NetSec-Analyst: Palo Alto Networks Certified Network Security Analyst Practice Exam

What the NetSec-Analyst exam covers

• Objects223 questions
• Policies221 questions
• Management and Operations193 questions
• Troubleshooting106 questions

Free NetSec-Analyst sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 743.

1. Question 1Objects

   Which of the following is a valid way to define an address object in Strata Cloud Manager?

   • AAs a security profile group applied to a zone pair
   • BAs a threat signature identifier assigned by Palo Alto Networks
   • CAs an IP netmask, an IP range, or a fully qualified domain nameCorrect
   • DAs a scheduled time window tied to a calendar recurrence
   ✓ Correct answer: C

   Address objects support several representations of a host or network so administrators can pick the format that best matches how the resource is identified, including a specific IP address with netmask, a contiguous IP range, or a domain name that resolves dynamically. Whichever format is chosen, the resulting object can be referenced in rules and groups the same way. This flexibility avoids forcing every address into a single rigid format.

   Why the other options are wrong

   • ASecurity profile groups are applied within security rules and are unrelated to defining an address object's value.
   • BA threat signature identifier belongs to threat objects, not to how an address object's value is defined.
   • DA calendar-based recurring time window describes a schedule object, not an address object.
2. Question 2Objects

   A server's hosting provider occasionally changes its IP address, but the server's hostname never changes. Which address object type keeps the related security policy accurate without manual updates?

   • AIP Range
   • BFQDNCorrect
   • CIP Netmask
   • DIP Wildcard Mask
   ✓ Correct answer: B

   Because the object is defined by hostname rather than IP address, the firewall's own DNS resolution keeps the matched addresses current whenever the provider changes the underlying IP, with no manual edit needed.

   Why the other options are wrong

   • AAn IP Range object holds a fixed start and end address and does not track hostname-based changes.
   • CAn IP Netmask object holds a fixed address or subnet and does not track hostname-based changes.
   • DAn IP Wildcard Mask object holds a fixed address and mask pattern and does not track hostname-based changes.
3. Question 3Objects

   The predefined service object named service-http is associated with which destination port?

   • AUDP port 53
   • BTCP port 8080
   • CTCP port 80Correct
   • DTCP port 21
   ✓ Correct answer: C

   Strata Cloud Manager includes predefined service objects for common protocols, and service-http is defined as TCP destination port 80, the standard port for unencrypted web traffic. Administrators can use it directly in rules without creating a custom service.

   Why the other options are wrong

   • APort 53 over UDP is used for DNS, not the predefined HTTP service.
   • BPort 8080 is a common alternate web port but is not the port defined by service-http.
   • DPort 21 is the standard FTP control port, unrelated to the predefined service-http object.
4. Question 4Objects

   What is the primary purpose of a Data Filtering profile in PAN-OS?

   • ATo enforce safe search restrictions across all supported web search engines
   • BTo classify network traffic into specific applications using App-ID signatures
   • CTo forward unknown executable files to the WildFire cloud for sandbox analysis
   • DTo detect data patterns, such as credit card numbers, within network trafficCorrect
   ✓ Correct answer: D

   Rules within the profile reference data pattern objects, such as predefined patterns for credit card or social security numbers, and apply an alert or block action once a configured number of matches is found in a session.

   Why the other options are wrong

   • ASafe search enforcement is a URL Filtering profile feature
   • BApplication classification is performed by App-ID, not the Data Filtering profile
   • CForwarding files to WildFire for sandboxing is the role of the WildFire Analysis profile
5. Question 5Policies

   What problem occurs when a broad security rule is placed above a more specific rule intended to handle a narrower case?

   • AThe firewall raises a configuration error and simply refuses to commit
   • BThe specific rule automatically takes priority over the broader rule above it
   • CThe specific rule below is shadowed and never gets evaluated for that trafficCorrect
   • DBoth rules end up merged into a single rule during the next commit
   ✓ Correct answer: C

   Because security rules are evaluated top to bottom with first-match-wins logic, any traffic that satisfies the broad rule's conditions is handled there, and the firewall never continues down to check the narrower rule intended for that traffic. This is a common misconfiguration that produces unexpected allow or deny results.

   Why the other options are wrong

   • AOverlapping or shadowed rules are a logical design issue, not something that blocks a commit from succeeding.
   • BRule order, not specificity, determines precedence; a lower, more specific rule does not override a rule above it.
   • DPAN-OS does not automatically merge overlapping rules together during a commit.
6. Question 6Policies

   A rule references a custom service object with a nonstandard port instead of 'application-default'. What is the effect on App-ID based matching for that rule?

   • AApp-ID is completely disabled for that particular rule
   • BThe rule automatically becomes a decryption rule instead
   • CThe custom service object is simply ignored by the firewall
   • DThe rule still matches the application, ignoring the portCorrect
   ✓ Correct answer: D

   App-ID continues to identify the application regardless of the configured service, but the rule enforces whatever port range the custom service object defines rather than limiting it to the application's expected ports. This can be useful for applications running on nonstandard ports, though it is generally less restrictive than application-default.

   Why the other options are wrong

   • AApp-ID classification remains active even when a custom service object is used.
   • BThe rule type remains a security rule; it does not automatically become a decryption rule.
   • CThe custom service object is what is actually enforced, not silently replaced by application-default.
7. Question 7Management and Operations

   A device sits in a folder that is nested three levels deep: grandparent folder, parent folder, and the device's own folder. How does its effective configuration get built?

   • AOnly the grandparent folder's configuration ever applies to the device
   • BConfiguration is inherited through each ancestor level, more specific winsCorrect
   • COnly the device's own folder contributes; ancestor folders are ignored
   • DThe three levels are averaged together automatically whenever they conflict
   ✓ Correct answer: B

   Inheritance is not limited to the immediate parent; it continues through every level above the device's own folder, including the grandparent folder and beyond. When settings conflict across those levels, the more specific, closer to the device definition takes precedence over the broader, more distant one.

   Why the other options are wrong

   • AThe grandparent folder is one contributing layer, but the parent and the device's own folder also contribute.
   • CAncestor folders further up the hierarchy still contribute inherited configuration; they are not ignored.
   • DConflicting settings are resolved by scope specificity, not by averaging values from different levels.
8. Question 8Management and Operations

   Which statement best describes log retention behavior in Strata Logging Service?

   • ALogs are retained only while the firewall that generated them stays powered on and online
   • BLogs are retained indefinitely forever with no possibility of ever being purged from storage
   • CLogs are permanently deleted at the end of each calendar day regardless of retention settings
   • DLogs remain searchable for the retention period the tenant selected, subject to quotaCorrect
   ✓ Correct answer: D

   Retention in the logging service is governed by a configurable period that the tenant selects, and how long logs remain fully depends on that setting together with available storage quota. Logs are not deleted on a fixed daily cycle, retained only while a device stays online, or kept indefinitely without any bound.

   Why the other options are wrong

   • AStored logs remain in the cloud repository independent of whether the originating firewall stays online.
   • BRetention is bounded by the selected period and available quota, not indefinite storage with no purge.
   • CRetention is governed by a selected period and quota, not a fixed one-day deletion cycle.
9. Question 9Management and Operations

   Which statement accurately reflects multi administrator behavior in Strata Cloud Manager?

   • AOnly one single administrator account can ever exist within a given SCM tenant configuration
   • BSCM strictly prevents any two administrators from editing configuration on the same calendar day
   • CAdministrators share a single candidate configuration session with no individual attribution
   • DMultiple administrators can work in the same tenant, with changes tied to their accountsCorrect
   ✓ Correct answer: D

   Because each administrator's edits are tracked under their own account, the platform supports accountability and traceability even when several people are making changes. This is important for troubleshooting and coordinating work across a team.

   Why the other options are wrong

   • AStrata Cloud Manager tenants support multiple administrator accounts, not just a single one.
   • BThere is no restriction preventing two administrators from editing configuration on the same day.
   • CChanges are attributed to individual administrator accounts rather than being anonymous or unattributed.
10. Question 10TroubleshootingSelect all that apply

    Which three Action values in a traffic log indicate the firewall actively sent a TCP reset to terminate the session? (Choose three.)

    • Areset-bothCorrect
    • Bdrop
    • Cdeny
    • Dreset-serverCorrect
    • Ereset-clientCorrect
    ✓ Correct answer: A, D, E

    These three action values describe the direction of the reset the firewall generated: toward the client, toward the server, or toward both sides of the connection. This differs from deny, which may or may not involve a reset depending on the matched service's default deny behavior, and from drop, which discards packets without sending any notification to either side.

    Why the other options are wrong

    • BDrop specifically means packets were discarded silently with no reset or notification sent to either side.
    • CDeny reflects a rule match and may or may not include sending a reset depending on the service's configured default deny behavior, so it is not itself a guaranteed reset action.

Related Palo Alto resources

• NetSec-Analyst study guideKey concepts
• Palo Alto practice examsAll Palo Alto
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• CyberSec-Practitioner practice examRelated
• NGFW-Engineer practice examRelated
• XDR-Engineer practice examRelated

NetSec-Analyst practice exam FAQ