Exam Domain 2 — Deploy and Configure Flashcards
1
Q
67. An application using which protocol can receive an incomplete value in the Application field in the Traffic log? A. UDP B. TCP C. ICMP D. GRE
A
B. TCP
2
Q
- Session traffic being evaluated by a firewall is encrypted with SSL. If the firewall does not decrypt the traffic, how can the firewall make an App-ID determination?
A. evaluate the HTTP headers
B. evaluate the SSL Hello exchange
C. evaluate certificate contents used for encryption
D. use information in the SSL Decryption Exclusion cache
A
C. evaluate certificate contents used for encryption
3
Q
- While a firewall is scanning an active session, how does it respond when it detects a change of application?
A. closes the session, opens a new one, and evaluates all Security policy rules again
B. closes the session, opens a new one, and evaluates the original matching Security policy
rule only
C. updates the application in the existing session and evaluates all Security policy rules again
D. updates the application in the existing session and continues to use the original action
from the first Security policy rule match
A
C. updates the application in the existing session and evaluates all Security policy rules again
4
Q
70. Which profile do you use for DLP based on file content? A. Antivirus B. Anti-Spyware C. Vulnerability Protection D. URL Filtering E. File Blocking F. WildFire Analysis G. Data Filtering
A
G. Data Filtering
5
Q
71. Which profile do you use to monitor DNS resolution lookups for sites associated with threat activity? A. Antivirus B. Anti-Spyware C. Vulnerability Protection D. URL Filtering E. File Blocking F. WildFire Analysis G. Data Filtering
A
B. Anti-Spyware
6
Q
72. Which profile do you use to analyze files for zero-day malware? A. Antivirus B. Anti-Spyware C. Vulnerability Protection D. URL Filtering E. File Blocking F. WildFire Analysis G. Data Filtering
A
F. WildFire Analysis
7
Q
73. Which profile do you use to examine browsing traffic for appropriate browsing policy enforcement? A. Antivirus B. Anti-Spyware C. Vulnerability Protection D. URL Filtering E. File Blocking F. WildFire Analysis G. Data Filtering
A
D. URL Filtering
8
Q
74. Which profile do you use to detect and block an executable file from being transferred through the firewall? A. Antivirus B. Anti-Spyware C. Vulnerability Protection D. URL Filtering E. File Blocking F. WildFire Analysis G. Data Filtering
A
E. File Blocking
9
Q
75. Which credential phishing prevention action allows users to choose to submit credentials to a site anyway? A. alert B. allow C. block D. continue
A
D. continue
10
Q
76. Which user credential detection method would work if multiple users share the same client IP address (for example, because of dynamic address translation done by a device on the internal side of the firewall)? A. IP-to-user mapping B. group mapping C. domain credential filter D. IP-and-port-to-user mapping
A
C. domain credential filter
11
Q
77. Which type of user credential detection must be used by a firewall administrator that wants to enable credential phishing prevention that blocks an attempt by a user to enter the organization’s user ID and password? A. IP-to-user mapping B. domain credential filter C. group mapping D. Citrix mapping
A
B. domain credential filter
12
Q
- Which security risk is elevated when port-based Security policy rules are used?
A. The firewall’s resources will be negatively impacted by processing unwanted traffic.
B. Unwanted applications can get through the firewall, bringing their vulnerabilities with
them.
C. The network is more vulnerable to TCP DoS attacks.
D. The firewall is more vulnerable to UDP DoS attacks.
A
B. Unwanted applications can get through the firewall, bringing their vulnerabilities with
them
13
Q
- What is the Palo Alto Networks suggested process for converting port-based Security policy rules to use App-ID?
A. Use the Expedition tool to analyze Traffic logs against Security policy to suggest policy changes.
B. Use the built-in firewall reports to identify applications found in the traffic and update policy based on desired traffic.
C. Use the Policy Optimizer feature of the firewall to identify applications and update policy rules.
D. Use the firewall’s New Applications Seen feature to identify applications and update policy rules.
A
C. Use the Policy Optimizer feature of the firewall to identify applications and update policy rules.
14
Q
- If App-ID is implemented in Security policy rules, should port numbers also be included?
A. No, App-ID-based Security policy rules detect and allow or block any desired application
using the included port number values in the App-ID database.
B. Yes, including the port numbers as a service-matching condition can eliminate some
traffic before App-ID processing, thus conserving firewall resources.
C. Yes, including an application-default setting in the service-matching condition requires
that applications use only known or typical port numbers.
D. No, App-ID based Security policy rules detect and allow or block any desired application
using the edited port number values in the App-ID database.
A
C. Yes, including an application-default setting in the service-matching condition requires that applications use only known or typical port numbers.
15
Q
- Which firewall tool provides settings and tools to convert policies from port-based to App-ID?
A. Network Monitor display under App Scope
B. Policy Optimizer under Policies
C. Application Hit Count under Policies
D. View Applications as Groups under Policies
A
B. Policy Optimizer under Policies
16
Q
- An administrator creates a Security policy rule that allows office-on-demand traffic through the firewall. After the change is committed, the firewall issues the following warning:
“vsys1: Rule ‘Allow Office apps’ application dependency warning:
Application ‘office-on-demand’ requires ‘ms-office365-base’ be allowed
Application ‘office-on-demand’ requires ‘sharepoint-online’ be allowed
Application ‘office-on-demand’ requires ‘ssl’ be allowed
Application ‘office-on-demand’ requires ‘web-browsing’ be allowed”
Which action should the administrator take?
A. create an application chain that include the dependencies
B. add the listed applications to the same Security policy rule
C. set the Service action of the rule to “dependent application default”
D. create a new Security policy rule for each listed application with an “allow” action higher in the rule list
A
B. add the listed applications to the same Security policy rule
17
Q
- The use of Dedicated Log Collectors instead of a mixed-mode Panorama for log collection provides which benefit?
A. Log processing is offloaded from the Panorama(s) that are managing firewalls.
B. Dedicated Log Collectors can forward logs to external sources which Panorama cannot do.
C. Dedicated Log Collectors can have more disk drives installed to increase log storage and Panorama cannot.
D. Dedicated Log Collectors provide store-and-forward support of logging data being sent to Panorama.
A
A. Log processing is offloaded from the Panorama(s) that are managing firewalls.
18
Q
- Which statement is true about the Dedicated Log Collector’s processing of firewall log data?
A. Dedicated Log Collectors receive, compress, and batch log data transmission to
Panorama.
B. Dedicated Log Collectors process firewall logging data and send summary data to
Panorama summary reporting databases.
C. Dedicated Log Collectors filter collected log data and forward desired alerts to Panorama.
D. Dedicated Log Collectors store firewall log data and provide query responses from Panorama on demand.
A
D. Dedicated Log Collectors store firewall log data and provide query responses from Panorama on demand.
19
Q
- Which two options will provide an enterprise-wide log that can be viewed from Panorama? (Choose two.)
A. Select firewalls are designated as Log Collectors and add logs forwarded from other firewalls to their own.
B. Panorama devices are configured as Dedicated Log Collectors that then are added to Log Collector Groups. Firewalls forward logs to a designated Log Collector within a Collector Group.
C. Cortex Data Lake is configured as a Log Collector in Panorama. Firewalls forward logs to Cortex Data Lake.
D. A Panorama device is configured in Management Mode and a Log Collector is defined on the Panorama appliance, which then is added to a Log Collector Group. Firewalls forward logs to a designated Log Collector within a Collector Group.
A
B. Panorama devices are configured as Dedicated Log Collectors that then are added to Log Collector Groups. Firewalls forward logs to a designated Log Collector within a Collector Group.
C. Cortex Data Lake is configured as a Log Collector in Panorama. Firewalls forward logs to
Cortex Data Lake.
20
Q
86. Which configuration is performed first on a firewall with factory default settings, according to Palo Alto Networks best practices? A. add licenses B. update PAN-OS software C. configure the management network port D. update dynamic update files
A
C. configure the management network port
21
Q
- You finished configuring the firewall’s basic connectivity in the lab and are ready to put it in the data center. What do you have to remember to do before you power down the firewall?
A. Save the changes.
B. Commit the changes.
C. Create a restore thumb drive in case the configuration is deleted.
D. Verify that the configuration is correct. You do not need to do anything else if it is
correct; the configuration is updated automatically.
A
B. Commit the changes.
22
Q
88. The firewall’s MGT port can be configured as which type of interface? A. Layer 2 B. Layer 3 C. virtual wire D. serial
A
B. Layer 3
23
Q
89. Which CLI command provides High Availability active/passive status of a firewall? A. show high-availability all B. show high-availability status C. show system state D. show system high-availability all
A
A. show high-availability all
24
Q
90. Which function can be performed directly in the High Availability widget? A. synchronize dynamic update files B. synchronize log files C. synchronize firewall configurations D. trigger an immediate failover
A
C. synchronize firewall configurations
25
Q
- Which two steps must be completed to enable the display of the Dashboard’s High Availability widget?
A. log in to the firewall management web interface and configure HA for active/active or active/passive
B. log in to the firewall management web interface and click the Sync to peer link in the firewall HA configuration settings
C. log in to the firewall’s CLI and enter the get management-server logging on command
D. select and enable the High Availability widget in the firewall’s management web interface Dashboard display
A
A. log in to the firewall management web interface and configure HA for active/active or
active/passive
D. select and enable the High Availability widget in the firewall’s management web interface Dashboard display
