Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Firewalls > EXAM > Flashcards

EXAM Flashcards

1
Q

What is the LAST step of packet processing in the firewall?

A

checking Security Profiles

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Which interface type requires you to configure where the next hop is for various addresses?

A

Layer 3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

How do you enable the firewall to be managed through a data-plane interface?

A

You specify HTTPS in the Interface Management Profile, and then specify in the interface properties to use that profile

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Some devices managed by Panorama have their external interface on ethernet1/1, some on ethernet1/2. However, the zone definitions for the external zone are identical. What is the recommended solution in this case?

A

Create two templates: one for the ethernet1/1 devices, one for the ethernet1/2 devices. Use the same external zone definitions in both. Apply those two templates to the appropriate devices.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

In a Panorama managed environment, which two options show the correct order of policy evaluation? (Choose two.)

A
  1. ) device group pre-rules, local firewall rules, device group post-rules,shared post-rules, intrazone-default, interzone-default
  2. ). shared pre-rules, device group pre-rules, local firewall rules, intrazone-default, interzone-default
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

When you deploy the Palo Alto Networks NGFW on NSX, how many virtual network interfaces does a VM-Series firewall need?

A

. three, one for traffic input, one for traffic output, and one for management traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Which source of user information is NOT supported by the NGFW?

A

RACF

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is the main mechanism of packet-based vulnerability attacks?

A

malformed packets that trigger software bugs when they are received

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Which method is not a PAN-OS software decryption method?

A

SSL Proxy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What type of identification does an Application Override policy override?

A

App-ID

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Which two types of protocols can cause an insufficient data value in the Application field in the Traffic log? (Choose two.)

A

UDP & TCP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Which three profile types are used to prevent malware executables from entering the network?

A

Anti-virus
WildFire Analysis
File Blocking

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Which user credential detection method does not require access to an external directory?

A

Certificate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

When destination NAT rules are configured, the associated security rule is matched using which parameters?

A

pre-NAT source zone and post-NAT destination zone

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the initial IP address for the management interface?

A

192.168.1.1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

In a new firewall, which port provides web interface access by default?

A

management port

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Which application requires you to import private keys?

A

SSL Inbound Inspection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Under which conditions can two Layer 3 interfaces have the same IP address?

A

This feature is not supported.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Which two protocols are supported for site-to-site VPNs? (Choose two.)

A

(AH) - Authentication Header

(ESP) - Encapsulating Security Payload

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

GlobalProtect Portal is responsible for which two functions? (Choose two.)

A
  1. ) authenticating (GP) GlobalProtect users

2. ) managing and updating (GP) GlobalProtect client configurations

21
Q

What is the preferred SYN flood defense action type?

A

SYN Cookies

22
Q

What would be a valid reason to allow non-SYN TCP packets at the start of a connection?

A

Load-balancing

23
Q

Where do you configure protection from malformed IP and TCP headers?

A

Zone Protection Profile

24
Q

Which parameter is not a valid criterion for the original packet in address translation?

A

application

25
Q

Which parameter in a Security policy rule do you use to apply a rule to traffic coming in from a specific interface?

A

source zone

26
Q

Where do you specify that certain URL categories are not to be decrypted?

A

Decryption policy

27
Q

Which two public cloud environments support pay-as-you-go (PAYG) firewall licensing? (Choose two.)

A
  1. ) Microsoft Azure

2. ) Amazon AWS

28
Q

Which log type gets redirected in Device > Log Settings?

A

Config

29
Q

Which tab of the firewall web interface gives you a consolidated picture of the security situation and the top-level threats?

A

ACC

30
Q

A customer’s custom application uses SMTP (email) to transfer directory information, which needs to be filtered in a different manner from normal SMTP. How do you configure this filtering?

A

Create a custom signature and specify the SMTP fields that are different from normal SMTP use and patterns to identify when it is the custom application.

31
Q

Which kind of update requires a disruption in connectivity?

A

PAN-OS software

32
Q

Which dedicated High Availability port is used for which plane?

A

HA1 for the management plane, HA2 for the data plane

33
Q

Which two protocols can AutoFocus use to retrieve log information from an NGFW? (Choose two.)

A
  1. ) HTTP

2. ) HTTPS

34
Q

. Palo Alto Networks publishes new applications at which approximate interval?

A

weekly

35
Q

Which type of device can receive the GlobalProtect data files content update?

A

firewall

36
Q

. In which log will you see evidence that an administrator cannot log in to the firewall?

A

system

37
Q

How do you reboot the firewall from the command line?

A

request restart system

38
Q

Where in the user interface do you configure how many packets to capture when the extended-capture option is selected in an Anti-Spyware Profile or Vulnerability Profile?

A

Capturing options for each capture file

39
Q

You are preparing a bootstrap template for use with a VM-Series firewall hosted in a public cloud. You don’t need to include the Content-ID files because the firewall will download the latest version when it is booted anyway. How do you configure the bootstrap’s content directory?

A

add an empty file to it named no-download

40
Q

Which format do you use for an AWS CloudFormation Template?

A

JSON

41
Q

In which order are Security policy rules from Panorama processed relative to local firewall policy rules?

A

Some rules are processed before the firewall’s local rules, some are processed after the local rules.

42
Q

Which statement is true about Security Profiles?

A

. They enable a specific type of threat scanning (e.g., Virus, Spyware).

43
Q

Which Captive Portal authentication method can be handled by the browser without affecting the user experience?

A

browser-challenge

44
Q

The firewall of a defense contractor is not connected to the internet. However, it is connected to the classified SIPRNet. The contractor is concerned about getting malware files through that network. Can this defense contractor use the WildFire service for protection?

A

. Yes, it can use a WF-500 appliance.

45
Q

How does the NGFW handle excess packets when there are QoS constraints?

A

It drops a percentage of them randomly

46
Q

Which function is performed by the management plane?

A

User-ID group lookups

47
Q

Which feature of the NGFW enables you to identify attempts to tunnel SSH over other ports?

A

App-ID

48
Q

What is the correct order of operations?

A

check allowed ports, decrypt (if traffic is encrypted and the policy specifies to decrypt it), check Security policy, check Security Profiles, re-encrypt traffic

Firewalls (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions