Skip to main content
ITPrepCerts
Login
Exams Free Samples About Contact
Login Create an account

NetSec-Analyst Palo Alto Networks Network Security Analyst

  • Palo Alto Networks
  • 5 free sample questions

About this exam

NetSec-Analyst is the Palo Alto Networks exam Palo Alto Networks Network Security Analyst. Paid practice material for this exam is not available yet, but you can try its free sample questions.

Exam code
NetSec-Analyst
Vendor
Palo Alto Networks
Practice questions
Not available yet
Free sample questions
5
Question bank last updated
Not available yet

Try 2 sample questions

Taken from the free sample set for NetSec-Analyst.

Question 1

An analyst is investigating why an App-ID for a custom application is showing as " unknown-tcp " in the Traffic logs. The application is running on port 8080. What is the most likely cause of this identification failure?

  1. Option A:
    The firewall does not have a signature for the proprietary application.
  2. Option B:
    The Security policy is set to " application-default."
  3. Option C:
    The traffic is being decrypted by an SSL Forward Proxy.
  4. Option D:
    The URL category is " private-ip-addresses. "
Show answer and explanation

Correct answer: A

Comprehensive and Detailed 150 to 250 words of Explanation From Palo Alto Networks Network Security Analyst Knowledge:
When traffic is logged as unknown-tcp or unknown-udp , it indicates that the App-ID engine has inspected the traffic but could not find a matching signature in its database. For proprietary or internal applications, this is the expected behavior unless the analyst has created a Custom Application Signature .
To resolve this, the analyst must capture the packet flow and identify a unique data pattern (signature) within the payload that identifies the application. Once the custom App-ID is created and committed, the firewall will correctly categorize the traffic, allowing the analyst to apply granular security profiles and reporting. Identifying and remediating " unknown " traffic is a key monitoring objective, as it helps eliminate visibility gaps and prevents malicious traffic from " hiding " behind unidentified protocols.

Question 2

An analyst needs to create a security rule to allow access to a specific web application that identifies itself as " web-browsing " but uses a custom, non-standard port of TCP 9000. Which configuration ensures the App-ID engine can still inspect this traffic?
  1. Option A:
    Change the Service to " application-default. "
  2. Option B:
    Create a custom Service object for TCP 9000 and use it in the rule.
  3. Option C:
    Use an Application Override rule for port 9000.
  4. Option D:
    Change the application to " any " and the service to TCP 9000.
Show answer and explanation

Correct answer: B

Comprehensive and Detailed 150 to 250 words of Explanation From Palo Alto Networks Network Security Analyst Knowledge:
In a Palo Alto Networks environment, the Service column in a security rule defines the destination port used for the initial session establishment. If an application like web-browsing (which typically uses TCP 80 or 443) is running on a non-standard port like TCP 9000 , the analyst must create a custom Service object for that port.
Using this custom service object in the security rule allows the session to be established on port 9000 while maintaining full App-ID inspection. This is critical because it allows the firewall to verify that the traffic is actually web-browsing and not a threat masquerading as a web service. Option A is incorrect because " application-default " would restrict the traffic to standard ports only. Option C (Application Override) is incorrect because it would disable Layer 7 inspection entirely, which is a significant security risk. By using a custom service with the correct App-ID, the analyst ensures that security remains granular and effective without disrupting non-standard business applications.
See all 5 free sample questions