Free Paloalto Networks NetSec-Generalist Practice Exams - Page 3 of 3

Question #21

Which action is only taken during slow path in the NGFW policy?

A . Session lookup
B . SSUTLS decryption
C . Layer 2-Layer 4 firewall processing
D . Security policy lookup

Correct Answer: B
B

Explanation:

In Palo Alto Networks Next-Generation Firewall (NGFW), packet processing is categorized into the fast path (also known as the accelerated path) and the slow path (also known as deep inspection processing). The slow path is responsible for handling operations that require deep content inspection and policy enforcement beyond standard Layer 2-4 packet forwarding.

Slow Path Processing and SSL/TLS Decryption

SSL/TLS decryption is performed only during the slow path because it involves computationally intensive tasks such as:

Intercepting encrypted traffic and performing man-in-the-middle (MITM) decryption.

Extracting the SSL handshake and certificate details for security inspection.

Inspecting decrypted payloads for threats, malicious content, and compliance with security policies.

Re-encrypting the traffic before forwarding it to the intended destination.

This process is critical in environments where encrypted threats can bypass traditional security inspection mechanisms. However, it significantly impacts firewall performance, making it a slow path action.

Other Answer Choices Analysis

(A) Session Lookup C This occurs in the fast path as part of session establishment before any deeper inspection. It checks whether an incoming packet belongs to an existing session.

(C) Layer 2CLayer 4 Firewall Processing C These are stateless or stateful filtering actions (e.g., access

control, NAT, and basic connection tracking), handled in the fast path.

(D) Security Policy Lookup C This is also in the fast path, where the firewall determines whether to allow, deny, or perform further inspection based on the defined security policy rules.

Reference and Justification:

Firewall Deployment C SSL/TLS decryption is part of the firewall’s deep packet inspection and Zero Trust enforcement strategies.

Security Policies C NGFWs use SSL decryption to enforce security policies, ensuring compliance and blocking encrypted threats.

VPN Configurations C SSL VPNs and IPsec VPNs also undergo decryption processing in specific security enforcement zones.

Threat Prevention C Palo Alto’s Threat Prevention engine analyzes decrypted traffic for malware, C2 (Command-and-Control) connections, and exploit attempts.

WildFire C Inspects decrypted traffic for zero-day malware and sandboxing analysis.

Panorama C Provides centralized logging and policy enforcement for SSL decryption events.

Zero Trust Architectures C Decryption is a crucial Zero Trust principle, ensuring encrypted traffic is not blindly trusted.

Thus, SSL/TLS decryption is the correct answer as it is performed exclusively in the slow path of Palo Alto Networks NGFWs.

Question #22

Which two tools can be used to configure Cloud NGFWs for AWS? (Choose two.)

A . Cortex XSIAM
B . Cloud service provider’s management console
C . Prisma Cloud management console
D . Panorama

Reveal Solution Hide Solution

Question #23

What is the most efficient way in Strata Cloud Manager (SCM) to apply a Security policy to all ten firewalls in one data center?

A . Create the Security policy on each firewall individually.
B . Set the configuration scope to "Global" and create the Security policy.
C . Create the Security policy at any configuration scope, then clone it to the ten firewalls.
D . Create a folder that groups the ten firewalls together, then create the Security policy at that configuration scope.

Reveal Solution Hide Solution

Question #24

In conjunction with Advanced URL Filtering, which feature can be enabled after usemame-to-IP mapping is set up?

A . Host information profile (HIP)
B . Credential phishing prevention
C . Client probing
D . Indexed data matching

Reveal Solution Hide Solution

Question #25

What are two ways to create an App-ID for unknown applications? (Choose two.)

A . Provide a packet capture to Palo Alto Networks and request an App-ID.
B . Create a custom application by using signatures.
C . Create a security profile that maps the signature to the unknown application.
D . Use WildFire API to map signatures to the unknown application.

Reveal Solution Hide Solution

Question #26

A security administrator is adding a new sanctioned cloud application to SaaS Data Security.

After authentication, how does the tool gain API access for monitoring?

A . It transmits the configured SAML user profile to the cloud application for security event attribution.
B . It establishes an encrypted key pair with the cloud application to safely transmit user data.
C . It generates a certificate and sends it to the cloud application for TLS decryption and inspection.
D . It receives a token from the cloud application for establishing and maintaining a secure connection.

Reveal Solution Hide Solution

Question #27

Which NGFW function can be used to enhance visibility, protect, block, and log the use of Post-quantum Cryptography (PQC)?

A . DNS Security profile
B . Decryption policy
C . Security policy
D . Decryption profile

Reveal Solution Hide Solution

Question #28

Which subscription sends non-file format-based traffic that matches Data Filtering Profile criteria to a cloud service to render a verdict?

Enterprise DLP

A . SaaS Security Inline
B . Advanced URL Filtering
C . Advanced WildFire

Reveal Solution Hide Solution