Latest Palo Alto Certification Exam Test Prep questions and answers_ 2021/2022.

Document Content and Description Below

Palo Alto Certification Exam Test Prep questions and answers_ 2021/2022. An Antivirus Security Profile specifies Actions and WildFire Actions. Wildfire Actions enable you to configure the firewall ... to perform which operation? A. Delete packet data when a virus is suspected. B. Download new antivirus signatures from WildFire. C. Block traffic when a WildFire virus signature is detected. D. Upload traffic to WildFire when a virus is suspected. An Interface Management Profile can be attached to which two interface types? (Choose two.) A. Tap B. Layer 2 C. Loopback D. Layer 3 E. Virtual Wire App-ID running on a firewall identifies applications using which three methods? (Choose three.) A. PAN-DB lookups B. WildFire lookups C. Application signatures D. Program heuristics E. Known protocol decoders Application block pages can be enabled for which applications? A. any B. web-based C. MGT port-based D. non-TCP/IP Because a firewall examines every packet in a session, a firewall can detect application ________? A. shifts B. errors C. groups D. filters Finding URLs matched to the not-resolved URL category in the URL Filtering log file might indicate that you should take which action? A.Reboot the firewall. B. Validate your Security policy rules. C. Validate connectivity to the PAN-DB cloud. D. Re-download the URL seed database. For which firewall feature should you create forward trust and forward untrust certificates? A. SSH decryption B. SSL forward proxy decryption C. SSL client-side certificate checking D. SSL Inbound Inspection decryption If a DNS sinkhole is configured, any sinkhole actions indicating a potentially infected host are recorded in which log type? A. Data Filtering B. WildFire Submissions C. Threat D. Traffic If there is an HA configuration mismatch between firewalls during peer negotiation, which state will the passive firewall enter? A. PASSIVE B. NON-FUNCTIONAL C. ACTIVE D. INITIAL In a destination NAT configuration, which option accurately completes the following sentence? A Security policy rule should be written to match the _______. A. original pre-NAT source and destination addresses, and the pre-NAT destination zone B. original pre-NAT source and destination addresses, but the post-NAT destination zone C. post-NAT source and destination addresses, and the post-NAT destination zone D. post-NAT source and destination addresses, but the pre-NAT destination zone In a Security Profile, which action does a firewall take when the profiles action is configured as Reset Server? (Choose two.) A. For UDP sessions, the connection is reset. B. For UDP sessions, the connection is dropped. C. The client is reset. D. The traffic responder is reset. In an HA configuration, which three components are synchronized between the pair of firewalls? (Choose three.) A. policies B. networks C. objects D. logs In an HA configuration, which three functions are associated with the HA1 Control Link? (Choose three.) A. synchronizing sessions B. synchronizing configuration C. exchanging heartbeats D. exchanging hellos SSL Inbound Inspection requires that the firewall be configured with which two components? (Choose two.) A. client's digital certificate B. server's digital certificate C. server's private key D. client's public key The firewall acts as a proxy for which two types of traffic? (Choose two.) A. SSL Inbound Inspection B. SSL outbound C. SSH D. Non-SSL The Threat log records events from which three Security Profiles? (Choose three.) A. Anti-Spyware B. File Blocking C. Antivirus D. URL Filtering E. WildFire Analysis F. Vulnerability Protection The WildFire Portal website supports which three operations? (Choose three.) A. upload files to WildFire for analysis B. request firewall WildFire licenses C. view WildFire verdicts D. report incorrect verdicts What are the two separate planes that make up the PAN-OS architecture? (Choose two.) A. routing plane B. signature processing plane C. control/management plane D. dataplane E. HA plane What are three connection methods for the GlobalProtect agent? (Choose three.) A. Captcha portal B. User-Logon C. On-demand D. Pre-Logon What are two benefits of attaching a Decryption Profile to a Decryption policy no-decrypt rule? (Choose two.) A. untrusted certificate checking B. acceptable protocol checking C. expired certificate checking D. URL category match checking What is a use case for deploying Palo Alto Networks NGFW in the public cloud? A. centralizing your data storage on premise B. faster WildFire analysis response time C. extending the corporate data center into the public cloud D. cost savings through one-time purchase of Palo Alto Networks hardware and subscriptions When SSL traffic passes through the firewall, which component is evaluated first? A. Decryption exclusions list B. Decryption policy C. Security policy D. Decryption Profile Where does a GlobalProtect client connect to first when trying to connect to the network? A. GlobalProtect Portal B. GlobalProtect Gateway C. AD agent D. User-ID agent Which action in a File Blocking Security Profile results in the user being prompted to verify a file transfer? A. Alert B. Allow C. Block D. Continue Which feature is a dynamic grouping of applications used in Security policy rules? A. application filter B. application group C. implicit applications D. dependent applications Which four actions can be applied to traffic matching a URL Filtering Security Profile? (Choose four.) A. Alert B. Reset Server C. Block D. Override E. Continue F. Reset Client Which interface type does NOT require any configuration changes to adjacent network devices? A. Tap B. Layer 2 C. Layer 3 D. Virtual Wire Which interface type is NOT assigned to a security zone? A. HA B. VLAN C. Layer 3 D. Virtual Wire Which statement is true about a URL Filtering Profile override password? A. There is a password per session. B. There is a password per website. C. There is a single, per-firewall password. D. There is a password per firewall administrator account. Which three are valid configuration options in a WildFire Analysis Profile? (Choose three.) A. direction B. file types C. application D. maximum file size Which three interface types can control or shape network traffic? (Choose three.) A. Virtual Wire B. Layer 2 C. Tap D. Layer 3 Which three MGT port configuration settings are required in order to access the WebUI from a remote subnet? (Choose three.) A. Default gateway B. Hostname C. Netmask D. IP address Which three network modes are supported by active/passive HA? (Choose three.) A. Virtual Wire B. Layer 2 C. Tap D. Layer 3 Which three statements are true regarding sessions on the firewall? (Choose three.) A. Sessions are always matched to a Security policy rule. B. The only session information tracked in the session logs are the five-tuples. C. Return traffic is allowed. D. Network packets are always matched to a session. Which two file types can be sent to WildFire for analysis if a firewall has only a standard subscription service? (Choose two.) A. .dll B. .pdf C. .jar D. .exe Which file must be downloaded from the firewall to create a Heatmap and Best Practices Assessment report? A. firewall config file B. stats dump file C. XML file D. Tech Support File GlobalProtect clientless VPN provides secure remote access to web applications that use which three technologies? (Choose three.) A. HTML5 B. Ruby C. Python D. Java E. HTML F. JavaScript Which three subscription services are included as part of the GlobalProtect cloud service? (Choose three.) A. AutoFocus B. Aperture C. URL Filtering D. WildFire® E. Panorama F. Threat Prevention What is the maximum number of WildFire® appliances that can be grouped in to a WildFire® appliance cluster? A. 12 B. 24 C. 32 D. 20 The decryption broker feature is supported by which three Palo Alto Networks firewall series? (Choose three.) A. PA-3200 B. PA-7000 C. PA-220 D. PA-5000 E. PA-5200 F. PA-3000 Which VM-Series model was introduced with the release of PAN-OS® 8.1? A. VM-50 Lite B. VM-200 Lite C. VM-300 Lite D. VM-100 Lite Which cloud computing platform provides shared resources, servers, and storage in a pay-as-you-go model? A. public B. private C. community D. hybrid Cloud security is a shared responsibility between the cloud provider and the customer. Which security platform is the cloud provider responsible for? A. foundation services B. firewall and network traffic C. identity and access management D. encryption management A Security policy rule displayed in italic font indicates which condition? A. The rule is active. B. The rule is disabled. C. The rule is a clone. D. The rule has been overridden. A Server Profile enables a firewall to locate which server type? A. a server with remote user accounts B. a server with firewall software updates C. a server with firewall threat updates D. a server with an available VPN connection In an HA configuration, which two failure detection methods rely on ICMP ping? (Choose two.) A. hellos B. heartbeats C. path monitoring D. link groups The User-ID feature is enabled per __________? A. firewall B. User-ID agent C. firewall security zone D. firewall interface What is a characteristic of Dynamic Admin Roles? A. Role privileges can be dynamically updated by a firewall administrator. B. They can be dynamically created or deleted by a firewall administrator. C. They can be dynamically modified by external authorization systems. What is the result of performing a firewall Commit operation? A. The loaded configuration becomes the candidate configuration. B. The candidate configuration becomes the saved configuration. C. The saved configuration becomes the loaded configuration. D. The candidate configuration becomes the running configuration. Which statement describes a function provided by an Interface Management Profile? A. It determines the NetFlow and LLDP interface management settings. B. It determines which external services are accessible by the firewall. C. It determines which administrators can manage which interfaces. D. It determines which firewall services are accessible from external devices. Which statement describes the Export named configuration snapshot operation? A. The running configuration is transferred from memory to the firewall's storage device. B. A copy of the configuration is uploaded to the cloud as a backup. C. A saved configuration is transferred to an external hosts storage device. D. The candidate configuration is transferred from memory to the firewall's storage device. Which three components can be sent to WildFire for analysis? (Choose three.) A. MGT interface traffic B. email attachments C. files traversing the firewall D. URL links found in email Which type of content update does NOT have to be scheduled for download on the firewall? A. WildFire antivirus signatures B. PAN-DB updates C. dynamic update antivirus signatures D. dynamic update threat signatures Which cloud computing service model will enable an application developer to develop, manage, and test their applications without the expense of purchasing equipment? A. code as a service B. software as a service C. infrastructure as a service D. platform as a service Which condition must exist before a firewall's in-band interface can process traffic? A. The firewall must not be a loopback interface. B. The firewall must be assigned to a security zone. C. The firewall must be enabled. D. The firewall must be assigned an IP address. Which two User-ID methods are used to verify known IP address-to-user mappings? (Choose two.) A. Client Probing B. Captive Portal C. Server Monitoring D. Session Monitoring Which user mapping method is recommended for a highly mobile user base? A. GlobalProtect B. Client Probing C. Server Monitoring D. Session Monitoring Which User-ID user mapping method is recommended for environments where users frequently change IP addresses? A. Client Probing B. Captive Portal C. Server Monitoring D. Session Monitoring Which three HTTP header insertion types are predefined? (Choose three.) A. YouTube B. Slack C. WebEx D. Box E. Dropbox F. Google Currently there are four available predefined applications: Google, Dropbox, YouTube, and Office 365 On a firewall that has 32 Ethernet ports and is configured with a dynamic IP and port (DIPP) NAT oversubscription rate of 2x, what is the maximum number of concurrent sessions supported by each available IP address? A. 32 B. 64K C. 128K D. 64 The firewall acts as a proxy for which two types of traffic? (Choose two.) A Server Profile enables a firewall to locate which server type? Cloud security is delivered in which three ways? (Choose three.) The Application Framework consists of which two components? (Choose two.) What does the Save Named Configuration Snapshot option do?#correct- The 'Save Named configuration Snapshot' will save the candidate configuration to a file by giving it a name. (True or false) - Virtual Wire interfaces can be subdivided into Virtual Wire subinterfaces that can be used to classify traffic according to VLAN tags, IP addresses, IP ranges, or subnets. What is the default metric value of static routes? What are the three components of rule usage? (Choose three.) #correct- Hit Count—The number of times traffic matched the criteria you defined in the policy rule. Persists through reboot, dataplane restarts, and upgrades unless you manually reset or rename the rule. Last Hit—The most recent timestamp for when traffic matched the rule. First Hit—The first instance when traffic was matched to this rule. Which two statements are true regarding User-ID and firewall configuration? (Choose two) A. Communications between the firewall and the User-ID agent are sent over an encrypted SSL Connection B. The firewall needs to have information for every User-ID agent to which it will connect. C. NetBIOS is the only client probing method supported by the User-ID agent. D. The User-ID agent must be installed on the domain controller. Which three items are valid choices when configuring the Source User field in a security policy rule (choose three.) A. all B. known-user C. any D. unknown E. none You must deploy the Windows-based User-ID agent to collect IP address-to-username mappings from a Windows AD domain controller. Which statement is true regarding User-ID and Security Policy rules? A. If the user associated with an IP address cannot be determined, all traffic from that address will be dropped. B. The Source User field can match only users, not groups C. The Source IP and Sourch User fields cannot be used in the same policy D. Users can be used in policy rules only if they are known by the firewall. Which three statements are true regarding a public key infrastructure? A. solves the problem of secure identification of public keys. B. Uses digital certificates to verify key owners C. relies on the manual distribution of shared keys D. has root and intermediate certificate authorities When the firewall is configured to inspect SSL traffic going to an internal server for which the firewall has the private key, it functions as a forward proxy. A. True B. False What are two methods of certificate revocation? (Choose two.) A. CRL B. OCSP C. IKE D. SSH When the firewall is configured to decrypt SSL traffic going to external sites, it functions as a forward proxy. A. True B. False When the firewall detects that a session has been broken as a result of the decryption process, it will cache the session information and will not attempt to decrypt the next session to the same server. How many hours does this cache entry persist? A. 8 B. 12 C. 18 D. 24 Which four items are possible network traffic match criteria in a Security policy on a Palo Alto Networks firewall? (Choose four.) A. Source Zone B. Username C. DNS Domain D. URL E. Application Which of the three types of Security policy rules that can be created is the default rule type? A. intrazone B. interzone C. universal The intrazone-default and interzone-default rules cannot be modified. A. True B. False Which three items are names of valid source NAT translation types? (Choose three.) A. dynamic IP B. dynamic IP/Port C. port forwarding D. static Logging on intrazone-default and interzone-default Security policy rules is enabled by default A. True B. False Which four models are the Palo Alto Networks next-generation firewall models? (Choose four.) A. PA-200 Series B. PA-300 Series C. PA-3200 Series D. PA-400 Series E. PA-5000 Series F. PA-7000 Series Which two planes are found in Palo Alto Networks single-pass platform architecture? (Choose two.) A. control B. single pass C. data D. parallel processing The strength of the Palo Alto Networks firewall is its Single-Pass Parallel Processing (SP3) engine. A. True B. False Which new firewall model was introduced with PAN-OS 8.1 with double the data plane memory? A. PA-5260 B. PA-5270 C. PA-5280 D. PA_5290 Palo Alto firewalls are built with a dedicated out-of-band management that has which three attributes? A. Labeled MGT by default B. Passes only management traffic for the device and cannot be configured as a standard traffic port C. Administrators use the out-of-band management port for direct connectivity to the management plane of the firewall. D. Cannot be configured to use DHCP Which three statements are true regarding the candidate configuration? A. You can roll back the candidate configuration by pressing the Undo button B. You can revert the candidate configuration to the running configuration C. Clicking Save creates a copy of the candidate configuration D. Choosing Commit updates the running configuration with the contents of the candidate configuration. True or False? Firewall administrator accounts can be individualised for user needs, granting or restricting permissions as appropriate? A. True B. False Firewall administration can be done using which four interfaces? A. web interface B. Panorama C. command line interface D. Java API E. XML API True or False? Service routes can be used to configure an in-band port to access external services. A. True B. False Virtual routers provide support for static routing and dynamic routing using which three protocols? (Choose three.) A. OSPF B. RIPv2 C. EGP D. BGP Which three interface types are valid on a Palo Alto Networks firewall (Choose three.) A. FC B. Layer 3 C. FCoE D. Tap E. Virtual Wire True or False? Intrazone traffic is allowed by default but interzone traffic is blocked by default. A. True B. False Which three attributes are true regarding a Virtual Wire (vwire) interface? (choose three.) A. Sometimes called a Bump in the Wire or Transparent In-Line B. no support for routing or device management C. supports NAT, Content-ID, and User-ID D. supports SSL Decrypt Inbound traffic only True or False? A Layer 3 interface can be configured as dual stack with both IPv4 and IPv6 addresses A. True B. False What are the three functions provided by the Control Plane What are the three functions provided by the Data plane What is the guiding principle of Zero Trust? What does "revert to last saved configuration" do? What does "revert to running configuration" do? What does "Load named configuration snapshot" do What does "Load configuration version" do? What does "Import named configuration snapshot" do? What does "Import device state" do? What does a 'commit lock' do? #correct- Blocks other admins from committing the candidate configuration What does a 'config lock' do? Who can remove locks? Which four items are possible network traffic match criteria in a Security policy on a Palo Alto networks firewall (choose. four) A. Source Zone B. Username C. DNS Domain D. URL E. Application Which of the three types of Security policy rules that can be created is the default rule type? A. Intrazone B. Interzone C. Universal True or False? The intrazone-default and interzone-default rules cannot be modified? A. True B. False True or False? Logging on intrazone-default and interzone-default Security policy rules is enabled by default A. True B. False Which item is the name of an object that dynamically groups applications based on application attributes that you define: Category, Subcategory, Technology, Risk, and Characteristic? A. Application B. Application Filter C. Application Group D. Application Profile True or False? In Palo Alto network terms, an application is a specific program or feature that can be detected, monitored, and blocked if neccessary. A. True B. False Before App-ID would identify traffic as facebook-base, it would first identify the traffic as which application? A. unknown-tcp B. unknown-udp C. web-browsing Which three statements are true regarding App-ID? (choose three.) A. It addresses the traffic classification limitations of traditional firewalls B. It is the Palo Alto Networks traffic classification mechanism C. It uses multiple identification mechanisms to determine the exact identity of applications traversing the network D. It is still in developmental stage and is not yet released True or False? Application groups can contain applications, filters, or other application groups. A. True B. False Which User-ID user mapping method is recommended for Non-windows systems, NAC mechanisms such as wireless controllers, 802.1x devices or proxy servers? A. Client Probing B. Captive Portal C. Syslog listener D. Session Monitoring Which User-ID user mapping method is recommended for web clients that do not use the domain server? A. Client Probing B. Captive Portal C. Syslog listener D. Session Monitoring Which User-ID user mapping method is recommended for devices and applications not integrated with User-ID? A. Client Probing B. Captive Portal C. Syslog listener D. XML API What are the differences between the PAN-OS integrated User-ID agent and the Windows-based User-ID agent Windows agent: Runs on a domain member (doesnt have to be DC) Multiples can be run for large or multi-forest domains Uses MS-RPC to send full security logs to the agent, which filters to send to the firewall Which anti-spyware feature enables an administrator to quickly identify a potentially infected host on the network? A. Data filtering log entry B. continuous response page C. DNS sinkhole D. CVE number True or False? A Security Profile attached to a Security policy rule is evaluated only if the Security rule matches traffic and the rule action is set to "Allow" A. True B. False Zone protection profiles are applied to which item? A. ingress ports B. Security policy rules C. egress ports D. Address groups True or False? The Antivirus Security profile defines actions to be taken if an infected file is detected as part of an application. A. True B. False True or False? Each Anti-Spyware Security Profile contains one master rule to handle all types of threats. A. True B. False Which four actions result in a URL Filtering log entry? (Choose four.) A. alert B. allow C. block D. continue E. override True or False? URLs are always matched to a PAN-DB URL category before they match a Custom URL category A. True B. False URL Matching Order: Custom URL Category External Dynamic Lists PAN-DB firewall cache Downloaded PAN-DB file PAN-DB Cloud Which three statements are true regarding safe search enforcement? (choose three.) A. Safe search is a web server setting B. Safe search is a web browser setting C. Safe search is a best effort setting D. Safe search is designed to block violent content True or False? A URL Filtering license is not required to define and use custom URL categories. A. True B. False A URL Filtering license is required to use the PAN-DB URL Filtering database to filter user access to websites. True or False? The user credential detection tab can be used to block traffic when users submit their corporate credentials to a website. A. True B. False 3 sources for detection (requires User-ID) IP User mapping (integrated agent, checks username only) Group mapping (integrated agent, checks username only) Domain Credential filtering (Windows agent, username and password) Which three terms are true about Wildfire? A. Identifies threats by signatures, which are available for download by Palo Alto Networks firewalls in as little as 5 minutes. B. Provides the ability to identify malicious behaviours in executable files by running them in a virtual environment and observing their behaviours C. Triggered by 'block' or 'forward' actions in a File Blocking Security Profile D. Uploads files for analysis to a WildFire solution maintained in the customers environment and or a hosted/public cloud environment. Which four options are possible WildFire analysis verdicts? A. Benign B. Grayware C. Malware D. Phishing E. Spyware True or False? When a malicious file or link is detected in an email, WildFire can update antivirus signatures and the PAN-DB database. A. True B. False Which three file types can be sent to Wildfire without a Wildfire license? A. dll B. exe C. pdf D. scr E. xml What does the default WildFire profile do with files when its assigned to a Security Policy? What is the WildFire private cloud? The GlobalProtect client will connect to either an internal gateway or an external gateway based on its location (inside or outside the corporate network). This location determination is based on the result of which option? A. reverse DNS lookup B. user selection during agent startup C. IP address of the client system D. Whether the user starts the client in offline or online mode. The GlobalProtect client is available in which two formats? A. dmg B. exe C. msi D. pkg True or False? If a GlobalProtect agent fails to establish an IPsec connection, the connection type will failback to SSL-VPN. A. True B. False Which three statements are true regarding a GlobalProtect gateway A. Provides security enforcement for traffic from GlobalProtect Gateway B. Requires a tunnel interface for external clients C. Tunnel interfaces are optional for internal gateways D. Authenticates users against a server profile. For which type of functionality can a GlobalProtect Gateway map IP addresses to the user A. App-ID B. Content-ID C. User-ID Which three options are aspects of the basic requirements to create a VPN in a PAN-OS release? (choose three) A. Add a static route to the virtual router B. Create the tunnel interface C. Configure the IPsec tunnel D. identify Proxy ID errors True or False? When you create a static route for the VPN, no next hop IP address is required. A. True B. False Which two options are true regarding a VPN tunnel interface A. The tunnel interface always requires an IP address B. A tunnel interface is a logical Layer 3 interface C. The tunnel interface must be added to a Layer 3 security zone D. The interface name "tunnel" can be renamed to anything you want, up to 20 characters in length True or False? IPSec is a set of protocols used to set up a secure tunnel for the VPN traffic. A. True B. False Logs can be forwarded to which four of the following Remote Logging Destinations? A. Email B. Syslog C. Common access log D. Panorama E. SNMP A log can be exported to which format? A. csv B. pdf C. PPT D. XLS True or False? A Report Group must be sent as a scheduled email. It can not be downloaded directly. A. True B. False A SaaS application that you formally approve for use on your network is which type of application? A. Sanctioned B. Production C. Unsanctioned D. Service Which four attributes describe an active/passive HA firewall configuration? A. Only one firewall actively passes traffic B. primarily designed to support asymmetric routing C. No increase in session capacity D. No increase in throughput E. Supports Virtual Wire, Layer 2 and Layer 3 deployments Which three types of traffic flow across the HA control link? A. Configuration synchronisation B. Session synchronisation C. Heartbeats D. Hellos On a firewall with dedicated HA ports, which option describes the function of the HA2 port? A. Control link B. Data link C. Heartbeat link D. Management link True or False? A Backup Control link helps split-brain operation in a firewall HA cluster. A. True B. False Which are four failure-detection methods in a HA cluster? A. Heartbeats and Hellos B. Internal Health Checks C. Link groups D. Path Groups E. polling Which phase is not one of the three phases used in a migration from port-based firewall policies to application-based firewall policies? A. Application Visibility B. Baseline Visibility C. Consolidate, Customize and Reduce Risk D. Next-Generation Policies Which tab in the ACC provides an overview of traffic and user activity on your network? A. Tunnel activity B. Blocked activity C. Network activity D. Threat activity You should set all category actions to which level when you create a new URL filtering Profile? A. Alert B. Block C. Continue D. Allow True or False? Heatmap and BPA are online tools only available to partners and employee's. A. True B. False To create a Heatmap and BPA report, which type of file would you need to create and download from the firewall? A. Stats dump file B. Config File saved in XML format C. Config File saved in CSV format D. Tech Support File What does IKE Phase 1 do? What does IKE Phase 2 do? What is the maximum number of IPSec tunnels a tunnel interface can have? Destination Nat Supports Dynamic IP addressing. DNAT can translate a destination port In an Active/Active HA configuration both firewalls maintain session tables and routing tables and synchronise Active Active primary used to support environments with asymmetric routing. Active Passive is supported in VW, Layer 2 and Layer 3 Active Active is support in Vwire and Layer 3 only. Both firewalls must share what in order to establish HA VMs - same hypervisor and CPU cores Control Link (HA) - Layer 3, needs IP Exchanges heartbearts, hellos and syncs config Data link (HA2) - Layer 2 or 3 if not on the same subnet Syncs sessions, forwarding, ipsec and arp #correct- How frequently are antivirus databases updated? [Show More]

Last updated: 1 year ago

Preview 1 out of 28 pages