Palo Alto Networks Network Security Professional (NetSec-Professional) - 340 Questions

1. A security engineer is designing a network access strategy for a financial institution. The CISO requires that no user or device is inherently trusted, even if they are already inside the corporate network. Which core principle best describes this requirement?

2. An organization currently uses traditional remote access VPN for all remote workers. The security team wants to migrate to a Zero Trust Network Access (ZTNA) model. What is the primary security advantage of ZTNA over a traditional VPN?

3. A network administrator is configuring a Palo Alto Networks NGFW and needs to understand which OSI layer is responsible for application identification. At which OSI layer does App-ID primarily operate to classify traffic?

4. A security analyst is reviewing the default security policy behavior in PAN-OS. A packet arrives on an interface in Zone A and is destined for an interface also in Zone A. What is the default PAN-OS behavior for this intrazone traffic?

5. A company is deploying a Palo Alto Networks NGFW and the firewall administrator needs to understand source NAT. The administrator wants all internal users (192.168.0.0/24) to share a single public IP address when accessing the internet. Which source NAT type should be configured?