "Max Bandwidth per User" is a QoS function, separate from DoS protection.

A. Application SLA Profile – No such SD-WAN object exists in PAN-OS; path selection is driven by Path Quality Profiles, not an “Application SLA” profile.

C. Data Filtering Profile – Provides DLP-style file and data control; it is unrelated to SD-WAN path measurement or selection.

D. Antivirus Profile – Detects malware in traffic; it has no influence on WAN-link monitoring or latency-based steering.

1. Palo Alto Networks, PAN-OS 10.2 Administrator’s Guide, “SD-WAN—Path Quality Profile,” paras. 1-4: describes latency/jitter/loss thresholds and metric priority used to pick the best path.

2. Palo Alto Networks TechDocs, “Best Path Selection and Failover for SD-WAN” (rev. 2023), section “How the Firewall Chooses the Path”: explains that the firewall selects the path with the best (lowest) value of the highest-priority metric, typically latency for voice.

3. Palo Alto Networks, PAN-OS 11.0 Administrator’s Guide, “Example: Prioritizing Voice Traffic with SD-WAN,” Example configuration step 3: shows assigning a Path Quality Profile with latency priority to voice applications.

B. Application Signature Change: This relates to App-ID and traffic classification for policy enforcement, not the performance or health of the physical network path.

D. Username Change: This is a User-ID event relevant for identity-based security policies and has no direct impact on network link performance metrics that trigger SD-WAN failover.

1. Palo Alto Networks PAN-OS® SD-WAN Administrator's Guide (PAN-OS 10.2): In the section "Path Quality Profiles," the documentation states, "You can monitor path quality based on latency, jitter, and packet loss. You set thresholds for these metrics... When the path quality degrades, the firewall can select a new path for the application." This directly confirms that latency and jitter are monitored metrics that can trigger path changes. (Reference: Chapter: SD-WAN Configuration, Section: Path Quality Profiles).

2. Palo Alto Networks PAN-OS® SD-WAN Administrator's Guide (PAN-OS 11.0): The section "Monitor SD-WAN Link Performance" details the metrics used for path selection. It specifies, "SD-WAN measures path quality for each path to a remote site based on the latency, jitter, and packet loss statistics..." and explains that these measurements are compared against thresholds in Path Quality Profiles to determine path health and trigger failovers. (Reference: Chapter: Monitor SD-WAN, Section: Monitor SD-WAN Link Performance).

A. Enforcing file blocking policies is a function of Security Policy rules and profiles, not the primary role of an SD-WAN template, which focuses on path selection.

C. Controlling certificate validity checks is typically managed within device certificate settings or Decryption profiles, which are distinct from SD-WAN configuration objects.

D. Creating decryption bypass rules is a component of Decryption Policy, which governs SSL/TLS inspection, not the traffic steering function of SD-WAN.

1. Palo Alto Networks PAN-OS® SD-WAN Administrator's Guide 10.2: In the "SD-WAN Configuration Overview" section, it states, "You use Panorama to centrally configure and manage your SD-WAN deployment... You configure SD-WAN on a template and push the configuration to the managed firewalls that are branch or hub sites." This directly confirms the role of templates in centralizing SD-WAN configuration deployment. (Reference: Chapter: "Get Started with SD-WAN", Section: "SD-WAN Configuration Overview").

2. Palo Alto Networks Panorama™ Administrator's Guide 10.2: The guide explains the fundamental purpose of templates: "Templates allow you to create a configuration that you can easily and consistently apply to multiple firewalls." When applied to the SD-WAN feature, this principle supports the answer that an SD-WAN template's main role is to centralize SD-WAN policy deployment. (Reference: Chapter: "Templates", Section: "Template Stacks").

B. Session Timeout: This is a firewall state-table management parameter that determines how long an idle session is maintained; it is not a network path performance metric used for SD-WAN path selection.

C. CPU Utilization: This metric reflects the processing load on the firewall appliance itself, not the quality or performance of the external WAN links that SD-WAN evaluates for path selection.

D. URL Category: This is a traffic identification and policy enforcement criterion. It is used to classify the traffic (e.g., as "streaming-video") so a specific SD-WAN policy can be applied, but it is not the metric used to measure path health.

---

1. Palo Alto Networks, PAN-OS® SD-WAN Administrator’s Guide, Version 10.2, "Path Quality Measurement," Page 12.

"The firewall measures path quality based on the latency, jitter, and packet loss of the traffic on the link. The firewall uses path quality monitoring to determine the health of the links to an SD-WAN device in a remote site." This document explicitly names packet loss as one of the three core metrics for measuring path quality.

