Q_426-450 Flashcards
Question #426 Topic 1
An engineer is designing a deployment of multi-vsys firewalls.
What must be taken into consideration when designing the device group structure?
A. Only one vsys or one firewall can be assigned to a device group, and a multi-vsys firewall can have each vsys in a different device group.
B. Multiple vsys and firewalls can be assigned to a device group, and a multi-vsys firewall can have each vsys in a different device group.
C. Multiple vsys and firewalls can be assigned to a device group. and a multi-vsys firewall must have all its vsys in a single device group.
D. Only one vsys or one firewall can be assigned to a device group, except for a multi-vsys firewall, which must have all its vsys in a single
device group.
A. Only one vsys or one firewall can be assigned to a device group, and a multi-vsys firewall can have each vsys in a different device group.
You can assign any one firewall or virtual system (vsys) to only one device group.
Question #427 Topic 1
An engineer needs to collect User-ID mappings from the company’s existing proxies.
What two methods can be used to pull this data from third party proxies? (Choose two.)
A. Client probing
B. XFF Headers
C. Syslog
D. Server Monitoring
B. XFF Headers
C. Syslog
Question #428 Topic 1
An engineer needs to configure SSL Forward Proxy to decrypt traffic on a PA-5260. The engineer uses a forward trust certificate from the
enterprise PKI that expires December 31, 2025.
The validity date on the PA-generated certificate is taken from what?
A. The root CA
B. The untrusted certificate
C. The server certificate
D. The trusted certificate
C. The server certificate
the validity date on the Palo Alto Networks firewall generated certificate is taken from the validity date on the real server certificate.
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm8wCAC
Question #429 Topic 1
A network administrator is troubleshooting an issue with Phase 2 of an IPSec VPN tunnel. The administrator determines that the lifetime needs to
be changed to match the peer.
Where should this change be made?
A. IKE Gateway profile
B. IPSec Crypto profile
C. IKE Crypto profile
D. IPSec Tunnel settings
B. IPSec Crypto profile
Question #430 Topic 1
Which statement about High Availability timer settings is true?
A. Use the Moderate timer for typical failover timer settings.
B. Use the Critical timer for faster failover timer settings.
C. Use the Aggressive timer for faster failover timer settings.
D. Use the Recommended timer for faster failover timer settings.
C. Use the Aggressive timer for faster failover timer settings.
Question #431 Topic 1
A firewall administrator is trying to identify active routes learned via BGP in the virtual router runtime stats within the GUI.
Where can they find this information?
A. Routes listed in the routing table with flags Oi
B. Routes listed in the routing table with flags A?B
C. Under the BGP Summary tab
D. Routes listed in the forwarding table with BGP in the Protocol column
B. Routes listed in the routing table with flags A?B
A?B—Active and learned via BGP
Question #432 Topic 1
An engineer decides to use Panorama to upgrade devices to PAN-OS 10.2.
Which three platforms support PAN-OS 10.2? (Choose three.)
A. PA-220
B. PA-800 Series
C. PA-5000 Series
D. PA-500
E. PA-3400 Series
A. PA-220
B. PA-800 Series
E. PA-3400 Series
PA-500 and PA-5000 EOL
Question #433 Topic 1
As a best practice, logging at session start should be used in which case?
A. While troubleshooting
B. Only on Deny rules
C. Only when log at session end is enabled
D. On all Allow rules
A. While troubleshooting
Question #434 Topic 1
What must be configured to apply tags automatically to User-ID logs?
A. User mapping
B. Log Forwarding profile
C. Log settings
D. Group mapping
C. Log settings
For User-ID, GlobalProtect, and IP-Tag logs, configure the log settings.
https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/policy/use-auto-tagging-to-automate-security-actions
Question #435 Topic 1
The profile is configured to provide granular defense against targeted flood attacks for specific critical systems that are accessed by users from
the internet.
Which profile is the engineer configuring?
A. Vulnerability Protection
B. DoS Protection
C. Packet Buffer Protection
D. Zone Protection
B. DoS Protection
Question #436 Topic 1
Which states will a pair of firewalls be in if their HA Group ID is mismatched?
A. Active/Non-functional
B. Active/Passive
C. Init/Init
D. Active/Active
A. Active/Non-functional
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PN3kCAG&lang=en_US%E2%80%A9
Question #437 Topic 1
An engineer troubleshooting a site-to-site VPN finds a Security policy dropping the peer’s IKE traffic at the edge firewall. Both VPN peers are
behind a NAT, and NAT-T is enabled.
How can the engineer remediate this issue?
A. Add a Security policy to allow UDP/500.
B. Add a Security policy to allow the IKE application.
C. Add a Security policy to allow the IPSec application.
D. Add a Security policy to allow UDP/4501.
C. Add a Security policy to allow the IPSec application.
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClivCAC
if NAT-T is enabled, packets will be on port 4500 instead of 500 from the 5th and 6th messages , IPSec -esp-udp - udp4500/4501
Question #438 Topic 1
An administrator wants to grant read-only access to all firewall settings, except administrator accounts, to a new-hire colleague in the IT
department.
Which dynamic role does the administrator assign to the new-hire colleague?
A. Superuser (read-only)
B. Device administrator (read-only)
C. Firewall administrator (read-only)
D. System administrator (read-only)
B. Device administrator (read-only)
Device administrator (read-only)—Has read-only access to all firewall settings except password profiles (no access) and administrator accounts (only the logged in account is visible).
Only Superuser and Devie admin are “Dynamic Roles”
Question #439 Topic 1
An engineer has been given approval to upgrade their environment to PAN-OS 10.2.
The environment consists of both physical and virtual firewalls, a virtual Panorama HA pair, and virtual log collectors.
What is the recommended order when upgrading to PAN-OS 10.2?
A. Upgrade the firewalls, upgrade log collectors, upgrade Panorama
B. Upgrade the firewalls, upgrade Panorama, upgrade the log collectors
C. Upgrade the log collectors, upgrade the firewalls, upgrade Panorama
D. Upgrade Panorama, upgrade the log collectors, upgrade the firewalls
D. Upgrade Panorama, upgrade the log collectors, upgrade the firewalls
Question #440 Topic 1 m /—graphics—/
Review the screenshot of the Certificates page.
An administrator for a small LLC has created a series of certificates as shown, to use for a planned Decryption roll out. The administrator has also
installed the self-signed root certificate in all client systems.
When testing, they noticed that every time a user visited an SSL site, they received unsecured website warnings.
What is the cause of the unsecured website warnings?
A. The forward trust certificate has not been signed by the self-singed root CA certificate.
B. The forward trust certificate has not been installed in client systems.
C. The forward untrust certificate has not been signed by the self-singed root CA certificate.
D. The self-signed CA certificate has the same CN as the forward trust and untrust certificates
A. The forward trust certificate has not been signed by the self-singed root CA certificate.
