Palo Alto Networks NetSec-Analyst Practice Test 90
Question 890
A network security analyst needs exactly TWO case-specific control steps. A branch's real-time video session intermittently stalls only when packet loss spikes on its primary ISP transport. Which TWO actions directly belong to the safe diagnostic and remediation workflow? Select TWO answers.
- Alternative verification: The affected device maintains stable resources while required high-risk traffic remains inspected.
- Apply correction: Compare SD-WAN link health, path-quality thresholds and transport errors, then apply a controlled failover correction.
- Collect evidence: Inspect per-link loss, jitter and latency trends, SD-WAN policy match and selected transport.
- Competing correction: Investigate dataplane resource utilization and session inspection workload before tuning specific high-cost policies or capacity.
- Alternative diagnostic: Inspect concurrent session count, session allocation failures, and new connection rates.
Explanation
Correct Answer
B:Confirm its effect by checking: Inspect per-link loss, jitter and latency trends, SD-WAN policy match and selected transport. Transport degradation can violate application SLA without causing a complete physical link-down event.
C:If confirmed, the narrowly scoped remedy is: Compare SD-WAN link health, path-quality thresholds and transport errors, then apply a controlled failover correction. These checks distinguish the actual cause before changes are attempted.
Incorrect Answers
A:This corresponds to a different condition: A WAN appliance reports memory pressure and connection failures after a logging or inspection policy expansion across all branch devices. The directly relevant correction here is: Compare SD-WAN link health, path-quality thresholds and transport errors, then apply a controlled failover correction.
D:This corresponds to a different condition: A busy web gateway's dataplane CPU is persistently high and application latency worsens, while management CPU looks normal. The directly relevant correction here is: Compare SD-WAN link health, path-quality thresholds and transport errors, then apply a controlled failover correction.
E:This corresponds to a different condition: A transaction edge experiences drops as active sessions approach platform capacity during a seasonal traffic surge. The current report has a distinct control gap; Transport degradation can violate application SLA without causing a complete physical link-down event.
Question 891
An analyst must collect precise technical evidence before changing configuration. A branch's real-time video session intermittently stalls only when packet loss spikes on its primary ISP transport. Which investigation would BEST isolate this specific mismatch? Select ONE best answer.
- Inspect per-link loss, jitter and latency trends, SD-WAN policy match and selected transport.
- Inspect concurrent session count, session allocation failures, and new connection rates.
- Review dataplane CPU, session rate, traffic mix and the timing of inspection policy changes.
- Review memory usage, packet buffers, inspection profile cost and push history.
Explanation
Correct Answer
A:If confirmed, the narrowly scoped remedy is: Compare SD-WAN link health, path-quality thresholds and transport errors, then apply a controlled failover correction. Transport degradation can violate application SLA without causing a complete physical link-down event.
Incorrect Answers
B:This corresponds to a different condition: A transaction edge experiences drops as active sessions approach platform capacity during a seasonal traffic surge. The directly relevant correction here is: Compare SD-WAN link health, path-quality thresholds and transport errors, then apply a controlled failover correction.
C:This corresponds to a different condition: A busy web gateway's dataplane CPU is persistently high and application latency worsens, while management CPU looks normal. Review dataplane CPU, session rate, traffic mix and the timing of inspection policy changes.
D:This corresponds to a different condition: A WAN appliance reports memory pressure and connection failures after a logging or inspection policy expansion across all branch devices. The discriminating evidence is: Inspect per-link loss, jitter and latency trends, SD-WAN policy match and selected transport.
Question 892
The approved controlled change was applied to this situation: A branch's real-time video session intermittently stalls only when packet loss spikes on its primary ISP transport. The change was to compare SD-WAN link health, path-quality thresholds and transport errors, then apply a controlled failover correction. Which verification result most directly demonstrates success? Select ONE best answer.
- Controlled peak traffic opens new approved connections without session-allocation failures.
- After the targeted remediation, dataplane utilization and application latency improve under comparable load.
- The affected device maintains stable resources while required high-risk traffic remains inspected.
- New test sessions use a qualified path during induced loss and video quality stabilizes.
Explanation
Correct Answer
D:Transport degradation can violate application SLA without causing a complete physical link-down event.
Incorrect Answers
A:This corresponds to a different condition: A transaction edge experiences drops as active sessions approach platform capacity during a seasonal traffic surge. The discriminating evidence is: Inspect per-link loss, jitter and latency trends, SD-WAN policy match and selected transport.
B:This corresponds to a different condition: A busy web gateway's dataplane CPU is persistently high and application latency worsens, while management CPU looks normal. The discriminating evidence is: Inspect per-link loss, jitter and latency trends, SD-WAN policy match and selected transport.
C:The current report has a distinct control gap; Transport degradation can violate application SLA without causing a complete physical link-down event.
Question 893
A supervisor is assessing the risks of a rushed remediation. A branch's real-time video session intermittently stalls only when packet loss spikes on its primary ISP transport. Which proposed shortcut should the analyst REJECT as unsafe or ineffective? Select ONE best answer.
- Compare SD-WAN link health, path-quality thresholds and transport errors, then apply a controlled failover correction.
- Inspect per-link loss, jitter and latency trends, SD-WAN policy match and selected transport.
- New test sessions use a qualified path during induced loss and video quality stabilizes.
- Change the application Security rule to allow every service rather than addressing WAN quality.
Explanation
Correct Answer
D:This is the unsafe proposal in the stated scenario because it bypasses the control boundary. The required principle is: Transport degradation can violate application SLA without causing a complete physical link-down event.
Incorrect Answers
A:This is a controlled and useful step for the described condition, not the unsafe shortcut. The shortcut to reject is: Change the application Security rule to allow every service rather than addressing WAN quality.
B:This is a controlled and useful step for the described condition, not the unsafe shortcut. Transport degradation can violate application SLA without causing a complete physical link-down event.
C:This is a controlled and useful step for the described condition, not the unsafe shortcut. New test sessions use a qualified path during induced loss and video quality stabilizes.
Question 894
A branch operations team must document a cause-based remediation with a measurable outcome. A branch's real-time video session intermittently stalls only when packet loss spikes on its primary ISP transport. What is the BEST complete investigation–change–verification plan? Select ONE best answer.
- Investigate: Inspect concurrent session count, session allocation failures, and new connection rates. Correct: Assess session-table occupancy and new-session rates, then remove unnecessary load or plan appropriate scale and limits. Verify: Controlled peak traffic opens new approved connections without session-allocation failures.
- Investigate: Review memory usage, packet buffers, inspection profile cost and push history. Correct: Correlate memory/session/resource changes with the deployed inspection policy and right-size or scope the costly control. Verify: The affected device maintains stable resources while required high-risk traffic remains inspected.
- Investigate: Review dataplane CPU, session rate, traffic mix and the timing of inspection policy changes. Correct: Investigate dataplane resource utilization and session inspection workload before tuning specific high-cost policies or capacity. Verify: After the targeted remediation, dataplane utilization and application latency improve under comparable load.
- Investigate: Inspect per-link loss, jitter and latency trends, SD-WAN policy match and selected transport. Correct: Compare SD-WAN link health, path-quality thresholds and transport errors, then apply a controlled failover correction. Verify: New test sessions use a qualified path during induced loss and video quality stabilizes.
Explanation
Correct Answer
D:It avoids the unsupported shortcut: Change the application Security rule to allow every service rather than addressing WAN quality.
Incorrect Answers
A:Inspect concurrent session count, session allocation failures, and new connection rates. Correct: Assess session-table occupancy and new-session rates, then remove unnecessary load or plan appropriate scale and limits. Verify: Controlled peak traffic opens new approved connections without session-allocation failures. This corresponds to a different condition: A transaction edge experiences drops as active sessions approach platform capacity during a seasonal traffic surge. The current report has a distinct control gap; Transport degradation can violate application SLA without causing a complete physical link-down event. The directly relevant correction here is: Compare SD-WAN link health, path-quality thresholds and transport errors, then apply a controlled failover correction. The discriminating evidence is: Inspect per-link loss, jitter and latency trends, SD-WAN policy match and selected transport.
B:Review memory usage, packet buffers, inspection profile cost and push history. Correct: Correlate memory/session/resource changes with the deployed inspection policy and right-size or scope the costly control. Verify: The affected device maintains stable resources while required high-risk traffic remains inspected. This corresponds to a different condition: A WAN appliance reports memory pressure and connection failures after a logging or inspection policy expansion across all branch devices. The current report has a distinct control gap; Transport degradation can violate application SLA without causing a complete physical link-down event. The directly relevant correction here is: Compare SD-WAN link health, path-quality thresholds and transport errors, then apply a controlled failover correction. The discriminating evidence is: Inspect per-link loss, jitter and latency trends, SD-WAN policy match and selected transport.
C:Review dataplane CPU, session rate, traffic mix and the timing of inspection policy changes. Correct: Investigate dataplane resource utilization and session inspection workload before tuning specific high-cost policies or capacity. Verify: After the targeted remediation, dataplane utilization and application latency improve under comparable load. This corresponds to a different condition: A busy web gateway's dataplane CPU is persistently high and application latency worsens, while management CPU looks normal. The current report has a distinct control gap; Transport degradation can violate application SLA without causing a complete physical link-down event. The directly relevant correction here is: Compare SD-WAN link health, path-quality thresholds and transport errors, then apply a controlled failover correction. The discriminating evidence is: Inspect per-link loss, jitter and latency trends, SD-WAN policy match and selected transport.
Question 895
A WAN appliance reports memory pressure and connection failures after a logging or inspection policy expansion across all branch devices. The team is considering the shortcut: Disable every security profile across the whole organization to recover memory on one branch. Which policy or object change DIRECTLY addresses the case? Select ONE best answer.
- Correlate memory/session/resource changes with the deployed inspection policy and right-size or scope the costly control.
- Disable every security profile across the whole organization to recover memory on one branch.
- Investigate dataplane resource utilization and session inspection workload before tuning specific high-cost policies or capacity.
- Assess session-table occupancy and new-session rates, then remove unnecessary load or plan appropriate scale and limits.
Explanation
Correct Answer
A:Operational capacity and policy changes must be evaluated together; a feature can be valid yet overloaded on a particular platform. This correction targets the observed gap rather than a neighboring symptom.
Incorrect Answers
B:That option would disable every security profile across the whole organization to recover memory on one branch, but it addresses a different concern. This correction targets the observed gap rather than a neighboring symptom.
C:This corresponds to a different condition: A busy web gateway's dataplane CPU is persistently high and application latency worsens, while management CPU looks normal. The current report has a distinct control gap; Operational capacity and policy changes must be evaluated together; a feature can be valid yet overloaded on a particular platform.
D:This corresponds to a different condition: A transaction edge experiences drops as active sessions approach platform capacity during a seasonal traffic surge. The current report has a distinct control gap; Operational capacity and policy changes must be evaluated together; a feature can be valid yet overloaded on a particular platform.
Question 896
In a Palo Alto Networks configuration review, the following condition is reported: A WAN appliance reports memory pressure and connection failures after a logging or inspection policy expansion across all branch devices. The proposed correction is to correlate memory/session/resource changes with the deployed inspection policy and right-size or scope the costly control. Which technical principle BEST explains why this correction is appropriate? Select ONE best answer.
- Operational capacity and policy changes must be evaluated together; a feature can be valid yet overloaded on a particular platform.
- Layer-1/2 faults can cause packet loss even when security rule matches are correct.
- Dataplane saturation affects packet processing independently of management-plane responsiveness.
- A full session table can prevent new connections even when existing sessions appear healthy.
Explanation
Correct Answer
A:The validation result should be: The affected device maintains stable resources while required high-risk traffic remains inspected.
Incorrect Answers
B:This corresponds to a different condition: A site shows packet drops and interface errors on one physical uplink despite normal App-ID and security policy hit counters. The directly relevant correction here is: Correlate memory/session/resource changes with the deployed inspection policy and right-size or scope the costly control.
C:This corresponds to a different condition: A busy web gateway's dataplane CPU is persistently high and application latency worsens, while management CPU looks normal. The directly relevant correction here is: Correlate memory/session/resource changes with the deployed inspection policy and right-size or scope the costly control.
D:This corresponds to a different condition: A transaction edge experiences drops as active sessions approach platform capacity during a seasonal traffic surge. The directly relevant correction here is: Correlate memory/session/resource changes with the deployed inspection policy and right-size or scope the costly control.
Question 897
An analyst must collect precise technical evidence before changing configuration. A WAN appliance reports memory pressure and connection failures after a logging or inspection policy expansion across all branch devices. Which investigation would BEST isolate this specific mismatch? Select ONE best answer.
- Review dataplane CPU, session rate, traffic mix and the timing of inspection policy changes.
- Review memory usage, packet buffers, inspection profile cost and push history.
- Inspect concurrent session count, session allocation failures, and new connection rates.
- Inspect CRC, drops, interface state, optical diagnostics and switch port counters.
Explanation
Correct Answer
B:Operational capacity and policy changes must be evaluated together; a feature can be valid yet overloaded on a particular platform. These checks distinguish the actual cause before changes are attempted.
Incorrect Answers
A:This corresponds to a different condition: A busy web gateway's dataplane CPU is persistently high and application latency worsens, while management CPU looks normal. The discriminating evidence is: Review memory usage, packet buffers, inspection profile cost and push history.
C:This corresponds to a different condition: A transaction edge experiences drops as active sessions approach platform capacity during a seasonal traffic surge. The discriminating evidence is: Review memory usage, packet buffers, inspection profile cost and push history.
D:This corresponds to a different condition: A site shows packet drops and interface errors on one physical uplink despite normal App-ID and security policy hit counters. The current report has a distinct control gap; Operational capacity and policy changes must be evaluated together; a feature can be valid yet overloaded on a particular platform.
Question 898
The approved controlled change was applied to this situation: A WAN appliance reports memory pressure and connection failures after a logging or inspection policy expansion across all branch devices. The change was to correlate memory/session/resource changes with the deployed inspection policy and right-size or scope the costly control. Which verification result most directly demonstrates success? Select ONE best answer.
- Controlled peak traffic opens new approved connections without session-allocation failures.
- After cabling or optic remediation, interface errors stop increasing and the application becomes stable.
- After the targeted remediation, dataplane utilization and application latency improve under comparable load.
- The affected device maintains stable resources while required high-risk traffic remains inspected.
Explanation
Correct Answer
D:Operational capacity and policy changes must be evaluated together; a feature can be valid yet overloaded on a particular platform. This is the observable acceptance result for the exact reported problem.
Incorrect Answers
A:The directly relevant correction here is: Correlate memory/session/resource changes with the deployed inspection policy and right-size or scope the costly control.
B:This corresponds to a different condition: A site shows packet drops and interface errors on one physical uplink despite normal App-ID and security policy hit counters. The discriminating evidence is: Review memory usage, packet buffers, inspection profile cost and push history.
C:This corresponds to a different condition: A busy web gateway's dataplane CPU is persistently high and application latency worsens, while management CPU looks normal. After the targeted remediation, dataplane utilization and application latency improve under comparable load.
Question 899
A supervisor is assessing the risks of a rushed remediation. A WAN appliance reports memory pressure and connection failures after a logging or inspection policy expansion across all branch devices. Which proposed shortcut should the analyst REJECT as unsafe or ineffective? Select ONE best answer.
- The affected device maintains stable resources while required high-risk traffic remains inspected.
- Review memory usage, packet buffers, inspection profile cost and push history.
- Disable every security profile across the whole organization to recover memory on one branch.
- Correlate memory/session/resource changes with the deployed inspection policy and right-size or scope the costly control.
Explanation
Correct Answer
C:This is the unsafe proposal in the stated scenario because it bypasses the control boundary. The required principle is: Operational capacity and policy changes must be evaluated together; a feature can be valid yet overloaded on a particular platform.
Incorrect Answers
A:This is a controlled and useful step for the described condition, not the unsafe shortcut. Operational capacity and policy changes must be evaluated together; a feature can be valid yet overloaded on a particular platform.
B:This is a controlled and useful step for the described condition, not the unsafe shortcut. The shortcut to reject is: Disable every security profile across the whole organization to recover memory on one branch.
D:This is a controlled and useful step for the described condition, not the unsafe shortcut. Correlate memory/session/resource changes with the deployed inspection policy and right-size or scope the costly control.
Question 900
A controlled network security change requires exactly THREE documented actions. A WAN appliance reports memory pressure and connection failures after a logging or inspection policy expansion across all branch devices. Which THREE elements are the necessary diagnosis, correction and proof of success? Select THREE answers.
- Diagnose: Review memory usage, packet buffers, inspection profile cost and push history.
- Alternative diagnostic: Inspect concurrent session count, session allocation failures, and new connection rates.
- Prove: The affected device maintains stable resources while required high-risk traffic remains inspected.
- Correct: Correlate memory/session/resource changes with the deployed inspection policy and right-size or scope the costly control.
- Alternative verification: After cabling or optic remediation, interface errors stop increasing and the application becomes stable.
- Competing correction: Investigate dataplane resource utilization and session inspection workload before tuning specific high-cost policies or capacity.
Explanation
Correct Answer
A:Operational capacity and policy changes must be evaluated together; a feature can be valid yet overloaded on a particular platform. If confirmed, the narrowly scoped remedy is: Correlate memory/session/resource changes with the deployed inspection policy and right-size or scope the costly control.
C:Operational capacity and policy changes must be evaluated together; a feature can be valid yet overloaded on a particular platform. Prove: The affected device maintains stable resources while required high-risk traffic remains inspected.
D:Operational capacity and policy changes must be evaluated together; a feature can be valid yet overloaded on a particular platform. The expected outcome is: The affected device maintains stable resources while required high-risk traffic remains inspected.
Incorrect Answers
B:This corresponds to a different condition: A transaction edge experiences drops as active sessions approach platform capacity during a seasonal traffic surge. Alternative diagnostic: Inspect concurrent session count, session allocation failures, and new connection rates.
E:The current report has a distinct control gap; Operational capacity and policy changes must be evaluated together; a feature can be valid yet overloaded on a particular platform.
F:This corresponds to a different condition: A busy web gateway's dataplane CPU is persistently high and application latency worsens, while management CPU looks normal. Competing correction: Investigate dataplane resource utilization and session inspection workload before tuning specific high-cost policies or capacity.
