لا تريد أن تفوت شيئا؟

نصائح اجتياز امتحان الشهادة

آخر أخبار الامتحانات ومعلومات الخصم

برعاية وحديثة من قبل خبرائنا

نعم، أرسل لي النشرة الإخبارية

خذ اختبارات أخرى عبر الإنترنت
السؤال #1
Which Security policy rule will allow an admin to block facebook chat but allow Facebook in general?
A. Deny application facebook-chat before allowing application facebook
B. Deny application facebook on top
C. Allow application facebook on top
D. Allow application facebook before denying application facebook-chat
عرض الإجابة
اجابة صحيحة: C
السؤال #2
When backing up and saving configuration files, what is achieved using only the firewall and is not available in Panorama?
A. Load named configuration snapshot
B. Load configuration version
C. Save candidate config
D. Export device state
عرض الإجابة
اجابة صحيحة: D
السؤال #3
Which three log-forwarding destinations require a server profile to be configured? (Choose three)
A. SNMP Trap
B. Email
C. RADIUS
D. Kerberos
E. Panorama
F. Syslog
عرض الإجابة
اجابة صحيحة: C
السؤال #4
Refer to Exhibit: A firewall has three PDF rules and a default route with a next hop of 172.29.19.1 that is configured in the default VR. A user named XX-bes a PC with a 192.168.101.10 IP address. He makes an HTTPS connection to 172.16.10.29. What is the next hop IP address for the HTTPS traffic from Wills PC.
A. 172
B. 172
C. 172
D. 172
عرض الإجابة
اجابة صحيحة: B
السؤال #5
An administrator wants multiple web servers in the DMZ to receive connections initiated from the internet. Traffic destined for 206.15.22.9 port 80/TCP needs to be forwarded to the server at 10.1.1.22 Based on the information shown in the image, which NAT rule will forward web-browsing traffic correctly? A) B) C) D)
A. Option A
B. Option B
C. Option C
D. Option D
عرض الإجابة
اجابة صحيحة: AD
السؤال #6
A logging infrastructure may need to handle more than 10,000 logs per second. Which two options support a dedicated log collector function? (Choose two)
A. Panorama virtual appliance on ESX(i) only
B. M-500
C. M-100 with Panorama installed
D. M-100
عرض الإجابة
اجابة صحيحة: A
السؤال #7
If a template stack is assigned to a device and the stack includes three templates with overlapping settings, which settings are published to the device when the template stack is pushed?
A. The settings assigned to the template that is on top of the stack
B. The administrator will be promoted to choose the settings for that chosen firewall
C. All the settings configured in all templates
D. Depending on the firewall location, Panorama decides with settings to send
عرض الإجابة
اجابة صحيحة: A
السؤال #8
An administrator creates an SSL decryption rule decrypting traffic on all ports. The administrator also creates a Security policy rule allowing only the applications DNS, SSL, and web-browsing. The administrator generates three encrypted BitTorrent connections and checks the Traffic logs. There are three entries. The first entry shows traffic dropped as application Unknown. The next two entries show traffic allowed as application SSL. Which action will stop the second and subsequent encrypted BitTorrent con
A. Create a decryption rule matching the encrypted BitTorrent traffic with action “No-Decrypt,” and place the rule at the top of the Decryption policy
B. Create a Security policy rule that matches application “encrypted BitTorrent” and place the rule at the top of the Security policy
C. Disable the exclude cache option for the firewall
D. Create a Decryption Profile to block traffic using unsupported cyphers, and attach the profile to the decryption rule
عرض الإجابة
اجابة صحيحة: A
السؤال #9
How would an administrator monitor/capture traffic on the management interface of the Palo Alto Networks NGFW?
A. Use the debug dataplane packet-diag set capture stage firewall file command
B. Enable all four stages of traffic capture (TX, RX, DROP, Firewall)
C. Use the debug dataplane packet-diag set capture stage management file command
D. Use the tcpdump command
عرض الإجابة
اجابة صحيحة: BD
السؤال #10
PBF can address which two scenarios? (Select Two)
A. forwarding all traffic by using source port 78249 to a specific egress interface
B. providing application connectivity the primary circuit fails
C. enabling the firewall to bypass Layer 7 inspection
D. routing FTP to a backup ISP link to save bandwidth on the primary ISP link
عرض الإجابة
اجابة صحيحة: A
السؤال #11
Which command can be used to validate a Captive Portal policy?
A. eval captive-portal policy
B. request cp-policy-eval
C. test cp-policy-match
D. debug cp-policy
عرض الإجابة
اجابة صحيحة: A
السؤال #12
The GlobalProtect Portal interface and IP address have been configured. Which other value needs to be defined to complete the network settings configuration of GlobalPortect Portal?
A. Server Certificate
B. Client Certificate
C. Authentication Profile
D. Certificate Profile
عرض الإجابة
اجابة صحيحة: D
السؤال #13
An organization has recently migrated its infrastructure and configuration to NGFWs, for which Panorama manages the devices The organization is coming from a L2-L4 firewall vendor, but wants to use App-ID while identifying policies that are no longer needed Which Panorama tool can help this organization?
A. Config Audit
B. Policy Optimizer
C. Application Groups
D. Test Policy Match
عرض الإجابة
اجابة صحيحة: A
السؤال #14
Which User-ID method should be configured to map IP addresses to usernames for users connected through a terminal server?
A. port mapping
B. server monitoring
C. client probing
D. XFF headers
عرض الإجابة
اجابة صحيحة: D
السؤال #15
Which field is optional when creating a new Security Policy rule?
A. Name
B. Description
C. Source Zone
D. Destination Zone
E. Action
عرض الإجابة
اجابة صحيحة: A
السؤال #16
YouTube videos are consuming too much bandwidth on the network, causing delays in mission-critical traffic. The administrator wants to throttle YouTube traffic. The following interfaces and zones are in use on the firewall: * ethernet1/1, Zone: Untrust (Internet-facing) * ethernet1/2, Zone: Trust (client-facing) A QoS profile has been created, and QoS has been enabled on both interfaces. A QoS rule exists to put the YouTube application into QoS class 6. Interface Ethernet1/1 has a QoS profile called Outboun
A. Outbound profile with Guaranteed Ingress
B. Outbound profile with Maximum Ingress
C. Inbound profile with Guaranteed Egress
D. Inbound profile with Maximum Egress
عرض الإجابة
اجابة صحيحة: C
السؤال #17
Which option is an IPv6 routing protocol?
A. RIPv3
B. OSPFv3
C. OSPv3
D. BGP NG
عرض الإجابة
اجابة صحيحة: BC
السؤال #18
A company hosts a publically accessible web server behind a Palo Alto Networks next generation firewall with the following configuration information. Users outside the company are in the "Untrust-L3" zone The web server physically resides in the "Trust-L3" zone. Web server public IP address: 23.54.6.10 Web server private IP address: 192.168.1.10 Which two items must be NAT policy contain to allow users in the untrust-L3 zone to access the web server? (Choose two)
A. Untrust-L3 for both Source and Destination zone
B. Destination IP of 192
C. Untrust-L3 for Source Zone and Trust-L3 for Destination Zone
D. Destination IP of 23
عرض الإجابة
اجابة صحيحة: AC
السؤال #19
A VPN connection is set up between Site-A and Site-B, but no traffic is passing in the system log of Site-A, there is an event logged as like-nego-p1-fail-psk. What action will bring the VPN up and allow traffic to start passing between the sites?
A. Change the Site-B IKE Gateway profile version to match Site-A,
B. Change the Site-A IKE Gateway profile exchange mode to aggressive mode
C. Enable NAT Traversal on the Site-A IKE Gateway profile
D. Change the pre-shared key of Site-B to match the pre-shared key of Site-A
عرض الإجابة
اجابة صحيحة: B
السؤال #20
Which Panorama feature allows for logs generated by Panorama to be forwarded to an external Security Information and Event Management(SIEM) system?
A. Panorama Log Settings
B. Panorama Log Templates
C. Panorama Device Group Log Forwarding
D. Collector Log Forwarding for Collector Groups
عرض الإجابة
اجابة صحيحة: BD
السؤال #21
The administrator has enabled BGP on a virtual router on the Palo Alto Networks NGFW, but new routes do not seem to be populating the virtual router. Which two options would help the administrator troubleshoot this issue? (Choose two.)
A. View the System logs and look for the error messages about BGP
B. Perform a traffic pcap on the NGFW to see any BGP problems
C. View the Runtime Stats and look for problems with BGP configuration
D. View the ACC tab to isolate routing issues
عرض الإجابة
اجابة صحيحة: A
السؤال #22
An administrator encountered problems with inbound decryption. Which option should the administrator investigate as part of triage?
A. Security policy rule allowing SSL to the target server
