Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

p11 > Q_126-150 > Flashcards

Q_126-150 Flashcards

1
Q

Question #126 Topic 1
Which GlobalProtect Client connect method requires the distribution and use of machine certificates?
A. At-boot
B. Pre-logon
C. User-logon (Always on)
D. On-demand

A

B. Pre-logon

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Question #127 Topic 1
Which feature can provide NGFWs with User-ID mapping information?
A. Web Captcha
B. Native 802.1q authentication
C. GlobalProtect
D. Native 802.1x authentication

A

C. GlobalProtect

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Question #128 Topic 1
Which Panorama administrator types require the configuration of at least one access domain? (Choose two.)
A. Role Based
B. Custom Panorama Admin
C. Device Group
D. Dynamic
E. Template Admin

A

C. Device Group

E. Template Admin

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Question #129 Topic 1
Which option enables a Palo Alto Networks NGFW administrator to schedule Application and Threat updates while applying only new content-IDs to traffic?
A. Select download-and-install
B. Select download-only
C. Select download-and-install, with ג€Disable new apps in content update ג€ selected
D. Select disable application updates and select ג€Install only Threat updates

A

A. Select download-and-install

“old” content id is already installed…
trick

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

!!!! uncertain Question #130 Topic 1
Which is the maximum number of samples that can be submitted to WildFire per day, based on a WildFire subscription?
A. 10,000
B. 15,000
C. 7,500
D. 5,000

A

A. 10,000

answer is 1000 however its not listed in the choices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Question #131 Topic 1
In which two types of deployment is active/active HA configuration supported? (Choose two.)
A. Layer 3 mode
B. TAP mode
C. Virtual Wire mode
D. Layer 2 mode

A

A. Layer 3 mode

C. Virtual Wire mode

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Question #132 Topic 1
For which two reasons would a firewall discard a packet as part of the packet flow sequence? (Choose two.)
A. ingress processing errors
B. rule match with action ג€deny €ג
C. rule match with action ג€allow €ג
D. equal-cost multipath

A

A. ingress processing errors
B. rule match with action deny

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Question #133 Topic 1
Which logs enable a firewall administrator to determine whether a session was decrypted?
A. Traffic
B. Security Policy
C. Decryption
D. Correlated Event

A

A. Traffic

could be decryption log…arggg

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Question #134 Topic 1
An administrator needs to upgrade an NGFW to the most current version of PAN-OS®ֲ software. The following is occurring:
✑ Firewall has internet connectivity through e 1/1.
✑ Default security rules and security rules allowing all SSL and web-browsing traffic to and from any zone.
✑ Service route is configured, sourcing update traffic from e1/1.
✑ A communication error appears in the System logs when updates are performed.
✑ Download does not complete.
What must be configured to enable the firewall to download the current version of PAN-OS software?
A. Static route pointing application PaloAlto-updates to the update servers
B. Security policy rule allowing PaloAlto-updates as the application
C. Scheduler for timed downloads of PAN-OS software
D. DNS settings for the firewall to use for resolution

A

D. DNS settings for the firewall to use for resolution

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Question #135 Topic 1
A client has a sensitive application server in their data center and is particularly concerned about session flooding because of denial-of-service
attacks.
How can the Palo Alto Networks NGFW be configured to specifically protect this server against session floods originating from a single IP
address?
A. Add an Anti-Spyware Profile to block attacking IP address
B. Define a custom App-ID to ensure that only legitimate application traffic reaches the server
C. Add QoS Profiles to throttle incoming requests
D. Add a tuned DoS Protection Profile

A

D. Add a tuned DoS Protection Profile

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Question #136 Topic 1
An administrator deploys PA-500 NGFWs as an active/passive high availability pair. The devices are not participating in dynamic routing, and preemption is disabled.
What must be verified to upgrade the firewalls to the most recent version of PAN-OS®ֲ software?
A. Antivirus update package.
B. Applications and Threats update package.
C. User-ID agent.
D. WildFire update package.

A

B. Applications and Threats update package.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Question #137 Topic 1
A firewall administrator has been asked to configure a Palo Alto Networks NGFW to prevent against compromised hosts trying to phone-home or beacon out to external command-and-control (C2) servers.
Which Security Profile type will prevent these behaviors?
A. Anti-Spyware
B. WildFire
C. Vulnerability Protection
D. Antivirus

A

A. Anti-Spyware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

!!OLD Question #138 Topic 1
What should an administrator consider when planning to revert Panorama to a pre-PAN-OS 8.1 version?
A. Panorama cannot be reverted to an earlier PAN-OS release if variables are used in templates or template stacks.
B. An administrator must use the Expedition tool to adapt the configuration to the pre-PAN-OS 8.1 state.
C. When Panorama is reverted to an earlier PAN-OS release, variables used in templates or template stacks will be removed automatically.
D. Administrators need to manually update variable characters to those used in pre-PAN-OS 8.1.

