Q_276-300 Flashcards
Question #276 Topic 1
A network security engineer is attempting to peer a virtual router on a PAN-OS firewall with an external router using the BGP protocol. The peer
relationship is not establishing. What command could the engineer run to see the current state of the BGP state between the two devices?
A. show routing protocol bgp rib-out
B. show routing protocol bgp peer
C. show routing protocol bgp summary
D. show routing protocol bgp state
B. show routing protocol bgp peer
Probably B is a little bit more correct answer as the output is split by peers with additional details and there is also an option to add “peer-name
<name>" which will filter output for only specific peer, summary shows them all
</name>
Question #277 Topic 1
What is the best description of the HA4 Keep-alive Threshold (ms)?
A. the timeframe that the local firewall waits before going to Active state when another cluster member is preventing the cluster from fully
synchronizing
B. the timeframe within which the firewall must receive keepalives from a cluster member to know that the cluster member is functional
C. the maximum interval between hello packets that are sent to verify that the HA functionality on the other firewall is operational
D. the time that a passive or active-secondary firewall will wait before taking over as the active or active-primary firewall
B. the timeframe within which the firewall must receive keepalives from a cluster member to know that the cluster member is functional
Question #278 Topic 1
An engineer is tasked with enabling SSL decryption across the environment. What are three valid parameters of an SSL Decryption policy?
(Choose three.)
A. GlobalProtect HIP
B. source users
C. App-ID
D. URL categories
E. source and destination IP addresses
/—-??—-/
B. source users
D. URL categories
E. source and destination IP addresses
Question #279 Topic 1
An engineer is configuring Packet Buffer Protection on ingress zones to protect from single-session DoS attacks. Which sessions does Packet
Buffer Protection apply to?
A. It applies to existing sessions and is not global
B. It applies to existing sessions and is global
C. It applies to new sessions and is global
D. It applies to new sessions and is not global
B. It applies to existing sessions and is global
/—-??—-/
Question #280 Topic 1
What are two best practices for incorporating new and modified App-IDs? (Choose two.)
A. Run the latest PAN-OS version in a supported release tree to have the best performance for the new App-IDs
B. Study the release notes and install new App-IDs if they are determined to have low impact
C. Configure a security policy rule to allow new App-IDs that might have network-wide impact
D. Perform a Best Practice Assessment to evaluate the impact of the new or modified App-IDs
B. Study the release notes and install new App-IDs if they are determined to have low impact
C. Configure a security policy rule to allow new App-IDs that might have network-wide impact
Question #281 Topic 1
The manager of the network security team has asked you to help configure the company’s Security Profiles according to Palo Alto Networks best
practice. As part of that effort, the manager has assigned you the Vulnerability Protection profile for the Internet gateway firewall. Which action
and packet-capture setting for items of high severity and critical severity best matches Palo Alto Networks best practice?
A. action ‘reset-server’ and packet capture ‘disable’
B. action ‘default’ and packet capture ‘single-packet’
C. action ‘reset-both’ and packet capture ‘extended-capture’
D. action ‘reset-both’ and packet capture ‘single-packet’
D. action ‘reset-both’ and packet capture ‘single-packet’
https://docs.paloaltonetworks.com/best-practices/internet-gateway-best-practices/best-practice-internet-gateway-security-policy/create-best-practice-security-profiles
Question #282 Topic 1
An engineer needs to redistribute User-ID mappings from multiple data centers. Which data flow best describes redistribution of user mappings?
A. User-ID agent to firewall
B. firewall to firewall
C. Domain Controller to User-ID agent
D. User-ID agent to Panorama
B. firewall to firewall
Question #283 Topic 1
An administrator is attempting to create policies for deployment of a device group and template stack. When creating the policies, the zone dropdown
list does not include the required zone. What must the administrator do to correct this issue?
A. Add a firewall to both the device group and the template
B. Add the template as a reference template in the device group
C. Enable “Share Unused Address and Service Objects with Devices” in Panorama settings
D. Specify the target device as the master device in the device group
B. Add the template as a reference template in the device group
Question #284 Topic 1
What best describes the HA Promotion Hold Time?
A. the time that the passive firewall will wait before taking over as the active firewall after communications with the HA peer have been lost
B. the time that is recommended to avoid a failover when both firewalls experience the same link/path monitor failure simultaneously
C. the time that is recommended to avoid an HA failover due to the occasional flapping of neighboring devices
D. the time that a passive firewall with a low device priority will wait before taking over as the active firewall it the firewall is operational again
A. the time that the passive firewall will wait before taking over as the active firewall after communications with the HA peer have been lost
Question #285 Topic 1
A user at an internal system queries the DNS server for their web server with a private IP of 10.250.241.131 in the DMZ. The DNS server returns an
address of the web servers public address, 200.1.1.10. In order to reach the web server, which security rule and U-Turn NAT rule must be
configured on the firewall?
no graphic
A. NAT Rule: Source Zone: Untrust_L3 Source IP: Any Destination Zone: DMZ Destination IP: 200.1.1.10 Destination Translation address:
10.250.241.131 Security Rule: Source IP: Any Destination Zone: DMZ Destination IP: 10.250.241.131
B. NAT Rule: Source Zone: Trust_L3 Source IP: Any Destination Zone: DMZ Destination IP: 200.1.1.10 Destination Translation address:
10.250.241.131 Security Rule: Source Zone: Untrust-L3 Source IP: Any Destination Zone: DMZ Destination IP: 10.250.241.131
C. NAT Rule: Source Zone: Untrust_L3 Source IP: Any Destination Zone: Untrust_L3 Destination IP: 200.1.1.10 Destination Translation address:
10.250.241.131 Security Rule: Source Zone: Untrust-L3 Source IP: Any Destination Zone: DMZ Destination IP: 10.250.241.131
D. NAT Rule: Source Zone: Trust_L3 Source IP: Any Destination Zone: Untrust_L3 Destination IP: 200.1.1.10 Destination Translation address:
10.250.241.131 Security Rule: Source Zone: Trust-L3 Source IP: Any Destination Zone: DMZ Destination IP: 200.1.1.10
D. NAT Rule: Source Zone: Trust_L3 Source IP: Any Destination Zone: Untrust_L3 Destination IP: 200.1.1.10 Destination Translation address:
10.250.241.131 Security Rule: Source Zone: Trust-L3 Source IP: Any Destination Zone: DMZ Destination IP: 200.1.1.10
separated for easier read
NAT Rule: Source Zone: Trust_L3 Source IP: Any Destination Zone: Untrust_L3 Destination IP: 200.1.1.10 Destination Translation address:
10.250.241.131 (typo in doc should be 10.50.241.131 ARGGGG)
Security Rule: Source Zone: Trust-L3 Source IP: Any Destination Zone: DMZ Destination IP: 200.1.1.10
NOTE: had to be this one,,,
In Sec Rule- always use final Zone with in-packet IP
(DMZ) with IP 200.1.1.10)
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClEiCAK
Question #286 Topic 1
What is considered the best practice with regards to zone protection?
A. Use separate log-forwarding profiles to forward DoS and zone threshold event logs separately from other threat logs
B. Review DoS threat activity (ACC > Block Activity) and look for patterns of abuse
C. Set the Alarm Rate threshold for event-log messages to high severity or critical severity
D. If the levels of zone and DoS protection consume too many firewall resources, disable zone protection
A. Use separate log-forwarding profiles to forward DoS and zone threshold event logs separately from other threat logs
https://docs.paloaltonetworks.com/best-practices/dos-and-zone-protection-best-practices/dos-and-zone-protection-best-practices/follow-post-deployment-dos-and-zone-protection-best-practices
Question #287 Topic 1
An administrator allocates bandwidth to a Prisma Access Remote Networks compute location with three remote networks. What is the minimum
amount of bandwidth the administrator could configure at the compute location?
A. 90Mbps
B. 75Mbps
C. 50Mbps
D. 300Mbps
C. 50Mbps
https://docs.paloaltonetworks.com/prisma/prisma-access/3-2/prisma-access-panorama-admin/prisma-access-for-networks/configure-prisma-access-for-networks/configure-bandwidth-by-compute-location#id2a91f76f-db22-4c25-8c25-91db3701d860
Question #288 Topic 1
An engineer must configure the Decryption Broker feature. Which Decryption Broker security chain supports bi-directional traffic flow?
A. Layer 2 security chain
B. Layer 3 security chain
C. Transparent Bridge security chain
D. Transparent Proxy security chai
B. Layer 3 security chain
Question #289 Topic 1
An administrator is using Panorama to manage multiple firewalls. After upgrading all devices to the latest PAN-OS software, the administrator
enables log forwarding from the firewalls to Panorama. However, pre-existing logs from the firewalls are not appearing in Panorama. Which action
should be taken to enable the firewalls to send their pre-existing logs to Panorama?
A. Use the import option to pull logs.
B. Use the scp logdb export command.
C. Export the log database.
D. Use the ACC to consolidate the logs.
C. Export the log database.
Answer C is correct, logdb stands for log database, but the command syntax in answer B is wrong:
scp export logdb ===> is good
scp logdb export ===> is not an option from the CLI
Question #290 Topic 1
A prospect is eager to conduct a Security Lifecycle Review (SLR) with the aid of the Palo Alto Networks NGFW. Which interface type is best suited
to provide the raw data for an SLR from the network in a way that is minimally invasive?
A. Layer 2
B. Virtual Wire
C. Tap
D. Layer 3
C. Tap
this is how evals were done..