2. Palo Alto Networks, PAN-OS® SD-WAN Administrator’s Guide, Version 10.2, "Configure a Path Quality Profile," Page 41.

This section details the configuration steps for a Path Quality Profile, which includes setting specific thresholds for "Packet Loss Threshold (%)", "Latency Threshold (ms)", and "Jitter Threshold (ms)". This confirms that packet loss is a primary, configurable metric used by the system to make path-forwarding decisions.

3. Kurose, J. F., & Ross, K. W. (2017). Computer Networking: A Top-Down Approach (7th ed.). Pearson. Chapter 7, "Multimedia Networking."

This standard university textbook explains the network requirements for multimedia applications. In sections discussing streaming video (e.g., Section 7.2), it is established that packet loss is a major impairment, as lost packets can result in missing frames or portions of frames, leading to significant visual degradation. This academic source validates the criticality of minimizing packet loss for video applications.

C. USB Tethering: This is an ad-hoc method of providing internet access from a mobile device and is not a typical, stable, or scalable link type for enterprise SD-WAN deployments.

D. Internal Loopback: This is a virtual network interface used for diagnostics and communication within a single host; it is not a physical WAN link used for external site-to-site connectivity.

1. Palo Alto Networks Documentation, "What is SD-WAN?": "SD-WAN enables organizations to use any combination of transport services, including MPLS, LTE and broadband internet services, to securely connect users to applications." This source explicitly lists both MPLS and broadband internet as core transport services for SD-WAN.

2. Palo Alto Networks, PAN-OS® SD-WAN Administrator’s Guide 10.2, "SD-WAN Overview": "SD-WAN allows you to manage your WAN and optimize traffic steering over any combination of transport, including low-cost internet, MPLS, 4G, and 5G." This official guide confirms that MPLS and internet (which includes broadband) are fundamental transport options for path selection.

A. Application SLA Profile: This object defines the performance thresholds (latency, jitter, packet loss) for path health monitoring, not the applications themselves.

C. Device Group: This is a Panorama management object used to group firewalls for configuration and policy deployment, unrelated to application identification in SD-WAN rules.

D. QoS Profile: This object is used to apply Quality of Service policies, such as traffic shaping and prioritization, to traffic after it has been matched by a rule.

---

1. Palo Alto Networks, PAN-OS® Administrator’s Guide 10.2, "SD-WAN Concepts":

Section: SD-WAN Policy Rule

Content: "An SD-WAN policy rule matches applications and application groups and directs them to an external network through a virtual or physical interface that has a specific path quality profile." This statement explicitly confirms that Application Groups are used as the matching criteria for applications.

2. Palo Alto Networks, PAN-OS® Administrator’s Guide 10.2, "Objects > Application Groups":

Section: Application Groups

Content: This section describes Application Groups as "named groups of applications that you can use to create policies." It details how these objects serve as a container for applications, which are then referenced in various policy types, including SD-WAN.

3. Palo Alto Networks, PAN-OS® Administrator’s Guide 10.2, "SD-WAN > Configure SD-WAN":

Section: Create an SD-WAN Policy Rule

Content: The procedural steps for creating an SD-WAN policy rule show that in the "Application" tab, an administrator selects either individual applications or pre-configured Application Groups to define the traffic that the rule will act upon.

A. Encrypts all SaaS traffic: SaaS traffic is typically already encrypted by the application provider using TLS/SSL. While SD-WAN encrypts its overlay tunnels, this is not its unique or primary benefit for SaaS.

C. Blocks malicious domains automatically: This is a function of a security service, such as DNS Security or a Next-Generation Firewall (NGFW), not a core networking capability of SD-WAN itself.

D. Reduces the need for antivirus scanning: SD-WAN is a network routing and optimization technology. It does not perform file inspection and therefore does not replace or reduce the need for antivirus solutions.

---

1. Palo Alto Networks. (2023). Prisma SD-WAN Datasheet.

Page 2, "Key Features," Section: "Application-defined SD-WAN policies": "Prisma SD-WAN enables you to create application-based policies that consider application performance, security, and link cost. This allows you to steer traffic to the preferred path to meet application SLAs." This directly supports the concept of routing based on application performance metrics.

2. Palo Alto Networks. (2022). Prisma SD-WAN At-a-Glance.

Page 1, Section: "Improve End-User Experience": "Improve end-user experience for cloud and SaaS applications by leveraging application-defined policies that steer traffic based on real-time link performance." This statement explicitly links SD-WAN's performance-based routing to the benefit for SaaS applications.

3. Palo Alto Networks. (2023). Prisma SD-WAN Design Guide.

Section: "Application Path and QoS Policy," Subsection: "Path Selection": The guide details how policies are configured to measure path quality (MOS-v, latency, jitter, loss) and select the best-performing path for specific applications to ensure the application performance requirements are met. This technical detail underpins the functionality described in the correct answer.