EXAM Flashcards
What is the LAST step of packet processing in the firewall?
checking Security Profiles
Which interface type requires you to configure where the next hop is for various addresses?
Layer 3
How do you enable the firewall to be managed through a data-plane interface?
You specify HTTPS in the Interface Management Profile, and then specify in the interface properties to use that profile
Some devices managed by Panorama have their external interface on ethernet1/1, some on ethernet1/2. However, the zone definitions for the external zone are identical. What is the recommended solution in this case?
Create two templates: one for the ethernet1/1 devices, one for the ethernet1/2 devices. Use the same external zone definitions in both. Apply those two templates to the appropriate devices.
In a Panorama managed environment, which two options show the correct order of policy evaluation? (Choose two.)
- ) device group pre-rules, local firewall rules, device group post-rules,shared post-rules, intrazone-default, interzone-default
- ). shared pre-rules, device group pre-rules, local firewall rules, intrazone-default, interzone-default
When you deploy the Palo Alto Networks NGFW on NSX, how many virtual network interfaces does a VM-Series firewall need?
. three, one for traffic input, one for traffic output, and one for management traffic
Which source of user information is NOT supported by the NGFW?
RACF
What is the main mechanism of packet-based vulnerability attacks?
malformed packets that trigger software bugs when they are received
Which method is not a PAN-OS software decryption method?
SSL Proxy
What type of identification does an Application Override policy override?
App-ID
Which two types of protocols can cause an insufficient data value in the Application field in the Traffic log? (Choose two.)
UDP & TCP
Which three profile types are used to prevent malware executables from entering the network?
Anti-virus
WildFire Analysis
File Blocking
Which user credential detection method does not require access to an external directory?
Certificate
When destination NAT rules are configured, the associated security rule is matched using which parameters?
pre-NAT source zone and post-NAT destination zone
What is the initial IP address for the management interface?
192.168.1.1
In a new firewall, which port provides web interface access by default?
management port
Which application requires you to import private keys?
SSL Inbound Inspection
Under which conditions can two Layer 3 interfaces have the same IP address?
This feature is not supported.
Which two protocols are supported for site-to-site VPNs? (Choose two.)
(AH) - Authentication Header
(ESP) - Encapsulating Security Payload
GlobalProtect Portal is responsible for which two functions? (Choose two.)
- ) authenticating (GP) GlobalProtect users
2. ) managing and updating (GP) GlobalProtect client configurations
What is the preferred SYN flood defense action type?
SYN Cookies
What would be a valid reason to allow non-SYN TCP packets at the start of a connection?
Load-balancing
Where do you configure protection from malformed IP and TCP headers?
Zone Protection Profile
Which parameter is not a valid criterion for the original packet in address translation?
application
Which parameter in a Security policy rule do you use to apply a rule to traffic coming in from a specific interface?
source zone
Where do you specify that certain URL categories are not to be decrypted?
Decryption policy
Which two public cloud environments support pay-as-you-go (PAYG) firewall licensing? (Choose two.)
- ) Microsoft Azure
2. ) Amazon AWS
Which log type gets redirected in Device > Log Settings?
Config
Which tab of the firewall web interface gives you a consolidated picture of the security situation and the top-level threats?
ACC
A customer’s custom application uses SMTP (email) to transfer directory information, which needs to be filtered in a different manner from normal SMTP. How do you configure this filtering?
Create a custom signature and specify the SMTP fields that are different from normal SMTP use and patterns to identify when it is the custom application.
Which kind of update requires a disruption in connectivity?
PAN-OS software
Which dedicated High Availability port is used for which plane?
HA1 for the management plane, HA2 for the data plane
Which two protocols can AutoFocus use to retrieve log information from an NGFW? (Choose two.)
- ) HTTP
2. ) HTTPS
. Palo Alto Networks publishes new applications at which approximate interval?
weekly
Which type of device can receive the GlobalProtect data files content update?
firewall
. In which log will you see evidence that an administrator cannot log in to the firewall?
system
How do you reboot the firewall from the command line?
request restart system
Where in the user interface do you configure how many packets to capture when the extended-capture option is selected in an Anti-Spyware Profile or Vulnerability Profile?
Capturing options for each capture file
You are preparing a bootstrap template for use with a VM-Series firewall hosted in a public cloud. You don’t need to include the Content-ID files because the firewall will download the latest version when it is booted anyway. How do you configure the bootstrap’s content directory?
add an empty file to it named no-download
Which format do you use for an AWS CloudFormation Template?
JSON
In which order are Security policy rules from Panorama processed relative to local firewall policy rules?
Some rules are processed before the firewall’s local rules, some are processed after the local rules.
Which statement is true about Security Profiles?
. They enable a specific type of threat scanning (e.g., Virus, Spyware).
Which Captive Portal authentication method can be handled by the browser without affecting the user experience?
browser-challenge
The firewall of a defense contractor is not connected to the internet. However, it is connected to the classified SIPRNet. The contractor is concerned about getting malware files through that network. Can this defense contractor use the WildFire service for protection?
. Yes, it can use a WF-500 appliance.
How does the NGFW handle excess packets when there are QoS constraints?
It drops a percentage of them randomly
Which function is performed by the management plane?
User-ID group lookups
Which feature of the NGFW enables you to identify attempts to tunnel SSH over other ports?
App-ID
What is the correct order of operations?
check allowed ports, decrypt (if traffic is encrypted and the policy specifies to decrypt it), check Security policy, check Security Profiles, re-encrypt traffic
