Exam Flashcards
An engineer configures a specific service route in an environment with multiple virtual systems instead of using the inherited global service route configuration. What type of service route can be used for this configuration?
A. Destination-Based Service Route
B. Inherit Global Setting
C. IPv6 Source or Destination Address
D. IPv4 Source Interface
IPv4 Source Interface
A firewall engineer reviews the PAN-OS GlobalProtect application and sees that it implicitly uses web-browsing and depends on SSL. When creating a new rule, what is needed to allow the application to resolve dependencies?
A. Add SSL application to the same rule.
B. SSL and web-browsing must both be explicitly allowed.
C. Add SSL and web-browsing applications to the same rule.
D. Add web-browsing application to the same rule.
Add SSL application to the same rule
An engineer is configuring a template in Panorama which will contain settings that need to be applied to all firewalls in production. Which three parts of a template an engineer can configure? (Choose three.)
A. Service Route Configuration
B. Dynamic Address Groups
C. NTP Server Address
D. Antivirus Profile
E. Authentication Profile
Service Route Configuration
NTP Server Address
Authentication Profile
Review the information below. A firewall engineer creates a U-NAT rule to allow users in the trust zone access to a server in the same zone by using an external, public NAT IP for that server. Given the rule below, what change should be made to make sure the NAT works as expected?
A. Change destination NAT zone to Trust_L3.
B. Change destination translation to Dynamic IP (with session distribution) using firewall eth1/2 address.
C. Change Source NAT zone to Untrust_L3.
D. Add source Translation to translate original source IP to the firewall eth1/2 interface translation.
Add source Translation to translate original source IP to the firewall eth1/2 interface translation.
An engineer creates a set of rules in a Device Group (Panorama) to permit traffic to various services for a specific LDAP user group.
What needs to be configured to ensure Panorama can retrieve user and group information for use in these rules?
A. A service route to the LDAP server
B. A User-ID agent on the LDAP server
C. A Master Device
D. Authentication Portal
A Master Device
An administrator troubleshoots an issue that causes packet drops.
Which log type will help the engineer verify whether packet buffer protection was activated?
A. Configuration
B. Data Filtering
C. Traffic
D. Threat
Threat
Information Security is enforcing group-based policies by using security-event monitoring on Windows User-ID agents for IP-to-User mapping in the network. During the rollout, Information Security identified a gap for users authenticating to their VPN and wireless networks.
Root cause analysis showed that users were authenticating via RADIUS and that authentication events were not captured on the domain controllers that were being monitored. Information Security found that authentication events existed on the Identity Management solution (IDM). There did not appear to be direct integration between PAN-OS and the IDM solution.
How can Information Security extract and learn IP-to-user mapping information from authentication events for VPN and wireless users?
A. Configure the integrated User-ID agent on PAN-OS to accept Syslog messages over TLS.
B. Configure the User-ID XML API on PAN-OS firewalls to pull the authentication events directly from the IDM solution.
C. Add domain controllers that might be missing to perform security-event monitoring for VPN and wireless users.
D. Configure the Windows User-ID agents to monitor the VPN concentrators and wireless controllers for IP-to-User mapping.
Configure the User-ID XML API on PAN-OS firewalls to pull the authentication events directly from the IDM solution.
Phase two of a VPN will not establish a connection. The peer is using a policy-based VPN configuration.
What part of the configuration should the engineer verify?
A. IKE Crypto Profile
B. Security policy
C. Proxy-IDs
D. PAN-OS versions
Proxy-IDs
Where can a service route be configured for a specific destination IP?
A. Use Network > Virtual Routers, select the Virtual Router > Static Routes > IPv4
B. Use Device > Setup > Services > Services
C. Use Device > Setup > Services > Service Route Configuration > Customize > IPv4
D. Use Device > Setup > Services > Service Route Configuration > Customize > Destination
Use Device > Setup > Services > Service Route Configuration > Customize > Destination
An administrator notices that an interface configuration has been overridden locally on a firewall. They require all configuration to be managed from Panorama and overrides are not allowed.
What is one way the administrator can meet this requirement?
A. Reload the running configuration and perform a Firewall local commit.
B. Perform a commit force from the CLI of the firewall.
C. Perform a template commit push from Panorama using the “Force Template Values” option.
D. Perform a device-group commit push from Panorama using the “Include Device and Network Templates” option
Perform a template commit push from Panorama using the “Force Template Values” option.
An administrator is troubleshooting why video traffic is not being properly classified.
If this traffic does not match any QoS classes, what default class is assigned?
A. 1
B. 2
C. 3
D. 4
4
A company has recently migrated their branch office’s PA-220s to a centralized Panorama. This Panorama manages a number of PA-7000 Series and PA-5200 Series devices. All device group and template configuration is managed solely within Panorama.
They notice that commit times have drastically increased for the PA-220s after the migration.
What can they do to reduce commit times?
A. Disable “Share Unused Address and Service Objects with Devices” in Panorama Settings.
B. Perform a device group push using the “merge with device candidate config” option.
C. Update the apps and threat version using device-deployment.
D. Use “export or push device config bundle” to ensure that the firewall is integrated with the Panorama config.
Disable “Share Unused Address and Service Objects with Devices” in Panorama Settings.
An engineer manages a high availability network and requires fast failover of the routing protocols. The engineer decides to implement BFD.
Which three dynamic routing protocols support BFD? (Choose three.)
A. OSPF
B. IGRP
C. OSPFv3 virtual link
D. BGP
E. RIP
OSPF
BGP
RIP
What can be used as an Action when creating a Policy-Based Forwarding (PBF) policy?
A. Deny
B. Allow
C. Discard
D. Next VR
Discard
Based on the graphic, which statement accurately describes the output shown in the Server Monitoring panel?
A. The User-ID agent is connected to a domain controller labeled lab-client.
B. The host lab-client has been found by the User-ID agent.
C. The host lab-client has been found by a domain controller.
D. The User-ID agent is connected to the firewall labeled lab-client.
The User-ID agent is connected to a domain controller labeled lab-client.
To ensure that a Security policy has the highest priority, how should an administrator configure a Security policy in the device group hierarchy?
A. Clone the security policy and add it to the other device groups.
B. Add the policy to the target device group and apply a master device to the device group.
C. Reference the targeted device’s templates in the target device group.
D. Add the policy in the shared device group as a pre-rule.
Add the policy in the shared device group as a pre-rule.
Which three external authentication services can the firewall use to authenticate admins into the Palo Alto Networks NGFW without creating administrator account on the local firewall? (Choose three.)
A. TACACS+
B. Kerberos
C. SAML
D. RADIUS
E. LDAP
TACACS+
SAML
RADIUS
An organization conducts research on the benefits of leveraging the Web Proxy feature of PAN-OS 11.0.
What are two benefits of using an explicit proxy method versus a transparent proxy method? (Choose two.)
A. No client configuration is required for explicit proxy, which simplifies the deployment complexity.
B. Explicit proxy supports interception of traffic using non-standard HTTPS ports.
C. It supports the X-Authenticated-User (XAU) header, which contains the authenticated username in the outgoing request.
D. Explicit proxy allows for easier troubleshooting, since the client browser is aware of the existence of the proxy.
It supports the X-Authenticated-User (XAU) header, which contains the authenticated username in the outgoing request.
Explicit proxy allows for easier troubleshooting, since the client browser is aware of the existence of the proxy.
An engineer is configuring a firewall with three interfaces:
- MGT connects to a switch with internet access.
- Ethernet1/1 connects to an edge router.
- Ethernet1/2 connects to a virtualization network.
The engineer needs to configure dynamic updates to use a dataplane interface for internet traffic.
