السؤال #1

A current NGFW customer has asked a systems engineer (SE) for a way to prove to their internal management team that its NGFW follows Zero Trust principles. Which action should the SE take?

A. Use the 'Monitor > PDF Reports' node to schedule a weekly email of the Zero Trust report to the internal management team

B. Help the customer build reports that align to their Zero Trust plan in the 'Monitor > Manage Custom Reports' tab

C. Use a third-party tool to pull the NGFW Zero Trust logs, and create a report that meets the customer's needs

D. Use the 'ACC' tab to help the customer build dashboards that highlight the historical tracking of the NGFW enforcing policies

عرض الإجابة

اجابة صحيحة: B

السؤال #2

A systems engineer (SE) is working with a customer that is fully cloud-deployed for all applications. The customer is interested in Palo Alto Networks NGFWs but describes the following challenges:"Our apps are in AWS and Azure, with whom we have contracts and minimum-revenue guarantees. We would use the built-in firewall on the cloud service providers (CSPs), but the need for centralized policy management to reduce human error is more important."Which recommendations should the SE make?

A. Cloud NGFWs at both CSPs; provide the customer a license for a Panorama virtual appliance from their CSP's marketplace of choice to centrally manage the systems

B. Cloud NGFWs in AWS and VM-Series firewall in Azure; the customer selects a PAYG licensing Panorama deployment in their CSP of choice

C. VM-Series firewalls in both CSPs; manually built Panorama in the CSP of choice on a host of either type: Palo Alto Networks provides a license

D. VM-Series firewall and CN-Series firewall in both CSPs; provide the customer a private-offer Panorama virtual appliance from their CSP's marketplace of choice to centrally manage the systems

عرض الإجابة

اجابة صحيحة: A

السؤال #3

Which three deployment modes of VM - Series firewalls are supported across NSX - T? (Choose three )

A. Partner Service

B. Boot Strap

C. Prism Central

D. Tier - 1 insertion

E. Tier - 0 insertion

عرض الإجابة

اجابة صحيحة: ADE

السؤال #4

Why are containers uniquely suitable for whitelist-based runtime security?

A. Developers typically define the processes used in their containers within the Dockerfile

B. Docker has a built-in runtime analysis capability to aid in whitelisting

C. Containers typically have only a few defined processes that should ever be executed

D. Operations teams typically know what processes are used within a container

عرض الإجابة

اجابة صحيحة: A

السؤال #5

How frequently do WildFire signatures move into the antivirus database?

A. Aevery 24 hours

B. Bevery 12 hours

C. Conce a week

D. Devery 1 hour

عرض الإجابة

اجابة صحيحة: A

السؤال #6

When would a PA-7000 Series NPC GQXM Card be preferable to a PA-7000 Series NPC GQ Card?

A. When the organization requires a greater number of sessions

B. When the environment has a need for more SFP+ interfaces

C. When the organization requires gear with a smaller slot size

D. When the environment has a need for more policy rules

عرض الإجابة

اجابة صحيحة: A

السؤال #7

Which is not a SaaS product?

A. Yahoo Maps

B. Microsoft Office 365

C. Microsoft Azure

D. Google Docs

عرض الإجابة

اجابة صحيحة: C

السؤال #8

Which three considerations should be made prior to installing a decryption policy on the NGFW? (Choose three.)

A. nclude all traffic types in decryption policy

B. nability to access websites

C. xclude certain types of traffic in decryption policy

D. eploy decryption setting all at one time

E. nsure throughput is not an issue

عرض الإجابة

اجابة صحيحة: ABC

السؤال #9

The need for a file proxy solution, virus and spyware scanner, a vulnerability scanner, and HTTP decoder for URL filtering is handled by which component in theNGFW?

A. irst Packet Processor

B. tream-based Signature Engine

C. IA (Scan It All) Processing Engine

D. ecurity Processing Engine

عرض الإجابة

اجابة صحيحة: B

السؤال #10

Which three descriptions apply to a perimeter firewall? (Choose three.)

A. ANetwork layer protection for the outer edge of a network

B. BPower utilization less than 500 watts sustained

C. CSecuring east-west traffic in a virtualized data center with flexible resource allocation

D. DPrimarily securing north-south traffic entering and leaving the network

E. EGuarding against external attacks

عرض الإجابة

اجابة صحيحة: ADE

السؤال #11

A customer is concerned about zero-day targeted attacks against its intellectual property.Which solution informs a customer whether an attack is specifically targeted at them?

