I85PREP
⌘ K
Palo Alto PSE Strata study materials
Palo Alto PSE Strata study resources

Palo Alto PSE Strata practice questions

One question at a time. Build your Palo Alto PSE Strata understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Network Security

In a Palo Alto Networks NGFW deployment, which Security policy rule action allows the session while logging only the application and threat data, without capturing the full packet payload?

  1. Deny with a reset-both action
  2. Allow with a Log Forwarding profile set to 'enhanced' logging Correct answer.
  3. Allow with no log forwarding profile attached
  4. Drop with packet capture enabled

Explanation

Enhanced application logging in a Log Forwarding profile causes the firewall to record richer application-layer details for allowed sessions, such as application characteristics and threat context, while still permitting the traffic. Plain Allow without any log forwarding produces minimal session logging and no enhanced detail. Deny and Drop block the session rather than allowing it.

Question 2Network Security

An administrator wants traffic from the guest zone to reach the internet but must prevent guests from reaching internal server subnets. Which mechanism enforces this intra-zone and inter-zone restriction most directly?

  1. An inter-zone Security policy rule denying guest-to-server with logging Correct answer.
  2. A Zone Protection profile on the guest zone
  3. A QoS policy applied to the guest interface
  4. An Anti-Spyware profile on the internet zone

Explanation

Security policy rules match on source and destination zones and are the primary control for permitting or denying traffic between zones. A deny rule from guest to server zones, placed above any broader allow, blocks that path while permitting guest-to-internet traffic. Zone Protection profiles and Anti-Spyware profiles handle flood and threat detection, not zone-to-zone authorization.

Question 3Network Security

Which App-ID characteristic means the firewall can identify an application even when it uses a non-standard port or is tunneled inside another protocol?

  1. The application's protocol and decryption-based detection Correct answer.
  2. The application's category assignment
  3. The application's default port membership
  4. The application's risk rating

Explanation

App-ID identifies applications by protocol and behavioral signatures rather than by port alone, so an application running on an unexpected port or inside a tunnel can still be recognized. Port membership is only a hint and can be spoofed. Category and risk rating are metadata labels, not detection mechanisms.

Question 4Network Security

A Security policy rule references an application group that contains both allowed and blocked applications. What is the resulting behavior for an application that is a member of the group?

  1. The rule matches the application because group membership is evaluated as a whole Correct answer.
  2. The rule matches only if the application is also present in a separate deny rule
  3. The application is blocked automatically because groups cannot be partially allowed
  4. Group membership is ignored and only the default application is evaluated

Explanation

When an application group is referenced in a rule, the firewall evaluates any application contained in that group as matching the rule. Group membership is resolved at policy evaluation time, so each member application inherits the rule's action. To exclude specific members, administrators create a more specific rule above the group rule.

Question 5Network Security

What is the primary function of a Security Profile Group in PAN-OS policy?

  1. To provide dynamic address group resolution
  2. To bundle multiple Security profiles so they can be attached to a rule as a single reference Correct answer.
  3. To schedule periodic configuration backups
  4. To define which zones are allowed to communicate

Explanation

A Security Profile Group combines vulnerability, anti-spyware, anti-virus, URL filtering, file blocking, and WildFire profiles into one object. Attaching the group to a Security policy rule applies all member profiles without adding each one individually. Zones, backups, and dynamic address groups are unrelated features.

Question 6Network Security

Which PAN-OS feature lets the firewall enforce policy based on the user identity of the session source rather than only the IP address?

  1. NAT with dynamic IP and port translation
  2. Zone Protection with SYN cookies
  3. App-ID with SSL decryption disabled
  4. User-ID with an LDAP or agent-based source Correct answer.

Explanation

User-ID maps IP addresses to user identities using sources such as the User-ID agent, terminal server agent, or directory integration. Security policy rules can then match on user or user group, so policy follows the person rather than the device's address. The other options concern application detection, flood defense, and address translation, respectively.

Question 7Network Security

A NAT policy rule translates a public destination address to an internal web server. Which Security policy rule must exist for the traffic to be permitted after translation?

  1. A rule matching the NAT policy name as an application
  2. A rule matching the post-NAT internal destination address in the trust zone Correct answer.
  3. A rule matching only the source zone with no destination constraint
  4. A rule matching the pre-NAT public destination address in the untrust zone

Explanation

PAN-OS evaluates Security policy against the post-NAT destination address, so the rule must reference the internal (translated) address and the zone of the internal server. The pre-NAT public address appears only in the original packet and is not what the Security policy matches on the server side.

Question 8Network Security

Which statement describes the default behavior of the interzone-default Security policy rule in PAN-OS?

  1. It permits all interzone traffic and logs at session end
  2. It permits only web-browsing between zones
  3. It applies only to intrazone traffic within a single zone
  4. It denies all interzone traffic that is not explicitly allowed by an earlier rule Correct answer.

Explanation

The interzone-default rule sits at the bottom of the Security policy and denies traffic between zones unless an earlier rule explicitly allows it. This default-deny posture is central to zone-based security design. Intrazone traffic is governed by a separate intrazone-default rule.

Question 9Network Security

An administrator needs the firewall to inspect traffic that uses a custom TCP port for an internally developed application. Which configuration approach is most appropriate?

  1. Disable App-ID and rely on service objects only
  2. Add the port to the any service and allow all applications
  3. Create a custom Application object with the correct port and signature and reference it in policy Correct answer.
  4. Change the application's default port in the predefined App-ID database

Explanation

Custom Application objects allow administrators to define port and signature characteristics for applications not covered by the predefined database. The object is then referenced in Security policy so the firewall recognizes and controls that traffic. Predefined App-ID entries cannot be edited, and disabling App-ID removes application-level control.

Question 10Network Security

A Security policy rule allows web-browsing but the firewall is not decrypting outbound SSL. What is the effect on application identification for traffic inside the encrypted session?

  1. App-ID identifies the inner application with full accuracy
  2. App-ID can identify the outer application but cannot see applications tunneled inside the encrypted session Correct answer.
  3. The session is automatically blocked because decryption is required
  4. App-ID treats all encrypted traffic as unknown-tcp

Explanation

Without SSL decryption, the firewall can identify the outer TLS application using certificate and handshake metadata but cannot inspect the encrypted payload to recognize inner applications. Decryption is required for visibility into applications tunneled within TLS. The session is not automatically blocked, and encrypted traffic is not universally labeled unknown-tcp.

Question 11Network Security

Which element of a Security policy rule determines whether the rule is evaluated before or after other rules in the policy?

  1. The rule's position in the rulebase order Correct answer.
  2. The rule's log forwarding profile
  3. The rule's schedule object
  4. The rule's tag assignment

Explanation

PAN-OS evaluates Security policy rules from top to bottom, and the first matching rule determines the action. Moving a rule up or down changes precedence, which is why specific deny rules are typically placed above broad allow rules. Tags, log forwarding, and schedules do not change evaluation order.

Question 12Network Security

An administrator wants to block only the file-transfer function of an application while allowing its other functions. Which App-ID capability supports this granular control?

  1. Application filters based on category
  2. Application-level function or behavior controls exposed by App-ID Correct answer.
  3. Application override with a custom signature
  4. Service objects that restrict TCP ports

Explanation

Some App-ID signatures expose application functions or behaviors, such as file transfer versus login, allowing policy to permit some functions and block others. This granularity comes from the application's own decoded behaviors rather than from ports or categories. Application override and service objects do not provide per-function control.

Question 13Network Security

Which condition causes a Security policy rule with an application of 'incomplete' to match traffic?

  1. The session uses a port not defined in any service object
  2. The firewall has not yet identified the application when the session is evaluated Correct answer.
  3. The application is in the unknown-tcp category
  4. The session matches a URL category of 'unknown'

Explanation

The incomplete application represents sessions for which App-ID has not yet determined the application at the time policy is evaluated. Rules allowing incomplete traffic let the session proceed while identification continues. It is distinct from unknown-tcp, which is a specific application designation for unidentified TCP traffic.

Question 14Network Security

A company wants to permit access to a SaaS application only for members of a specific Active Directory group. Which combination of PAN-OS features accomplishes this?

  1. App-ID plus a URL filtering profile blocking the SaaS category
  2. User-ID group mapping plus a Security policy rule matching the user group Correct answer.
  3. Zone Protection plus a DoS policy
  4. NAT64 plus DNS proxy

Explanation

User-ID maps source IP addresses to users and their group memberships, and Security policy can match on a user group. Combining that with an application match restricts access to the SaaS app to members of the specified AD group. The other options do not enforce identity-based group access.

Question 15Network Security

Which statement accurately describes how a URL Filtering profile interacts with a Security policy rule?

  1. The URL Filtering profile replaces the need for an application match
  2. The URL Filtering profile applies only to the intrazone-default rule
  3. The URL Filtering profile is applied only to decrypted traffic
  4. The URL Filtering profile is attached to the rule and evaluates the requested URL category to allow, block, or alert Correct answer.

Explanation

A URL Filtering profile is attached to a Security policy rule and inspects the requested URL, mapping it to a category and applying the configured allow, block, continue, or alert action. It complements the application match rather than replacing it. It applies to permitted sessions where URL inspection is possible, not exclusively to decrypted traffic.

Question 16Network Security

An administrator observes that a permitted session is logged with an application of 'ssl' but the expected web application is not shown. Which explanation is most consistent with this observation?

  1. The session is being decrypted and inspected
  2. The session is encrypted and the inner application could not be identified Correct answer.
  3. The firewall has no route to the server
  4. The application is blocked by a deny rule

Explanation

When traffic is encrypted and not decrypted, the firewall may identify only the outer 'ssl' application because the inner application is hidden. To reveal the inner application, SSL decryption must be configured. Routing failures or deny rules would produce different symptoms, such as session drops or deny logs.

Question 17Network Security

Which best describes the role of a Decryption policy rule in PAN-OS?

  1. It controls the certificate used for the management interface
  2. It sets the password policy for administrator accounts
  3. It determines which traffic is decrypted or excluded from decryption based on match criteria Correct answer.
  4. It defines the encryption algorithms used for IPsec tunnels

Explanation

Decryption policy rules match on source, destination, URL category, and other criteria to decide whether traffic is decrypted, bypassed, or blocked. They are separate from Security policy, which then inspects the decrypted traffic. IPsec algorithms, admin passwords, and management certificates are configured elsewhere.

Question 18Network Security

A Security policy rule is configured with a source of 'any' and a destination of 'any' but an application of 'web-browsing'. Which traffic will the rule permit?

  1. Only traffic using TCP port 80
  2. Only sessions identified as web-browsing between any source and destination Correct answer.
  3. Only traffic from the trust zone to the untrust zone
  4. All traffic between any zones regardless of application

Explanation

The rule matches any source and destination but restricts the application to web-browsing, so only sessions identified as web-browsing are permitted. Source and destination 'any' broaden the match, but the application constraint still narrows it. Port 80 is not required because App-ID does not depend on the default port.

Question 19Network Security

An administrator creates a deny rule for a specific application but traffic is still permitted. Which is the most likely cause?

  1. The deny rule uses an application group
  2. The deny rule is positioned below a broader allow rule that matches first Correct answer.
  3. The deny rule lacks a Log Forwarding profile
  4. The deny rule has a schedule attached

Explanation

Because rules are evaluated top-down and the first match wins, a deny rule placed below a broader allow rule never gets evaluated for that traffic. The fix is to move the deny rule above the allow rule. Missing logging, group usage, or a schedule would not by itself cause the allow to take precedence unless the schedule made the deny inactive.

Question 20Network Security

Which statement about intrazone traffic and the intrazone-default rule is correct?