A

A. Panorama cannot be reverted to an earlier PAN-OS release if variables are used in templates or template stacks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Question #139 Topic 1
Which two methods can be configured to validate the revocation status of a certificate? (Choose two.)
A. CRL
B. CRT
C. OCSP
D. Cert-Validation-Profile
E. SSL/TLS Service Profile

A

A. CRL

C. OCSP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Question #140 Topic 1
Which administrative authentication method supports authorization by an external service?
A. Certificates
B. LDAP
C. RADIUS
D. SSH keys

A

C. RADIUS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Question #141 Topic 1
Which three file types can be forwarded to WildFire for analysis as a part of the basic WildFire service? (Choose three.)
A. .dll
B. .exe
C. .fon
D. .apk
E. .pdf
F. .jar

A

A. .dll
B. .exe
C. .fon

17
Q

Question #142 Topic 1
An administrator has been asked to configure active/active HA for a pair of firewalls. The firewalls use Layer 3 interfaces to send traffic to a single
gateway IP for the pair.
Which configuration will enable this HA scenario?
A. The two firewalls will share a single floating IP and will use gratuitous ARP to share the floating IP.
B. Each firewall will have a separate floating IP, and priority will determine which firewall has the primary IP.
C. The firewalls do not use floating IPs in active/active HA.
D. The firewalls will share the same interface IP address, and device 1 will use the floating IP if device 0 fails.
Correct

A

A. The two firewalls will share a single floating IP and will use gratuitous ARP to share the floating IP.

Single gateway means a shared singel floating IP

18
Q

!! IGNORE Question #143 Topic 1
Which version of GlobalProtect supports split tunneling based on destination domain, client process, and HTTP/HTTPS video streaming
application?
A. GlobalProtect version 4.0 with PAN-OS 8.1
B. GlobalProtect version 4.1 with PAN-OS 8.1
C. GlobalProtect version 4.1 with PAN-OS 8.0
D. GlobalProtect version 4.0 with PAN-OS 8.0

A

!! IGNORE
B. GlobalProtect version 4.1 with PAN-OS 8.1

19
Q

Question #144 Topic 1
How does Panorama prompt VMWare NSX to quarantine an infected VM?
A. HTTP Server Profile
B. Syslog Server Profile
C. Email Server Profile
D. SNMP Server Profile

A

A. HTTP Server Profile

20
Q

Question #145 Topic 1
An administrator accidentally closed the commit window/screen before the commit was finished. Which two options could the administrator use
to verify the progress or success of that commit task? (Choose two.)
A: System Log (shows informational severity)
B. Traffic Log
C. System log (filtered “link-change”)
D: Task manager

A

A: System Log

D: Task manager

note the pics. Commit is NOT in a link-change filtered system log

21
Q

Question #146 Topic 1
Which two actions would be part of an automatic solution that would block sites with untrusted certificates without enabling SSL Forward Proxy? (Choose two.)
A. Create a no-decrypt Decryption Policy rule.
B. Configure a Dynamic Address Group for untrusted sites.
C. Create a Security Policy rule with a vulnerability Security Profile attached.
D. Enable the ג€Block sessions with untrusted issuers ג€ setting.

A

(Choose two.)
A. Create a no-decrypt Decryption Policy rule.

D. Enable the ג€Block sessions with untrusted issuers ג€ setting.

22
Q

Question #147 Topic 1
An administrator is defining protection settings on the Palo Alto Networks NGFW to guard against resource exhaustion. When platform utilization is considered, which steps must the administrator take to configure and apply packet buffer protection?
A. Enable and configure the Packet Buffer Protection thresholds. Enable Packet Buffer Protection per ingress zone.
B. Enable and then configure Packet Buffer thresholds. Enable Interface Buffer protection.
C. Create and Apply Zone Protection Profiles in all ingress zones. Enable Packet Buffer Protection per ingress zone.
D. Configure and apply Zone Protection Profiles for all egress zones. Enable Packet Buffer Protection per egress zone.
E. Enable per-vsys Session Threshold alerts and triggers for Packet Buffer Limits. Enable Zone Buffer Protection per zone.

A

A. Enable and configure the Packet Buffer Protection thresholds. Enable Packet Buffer Protection per ingress zone.

23
Q

Question #148 Topic 1
What is the purpose of the firewall decryption broker?
A. decrypt SSL traffic and then send it as cleartext to a security chain of inspection tools.
B. force decryption of previously unknown cipher suites
C. reduce SSL traffic to a weaker cipher before sending it to a security chain of inspection tools.
D. inspect traffic within IPsec tunnels

A

A. decrypt SSL traffic and then send it as cleartext to a security chain of inspection tools.

24
Q

Question #149 Topic 1
SAML SLO is supported for which two firewall features? (Choose two.)
A. GlobalProtect Portal
B. CaptivePortal
C. WebUI
D. CLI

A

A. GlobalProtect Portal

C. WebUI

25
Q

Question #150 Topic 1
What are the two behavior differences between Highlight Unused Rules and the Rule Usage Hit counter when a firewall is rebooted? (Choose two.)
A. Rule Usage Hit counter will not be reset.
B. Highlight Unused Rules will highlight all rules.
C. Highlight Unused Rules will highlight zero rules.
D. Rule Usage Hit counter will reset

A

A. Rule Usage Hit counter will not be reset.

B. Highlight Unused Rules will highlight all rules.

p11 (26 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions