q_51-75

Question 1

Question #51 Topic 1
An administrator has users accessing network resources through Citrix XenApp 7.x.
Which User-ID mapping solution will map multiple users who are using Citrix to connect to the network and access resources?
A. Client Probing
B. Terminal Services agent
C. GlobalProtect
D. Syslog Monitoring

Answer 1

B. Terminal Services agent

Question 2

Question #52 Topic 1
An administrator needs to upgrade a Palo Alto Networks NGFW to the most current version of PAN-OS®ֲ software. The firewall has internet connectivity through an Ethernet interface, but no internet connectivity from the management interface. The Security policy has the default security rules and a rule that allows all web- browsing traffic from any to any zone. What must the administrator configure so that the PAN-OS®ֲ software can be upgraded?
A. Security policy rule
B. CRL
C. Service route
D. Scheduler

Answer 2

C. Service route

Question 3

Question #53 Topic 1
Which feature prevents the submission of corporate login information into website forms?
A. Data filtering
B. User-ID
C. File blocking
D. Credential phishing prevention

Answer 3

D. Credential phishing prevention

Question 4

Question #54 Topic 1
Which option is part of the content inspection process?
A. Packet forwarding process
B. SSL Proxy re-encrypt
C. IPsec tunnel encryption
D. Packet egress process

Answer 4

B. SSL Proxy re-encrypt

Question 5

Question #55 Topic 1
In a virtual router, which object contains all potential routes?
A. MIB
B. RIB
C. SIP
D. FIB

Answer 5

B. RIB

Question 6

Question #56 Topic 1
An administrator creates an SSL decryption rule decrypting traffic on all ports. The administrator also creates a Security policy rule allowing only the applications DNS, SSL, and web-browsing.
The administrator generates three encrypted BitTorrent connections and checks the Traffic logs. There are three entries. The first entry shows traffic dropped as application Unknown. The next two entries show traffic allowed as application SSL. Which action will stop the second and subsequent encrypted BitTorrent connections from being allowed as SSL?
A. Create a decryption rule matching the encrypted BitTorrent traffic with action No-Decrypt, and place the rule at the top of the
Decryption policy.
B. Create a Security policy rule that matches application encrypted BitTorrent and place the rule at the top of the Security policy.
C. Disable the exclude cache option for the firewall.
D. Create a Decryption Profile to block traffic using unsupported cyphers, and attach the profile to the decryption rule.

Answer 6

D. Create a Decryption Profile to block traffic using unsupported cyphers, and attach the profile to the decryption rule.

D is Correct
There is no application called “encrypted BitTorrent” so “B” is out
“A” would not work either since you would still need to create a Decryption Profile which is not mentioned.
“D” is the most complete answer which is to create the Decryption Profile and attach it to the Decryption rule.

Question 7

Question #57 Topic 1
Refer to the exhibit.
Which certificates can be used as a Forward Trust certificate?
A. Certificate from Default Trust Certificate Authorities
B. Domain Sub-CA
C. Forward-Trust
D. Domain-Root-Cert

Answer 7

B. Domain Sub-CA

Question 8

Question #58 Topic 1
Which option would an administrator choose to define the certificate and protocol that Panorama and its managed devices use for SSL/TLS
services?
A. Configure a Decryption Profile and select SSL/TLS services.
B. Set up SSL/TLS under Policies > Service/URL Category > Service.
C. Set up Security policy rule to allow SSL communication.
D. Configure an SSL/TLS Profile.

Answer 8

D. Configure an SSL/TLS Profile.

Question 9

Question #59 Topic 1
Which menu item enables a firewall administrator to see details about traffic that is currently active through the NGFW?
A. ACC
B. System Logs
C. App Scope
D. Session Browser

Answer 9

D. Session Browser

Question 10

Question #60 Topic 1
Which protection feature is available only in a Zone Protection Profile?
A. SYN Flood Protection using SYN Flood Cookies
B. ICMP Flood Protection
C. Port Scan Protection
D. UDP Flood Protections

Answer 10

C. Port Scan Protection

Question 11

Question #61 Topic 1
Which CLI command can be used to export the tcpdump capture?
A. scp export tcpdump from mgmt.pcap to < username@host:path>
B. scp extract mgmt-pcap from mgmt.pcap to < username@host:path>
C. scp export mgmt-pcap from mgmt.pcap to < username@host:path>
D. download mgmt-pcap

Answer 11

C. scp export mgmt-pcap from mgmt.pcap to < username@host:path>

Question 12

Question #62 Topic 1
An administrator has configured the Palo Alto Networks NGFW’s management interface to connect to the internet through a dedicated path that does not traverse back through the NGFW itself.
Which configuration setting or step will allow the firewall to get automatic application signature updates?
A. A scheduler will need to be configured for application signatures.
B. A Security policy rule will need to be configured to allow the update requests from the firewall to the update servers.
C. A Threat Prevention license will need to be installed.
D. A service route will need to be configured.

Answer 12

A. A scheduler will need to be configured for application signatures.

attentionto detail
It clearly says the Mgmt interface has internet access, not through the firewall

Question 13

Question #63 Topic 1
Which three options are supported in HA Lite? (Choose three.)
A. Virtual link
B. Active/passive deployment
C. Synchronization of IPsec security associations
D. Configuration synchronization
E. Session synchronization

Answer 13

B. Active/passive deployment
C. Synchronization of IPsec security associations
D. Configuration synchronization

Question 14

Question #64 Topic 1
Which CLI command enables an administrator to view details about the firewall including uptime, PAN-OS®ֲ version, and serial number?
A. debug system details
B. show session info
C. show system info
D. show system details

Answer 14

C. show system info

Question 15

Question #65 Topic 1
During the packet flow process, which two processes are performed in application identification? (Choose two.)
A. Pattern based application identification
B. Application override policy match
C. Application changed from content inspection
D. Session application identified

Answer 15

!!READ CLOSER!!!
A. Pattern based application identification
B. Application override policy match

Question 16

Question #66 Topic 1
Which tool provides an administrator the ability to see trends in traffic over periods of time, such as threats detected in the last 30 days?
A. Session Browser
B. Application Command Center
C. TCP Dump
D. Packet Capture

Answer 16

B. Application Command Center

Question 17

Question #67 Topic 1
The certificate information displayed in the following image is for which type of certificate?
((only CA box is checked)
A. Forward Trust certificate
B. Self-Signed Root CA certificate
C. Web Server certificate
D. Public CA signed certificate

Answer 17

B. Self-Signed Root CA certificate

crappy graphic questions…

Question 18

Question #68 Topic 1
Which three steps will reduce the CPU utilization on the management plane? (Choose three.)
A. Disable SNMP on the management interface.
B. Application override of SSL application.
C. Disable logging at session start in Security policies.
D. Disable predefined reports.
E. Reduce the traffic being decrypted by the firewall.

Answer 18

A. Disable SNMP on the management interface.

C. Disable logging at session start in Security policies.
D. Disable predefined reports.

Question 19

Question #69 Topic 1
Which feature must you configure to prevent users from accidentally submitting their corporate credentials to a phishing website?
A. URL Filtering profile
B. Zone Protection profile
C. Anti-Spyware profile
D. Vulnerability Protection profile

Answer 19

A. URL Filtering profile

Question 20

Question #70 Topic 1
How can a candidate or running configuration be copied to a host external from Panorama?
A. Commit a running configuration.
B. Save a configuration snapshot.
C. Save a candidate configuration.
D. Export a named configuration snapshot.

Answer 20

D. Export a named configuration snapshot.

Question 21

Question #71 Topic 1
If an administrator does not possess a website’s certificate, which SSL decryption mode will allow the Palo Alto Networks NGFW to inspect traffic when users browse to HTTP(S) websites?
A. SSL Forward Proxy
B. SSL Inbound Inspection
C. SSL Reverse Proxy
D. SSL Outbound Inspection

Answer 21

A. SSL Forward Proxy

Vs. SSL Inbound Inspection where you have the Website cert.

Question 22

Question #72 Topic 1
An administrator sees several inbound sessions identified as unknown-tcp in the Traffic logs. The administrator determines that these sessions are form external users accessing the company’s proprietary accounting application. The administrator wants to reliably identify this traffic as their accounting application and to scan this traffic for threats. Which option would achieve this result?
A. Create a custom App-ID and enable scanning on the advanced tab.
B. Create an Application Override policy.
C. Create a custom App-ID and use the ג€ordered conditions ג€ check box.
D. Create an Application Override policy and a custom threat signature for the application.

Answer 22

A. Create a custom App-ID and enable scanning on the advanced tab.

Question 23

Question #73 Topic 1
The administrator has enabled BGP on a virtual router on the Palo Alto Networks NGFW, but new routes do not seem to be populating the virtual router. Which two options would help the administrator troubleshoot this issue? (Choose two.)

A. View the System logs and look for the error messages about BGP.
B. Perform a traffic pcap on the NGFW to see any BGP problems.
C. View the Runtime Stats and look for problems with BGP configuration.
D. View the ACC tab to isolate routing issues.

Answer 23

B. Perform a traffic pcap on the NGFW to see any BGP problems.
C. View the Runtime Stats and look for problems with BGP configuration.

Question 24

Question #74 Topic 1
An administrator has enabled OSPF on a virtual router on the NGFW. OSPF is not adding new routes to the virtual router.
Which two options enable the administrator to troubleshoot this issue? (Choose two.)
A. View Runtime Stats in the virtual router.
B. View System logs.
C. Add a redistribution profile to forward as BGP updates.
D. Perform a traffic pcap at the routing stage.

Answer 24

A. View Runtime Stats in the virtual router.
B. View System logs.

Question 25

Question #75 Topic 1
Which three firewall states are valid? (Choose three.)
A. Active
B. Functional
C. Pending
D. Passive
E. Suspended

Answer 25

A. Active

D. Passive
E. Suspended