  1. Intrazone traffic is always denied by default
  2. Intrazone traffic is controlled only by Zone Protection profiles
  3. Intrazone traffic is permitted by the intrazone-default rule unless an earlier rule denies it Correct answer.
  4. Intrazone traffic bypasses Security policy entirely

Explanation

The intrazone-default rule permits traffic between interfaces in the same zone by default, and administrators can add more specific rules above it to restrict that traffic. This differs from interzone-default, which denies by default. Intrazone traffic is still subject to Security policy and is not exempt from inspection.

Question 21Network Security

An administrator wants to allow DNS but block DNS tunneling that abuses the protocol. Which PAN-OS capability is designed to detect and block such abuse within an allowed application?

  1. A Zone Protection profile with DNS flood protection
  2. A NAT rule with DNS rewrite
  3. A Threat Prevention profile with DNS-related spyware signatures Correct answer.
  4. A QoS profile with DNS priority

Explanation

Threat Prevention, specifically anti-spyware signatures, includes detection for DNS tunneling and other abuse of allowed protocols. Zone Protection DNS flood protection mitigates volumetric floods but does not detect tunneling content. QoS and NAT do not inspect payload for malicious behavior.

Question 22Network Security

A Security policy rule allows an application, but the attached Security Profile Group blocks a file download mid-session. Which statement best explains this behavior?

  1. Security profiles only act after the session is denied
  2. Security profiles apply only to decrypted traffic
  3. Security profiles replace the Security policy action
  4. Security profiles can take action on allowed sessions based on content inspection Correct answer.

Explanation

Security profiles operate on sessions permitted by Security policy and can block or alert based on content, such as a file matching a File Blocking profile. The session is allowed at the policy level, but the profile can still prevent a specific transfer. Profiles do not replace the policy action and are not limited to decrypted traffic.

Question 23Network Security

An administrator needs to ensure that only traffic destined for a specific external SaaS tenant is allowed, even though the SaaS provider uses shared IP ranges. Which approach is most precise?

  1. Block all traffic to the SaaS provider and rely on users to report issues
  2. Use a provider-supported tenant-aware restriction mechanism configured to allow only the specified tenant Correct answer.
  3. Allow the entire SaaS IP range with an application of ssl
  4. Allow any application to the SaaS category

Explanation

A supported tenant-aware restriction mechanism enforces access using tenant identity. Resolving a tenant's FQDN into an IP list loses that distinction because other tenants may share the same addresses. An address-based External Dynamic List therefore cannot enforce the required restriction to one tenant.

Question 24Network Security

A rule allows an application group, and a new application is later added to that group. What is the effect on policy for the newly added application?

  1. It is automatically permitted because it inherits the group rule's action Correct answer.
  2. It is blocked because groups are static snapshots
  3. It remains denied until a separate rule is created
  4. It is permitted only after a commit and a device restart

Explanation

Application groups are references, so adding a member application causes the group rule to match the new application without editing the rule itself. After the configuration is committed, the new member inherits the group's action. A restart is not required, and groups are not frozen snapshots.

Question 25Network Security

Which combination best explains why a session might be logged as allowed but later dropped by the firewall?

  1. The session matched the interzone-default deny rule
  2. The session was translated by NAT after logging
  3. The Security policy allowed the session, but a Security profile detected a threat and reset the connection Correct answer.
  4. The Security policy denied the session, but logging was delayed

Explanation

A session can be permitted by Security policy while a Security profile, such as anti-spyware or vulnerability protection, detects malicious content and drops or resets the connection. The traffic log then reflects the allow decision with a threat log recording the profile action. A deny rule, default deny, or NAT translation would not produce this sequence.

Question 26Network Security

Which PAN-OS Security policy action silently discards a session without sending a reset or notification to either endpoint?

  1. Reset-client
  2. Reset-server
  3. Drop Correct answer.
  4. Deny

Explanation

The drop action discards matching traffic without notifying the client or server, so the source simply times out. Deny and the reset actions actively signal the endpoints, which changes how the client perceives the block.

