Palo Alto Networks NetSec-Analyst Practice Test 87
Question 860
A network security analyst needs exactly TWO case-specific control steps. A busy web gateway's dataplane CPU is persistently high and application latency worsens, while management CPU looks normal. Which TWO actions directly belong to the safe diagnostic and remediation workflow? Select TWO answers.
- Alternative diagnostic: Check log forwarding buffer, connectivity, ingestion delays and local-versus-cloud timestamps.
- Collect evidence: Review dataplane CPU, session rate, traffic mix and the timing of inspection policy changes.
- Competing correction: Check physical interface counters, duplex, optics and link health before changing access controls.
- Alternative verification: Controlled peak traffic opens new approved connections without session-allocation failures.
- Apply correction: Investigate dataplane resource utilization and session inspection workload before tuning specific high-cost policies or capacity.
Explanation
Correct Answer
B:If confirmed, the narrowly scoped remedy is: Investigate dataplane resource utilization and session inspection workload before tuning specific high-cost policies or capacity. These checks distinguish the actual cause before changes are attempted.
E:Confirm its effect by checking: Review dataplane CPU, session rate, traffic mix and the timing of inspection policy changes. Dataplane saturation affects packet processing independently of management-plane responsiveness.
Incorrect Answers
A:This corresponds to a different condition: A branch sees delayed logs in SCM after a WAN outage, yet local traffic continues and logging queues grow. The current report has a distinct control gap; Dataplane saturation affects packet processing independently of management-plane responsiveness.
C:This corresponds to a different condition: A site shows packet drops and interface errors on one physical uplink despite normal App-ID and security policy hit counters. The directly relevant correction here is: Investigate dataplane resource utilization and session inspection workload before tuning specific high-cost policies or capacity.
D:This corresponds to a different condition: A transaction edge experiences drops as active sessions approach platform capacity during a seasonal traffic surge. The directly relevant correction here is: Investigate dataplane resource utilization and session inspection workload before tuning specific high-cost policies or capacity.
Question 861
An analyst must collect precise technical evidence before changing configuration. A busy web gateway's dataplane CPU is persistently high and application latency worsens, while management CPU looks normal. Which investigation would BEST isolate this specific mismatch? Select ONE best answer.
- Inspect CRC, drops, interface state, optical diagnostics and switch port counters.
- Inspect concurrent session count, session allocation failures, and new connection rates.
- Review dataplane CPU, session rate, traffic mix and the timing of inspection policy changes.
- Check log forwarding buffer, connectivity, ingestion delays and local-versus-cloud timestamps.
Explanation
Correct Answer
C:If confirmed, the narrowly scoped remedy is: Investigate dataplane resource utilization and session inspection workload before tuning specific high-cost policies or capacity. Dataplane saturation affects packet processing independently of management-plane responsiveness.
Incorrect Answers
A:This corresponds to a different condition: A site shows packet drops and interface errors on one physical uplink despite normal App-ID and security policy hit counters. The discriminating evidence is: Review dataplane CPU, session rate, traffic mix and the timing of inspection policy changes.
B:This corresponds to a different condition: A transaction edge experiences drops as active sessions approach platform capacity during a seasonal traffic surge. The discriminating evidence is: Review dataplane CPU, session rate, traffic mix and the timing of inspection policy changes.
D:This corresponds to a different condition: A branch sees delayed logs in SCM after a WAN outage, yet local traffic continues and logging queues grow. The directly relevant correction here is: Investigate dataplane resource utilization and session inspection workload before tuning specific high-cost policies or capacity.
Question 862
The approved controlled change was applied to this situation: A busy web gateway's dataplane CPU is persistently high and application latency worsens, while management CPU looks normal. The change was to investigate dataplane resource utilization and session inspection workload before tuning specific high-cost policies or capacity. Which verification result most directly demonstrates success? Select ONE best answer.
- After the targeted remediation, dataplane utilization and application latency improve under comparable load.
- Controlled peak traffic opens new approved connections without session-allocation failures.
- After cabling or optic remediation, interface errors stop increasing and the application becomes stable.
- Backlogged events catch up in Log Viewer and controlled new events arrive within expected latency.
Explanation
Correct Answer
A:This is the observable acceptance result for the exact reported problem. Dataplane saturation affects packet processing independently of management-plane responsiveness.
Incorrect Answers
B:This corresponds to a different condition: A transaction edge experiences drops as active sessions approach platform capacity during a seasonal traffic surge. Controlled peak traffic opens new approved connections without session-allocation failures.
C:This corresponds to a different condition: A site shows packet drops and interface errors on one physical uplink despite normal App-ID and security policy hit counters. After cabling or optic remediation, interface errors stop increasing and the application becomes stable.
D:This corresponds to a different condition: A branch sees delayed logs in SCM after a WAN outage, yet local traffic continues and logging queues grow. The discriminating evidence is: Review dataplane CPU, session rate, traffic mix and the timing of inspection policy changes.
Question 863
A supervisor is assessing the risks of a rushed remediation. A busy web gateway's dataplane CPU is persistently high and application latency worsens, while management CPU looks normal. Which proposed shortcut should the analyst REJECT as unsafe or ineffective? Select ONE best answer.
- Review dataplane CPU, session rate, traffic mix and the timing of inspection policy changes.
- Investigate dataplane resource utilization and session inspection workload before tuning specific high-cost policies or capacity.
- Reboot the management web UI repeatedly without examining packet-processing resource use.
- After the targeted remediation, dataplane utilization and application latency improve under comparable load.
Explanation
Correct Answer
C:This is the unsafe proposal in the stated scenario because it bypasses the control boundary. The analyst should inspect: Review dataplane CPU, session rate, traffic mix and the timing of inspection policy changes.
Incorrect Answers
A:This is a controlled and useful step for the described condition, not the unsafe shortcut. The shortcut to reject is: Reboot the management web UI repeatedly without examining packet-processing resource use.
B:This is a controlled and useful step for the described condition, not the unsafe shortcut. Dataplane saturation affects packet processing independently of management-plane responsiveness.
D:This is a controlled and useful step for the described condition, not the unsafe shortcut. After the targeted remediation, dataplane utilization and application latency improve under comparable load.
Question 864
A branch operations team must document a cause-based remediation with a measurable outcome. A busy web gateway's dataplane CPU is persistently high and application latency worsens, while management CPU looks normal. What is the BEST complete investigation–change–verification plan? Select ONE best answer.
- Investigate: Inspect concurrent session count, session allocation failures, and new connection rates. Correct: Assess session-table occupancy and new-session rates, then remove unnecessary load or plan appropriate scale and limits. Verify: Controlled peak traffic opens new approved connections without session-allocation failures.
- Investigate: Review dataplane CPU, session rate, traffic mix and the timing of inspection policy changes. Correct: Investigate dataplane resource utilization and session inspection workload before tuning specific high-cost policies or capacity. Verify: After the targeted remediation, dataplane utilization and application latency improve under comparable load.
- Investigate: Check log forwarding buffer, connectivity, ingestion delays and local-versus-cloud timestamps. Correct: Investigate log forwarding connectivity, queue/backlog and Strata Logging Service health before altering traffic permits. Verify: Backlogged events catch up in Log Viewer and controlled new events arrive within expected latency.
- Investigate: Inspect CRC, drops, interface state, optical diagnostics and switch port counters. Correct: Check physical interface counters, duplex, optics and link health before changing access controls. Verify: After cabling or optic remediation, interface errors stop increasing and the application becomes stable.
Explanation
Correct Answer
B:It avoids the unsupported shortcut: Reboot the management web UI repeatedly without examining packet-processing resource use.
Incorrect Answers
A:Inspect concurrent session count, session allocation failures, and new connection rates. Correct: Assess session-table occupancy and new-session rates, then remove unnecessary load or plan appropriate scale and limits. Verify: Controlled peak traffic opens new approved connections without session-allocation failures. This corresponds to a different condition: A transaction edge experiences drops as active sessions approach platform capacity during a seasonal traffic surge. The current report has a distinct control gap; Dataplane saturation affects packet processing independently of management-plane responsiveness. The directly relevant correction here is: Investigate dataplane resource utilization and session inspection workload before tuning specific high-cost policies or capacity. The discriminating evidence is: Review dataplane CPU, session rate, traffic mix and the timing of inspection policy changes.
C:Check log forwarding buffer, connectivity, ingestion delays and local-versus-cloud timestamps. Correct: Investigate log forwarding connectivity, queue/backlog and Strata Logging Service health before altering traffic permits. Verify: Backlogged events catch up in Log Viewer and controlled new events arrive within expected latency. This corresponds to a different condition: A branch sees delayed logs in SCM after a WAN outage, yet local traffic continues and logging queues grow. The current report has a distinct control gap; Dataplane saturation affects packet processing independently of management-plane responsiveness. The directly relevant correction here is: Investigate dataplane resource utilization and session inspection workload before tuning specific high-cost policies or capacity. The discriminating evidence is: Review dataplane CPU, session rate, traffic mix and the timing of inspection policy changes.
D:Inspect CRC, drops, interface state, optical diagnostics and switch port counters. Correct: Check physical interface counters, duplex, optics and link health before changing access controls. Verify: After cabling or optic remediation, interface errors stop increasing and the application becomes stable. This corresponds to a different condition: A site shows packet drops and interface errors on one physical uplink despite normal App-ID and security policy hit counters. The current report has a distinct control gap; Dataplane saturation affects packet processing independently of management-plane responsiveness. The directly relevant correction here is: Investigate dataplane resource utilization and session inspection workload before tuning specific high-cost policies or capacity. The discriminating evidence is: Review dataplane CPU, session rate, traffic mix and the timing of inspection policy changes.
Question 865
A transaction edge experiences drops as active sessions approach platform capacity during a seasonal traffic surge. The team is considering the shortcut: Disable stateful session tracking to mask a capacity warning. Which policy or object change DIRECTLY addresses the case? Select ONE best answer.
- Investigate log forwarding connectivity, queue/backlog and Strata Logging Service health before altering traffic permits.
- Assess session-table occupancy and new-session rates, then remove unnecessary load or plan appropriate scale and limits.
- Disable stateful session tracking to mask a capacity warning.
- Check physical interface counters, duplex, optics and link health before changing access controls.
Explanation
Correct Answer
B:Confirm its effect by checking: Inspect concurrent session count, session allocation failures, and new connection rates. This correction targets the observed gap rather than a neighboring symptom.
Incorrect Answers
A:This corresponds to a different condition: A branch sees delayed logs in SCM after a WAN outage, yet local traffic continues and logging queues grow. The current report has a distinct control gap; A full session table can prevent new connections even when existing sessions appear healthy.
C:Disable stateful session tracking to mask a capacity warning. This is the shortcut under scrutiny. In this case it fails because: A full session table can prevent new connections even when existing sessions appear healthy. A safe correction instead is: Assess session-table occupancy and new-session rates, then remove unnecessary load or plan appropriate scale and limits. Verify using: Inspect concurrent session count, session allocation failures, and new connection rates.
D:This corresponds to a different condition: A site shows packet drops and interface errors on one physical uplink despite normal App-ID and security policy hit counters. The current report has a distinct control gap; A full session table can prevent new connections even when existing sessions appear healthy.
Question 866
In a Palo Alto Networks configuration review, the following condition is reported: A transaction edge experiences drops as active sessions approach platform capacity during a seasonal traffic surge. The proposed correction is to assess session-table occupancy and new-session rates, then remove unnecessary load or plan appropriate scale and limits. Which technical principle BEST explains why this correction is appropriate? Select ONE best answer.
- A full session table can prevent new connections even when existing sessions appear healthy.
- A logging pipeline backlog is an observability impairment, not necessarily a security-rule block.
- Layer-1/2 faults can cause packet loss even when security rule matches are correct.
- Failover loops can result from health checks or resource issues that must be differentiated from ordinary session policy errors.
Explanation
Correct Answer
A:The validation result should be: Controlled peak traffic opens new approved connections without session-allocation failures.
Incorrect Answers
B:This corresponds to a different condition: A branch sees delayed logs in SCM after a WAN outage, yet local traffic continues and logging queues grow. The directly relevant correction here is: Assess session-table occupancy and new-session rates, then remove unnecessary load or plan appropriate scale and limits.
C:This corresponds to a different condition: A site shows packet drops and interface errors on one physical uplink despite normal App-ID and security policy hit counters. The directly relevant correction here is: Assess session-table occupancy and new-session rates, then remove unnecessary load or plan appropriate scale and limits.
D:This corresponds to a different condition: An HA firewall pair fails over repeatedly during peak load, disrupting long-lived sessions while both members show intermittent resource alarms. The directly relevant correction here is: Assess session-table occupancy and new-session rates, then remove unnecessary load or plan appropriate scale and limits.
Question 867
An analyst must collect precise technical evidence before changing configuration. A transaction edge experiences drops as active sessions approach platform capacity during a seasonal traffic surge. Which investigation would BEST isolate this specific mismatch? Select ONE best answer.
- Review HA state transitions, heartbeat loss logs, dataplane load and monitored-link events.
- Inspect concurrent session count, session allocation failures, and new connection rates.
- Check log forwarding buffer, connectivity, ingestion delays and local-versus-cloud timestamps.
- Inspect CRC, drops, interface state, optical diagnostics and switch port counters.
Explanation
Correct Answer
B:If confirmed, the narrowly scoped remedy is: Assess session-table occupancy and new-session rates, then remove unnecessary load or plan appropriate scale and limits. These checks distinguish the actual cause before changes are attempted.
Incorrect Answers
A:This corresponds to a different condition: An HA firewall pair fails over repeatedly during peak load, disrupting long-lived sessions while both members show intermittent resource alarms. The current report has a distinct control gap; A full session table can prevent new connections even when existing sessions appear healthy.
C:This corresponds to a different condition: A branch sees delayed logs in SCM after a WAN outage, yet local traffic continues and logging queues grow. Check log forwarding buffer, connectivity, ingestion delays and local-versus-cloud timestamps.
D:This corresponds to a different condition: A site shows packet drops and interface errors on one physical uplink despite normal App-ID and security policy hit counters. The discriminating evidence is: Inspect concurrent session count, session allocation failures, and new connection rates.
Question 868
The approved controlled change was applied to this situation: A transaction edge experiences drops as active sessions approach platform capacity during a seasonal traffic surge. The change was to assess session-table occupancy and new-session rates, then remove unnecessary load or plan appropriate scale and limits. Which verification result most directly demonstrates success? Select ONE best answer.
- The pair stabilizes under test and approved sessions survive normal HA operation within documented limits.
- Controlled peak traffic opens new approved connections without session-allocation failures.
- Backlogged events catch up in Log Viewer and controlled new events arrive within expected latency.
- After cabling or optic remediation, interface errors stop increasing and the application becomes stable.
Explanation
Correct Answer
B:A full session table can prevent new connections even when existing sessions appear healthy.
Incorrect Answers
A:This corresponds to a different condition: An HA firewall pair fails over repeatedly during peak load, disrupting long-lived sessions while both members show intermittent resource alarms. The pair stabilizes under test and approved sessions survive normal HA operation within documented limits.
C:This corresponds to a different condition: A branch sees delayed logs in SCM after a WAN outage, yet local traffic continues and logging queues grow. The discriminating evidence is: Inspect concurrent session count, session allocation failures, and new connection rates.
D:The directly relevant correction here is: Assess session-table occupancy and new-session rates, then remove unnecessary load or plan appropriate scale and limits.
Question 869
A supervisor is assessing the risks of a rushed remediation. A transaction edge experiences drops as active sessions approach platform capacity during a seasonal traffic surge. Which proposed shortcut should the analyst REJECT as unsafe or ineffective? Select ONE best answer.
- Controlled peak traffic opens new approved connections without session-allocation failures.
- Assess session-table occupancy and new-session rates, then remove unnecessary load or plan appropriate scale and limits.
- Disable stateful session tracking to mask a capacity warning.
- Inspect concurrent session count, session allocation failures, and new connection rates.
Explanation
Correct Answer
C:This is the unsafe proposal in the stated scenario because it bypasses the control boundary. The required principle is: A full session table can prevent new connections even when existing sessions appear healthy.
Incorrect Answers
A:This is a controlled and useful step for the described condition, not the unsafe shortcut. A full session table can prevent new connections even when existing sessions appear healthy.
B:This is a controlled and useful step for the described condition, not the unsafe shortcut. The shortcut to reject is: Disable stateful session tracking to mask a capacity warning.
D:This is a controlled and useful step for the described condition, not the unsafe shortcut. Inspect concurrent session count, session allocation failures, and new connection rates.
Question 870
A network security analyst needs exactly TWO case-specific control steps. A transaction edge experiences drops as active sessions approach platform capacity during a seasonal traffic surge. Which TWO actions directly belong to the safe diagnostic and remediation workflow? Select TWO answers.
- Alternative verification: After cabling or optic remediation, interface errors stop increasing and the application becomes stable.
- Apply correction: Assess session-table occupancy and new-session rates, then remove unnecessary load or plan appropriate scale and limits.
- Collect evidence: Inspect concurrent session count, session allocation failures, and new connection rates.
- Alternative diagnostic: Review HA state transitions, heartbeat loss logs, dataplane load and monitored-link events.
- Competing correction: Investigate log forwarding connectivity, queue/backlog and Strata Logging Service health before altering traffic permits.
Explanation
Correct Answer
B:Confirm its effect by checking: Inspect concurrent session count, session allocation failures, and new connection rates. A full session table can prevent new connections even when existing sessions appear healthy.
C:If confirmed, the narrowly scoped remedy is: Assess session-table occupancy and new-session rates, then remove unnecessary load or plan appropriate scale and limits. A full session table can prevent new connections even when existing sessions appear healthy.
Incorrect Answers
A:This corresponds to a different condition: A site shows packet drops and interface errors on one physical uplink despite normal App-ID and security policy hit counters. Alternative verification: After cabling or optic remediation, interface errors stop increasing and the application becomes stable.
D:This corresponds to a different condition: An HA firewall pair fails over repeatedly during peak load, disrupting long-lived sessions while both members show intermittent resource alarms. The discriminating evidence is: Inspect concurrent session count, session allocation failures, and new connection rates.
E:This corresponds to a different condition: A branch sees delayed logs in SCM after a WAN outage, yet local traffic continues and logging queues grow. Competing correction: Investigate log forwarding connectivity, queue/backlog and Strata Logging Service health before altering traffic permits.
