Lab Exercises Security Profiles

A "Continue" action can be configured on the following Security Profiles:

• URL Filtering, File Blocking, and Data Filtering

• URL Filtering

• URL Filtering and Antivirus

• URL Filtering and File Blocking

Which Palo Alto Networks Next Generation Firewall URL Category Action sends a response page to the user's browser that prompts the user for the administrator-defined override password, and logs the action to the URL Filtering log?

• override

• continue

• block

• alert

Which three statements describe the operation of Security policy rules and Security Profiles? (Choose three.)

• Security Profiles are attached to Security policy rules.

• Security policy rules inspect but do not block traffic.

• Security Profiles should be used only on allowed traffic.

• Security policy rules can block or allow traffic.

• Security policy rules are attached to Security Profiles.

An administrator has been asked to configure a Palo Alto Networks NGFW to provide protection against worms and trojans.

Which Security Profile type will protect against worms and trojans?

• Anti-Spyware

• Instruction Prevention

• File Blocking

• Antivirus

An administrator receives a global notification for a new malware that infects hosts. The infection will result in the infected host attempting to contact and command-and-control (C2) server.

Which security profile components will detect and prevent this threat after the firewall's signature database has been updated?

• antivirus profile applied to outbound security policies

• data filtering profile applied to inbound security policies

• data filtering profile applied to outbound security policies

• vulnerability profile applied to inbound security policies

Answer explanation

PCNSA Study Guide pg. 41

Which two security profile types can be attached to a security policy? (Choose two.)

• antivirus

• DDoS protection

• threat

• vulnerability protection

The CFO found a malware infected USB drive in the parking lot, which when inserted infected their corporate laptop. The malware contacted a known command- and-control server, which caused the infected laptop to begin exfiltrating corporate data.

Which security profile feature could have been used to prevent the communication with the command-and-control server?

• Create an anti-spyware profile and enable DNS Sinkhole feature.

• Create an antivirus profile and enable its DNS Sinkhole feature.

• Create a URL filtering profile and block the DNS Sinkhole URL category

• Create a Data Filtering Profiles and enable its DNS Sinkhole feature.

Answer explanation

PCNSA Study Guide pg. 140

Which type of profile must be applied to the Security policy rule to protect against buffer overflows, illegal code execution, and other attempts to exploit system flaws?

• URL filtering

• vulnerability protection

• file blocking

• anti-spyware

Answer explanation

PCNSA Study Guide pg. 140

A firewall administrator has been asked to configure a Palo Alto Networks NGFW to prevent against compromised hosts trying to phone-home or beacon out to external command-and-control (C2) servers.

Which Security Profile type will prevent these behaviors?

• Anti-Spyware

• WildFire

• Vulnerability Protection

• Antivirus

Answer explanation

PCNSA Study Guide pg. 140

Which fields can be altered in the default Vulnerability profile?

• Severity

• Category

• None

• CVE