Question 27Network Security

Which zone type must be assigned to the interface that faces the public internet in a standard PAN-OS deployment?

  1. Virtual wire
  2. Layer 3 Correct answer.
  3. Tap
  4. Layer 2

Explanation

An internet-facing interface normally has an IP address, routing, and NAT applied, which requires a Layer 3 zone. Layer 2, virtual wire, and tap interfaces serve switching, transparent inspection, and monitoring roles instead.

Question 28Network Security

Which PAN-OS object is used to define a reusable set of IP addresses so that many Security policy rules can reference the same list?

  1. Address object
  2. Region object
  3. Address group Correct answer.
  4. Service group

Explanation

An address group bundles multiple address objects (static or dynamic) so rules can reference the group once and inherit membership changes. A single address object represents one host or subnet, and service groups and region objects serve different purposes.

Question 29Network Security

Which Security policy rule field identifies the applications that the rule is written to control?

  1. Source User
  2. Application Correct answer.
  3. Category
  4. Service

Explanation

The Application field selects the App-ID signatures the rule matches, and the firewall identifies the application before final policy enforcement. Service limits the rule to specific ports, while Category and Source User match URL category and identity respectively.

Question 30Network Security

What does the 'any' selection in the Application field of a Security policy rule cause the firewall to do?

  1. Match only applications in the default application list
  2. Match traffic on the first packet without waiting for application identification Correct answer.
  3. Match only applications that are not otherwise defined
  4. Match traffic only after App-ID resolution completes

Explanation

Selecting any means the rule can match on the first packet, before App-ID has identified the application. This permits traffic quickly but gives up application-level granularity, so the rule cannot distinguish one application from another.

Question 31Network Security

Which PAN-OS feature provides a single place to attach antivirus, anti-spyware, vulnerability, and URL filtering profiles to a Security policy rule?

  1. Application Override
  2. Decryption Profile
  3. Log Forwarding Profile
  4. Security Profile Group Correct answer.

Explanation

A Security Profile Group bundles multiple security profiles so they can be applied to a rule as a unit. Log forwarding profiles control where logs are sent, decryption profiles govern SSL inspection, and application overrides change port-based app identification.

Question 32Network Security

Which log type should an administrator review to see sessions that were denied by a Security policy rule?

  1. Traffic log Correct answer.
  2. URL Filtering log
  3. Data Filtering log
  4. Threat log

Explanation

The traffic log records session-level decisions, including allows and denies, along with the rule that matched. Threat logs record signatures and exploits, while URL Filtering and Data Filtering logs record category and data pattern events.

Question 33Network Security

Which interface type on a PAN-OS firewall is used to manage the device out of band, separate from data traffic?

  1. MGT interface Correct answer.
  2. Loopback interface
  3. Ethernet 1/1
  4. Tunnel interface

Explanation

The management interface carries administrative access such as HTTPS, SSH, and the web UI, and it is separate from data plane interfaces. Ethernet, loopback, and tunnel interfaces carry or terminate data traffic instead.

Question 34Network Security

A Security policy rule allows web-browsing to a server, but the firewall logs the session as application 'ssl' and applies a different rule. Which configuration change is most likely needed to make the intended rule match?

  1. Disable App-ID on the firewall
  2. Add the 'ssl' application to the intended rule Correct answer.
  3. Remove the Service field from all rules
  4. Change the rule action from allow to deny

Explanation

When traffic is encrypted, App-ID may initially identify the session as ssl before decryption or further inspection reveals the inner application. Adding ssl to the intended rule, or enabling decryption so the real application is identified, allows the correct rule to match.

Question 35Network Security

An administrator wants to allow only a specific set of source IP addresses to reach a database server on TCP 1433. Which rule configuration achieves this with the least exposure?

  1. Source set to the approved addresses, destination set to any, application set to any, action allow
  2. Source set to any, destination set to the server, service set to any, action allow
  3. Source set to any, destination set to the server, application set to any, action allow
  4. Source set to the approved addresses, destination set to the server, application set to mssql-db, action allow Correct answer.

Explanation

Restricting source, destination, and application together limits the rule to exactly the intended traffic. Leaving source, destination, or application as any broadens the rule and permits traffic beyond the approved set.

Question 36Network Security

A rule allows an application, but the firewall is not decrypting the traffic and the application is only visible after decryption. What is the most likely result?

  1. The session is dropped because App-ID cannot function without decryption
  2. The session is always denied by the interzone-default rule
  3. The session is logged with an application of incomplete
  4. The session is identified as ssl and may match a different rule Correct answer.

Explanation

Without decryption, App-ID can often only see the outer TLS session and identifies it as ssl. The session may then match a broader rule or the ssl application rather than the intended inner application.

Question 37Network Security

Which action should an administrator take to enforce a default-deny posture after writing explicit allow rules?

  1. Add an explicit deny rule at the top of the rulebase
  2. Add an explicit deny rule at the bottom of the rulebase Correct answer.
  3. Rely on the interzone-default rule to deny all unmatched traffic
  4. Change the interzone-default rule to allow

Explanation

An explicit deny rule at the bottom makes the default-deny intent visible and logged, and it remains in effect if the implicit defaults are changed. The interzone-default rule already denies unmatched interzone traffic, but an explicit rule provides clear logging and intent.

Question 38Network Security

An administrator needs to permit a custom application that uses TCP 8443 but App-ID identifies it as 'unknown-tcp'. Which configuration is appropriate?

  1. Add the ssl application to the rule
  2. Create an Application Override for TCP 8443 and reference the custom application in the rule Correct answer.
  3. Set the rule application to any and service to 8443
  4. Create a Decryption policy rule for TCP 8443

Explanation

An Application Override maps a specific port to a custom application so App-ID treats traffic on that port as the defined application. Setting application to any with a service of 8443 permits the traffic but does not provide application identification.

Question 39Network Security

A Security policy rule allows traffic from the trust zone to the untrust zone, but the return traffic is being blocked. What is the most likely cause?

  1. The rule is missing a URL category
  2. The rule is missing a source user
  3. The return traffic is not being matched to the existing session Correct answer.
  4. The rule action is set to drop

Explanation

PAN-OS is stateful, so return traffic for an allowed session is permitted by the session table without a separate rule. If return traffic is blocked, the session was likely not established or was torn down, so the packets are treated as a new session and evaluated against policy.

Question 40Network Security

Which configuration allows a Security policy rule to match traffic based on the specific URL category of a web request?

  1. Set the application to web-browsing only
  2. Enable App-ID on the rule
  3. Set the service to TCP 80
  4. Attach a URL Filtering profile and use a URL category in the rule Correct answer.

Explanation

URL category matching in a Security policy rule requires a URL Filtering profile so the firewall can categorize requests, after which the rule can match on category. Application, service, and App-ID settings do not provide URL categorization.

Question 41Network Security

An administrator wants to log all traffic that matches a deny rule for later investigation. Which setting on the deny rule accomplishes this?

  1. Disable logging on the rule
  2. Set the rule to drop without logging
  3. Enable log forwarding only for allowed traffic
  4. Enable logging at session end Correct answer.

Explanation

Enabling logging at session end records each session that matches the deny rule in the traffic log. Disabling logging or using a silent drop without logging removes the visibility needed for investigation.

Question 42Network Security

Which PAN-OS object allows a rule to match a group of applications that are managed together?

  1. Service group
  2. URL category group
  3. Application group Correct answer.
  4. Application Override

Explanation

An application group is a container for multiple applications so a single rule can reference them collectively. Application Override changes port-to-application mapping, service groups bundle ports, and URL category groups bundle categories.

Question 43Network Security

An administrator wants to permit access to a web application only for users in a specific group, while still allowing unauthenticated access to a public portal. Which approach best meets this requirement?

  1. Use a single rule with the user group and application any
  2. Use two rules: one with the user group for the protected app and one without user criteria for the public portal Correct answer.
  3. Use a single rule with source any and application web-browsing
  4. Use a single rule with the user group and source any

Explanation

Separating the protected application into a rule with a user group and the public portal into a rule without user criteria gives each the intended access model. Combining them in one rule either over-restricts the portal or under-restricts the protected app.

Question 44Network Security

An administrator notices that a rule allowing a business application is not matching, and the traffic log shows the application as 'insufficient-data'. What does this indicate?

  1. App-ID has not seen enough packets to identify the application Correct answer.
  2. The rule has an incorrect source user
  3. The application is blocked by a security profile
  4. The service field is set to application-default

Explanation

The insufficient-data result means App-ID has not yet observed enough of the session to make a determination. The session may be allowed by a broader rule until identification completes, at which point policy is re-evaluated.

Question 45Network Security

Which statement describes the effect of changing a Security policy rule's action from allow to deny while sessions are active?

  1. All existing sessions are immediately terminated
  2. Only the first packet of each session is denied
  3. New sessions are denied, but existing sessions may continue until they end or are cleared Correct answer.
  4. The rule is ignored until the firewall is rebooted

Explanation

A policy change applies to new sessions, while established sessions remain in the session table until they close or are cleared. Administrators who need immediate enforcement can clear matching sessions from the session browser.

Question 46Network Security

An administrator wants to block traffic to a known malicious IP address while allowing all other traffic to the same destination. Which configuration achieves this?

  1. Place a deny rule for the malicious source below the broader allow rule
  2. Change the allow rule action to deny
  3. Place a deny rule for the malicious source above the broader allow rule Correct answer.
  4. Add the malicious IP to the allow rule's source

Explanation

Security policy is evaluated top-down, so a specific deny rule must appear above the broader allow rule to take effect. Placing it below means the allow rule matches first and the deny is never reached.

Question 47Network Security

A rule allows a SaaS application, but users report intermittent access failures. The traffic log shows some sessions matching the allow rule and others hitting the interzone-default deny. Which cause is most likely?

  1. The allow rule has an incorrect log forwarding profile
  2. The firewall is missing a default route
  3. Some sessions are resolving to a different application that no rule allows Correct answer.
  4. The interzone-default rule has been set to allow

Explanation

When traffic is identified as a different application than the one allowed, it falls through to the implicit deny. Broadening the rule to include related applications or adding a separate rule for them resolves the intermittent failures.

Question 48Network Security

An administrator needs to allow a specific application for one department while denying it for all other departments, with the least number of rules. Which design is most efficient?

  1. Place a deny rule for the application with source any above an allow rule scoped to the department
  2. Create a deny rule for every other department individually
  3. Place a deny rule for the application with source any below an allow rule scoped to the department Correct answer.
  4. Use a single allow rule with source any

Explanation

A scoped allow rule above a broad deny rule permits the department while denying everyone else with only two rules. Order matters: the allow must be evaluated before the deny so the department's traffic is not blocked.

Question 49Network Security

Which combination explains why a session may be logged as allowed in the traffic log but later dropped by the firewall?

  1. The session was allowed by policy but a security profile detected a threat and reset the connection Correct answer.
  2. The session was allowed by policy but the service field was set to application-default
  3. The session was allowed by policy but the source user changed mid-session
  4. The session was allowed by policy but the rule was later deleted

Explanation

A session can be permitted by policy while a security profile later inspects the payload and blocks a detected threat, producing a threat log and a reset. The traffic log records the original policy decision, so the two logs must be correlated.

Question 50Network Security

An administrator must ensure that traffic to a partner's web service is allowed only when the destination resolves to a specific FQDN, even if the IP address changes. Which configuration supports this?

  1. Use a service group for TCP 443
  2. Use an FQDN address object in the destination field of the rule Correct answer.
  3. Use a static IP address object for the partner's current IP
  4. Use a URL category in the rule

Explanation

An FQDN address object is refreshed by DNS resolution, so the rule tracks the partner's changing IP addresses automatically. A static address object becomes stale when the IP changes, and service or URL category settings do not track destination IPs.