What should be configured in Setup > Services > Service Route Configuration to allow this traffic?
A. Set DNS and Palo Alto Networks Services to use the MGT source interface.
B. Set DNS and Palo Alto Networks Services to use the ethernet1/1 source interface.
C. Set DNS and Palo Alto Networks Services to use the ethernet1/2 source interface.
D. Set DDNS and Palo Alto Networks Services to use the MGT source interface.
Set DNS and Palo Alto Networks Services to use the ethernet1/1 source interface.
Which three items must be configured to implement application override? (Choose three.)
A. Application filter
B. Application override policy rule
C. Custom app
D. Decryption policy rule
E. Security policy rule
Application override policy rule
Custom app
Security policy rule
542 If a URL is in multiple custom URL categories with different actions, which action will take priority?
A. Block
B. Allow
C. Alert
D. Override
Block
Which new PAN-OS 11.0 feature supports IPv6 traffic?
A. OSPF
B. IKEv1
C. DHCP Server
D. DHCPv6 Client with Prefix Delegation
DHCPv6 Client with Prefix Delegation
After importing a pre-configured firewall configuration to Panorama, what step is required to ensure a commit/push is successful without duplicating local configurations?
A. Ensure Force Template Values is checked when pushing configuration.
B. Push the Template first, then push Device Group to the newly managed firewall.
C. Push the Device Group first, then push Template to the newly managed firewall.
D. Perform the Export or push Device Config Bundle to the newly managed firewall.
Perform the Export or push Device Config Bundle to the newly managed firewall.
After implementing a new NGFW, a firewall engineer sees a VoIP traffic issue going through the firewall. After troubleshooting, the engineer finds that the firewall performs NAT on the voice packets payload and opens dynamic pinholes for media ports.
What can the engineer do to solve the VoIP traffic issue?
A. Disable ALG under H.323 application
B. Increase the TCP timeout under H.323 application
C. Increase the TCP timeout under SIP application
D. Disable ALG under SIP application
Disable ALG under SIP application
A network security administrator wants to inspect HTTPS traffic from users as it egresses through a firewall to the Internet/Untrust zone from trusted network zones. The security admin wishes to ensure that if users are presented with invalid or untrusted security certificates, the user will see an untrusted certificate warning.
What is the best choice for an SSL Forward Untrust certificate?
A. A self-signed certificate generated on the firewall
B. A web server certificate signed by the organization’s PKI
C. A web server certificate signed by an external Certificate Authority
D. A subordinate Certificate Authority certificate signed by the organization’s PKI
A self-signed certificate generated on the firewall
An engineer is deploying multiple firewalls with common configuration in Panorama.
What are two benefits of using nested device groups? (Choose two.)
A. Inherit all Security policy rules and objects
B. Inherit settings from the Shared group
C. Inherit IPSec crypto profiles
D. Inherit parent Security policy rules and objects
Inherit settings from the Shared group
Inherit parent Security policy rules and objects
Which two profiles should be configured when sharing tags from threat logs with a remote User-ID agent? (Choose two.)
A. LDAP
B. Log Ingestion
C. HTTP
D. Log Forwarding
HTTP
Log Forwarding
A network security administrator has been tasked with deploying User-ID in their organization. What are three valid methods of collecting User-ID information in the network?
A Windows User-ID agent
Dynamic User Groups
External Dynamic List
GlobalProtect
XML API
A Windows User-ID agent
GlobalProtect
XML API
Which GlobalProtect gateway setting is required to enable split-tunneling by access route, destination domain, and application?
Satellite mode
Tunnel mode
No Direct Access to local networks
IPSec mode
Tunnel mode
An organization is interested in migrating from their existing web proxy architecture to the Web Proxy feature of their PAN-OS 11.0 firewalls.
Currently, HTTP and SSL requests contain the destination IP address of the web server and the client browser is redirected to the proxy.
Which PAN-OS proxy method should be configured to maintain this type of traffic flow?
forward proxy
Explicit proxy
Transparent proxy
DNS proxy
Transparent proxy
Which type of zone will allow different virtual systems to communicate with each other?
Tap
Tunnel
Virtual Wire
External
External
Which source is the most reliable for collecting User-ID user mapping?
Microsoft Active Directory
Microsoft Exchange
GlobalProtect
Syslog Listener
GlobalProtect
An engineer configures SSL decryption in order to have more visibility to the internal users’ traffic when it is egressing the firewall.
Which three types of interfaces support SSL Forward Proxy? (Choose three.)
High availability (HA)
Layer 3
Layer 2
Tap
Wire
Layer 3
Layer 2
Wire
An administrator has configured OSPF with Advanced Routing enabled on a Palo Alto Networks firewall running PAN-OS 10.2. After OSPF was configured, the administrator noticed that OSPF routes were not being learned. Which two actions could an administrator take to troubleshoot this issue? (Choose two.)
A. Run the CLI command show advanced-routing ospf neighbor
B. In the WebUI, view the Runtime Stats in the virtual router
C. Look for configuration problems in Network > virtual router > OSPF
D. In the WebUI, view Runtime Stats in the logical router
Run the CLI command show advanced-routing ospf neighbor
In the WebUI, view Runtime Stats in the logical router
How can Panorama help with troubleshooting problems such as high CPU or resource exhaustion on a managed firewall?
A. Firewalls send SNMP traps to Panorama when resource exhaustion is detected. Panorama generates a system log and can send email alerts.
B. Panorama provides visibility into all the system and traffic logs received from firewalls. It does not offer any ability to see or monitor resource utilization on managed firewalls.
C. Panorama provides information about system resources of the managed devices in the Managed Devices > Health menu.
D. Panorama monitors all firewalls using SNMP. It generates a system log and can send email alerts when resource exhaustion is detected on a managed firewall.
Panorama provides information about system resources of the managed devices in the Managed Devices > Health menu.
The decision to upgrade to PAN-OS 10.2 has been approved. The engineer begins the process by upgrading the Panorama servers, but gets an error when trying to install.
When performing an upgrade on Panorama to PAN-OS 10.2, what is the potential cause of a failed install?
A. GlobalProtect agent version
B. Outdated plugins
C. Management only mode
D. Expired certificates
Outdated plugins
A network security administrator wants to enable Packet-Based Attack Protection in a Zone Protection profile. What are two valid ways to enable Packet-Based Attack Protection? (Choose two.)
TCP Drop
ICMP Drop
SYN Random Early Drop
TCP Port Scan Block
TCP Drop
ICMP Drop
An engineer is bootstrapping a VM-Series Firewall. Other than the /config folder, which three directories are mandatory as part of the bootstrap
package directory structure? (Choose three.)
A. /plugins
B. /license
C. /opt
D. /content
E. /software
/license
/content
/software
A firewall administrator has been tasked with ensuring that all firewalls forward System logs to Panorama.
A. Monitor > Logs > System
B. Objects > Log Forwarding
C. Device > Log Settings
D. Panorama > Managed Devices
Device > Log Settings
An administrator needs to identify which NAT policy is being used for internet traffic.
From the GUI of the firewall, how can the administrator identify which NAT policy is in use for a traffic flow?
A. From the Monitor tab, click Traffic view and review the information in the detailed log view.
B. From the Monitor tab, click Traffic view, ensure that the Source or Destination NAT columns are included and review the information in the detailed log view.
C. From the Monitor tab, click App Scope > Network Monitor and filter the report for NAT rules.
D. From the Monitor tab, click Session Browser and review the session details.
From the Monitor tab, click Session Browser and review the session details.
Which three firewall multi-factor authentication factors are supported by PAN-OS? (Choose three.)
A. Short message service
B. Push
C. User logon
D. One-Time Password
C. SSH key
Short message service
Push
One-Time Password
