Free Palo Alto Networks Network Security Generalist Exam NetSec-Generalist Exam Practice Test

Which two policies in Strata Cloud Manager (SCM) will ensure the personal data of employees remains private while enabling decryption for mobile users in Prisma Access? (Choose two.)

• SSH Decryption
• SSL Inbound Inspection
• SSL Forward Proxy
• No Decryption

Which step is necessary to ensure an organization is using the inline cloud analysis features in its Advanced Threat Prevention subscription?

• Configure Advanced Threat Prevention profiles with default settings and only focus on high-risk traffic to avoid affecting network performance.
• Enable SSL decryption in Security policies to inspect and analyze encrypted traffic for threats.
• Update or create a new anti-spyware security profile and enable the appropriate local deep - learning models.
• Disable anti-spyware to avoid performance impacts and rely solely on external threat intelligence.

Which two tools can be used to configure Cloud NGFWs for AWS? (Choose two.)

• Cortex XSIAM
• Cloud service provider's management console
• Prisma Cloud management console
• Panorama

At a minimum, which action must be taken to ensure traffic coming from outside an organization to the DMZ can access the DMZ zone for a company using private IP address space?

• Configure static NAT for all incoming traffic.
• Create NAT policies on post-NAT addresses for all traffic destined for DMZ.
• Configure NAT policies on the pre-NAT addresses and post-NAT zone.
• Create policies only for pre-NAT addresses and any destination zone.

Which two security profiles must be updated to prevent data exfiltration in outbound traffic on NGFWs? (Choose two.)Data FilteringDoS ProtectionFile BlockingAntivirus

• Data Filtering
• ✅ C. File Blocking

After a Best Practice Assessment (BPA) is complete, it is determined that dynamic updates for Cloud- Delivered Security Services (CDSS) used by company branch offices do not match recommendations. The snippet used for dynamic updates is currently set to download and install updates weekly.Knowing these devices have the Precision Al bundle, which two statements describe how the settings need to be adjusted in the snippet? (Choose two.)

• Applications and threats should be updated daily.
• Antivirus should be updated daily.
• WildFire should be updated every five minutes.
• URL filtering should be updated hourly.

Which two cloud deployment high availability (HA) options would cause a firewall administrator to use Cloud NGFW? (Choose two.)Automated autoscalingTerraform to automate HADedicated vNIC for HADeployed with load balancers

• It helps automate HA configuration, but does not directly provide HA functionality.
• C . Dedicated vNIC for HA ❌
• Cloud NGFW does not use dedicated vNICs for HA—it relies on cloud-native failover mechanisms. Dedicated vNICs are more relevant for on-prem HA deployments.
• Reference to Firewall Deployment and Security Features:
• Firewall Deployment – Cloud NGFW supports HA through autoscaling and load balancing. Security Policies – Ensures policies remain enforced across dynamically scaled instances. VPN Configurations – Works with IPsec VPNs in cloud deployments.
• Threat Prevention – Maintains security inspection even during autoscaling events. WildFire Integration – Ensures malware inspection is consistently available.
• Zero Trust Architectures – Enforces Zero Trust security at scale.
• Thus, the correct answers are:
• ✅ A . Automated autoscaling
• ✅ D . Deployed with load balancers

When a firewall acts as an application-level gateway (ALG), what does it require in order to establish a connection?PinholeDynamic IP and Port (DIPP)Session Initiation Protocol (SIP)Payload

• Pinhole because it enables a firewall to establish application-layer connections securely while enforcing dynamic traffic filtering.

Which subscription sends non-file format-based traffic that matches Data Filtering Profile criteria to a cloud service to render a verdict?Enterprise DLPSaaS Security InlineAdvanced URL FilteringAdvanced WildFire

• Enterprise DLP

In Prisma SD-WAN. what is the recommended initial action when VoIP traffic experiences high latency and packet loss during business hours?

• Configure a new VPN gateway connection.
• Monitor real-time path performance metrics.
• Add new link tags to existing interfaces.
• Disable the most recently created path quality.