Palo Alto Networks NetSec-Analyst Practice Test 27
Question 260
A network security analyst needs exactly TWO case-specific control steps. A franchise has a backup MPLS circuit and a metered broadband link, but its SD-WAN policies distribute traffic equally despite cost constraints. Which TWO actions directly belong to the safe diagnostic and remediation workflow? Select TWO answers.
- Apply correction: Configure a Traffic Distribution profile expressing permitted path preferences and bind it to the appropriate application SD-WAN rules.
- Alternative diagnostic: Review packet-loss history, supported link-management profiles and the SD-WAN policy attachment.
- Alternative verification: The intended device receives the correct profile configuration without leaking branch policy to unrelated firewalls.
- Collect evidence: Inspect profile member priorities, link eligibility and matched application sessions during healthy and failed-link trials.
- Competing correction: Define SD-WAN traffic distribution and path quality behavior suitable for latency-sensitive voice and apply the matching policy.
Explanation
Correct Answer
A:Traffic distribution determines the preferred eligible path independently of the thresholds that judge link quality. The expected outcome is: Normal traffic follows the intended cost-aware preference while failover still works for approved applications.
D:Traffic distribution determines the preferred eligible path independently of the thresholds that judge link quality. These checks distinguish the actual cause before changes are attempted.
Incorrect Answers
B:This corresponds to a different condition: A rural WAN circuit has occasional high packet loss and the operator wants forward error handling for important transactions. The current report has a distinct control gap; Traffic distribution determines the preferred eligible path independently of the thresholds that judge link quality.
C:This corresponds to a different condition: An enterprise deploys SD-WAN profiles to a branch folder but a new firewall outside that folder does not inherit the templates. The directly relevant correction here is: Configure a Traffic Distribution profile expressing permitted path preferences and bind it to the appropriate application SD-WAN rules.
E:This corresponds to a different condition: A branch runs two internet transports, but voice traffic takes a congested default link even though a healthy backup link exists. The directly relevant correction here is: Configure a Traffic Distribution profile expressing permitted path preferences and bind it to the appropriate application SD-WAN rules.
Question 261
An analyst must collect precise technical evidence before changing configuration. A franchise has a backup MPLS circuit and a metered broadband link, but its SD-WAN policies distribute traffic equally despite cost constraints. Which investigation would BEST isolate this specific mismatch? Select ONE best answer.
- Review packet-loss history, supported link-management profiles and the SD-WAN policy attachment.
- Inspect SD-WAN rule match, transport quality metrics and current traffic-distribution selections.
- Check the branch folder membership, snippet/template scope, SD-WAN profile references and push status.
- Inspect profile member priorities, link eligibility and matched application sessions during healthy and failed-link trials.
Explanation
Correct Answer
D:Traffic distribution determines the preferred eligible path independently of the thresholds that judge link quality. Success is demonstrated when: Normal traffic follows the intended cost-aware preference while failover still works for approved applications.
Incorrect Answers
A:This corresponds to a different condition: A rural WAN circuit has occasional high packet loss and the operator wants forward error handling for important transactions. The directly relevant correction here is: Configure a Traffic Distribution profile expressing permitted path preferences and bind it to the appropriate application SD-WAN rules.
B:This corresponds to a different condition: A branch runs two internet transports, but voice traffic takes a congested default link even though a healthy backup link exists. The discriminating evidence is: Inspect profile member priorities, link eligibility and matched application sessions during healthy and failed-link trials.
C:This corresponds to a different condition: An enterprise deploys SD-WAN profiles to a branch folder but a new firewall outside that folder does not inherit the templates. The discriminating evidence is: Inspect profile member priorities, link eligibility and matched application sessions during healthy and failed-link trials.
Question 262
The approved controlled change was applied to this situation: A franchise has a backup MPLS circuit and a metered broadband link, but its SD-WAN policies distribute traffic equally despite cost constraints. The change was to configure a Traffic Distribution profile expressing permitted path preferences and bind it to the appropriate application SD-WAN rules. Which verification result most directly demonstrates success? Select ONE best answer.