A. raps TMS

B. utoFocus

C. anorama Correlation Report

D. irewall Botnet Report

عرض الإجابة

اجابة صحيحة: B

السؤال #12

A company plans to deploy identity for improved visibility and identity-based controls for least privilege access to applications and dat

A. The company does not have an on-premises Active Directory (AD) deployment, and devices are connected and managed by using a combination of Entra ID and Jamf

B. Captive portal

C. User-ID agents configured for WMI client probing

D. GlobalProtect with an internal gateway deployment

E. Cloud Identity Engine synchronized with Entra ID

عرض الإجابة

اجابة صحيحة: CD

السؤال #13

A company has multiple business units, each of which manages its own user directories and identity providers (IdPs) with different domain names. The company's network security team wants to deploy a shared GlobalProtect remote access service for all business units to authenticate users to each business unit's IdP.Which configuration will enable the network security team to authenticate GlobalProtect users to multiple SAML IdPs?

A. ultiple Cloud Identity Engine tenants for each business unit

B. lobalProtect with multiple authentication profiles for each SAML IdP

C. uthentication sequence that has multiple authentication profiles using different authentication methods

D. ultiple authentication mode Cloud Identity Engine authentication profile for use on the GlobalProtect portals and gateways

عرض الإجابة

اجابة صحيحة: B

السؤال #14

What are two benefits of using Panorama for a customer who is deploying virtual firewalls to secure data center traffic? (Choose two.)

A. It can provide the Automated Correlation Engine functionality, which the virtual firewalls do not support

B. It can monitor the virtual firewalls' physical hosts and Vmotion them as necessary

C. It can automatically create address groups for use with KVM

D. It can bootstrap the virtual firewalls for dynamic deployment scenarios

عرض الإجابة

اجابة صحيحة: AD

السؤال #15

A systems engineer (SE) is working with a customer that is fully cloud-deployed for all applications. The customer is interested in Palo Alto Networks NGFWs but describes the following challenges:"Our apps are in AWS and Azure, with whom we have contracts and minimum-revenue guarantees. We would use the built-in firewall on the cloud service providers (CSPs), but the need for centralized policy management to reduce human error is more important."Which recommendations should the SE make?

A. Cloud NGFWs at both CSPs; provide the customer a license for a Panorama virtual appliance from their CSP's marketplace of choice to centrally manage the systems

B. Cloud NGFWs in AWS and VM-Series firewall in Azure; the customer selects a PAYG licensing Panorama deployment in their CSP of choice

C. VM-Series firewalls in both CSPs; manually built Panorama in the CSP of choice on a host of either type: Palo Alto Networks provides a license

D. VM-Series firewall and CN-Series firewall in both CSPs; provide the customer a private-offer Panorama virtual appliance from their CSP's marketplace of choice to centrally manage the systems

عرض الإجابة

اجابة صحيحة: A

السؤال #16

When would a PA-7000 Series NPC GQXM Card be preferable to a PA-7000 Series NPC GQ Card?

A. AWhen the organization requires a greater number of sessions

B. BWhen the environment has a need for more SFP+ interfaces

C. CWhen the organization requires gear with a smaller slot size

D. DWhen the environment has a need for more policy rules

عرض الإجابة

اجابة صحيحة: A

السؤال #17

What component is needed if there is a large scale deployment of Next Generation Firewalls with multiple Panorama Management Servers?

A. -600 Appliance

B. anorama Large Scale VPN Plugin

C. anorama Interconnect Plugin

D. alo Alto Networks Cluster License

عرض الإجابة

اجابة صحيحة: C

السؤال #18

Which two products can be integrated and managed by Strata Cloud Manager (SCM)? (Choose two)

A. APrisma SD-WAN

B. BPrisma Cloud

C. CCortex XDR

D. DVM-Series NGFW

عرض الإجابة

اجابة صحيحة: AD

السؤال #19

Which configuration is required to share NSX security groups as tags to be used by Dynamic Address Groups in a non-NSX firewall?

A. notify device groups within VMware Services Manager

B. a User-ID agent on a Windows domain server

C. VMware Information Sources

D. none, sharing happens by default

عرض الإجابة

اجابة صحيحة: B

السؤال #20

Which interface mode do you use to generate the statdump file that can be converted into an SLR? Assume that the SE wants to make the evaluation as unintrusive as possible.

A. Virtual Wire

B. Layer 2

C. TAP

D. Layer 3

عرض الإجابة

اجابة صحيحة: C

السؤال #21

A company plans to deploy identity for improved visibility and identity-based controls for least privilege access to applications and dat

A. The company does not have an on-premises Active Directory (AD) deployment, and devices are connected and managed by using a combination of Entra ID and Jamf

B. Captive portal

C. User-ID agents configured for WMI client probing

D. GlobalProtect with an internal gateway deployment

E. Cloud Identity Engine synchronized with Entra ID

عرض الإجابة

اجابة صحيحة: CD

السؤال #22

What is the default session distribution policy in the PA-7000 Series?

A. Hash

B. Egress-Slot

C. Round Robin

D. Ingress-Slot

عرض الإجابة

اجابة صحيحة: D

السؤال #23

Whichconfiguration is required in NSX for Panorama to use the tags from security groups in dynamic address groups?

A. reate security groups only

B. reate security groups and mark them as exchangeable

C. reate security groups with tags marked as shareable

D. reate security groups and use them in an NSX-to-Palo Alto Networks redirection policy

عرض الإجابة

اجابة صحيحة: A

السؤال #24

A systems engineer (SE) is working with a customer that is fully cloud-deployed for all applications. The customer is interested in Palo Alto Networks NGFWs but describes the following challenges:"Our apps are in AWS and Azure, with whom we have contracts and minimum-revenue guarantees. We would use the built-in firewall on the cloud service providers (CSPs), but the need for centralized policy management to reduce human error is more important."Which recommendations should the SE make?

A. Cloud NGFWs at both CSPs; provide the customer a license for a Panorama virtual appliance from their CSP's marketplace of choice to centrally manage the systems

B. Cloud NGFWs in AWS and VM-Series firewall in Azure; the customer selects a PAYG licensing Panorama deployment in their CSP of choice

C. VM-Series firewalls in both CSPs; manually built Panorama in the CSP of choice on a host of either type: Palo Alto Networks provides a license

D. VM-Series firewall and CN-Series firewall in both CSPs; provide the customer a private-offer Panorama virtual appliance from their CSP's marketplace of choice to centrally manage the systems

عرض الإجابة

اجابة صحيحة: A

السؤال #25

In which two locations can a Best Practice Assessment (BPA) report be generated for review by a customer? (Choose two.)

A. PANW Partner Portal

B. Customer Support Portal

C. AIOps

D. Strata Cloud Manager (SCM)

عرض الإجابة

اجابة صحيحة: AB

السؤال #26

Prisma SaaS provides which two SaaS threat prevention capabilities? (Choose two)

A. shellcode protection

B. file quarantine

C. SaaS AppID signatures

D. WildFire analysis

E. remote procedural call (RPC) interrogation

عرض الإجابة

اجابة صحيحة: CD

السؤال #27

Which interface mode do you use to generate the statdump file that can be converted into an SLR? Assume that the SE wants to make the evaluation as unintrusive as possible.

A. Virtual Wire

B. Layer 2

C. TAP

D. Layer 3

عرض الإجابة

اجابة صحيحة: C

السؤال #28

Which two tools should a systems engineer use to showcase the benefit of an evaluation that a customer has just concluded?

A. Best Practice Assessment (BPA)

B. Security Lifecycle Review (SLR)

C. Firewall Sizing Guide

D. Golden Images

عرض الإجابة

اجابة صحيحة: AB

السؤال #29

Which three deployment modes of VM-Series firewalls are supported across NSX-T? (Choose three )

A. Partner Service

B. Boot Strap

C. Prism Central

D. Tier-1 insertion

E. Tier-0 insertion

عرض الإجابة

اجابة صحيحة: ADE

السؤال #30

A customer wants to completely segment their internal networks They have Cisco switches and extensively use 10Gbps interfaces. They are running VMware ESXi and are considering implementing NSX. Which three Palo Alto Networks firewall models will support this deployment? (Choose three.)

A. PA-3050

B. VM-100

C. VM-300

D. PA-3250

E. PA-7050

عرض الإجابة

اجابة صحيحة: ADE

السؤال #31

Which interface mode do you use to generate the statdump file that can be converted into an SLR? Assume that the SE wants to make the evaluation as unintrusive as possible.

A. Virtual Wire

B. Layer 2

C. TAP

D. Layer 3

عرض الإجابة

اجابة صحيحة: C

السؤال #32

In PAN-OS 10.0 and later, DNS Security allows policy actions to be applied based on which three domains? (Choose three.)

A. enign

B. overnment

C. ommand and control (C2)

D. alware

E. rayware

عرض الإجابة

اجابة صحيحة: CDE

السؤال #33

What can be applied to prevent users from unknowingly downloading malicious file types from the internet?

A. A vulnerability profile to security policy rules that deny general web access

B. An antivirus profile to security policy rules that deny general web access

C. A zone protection profile to the untrust zone

D. A file blocking profile to security policy rules that allow general web access

عرض الإجابة

اجابة صحيحة: D

السؤال #34

Which two tools should a systems engineer use to showcase the benefit of an evaluation that a customer has just concluded?

A. Best Practice Assessment (BPA)

B. Security Lifecycle Review (SLR)

C. Firewall Sizing Guide

D. Golden Images

عرض الإجابة

اجابة صحيحة: AB

السؤال #35

A customer claims that Advanced WildFire miscategorized a file as malicious and wants proof, because another vendor has said that the file is benign.How could the systems engineer assure the customer that Advanced WildFire was accurate?

A. Review the threat logs for information to provide to the customer

B. Use the WildFire Analysis Report in the log to show the customer the malicious actions the file took when it was detonated

C. Open a TAG ticket for the customer and allow support engineers to determine the appropriate action

D. Do nothing because the customer will realize Advanced WildFire is right

عرض الإجابة

اجابة صحيحة: B

السؤال #36

What does Policy Optimizer allow a systems engineer to do for an NGFW?

A. Recommend best practices on new policy creation

B. Show unused licenses for Cloud-Delivered Security Services (CDSS) subscriptions and firewalls

C. Identify Security policy rules with unused applications

D. Act as a migration tool to import policies from third-party vendors

عرض الإجابة

اجابة صحيحة: C

السؤال #37

How often are the databases for Anti-virus. Application, Threats, and WildFire subscription updated?

A. Anti-virus (weekly): Application (daily)

B. Anti-virus (weekly), Application (daily), Threats (daily), WildFire (5 minutes)

C. Anti-virus (daily), Application (weekly), Threats (weekly), WildFire (5 minutes)

D. Anti-virus (daily), Application (weekly), Threats (daily), WildFire (5 minutes)

عرض الإجابة

اجابة صحيحة: C

السؤال #38

Which three deployment modes of VM-Series firewalls are supported across NSX-T? (Choose three )

A. Partner Service

B. Boot Strap

C. Prism Central

D. Tier-1 insertion

E. Tier-0 insertion

عرض الإجابة

اجابة صحيحة: ADE

السؤال #39

Which statement applies to the default configuration of a Palo Alto Networks NGFW?

A. Security profiles are applied to all policies by default, eliminating implicit trust of any data traversing the firewall

B. The default policy action for intrazone traffic is deny, eliminating implicit trust within a security zone

C. The default policy action allows all traffic unless explicitly denied

D. The default policy action for interzone traffic is deny, eliminating implicit trust between security zones

عرض الإجابة

اجابة صحيحة: D

السؤال #40

Which two products can send logs to the Cortex Data Lake? (Choose two.)

A. AAutoFocus

B. BPA-3260 firewall

C. CPrisma Access

D. DPrisma Public Cloud

عرض الإجابة

اجابة صحيحة: BC

لا تريد أن تفوت شيئا؟

اجتياز اختبار الممارسة Cisco وPMP وCISA وCISM وAWS بنسبة 100% للبيع!
احصل الان

View The Updated PSE-Strata Exam Questions

عرض الإجابات بعد التقديم

لا تريد أن تفوت شيئا؟

اجتياز اختبار الممارسة Cisco وPMP وCISA وCISM وAWS بنسبة 100% للبيع! احصل الان

View The Updated PSE-Strata Exam Questions

عرض الإجابات بعد التقديم

اجتياز اختبار الممارسة Cisco وPMP وCISA وCISM وAWS بنسبة 100% للبيع!
احصل الان