B. Firewall connectivity to a CRL
C. Root certificate imported into the firewall with “Trust” enabled
D. Importation of a certificate from an HSM
عرض الإجابة
اجابة صحيحة: D
السؤال #23
When a malware-infected host attempts to resolve a known command-and-control server, the traffic matches a security policy with DNS sinhole enabled, generating a traffic log. What will be the destination IP Address in that log entry?
A. The IP Address of sinkhole
B. The IP Address of the command-and-control server
C. The IP Address specified in the sinkhole configuration
D. The IP Address of one of the external DNS servers identified in the anti-spyware database
عرض الإجابة
اجابة صحيحة: ABC
السؤال #24
An administrator needs to upgrade an NGFW to the most current version of PAN-OS? software. The following is occurring: ?Firewall has Internet connectivity through e1/1. ?Default security rules and security rules allowing all SSL and web-browsing traffic to and from any zone. ?Service route is configured, sourcing update traffic from e1/1. ?A communication error appears in the System logs when updates are performed. ?Download does not complete. What must be configured to enable the firewall to download the c
A. DNS settings for the firewall to use for resolution
B. scheduler for timed downloads of PAN-OS software
C. static route pointing application PaloAlto-updates to the update servers
D. Security policy rule allowing PaloAlto-updates as the application
عرض الإجابة
اجابة صحيحة: BCD
السؤال #25
An administrator sees several inbound sessions identified as unknown-tcp in the Traffic logs. The administrator determines that these sessions are form external users accessing the company’s proprietary accounting application. The administrator wants to reliably identify this traffic as their accounting application and to scan this traffic for threats. Which option would achieve this result?
A. Create a custom App-ID and enable scanning on the advanced tab
B. Create an Application Override policy
C. Create a custom App-ID and use the “ordered conditions” check box
D. Create an Application Override policy and custom threat signature for the application
عرض الإجابة
اجابة صحيحة: B
السؤال #26
If the firewall has the link monitoring configuration, what will cause a failover?
A. ethernet1/3 and ethernet1/6 going down
B. ethernet1/3 going down
C. ethernet1/3 or Ethernet1/6 going down
D. ethernet1/6 going down
عرض الإجابة
اجابة صحيحة: A
السؤال #27
An administrator wants a new Palo Alto Networks NGFW to obtain automatic application updates daily, so it is configured to use a scheduler for the application database. Unfortunately, they required the management network to be isolated so that it cannot reach the internet. Which configuration will enable the firewall to download and install application updates automatically?
A. Configure a Policy Based Forwarding policy rule for the update server IP address so that traffic sourced from themanagement interfaced destined for the update servers goes out of the interface acting as your internet connection
B. Configure a security policy rule to allow all traffic to and from the update servers
C. Download and install application updates cannot be done automatically if the MGT port cannot reach the internet
D. Configure a service route for Palo Alto networks services that uses a dataplane interface that can route traffic to the internet, and create a security policy rule to allow the traffic from that interface to the update servers if necessary
عرض الإجابة
اجابة صحيحة: D
السؤال #28
Which three firewall states are valid? (Choose three.)
A. Active
B. Functional
C. Pending
D. Passive
E. Suspended
عرض الإجابة
اجابة صحيحة: DEF
السؤال #29
Which two methods can be used to mitigate resource exhaustion of an application server? (Choose two)
A. Vulnerability Object
B. DoS Protection Profile
C. Data Filtering Profile
D. Zone Protection Profile
عرض الإجابة
اجابة صحيحة: C
السؤال #30
Which URL Filtering Security Profile action togs the URL Filtering category to the URL Filtering log?
A. Log
B. Alert
C. Allow
D. Default
عرض الإجابة
اجابة صحيحة: D
السؤال #31
An administrator logs in to the Palo Alto Networks NGFW and reports that the WebUI is missing the Policies tab. Which profile is the cause of the missing Policies tab?
A. Admin Role
B. WebUI
C. Authentication
D. Authorization
عرض الإجابة
اجابة صحيحة: A
السؤال #32
An administrator has configured a QoS policy rule and a QoS profile that limits the maximum allowable bandwidth for the YouTube application. However , YouTube is consuming more than the maximum bandwidth allotment configured. Which configuration step needs to be configured to enable QoS?
A. Enable QoS Data Filtering Profile
B. Enable QoS monitor
C. Enable Qos interface
D. Enable Qos in the interface Management Profile
عرض الإجابة
اجابة صحيحة: BD
السؤال #33
Which statement accurately describes service routes and virtual systems?
A. Virtual systems can only use one interface for all global service and service routes of the firewall
B. The interface must be used for traffic to the required external services
C. Virtual systems that do not have specific service routes configured inherit the global service and service route settings for the firewall
D. Virtual systems cannot have dedicated service routes configured: and virtual systems always use the global service and service route settings for the firewall
عرض الإجابة
اجابة صحيحة: CD
السؤال #34
Which two statements correctly identify the number of Decryption Broker security chains that are supported on a pair of decryption-forwarding interfaces'? (Choose two)
A. A single transparent bridge security chain is supported per pair of interfaces
B. L3 security chains support up to 32 security chains
C. L3 security chains support up to 64 security chains
D. A single transparent bridge security chain is supported per firewall
عرض الإجابة
اجابة صحيحة: AC
السؤال #35
An administrator wants to enable zone protection Before doing so, what must the administrator consider?
A. Activate a zone protection subscription
B. To increase bandwidth no more than one firewall interface should be connected to a zone
C. Security policy rules do not prevent lateral movement of traffic between zones
D. The zone protection profile will apply to all interfaces within that zone
عرض الإجابة
اجابة صحيحة: A
السؤال #36
Which authentication source requires the installation of Palo Alto Networks software, other than PAN-OS 7x, to obtain a username-to-IP-address mapping?
A. Microsoft Active Directory
B. Microsoft Terminal Services
C. Aerohive Wireless Access Point
D. Palo Alto Networks Captive Portal
عرض الإجابة
اجابة صحيحة: A
السؤال #37
A Network Administrator wants to deploy a Large Scale VPN solution. The Network Administrator has chosen a GlobalProtect Satellite solution. This configuration needs to be deployed to multiple remote offices and the Network Administrator decides to use Panorama to deploy the configurations. How should this be accomplished?
A. Create a Template with the appropriate IKE Gateway settings
B. Create a Template with the appropriate IPSec tunnel settings
C. Create a Device Group with the appropriate IKE Gateway settings
D. Create a Device Group with the appropriate IPSec tunnel settings
عرض الإجابة
اجابة صحيحة: C
السؤال #38
A company.com wants to enable Application Override. Given the following screenshot: Which two statements are true if Source and Destination traffic match the Application Override policy? (Choose two)
A. Traffic that matches "rtp-base" will bypass the App-ID and Content-ID engines
B. Traffic will be forced to operate over UDP Port 16384
C. Traffic utilizing UDP Port 16384 will now be identified as "rtp-base"
D. Traffic utilizing UDP Port 16384 will bypass the App-ID and Content-ID engines
عرض الإجابة
اجابة صحيحة: CE
السؤال #39
An administrator sees several inbound sessions identified as unknown-tcp in the traffic logs. The administrator determines that these sessions are from external users accessing the company’s proprietary accounting application. The administrator wants to reliably identify this as their accounting application and to scan this traffic for threats. Which option would achieve this result?
A. Create an Application Override policy and a custom threat signature for the application
B. Create an Application Override policy
C. Create a custom App-ID and use the "ordered conditions" check box
D. Create a custom App ID and enable scanning on the advanced tab
عرض الإجابة
اجابة صحيحة: D

عرض الإجابات بعد التقديم

يرجى إرسال البريد الإلكتروني الخاص بك والواتس اب للحصول على إجابات الأسئلة.

ملحوظة: يرجى التأكد من صلاحية معرف البريد الإلكتروني وWhatsApp حتى تتمكن من الحصول على نتائج الاختبار الصحيحة.

بريد إلكتروني:
رقم الواتس اب/الهاتف:


Copyright © 2024. Designer by SPOTO Official Website. All Rights Reserved.