- Normal traffic follows the intended cost-aware preference while failover still works for approved applications.
- Controlled loss tests improve successful delivery without unacceptable bandwidth overhead.
- The intended device receives the correct profile configuration without leaking branch policy to unrelated firewalls.
- New voice sessions select a qualified low-latency path when measured thresholds are exceeded.
Explanation
Correct Answer
A:Traffic distribution determines the preferred eligible path independently of the thresholds that judge link quality. This is the observable acceptance result for the exact reported problem.
Incorrect Answers
B:This corresponds to a different condition: A rural WAN circuit has occasional high packet loss and the operator wants forward error handling for important transactions. The discriminating evidence is: Inspect profile member priorities, link eligibility and matched application sessions during healthy and failed-link trials.
C:The current report has a distinct control gap; Traffic distribution determines the preferred eligible path independently of the thresholds that judge link quality.
D:This corresponds to a different condition: A branch runs two internet transports, but voice traffic takes a congested default link even though a healthy backup link exists. New voice sessions select a qualified low-latency path when measured thresholds are exceeded.
Question 263
A supervisor is assessing the risks of a rushed remediation. A franchise has a backup MPLS circuit and a metered broadband link, but its SD-WAN policies distribute traffic equally despite cost constraints. Which proposed shortcut should the analyst REJECT as unsafe or ineffective? Select ONE best answer.
- Configure a Traffic Distribution profile expressing permitted path preferences and bind it to the appropriate application SD-WAN rules.
- Inspect profile member priorities, link eligibility and matched application sessions during healthy and failed-link trials.
- Normal traffic follows the intended cost-aware preference while failover still works for approved applications.
- Remove all health checks so a low-cost but failed link remains preferred forever.
Explanation
Correct Answer
D:This is the unsafe proposal in the stated scenario because it bypasses the control boundary. The required principle is: Traffic distribution determines the preferred eligible path independently of the thresholds that judge link quality.
Incorrect Answers
A:This is a controlled and useful step for the described condition, not the unsafe shortcut. The shortcut to reject is: Remove all health checks so a low-cost but failed link remains preferred forever.
B:This is a controlled and useful step for the described condition, not the unsafe shortcut. Traffic distribution determines the preferred eligible path independently of the thresholds that judge link quality.
C:This is a controlled and useful step for the described condition, not the unsafe shortcut. Normal traffic follows the intended cost-aware preference while failover still works for approved applications.
Question 264
A branch operations team must document a cause-based remediation with a measurable outcome. A franchise has a backup MPLS circuit and a metered broadband link, but its SD-WAN policies distribute traffic equally despite cost constraints. What is the BEST complete investigation–change–verification plan? Select ONE best answer.
- Investigate: Inspect profile member priorities, link eligibility and matched application sessions during healthy and failed-link trials. Correct: Configure a Traffic Distribution profile expressing permitted path preferences and bind it to the appropriate application SD-WAN rules. Verify: Normal traffic follows the intended cost-aware preference while failover still works for approved applications.
- Investigate: Inspect SD-WAN rule match, transport quality metrics and current traffic-distribution selections. Correct: Define SD-WAN traffic distribution and path quality behavior suitable for latency-sensitive voice and apply the matching policy. Verify: New voice sessions select a qualified low-latency path when measured thresholds are exceeded.
- Investigate: Review packet-loss history, supported link-management profiles and the SD-WAN policy attachment. Correct: Configure a supported SD-WAN Error Correction profile for the affected traffic and link it via policy after assessing tradeoffs. Verify: Controlled loss tests improve successful delivery without unacceptable bandwidth overhead.
- Investigate: Check the branch folder membership, snippet/template scope, SD-WAN profile references and push status. Correct: Place the approved SD-WAN link-management and policy templates in the correct target scope, verify device association and push. Verify: The intended device receives the correct profile configuration without leaking branch policy to unrelated firewalls.
Explanation
Correct Answer
A:Traffic distribution determines the preferred eligible path independently of the thresholds that judge link quality. It avoids the unsupported shortcut: Remove all health checks so a low-cost but failed link remains preferred forever.
Incorrect Answers
B:Inspect SD-WAN rule match, transport quality metrics and current traffic-distribution selections. Correct: Define SD-WAN traffic distribution and path quality behavior suitable for latency-sensitive voice and apply the matching policy. Verify: New voice sessions select a qualified low-latency path when measured thresholds are exceeded. This corresponds to a different condition: A branch runs two internet transports, but voice traffic takes a congested default link even though a healthy backup link exists. The current report has a distinct control gap; Traffic distribution determines the preferred eligible path independently of the thresholds that judge link quality. The directly relevant correction here is: Configure a Traffic Distribution profile expressing permitted path preferences and bind it to the appropriate application SD-WAN rules. The discriminating evidence is: Inspect profile member priorities, link eligibility and matched application sessions during healthy and failed-link trials.
C:Review packet-loss history, supported link-management profiles and the SD-WAN policy attachment. Correct: Configure a supported SD-WAN Error Correction profile for the affected traffic and link it via policy after assessing tradeoffs. Verify: Controlled loss tests improve successful delivery without unacceptable bandwidth overhead. This corresponds to a different condition: A rural WAN circuit has occasional high packet loss and the operator wants forward error handling for important transactions. The current report has a distinct control gap; Traffic distribution determines the preferred eligible path independently of the thresholds that judge link quality. The directly relevant correction here is: Configure a Traffic Distribution profile expressing permitted path preferences and bind it to the appropriate application SD-WAN rules. The discriminating evidence is: Inspect profile member priorities, link eligibility and matched application sessions during healthy and failed-link trials.
D:Check the branch folder membership, snippet/template scope, SD-WAN profile references and push status. Correct: Place the approved SD-WAN link-management and policy templates in the correct target scope, verify device association and push. Verify: The intended device receives the correct profile configuration without leaking branch policy to unrelated firewalls. This corresponds to a different condition: An enterprise deploys SD-WAN profiles to a branch folder but a new firewall outside that folder does not inherit the templates. The current report has a distinct control gap; Traffic distribution determines the preferred eligible path independently of the thresholds that judge link quality. The directly relevant correction here is: Configure a Traffic Distribution profile expressing permitted path preferences and bind it to the appropriate application SD-WAN rules. The discriminating evidence is: Inspect profile member priorities, link eligibility and matched application sessions during healthy and failed-link trials.
Question 265
An enterprise deploys SD-WAN profiles to a branch folder but a new firewall outside that folder does not inherit the templates. The team is considering the shortcut: Apply the branch-specific transport configuration to all global firewalls just to make the missing device see it. Which policy or object change DIRECTLY addresses the case? Select ONE best answer.
- Place the approved SD-WAN link-management and policy templates in the correct target scope, verify device association and push.
- Apply the branch-specific transport configuration to all global firewalls just to make the missing device see it.
- Configure a supported SD-WAN Error Correction profile for the affected traffic and link it via policy after assessing tradeoffs.
- Define SD-WAN traffic distribution and path quality behavior suitable for latency-sensitive voice and apply the matching policy.
Explanation
Correct Answer
A:The expected outcome is: The intended device receives the correct profile configuration without leaking branch policy to unrelated firewalls. This correction targets the observed gap rather than a neighboring symptom.
Incorrect Answers
B:That option would apply the branch-specific transport configuration to all global firewalls just to make the missing device see it, but it addresses a different concern. This correction targets the observed gap rather than a neighboring symptom.
C:This corresponds to a different condition: A rural WAN circuit has occasional high packet loss and the operator wants forward error handling for important transactions. The current report has a distinct control gap; Reusable SD-WAN profiles and templates must be present in the device's applicable configuration scope.
D:This corresponds to a different condition: A branch runs two internet transports, but voice traffic takes a congested default link even though a healthy backup link exists. The current report has a distinct control gap; Reusable SD-WAN profiles and templates must be present in the device's applicable configuration scope.
Question 266
In a Palo Alto Networks configuration review, the following condition is reported: An enterprise deploys SD-WAN profiles to a branch folder but a new firewall outside that folder does not inherit the templates. The proposed correction is to place the approved SD-WAN link-management and policy templates in the correct target scope, verify device association and push. Which technical principle BEST explains why this correction is appropriate? Select ONE best answer.
- Error correction can improve reliability under certain loss conditions but introduces bandwidth or processing costs.
- Reusable SD-WAN profiles and templates must be present in the device's applicable configuration scope.
- Application-specific path-quality thresholds identify degraded links for traffic whose quality is sensitive to delay or loss.
- SD-WAN steers matching sessions according to path health and distribution rules rather than relying solely on a static default route.
Explanation
Correct Answer
B:The validation result should be: The intended device receives the correct profile configuration without leaking branch policy to unrelated firewalls.
Incorrect Answers
A:This corresponds to a different condition: A rural WAN circuit has occasional high packet loss and the operator wants forward error handling for important transactions. The directly relevant correction here is: Place the approved SD-WAN link-management and policy templates in the correct target scope, verify device association and push.
C:This corresponds to a different condition: A branch video-conferencing policy uses generic quality limits, failing to distinguish interactive sessions from large overnight transfers. The current report has a distinct control gap; Reusable SD-WAN profiles and templates must be present in the device's applicable configuration scope.
D:This corresponds to a different condition: A branch runs two internet transports, but voice traffic takes a congested default link even though a healthy backup link exists. The directly relevant correction here is: Place the approved SD-WAN link-management and policy templates in the correct target scope, verify device association and push.
Question 267
An analyst must collect precise technical evidence before changing configuration. An enterprise deploys SD-WAN profiles to a branch folder but a new firewall outside that folder does not inherit the templates. Which investigation would BEST isolate this specific mismatch? Select ONE best answer.
- Check the branch folder membership, snippet/template scope, SD-WAN profile references and push status.
- Review packet-loss history, supported link-management profiles and the SD-WAN policy attachment.
- Compare measured latency, jitter and loss against the configured thresholds and SD-WAN rule matches.
- Inspect SD-WAN rule match, transport quality metrics and current traffic-distribution selections.
Explanation
Correct Answer
A:Success is demonstrated when: The intended device receives the correct profile configuration without leaking branch policy to unrelated firewalls. These checks distinguish the actual cause before changes are attempted.
Incorrect Answers
B:This corresponds to a different condition: A rural WAN circuit has occasional high packet loss and the operator wants forward error handling for important transactions. The discriminating evidence is: Check the branch folder membership, snippet/template scope, SD-WAN profile references and push status.
C:This corresponds to a different condition: A branch video-conferencing policy uses generic quality limits, failing to distinguish interactive sessions from large overnight transfers. The directly relevant correction here is: Place the approved SD-WAN link-management and policy templates in the correct target scope, verify device association and push.
D:This corresponds to a different condition: A branch runs two internet transports, but voice traffic takes a congested default link even though a healthy backup link exists. The discriminating evidence is: Check the branch folder membership, snippet/template scope, SD-WAN profile references and push status.
Question 268
The approved controlled change was applied to this situation: An enterprise deploys SD-WAN profiles to a branch folder but a new firewall outside that folder does not inherit the templates. The change was to place the approved SD-WAN link-management and policy templates in the correct target scope, verify device association and push. Which verification result most directly demonstrates success? Select ONE best answer.
- Video sessions fail over when an applicable threshold is exceeded while the bulk-transfer policy remains distinct.
- New voice sessions select a qualified low-latency path when measured thresholds are exceeded.
- Controlled loss tests improve successful delivery without unacceptable bandwidth overhead.
- The intended device receives the correct profile configuration without leaking branch policy to unrelated firewalls.
Explanation
Correct Answer
D:Reusable SD-WAN profiles and templates must be present in the device's applicable configuration scope.
Incorrect Answers
A:This corresponds to a different condition: A branch video-conferencing policy uses generic quality limits, failing to distinguish interactive sessions from large overnight transfers. The discriminating evidence is: Check the branch folder membership, snippet/template scope, SD-WAN profile references and push status.
B:The current report has a distinct control gap; Reusable SD-WAN profiles and templates must be present in the device's applicable configuration scope.
C:The directly relevant correction here is: Place the approved SD-WAN link-management and policy templates in the correct target scope, verify device association and push.
Question 269
A supervisor is assessing the risks of a rushed remediation. An enterprise deploys SD-WAN profiles to a branch folder but a new firewall outside that folder does not inherit the templates. Which proposed shortcut should the analyst REJECT as unsafe or ineffective? Select ONE best answer.
- Place the approved SD-WAN link-management and policy templates in the correct target scope, verify device association and push.
- Check the branch folder membership, snippet/template scope, SD-WAN profile references and push status.
- The intended device receives the correct profile configuration without leaking branch policy to unrelated firewalls.
- Apply the branch-specific transport configuration to all global firewalls just to make the missing device see it.
Explanation
Correct Answer
D:This is the unsafe proposal in the stated scenario because it bypasses the control boundary. The required principle is: Reusable SD-WAN profiles and templates must be present in the device's applicable configuration scope.
Incorrect Answers
A:This is a controlled and useful step for the described condition, not the unsafe shortcut. Reusable SD-WAN profiles and templates must be present in the device's applicable configuration scope.
B:This is a controlled and useful step for the described condition, not the unsafe shortcut. The shortcut to reject is: Apply the branch-specific transport configuration to all global firewalls just to make the missing device see it.
C:This is a controlled and useful step for the described condition, not the unsafe shortcut. The intended device receives the correct profile configuration without leaking branch policy to unrelated firewalls.
Question 270
A network security analyst needs exactly TWO case-specific control steps. An enterprise deploys SD-WAN profiles to a branch folder but a new firewall outside that folder does not inherit the templates. Which TWO actions directly belong to the safe diagnostic and remediation workflow? Select TWO answers.
- Alternative verification: New voice sessions select a qualified low-latency path when measured thresholds are exceeded.
- Apply correction: Place the approved SD-WAN link-management and policy templates in the correct target scope, verify device association and push.
- Competing correction: Configure a supported SD-WAN Error Correction profile for the affected traffic and link it via policy after assessing tradeoffs.
- Alternative diagnostic: Compare measured latency, jitter and loss against the configured thresholds and SD-WAN rule matches.
- Collect evidence: Check the branch folder membership, snippet/template scope, SD-WAN profile references and push status.
Explanation
Correct Answer
B:The expected outcome is: The intended device receives the correct profile configuration without leaking branch policy to unrelated firewalls. Reusable SD-WAN profiles and templates must be present in the device's applicable configuration scope.
E:Success is demonstrated when: The intended device receives the correct profile configuration without leaking branch policy to unrelated firewalls. Reusable SD-WAN profiles and templates must be present in the device's applicable configuration scope.
Incorrect Answers
A:This corresponds to a different condition: A branch runs two internet transports, but voice traffic takes a congested default link even though a healthy backup link exists. Alternative verification: New voice sessions select a qualified low-latency path when measured thresholds are exceeded.
C:This corresponds to a different condition: A rural WAN circuit has occasional high packet loss and the operator wants forward error handling for important transactions. Competing correction: Configure a supported SD-WAN Error Correction profile for the affected traffic and link it via policy after assessing tradeoffs.
D:This corresponds to a different condition: A branch video-conferencing policy uses generic quality limits, failing to distinguish interactive sessions from large overnight transfers. Alternative diagnostic: Compare measured latency, jitter and loss against the configured thresholds and SD-WAN rule matches.