لا تريد أن تفوت شيئا؟

نصائح اجتياز امتحان الشهادة

آخر أخبار الامتحانات ومعلومات الخصم

برعاية وحديثة من قبل خبرائنا

نعم، أرسل لي النشرة الإخبارية

خذ اختبارات أخرى عبر الإنترنت
السؤال #1
An administrator needs to upgrade an NGFW to the most current version of PAN-OS® software. The following is occurring:-Firewall has internet connectivity through e 1/1.-Default security rules and security rules allowing all SSL and web-browsing traffic to and from any zone.-Service route is configured, sourcing update traffic from e1/1.-A communication error appears in the System logs when updates are performed.-Download does not complete.What must be configured to enable the firewall to download the curren
A. tatic route pointing application PaloAlto-updates to the update servers
B. ecurity policy rule allowing PaloAlto-updates as the application
C. cheduler for timed downloads of PAN-OS software
D. NS settings for the firewall to use for resolution
عرض الإجابة
اجابة صحيحة: D
السؤال #2
What are three types of Decryption Policy rules? (Choose three.)
A. Decryption profile must be attached to the Decryption policy that the traffic matches
B. here must be a certificate with both the Forward Trust option and Forward Untrust option selected
C. Decryption profile must be attached to the Security policy that the traffic matches
D. here must be a certificate with only the Forward Trust option selected
عرض الإجابة
اجابة صحيحة: ABC
السؤال #3
A Panorama administrator configures a new zone and uses the zone in a new Security policy. After the administrator commits the configuration to Panorama, which device-group commit push operation should the administrator use to ensure that the push is successful?
A. erge with candidate config
B. nclude device and network templates
C. pecify the template as a reference template
D. orce template values
عرض الإجابة
اجابة صحيحة: A
السؤال #4
Refer to the image. An administrator is tasked with correcting an NTP service configuration for firewalls that cannot use the Global template NTP servers. The administrator needs to change the IP address to a preferable server for this template stack but cannot impact other template stacks.How can the issue be corrected?
A. verride the value on the NYCFW template
B. verride a template value using a template stack variable
C. verride the value on the Global template
D. nable "objects defined in ancestors will take higher precedence" under Panorama settings
عرض الإجابة
اجابة صحيحة: B
السؤال #5
What file type upload is supported as part of the basic WildFire service?
A. LF
B. AT
C. E
D. BS
عرض الإجابة
اجابة صحيحة: C
السؤال #6
Which two benefits come from assigning a Decryption Profile to a Decryption policy rule with a “No Decrypt” action? (Choose two.)
A. ort mapping
B. erver monitoring
C. lient probing
D. FF headers
عرض الإجابة
اجابة صحيحة: AD
السؤال #7
On the NGFW, how can you generate and block a private key from export and thus harden your security posture and prevent rogue administrators or other bad actors from misusing keys?
A.
B.
C.
D.
عرض الإجابة
اجابة صحيحة: C
السؤال #8
An administrator is using Panorama and multiple Palo Alto Networks NGFWs. After upgrading all devices to the latest PAN-OS® software, the administrator enables log forwarding from the firewalls to Panorama. Pre-existing logs from the firewalls are not appearing in Panorama.Which action would enable the firewalls to send their pre-existing logs to Panorama?
A. ore than 15 minutes
B. minutes
C. 0 to 15 minutes
D. to 10 minutes
عرض الإجابة
اجابة صحيحة: B
السؤال #9
DRAG DROP (Drag and Drop is not supported)Place the steps to onboard a ZTP firewall into Panorama/CSP/ZTP-Service in the correct order.Select and Place:
A. ee Explanation section for answer
عرض الإجابة
اجابة صحيحة: A
السؤال #10
An administrator wants to enable zone protection.Before doing so, what must the administrator consider?
A. ctivate a zone protection subscription
B. ecurity policy rules do not prevent lateral movement of traffic between zones
C. he zone protection profile will apply to all interfaces within that zone
D. o increase bandwidth, no more than one firewall interface should be connected to a zone
عرض الإجابة
اجابة صحيحة: C
السؤال #11
DRAG DROP (Drag and Drop is not supported)Match each type of DoS attack to an example of that type of attack.Select and Place:
A. ee Explanation section for answer
عرض الإجابة
اجابة صحيحة: A
السؤال #12
An administrator accidentally closed the commit window/screen before the commit was finished. Which two options could the administrator use to verify the progress or success of that commit task? (Choose two.)
A. nable and configure the Packet Buffer Protection thresholds
B. nable and then configure Packet Buffer thresholds
C. reate and Apply Zone Protection Profiles in all ingress zones
D. onfigure and apply Zone Protection Profiles for all egress zones
E. nable per-vsys Session Threshold alerts and triggers for Packet Buffer Limits
عرض الإجابة
اجابة صحيحة: AD
السؤال #13
What does SSL decryption require to establish a firewall as a trusted third party and to establish trust between a client and server to secure SSL/TLS connection?
A. ink state
B. rofiles
C. tateful firewall connection
D. ertificates
عرض الإجابة
اجابة صحيحة: D
السؤال #14
In a security-first network, what is the recommended threshold value for content updates to be dynamically updated?
A. to 4 hours
B. to 12 hours
C. 4 hours
D. 6 hours
عرض الإجابة
اجابة صحيحة: B
السؤال #15
Given the following configuration, which route is used for destination 10.10.0.4?set network virtual-router 2 routing-table ip static-route "Route 1" nexthop ip-address 192.168.1.2set network virtual-router 2 routing-table ip static-route "Route 1" metric 30set network virtual-router 2 routing-table ip static-route "Route 1" destination 10.10.0.0/24set network virtual-router 2 routing-table ip static-route "Route 1" reroute-table unicastset network virtual-router 2 routing-table ip static-route "Route 2" ne
A. oute 1
B. oute 3
C. oute 2
D. oute 4
عرض الإجابة
اجابة صحيحة: C
السؤال #16
In a template, you can configure which two objects? (Choose two.)
A. o
B. es
C. o
D. es
عرض الإجابة
اجابة صحيحة: AD
السؤال #17
A global corporate office has a large-scale network with only one User-ID agent, which creates a bottleneck near the User-ID agent server.Which solution in PAN-OS® software would help in this case?
A. se config-drive on a USB stick
B. se an S3 bucket with an ISO
C. reate and attach a virtual hard disk (VHD)
D. se a virtual CD-ROM with an ISO
عرض الإجابة
اجابة صحيحة: D
السؤال #18
When configuring a GlobalProtect Portal, what is the purpose of specifying an Authentication Profile?
A. o enable Gateway authentication to the Portal
B. o enable Portal authentication to the Gateway
C. o enable user authentication to the Portal
D. o enable client machine authentication to the Portal
عرض الإجابة
اجابة صحيحة: C
السؤال #19
An administrator has a PA-820 firewall with an active Threat Prevention subscription. The administrator is considering adding a WildFire subscription.How does adding the WildFire subscription improve the security posture of the organization?
A. ildFire and Threat Prevention combine to minimize the attack surface
B. fter 24 hours, WildFire signatures are included in the antivirus update
C. rotection against unknown malware can be provided in near real-time
D. ildFire and Threat Prevention combine to provide the utmost security posture for the firewall
عرض الإجابة
اجابة صحيحة: C
السؤال #20
Before you upgrade a Palo Alto Networks NGFW, what must you do?
A. ake sure that the PAN-OS support contract is valid for at least another year
B. xport a device state of the firewall
C. ake sure that the firewall is running a supported version of the app + threat update
D. ake sure that the firewall is running a version of antivirus software and a version of WildFire that support the licensed subscriptions
عرض الإجابة
اجابة صحيحة: C
السؤال #21
Which three authentication factors does PAN-OS® software support for MFA? (Choose three.)
A. one Protection
B. eplay
C. eb Application
D. oS Protection
عرض الإجابة
اجابة صحيحة: ADE
السؤال #22
An administrator has been asked to configure a Palo Alto Networks NGFW to provide protection against worms and trojans.Which Security Profile type will protect against worms and trojans?
A. nti-Spyware
B. nstruction Prevention
C. ile Blocking
D. ntivirus
عرض الإجابة
اجابة صحيحة: D
السؤال #23
An administrator has been asked to configure active/passive HA for a pair of Palo Alto Networks NGFWs. The administrator assigns priority 100 to the active firewall.Which priority is correct for the passive firewall?
A.
B. 9
C.
D. 55
عرض الإجابة
اجابة صحيحة: D
السؤال #24
An engineer must configure the Decryption Broker feature. Which Decryption Broker security chain supports bi-directional traffic flow?
A. ayer 2 security chain
B. ayer 3 security chain
C. ransparent Bridge security chain
D. ransparent Proxy security chain
عرض الإجابة
اجابة صحيحة: B
السؤال #25
An administrator is attempting to create policies for deployment of a device group and template stack. When creating the policies, the zone drop-down list does not include the required zone.What can the administrator do to correct this issue?
A. dd a firewall to both the device group and the template
B. dd the template as a reference template in the device group
C. nable "Share Unused Address and Service Objects with Devices" in Panorama settings
D. pecify the target device as the master device in the device group
عرض الإجابة
اجابة صحيحة: A
السؤال #26
Refer to the exhibit.An organization has Palo Alto Networks NGFWs that send logs to remote monitoring and security management platforms. The network team has reported excessive traffic on the corporate WAN.How could the Palo Alto Networks NGFW administrator reduce WAN traffic while maintaining support for all the existing monitoring/security platforms?
A. orward logs from firewalls only to Panorama and have Panorama forward logs to other external services
B. orward logs from external sources to Panorama for correlation, and from Panorama send them to the NGFW
C. onfigure log compression and optimization features on all remote firewalls
D. ny configuration on an M-500 would address the insufficient bandwidth concerns
عرض الإجابة
اجابة صحيحة: A
السؤال #27
Which two events trigger the operation of automatic commit recovery? (Choose two.)
A. espond to changes in user behaviour or potential threats using manual policy changes
B. espond to changes in user behaviour or potential threats without manual policy changes
C. espond to changes in user behaviour or potential threats without automatic policy changes
D. espond to changes in user behaviour and confirmed threats with manual policy changes
عرض الإجابة
اجابة صحيحة: BC
السؤال #28
Which two virtualization platforms officially support the deployment of Palo Alto Networks VM-Series firewalls? (Choose two.)
A. ML API
B. ort Mapping
C. lient Probing
D. erver Monitoring
عرض الإجابة
اجابة صحيحة: BD
السؤال #29
If a template stack is assigned to a device and the stack includes three templates with overlapping settings, which settings are published to the device when the template stack is pushed?
A. he settings assigned to the template that is on top of the stack
B. he administrator will be promoted to choose the settings for that chosen firewall
C. ll the settings configured in all templates
D. epending on the firewall location, Panorama decides with settings to send
عرض الإجابة
اجابة صحيحة: A
السؤال #30
What is exchanged through the HA2 link?
A. oth SSH keys and SSL certificates must be generated
B. o prerequisites are required
C. SH keys must be manually generated
D. SL certificates must be generated
عرض الإجابة
اجابة صحيحة: C
السؤال #31
Which option is part of the content inspection process?
A. acket forwarding process
B. SL Proxy re-encrypt
C. Psec tunnel encryption
D. acket egress process
عرض الإجابة
اجابة صحيحة: B
السؤال #32
The SSL Forward Proxy decryption policy is configured. The following four certificate authority (CA) certificates are installed on the firewall.An end-user visits the untrusted website https://www.firewall-do-not-trust-website.com.Which certificate authority (CA) certificate will be used to sign the untrusted webserver certificate?
A. lobalProtect client
B. PTP tunnels
C. Psec tunnels using IKEv2
D. lobalProtect satellite
عرض الإجابة
اجابة صحيحة: B
السؤال #33
Which statement regarding HA timer settings is true?
A. se the Moderate profile for typical failover timer settings
B. se the Critical profile for faster failover timer settings
C. se the Aggressive profile for slower failover timer settings
D. se the Recommended profile for typical failover timer settings
عرض الإجابة
اجابة صحيحة: D
السؤال #34
An administrator encountered problems with inbound decryption. Which option should the administrator investigate as part of triage?
A. ecurity policy rule allowing SSL to the target server
B. irewall connectivity to a CRL
C. oot certificate imported into the firewall with “Trust” enabled
D. mportation of a certificate from an HSM
عرض الإجابة
اجابة صحيحة: A
السؤال #35
When an in-band data port is set up to provide access to required services, what is required for an interface that is assigned to service routes?
A. ou must set the interface to Layer 2, Layer 3, or virtual wire
B. he interface must be used for traffic to the required services
C. ou must use a static IP address
D. ou must enable DoS and zone protection
عرض الإجابة
اجابة صحيحة: C
السؤال #36
What are two characteristic types that can be defined for a variable? (Choose two.)
A. scp export mgmt-pcap from mgmt
B. scp export poap-mgmt from poap
C. ftp export mgmt-pcap from mgmt
D. scp export pcap from pcap to (username@host:path)
عرض الإجابة
اجابة صحيحة: BC
السؤال #37
Which User-ID method maps IP addresses to usernames for users connecting through a web proxy that has already authenticated the user?
A. yslog listening
B. erver monitoring
C. lient probing
D. ort mapping
عرض الإجابة
اجابة صحيحة: A
السؤال #38
Which two subscriptions are available when configuring Panorama to push dynamic updates to connected devices? (Choose two.)
A. t configures the tunnel address of all internal clients to an IP address range starting at 192
B. t forces an internal client to connect to an internal gateway at IP address 192
C. t enables a client to perform a reverse DNS lookup on 192
D. t forces the firewall to perform a dynamic DNS update, which adds the internal gateway’s hostname and IP address to the DNS server
عرض الإجابة
اجابة صحيحة: CD
السؤال #39
02. Which two external authentication methods can be used with Authentication Profiles in PAN-OS?
A. TLM
B. SH
C. DAP
D. ADIUS
عرض الإجابة
اجابة صحيحة: A
السؤال #40
An administrator has created an SSL Decryption policy rule that decrypts SSL sessions on any port. Which log entry can the administrator use to verify that sessions are being decrypted?
A. n the details of the Traffic log entries
B. ecryption log
C. ata Filtering log
D. n the details of the Threat log entries
عرض الإجابة
اجابة صحيحة: A
السؤال #41
07. A legacy virtual router can use a Redistribution Profile to share routes between which three routing protocols?
A. nspectingtrafficattheapplicationlaye
B. reatingvirtualconnectionsoutofUDPtraffic
C. heckingforsuspicious,buttechnicallycompliant,protocolbehavi
D. emporarilyallowinganexternalwebservertosendinboundpacketsafteranoutboundrequestforawebpage
عرض الإجابة
اجابة صحيحة: C
السؤال #42
How can a candidate or running configuration be copied to a host external from Panorama?
A. ommit a running configuration
B. ave a configuration snapshot
C. ave a candidate configuration
D. xport a named configuration snapshot
عرض الإجابة
اجابة صحيحة: D
السؤال #43
A client is concerned about resource exhaustion because of denial-of-service attacks against their DNS servers.Which option will protect the individual servers?
A. nable packet buffer protection on the Zone Protection Profile
B. pply an Anti-Spyware Profile with DNS sinkholing
C. se the DNS App-ID with application-default
D. pply a classified DoS Protection Profile
عرض الإجابة
اجابة صحيحة: D
السؤال #44
Which Zone Pair and Rule Type will allow a successful connection for a user on the Internet zone to a web server hosted on the DMZ zone? The web server is reachable using a Destination NAT policy in the Palo Alto Networks firewall.
A. nable QoS interface
B. nable QoS in the Interface Management Profile
C. nable QoS Data Filtering Profile
D. nable QoS monitor
عرض الإجابة
اجابة صحيحة: B
السؤال #45
Which tool provides an administrator the ability to see trends in traffic over periods of time, such as threats detected in the last 30 days?
A. Session Browser
B. Application Command Center
C. TCP Dump
D. Packet Capture
عرض الإجابة
اجابة صحيحة: B
السؤال #46
What is the best description of the HA4 Keep-alive Threshold (ms)?
A. he timeframe that the local firewall waits before going to Active state when another cluster member is preventing the cluster from fully synchronizing
B. he timeframe within which the firewall must receive keepalives from a cluster member to know that the cluster member is functional
C. he maximum interval between hello packets that are sent to verify that the HA functionality on the other firewall is operational
D. he time that a passive or active-secondary firewall will wait before taking over as the active or active-primary firewall
عرض الإجابة
اجابة صحيحة: B
السؤال #47
DRAG DROP (Drag and Drop is not supported)Place the steps in the WildFire process workflow in their correct order.Select and Place:
A. ee Explanation section for answer
عرض الإجابة
اجابة صحيحة: A
السؤال #48
Which version of GlobalProtect supports split tunneling based on destination domain, client process, and HTTP/HTTPS video streaming application?
A. TTP Server Profile
B. yslog Server Profile
C. mail Server Profile
D. NMP Server Profile
عرض الإجابة
اجابة صحيحة: B
السؤال #49
An administrator has 750 firewalls. The administrator's central-management Panorama instance deploys dynamic updates to the firewalls. The administrator notices that the dynamic updates from Panorama do not appear on some of the firewalls.If Panorama pushes the configuration of a dynamic update schedule to managed firewalls, but the configuration does not appear, what is the root cause?
A. anorama does not have valid licenses to push the dynamic updates
B. anorama has no connection to Palo Alto Networks update servers
C. ocally-defined dynamic update settings take precedence over the settings that Panorama pushed
D. o service route is configured on the firewalls to Palo Alto Networks update servers
عرض الإجابة
اجابة صحيحة: C
السؤال #50
An engineer needs to redistribute User-ID mappings from multiple data centers. Which data flow best describes redistribution of user mappings?
A. ser-ID agent to firewall
B. irewall to firewall
C. omain Controller to User-ID agent
D. ser-ID agent to Panorama
عرض الإجابة
اجابة صحيحة: B
السؤال #51
An administrator has configured the Palo Alto Networks NGFW’s management interface to connect to the internet through a dedicated path that does not traverse back through the NGFW itself.Which configuration setting or step will allow the firewall to get automatic application signature updates?
A. scheduler will need to be configured for application signatures
B. Security policy rule will need to be configured to allow the update requests from the firewall to the update servers
C. Threat Prevention license will need to be installed
D. service route will need to be configured
عرض الإجابة
اجابة صحيحة: A
السؤال #52
The firewall is not downloading IP addresses from MineMeld. Based on the image, what most likely is wrong?
A. Certificate Profile that contains the client certificate needs to be selected
B. he source address supports only files hosted with an ftp://
C. xternal Dynamic Lists do not support SSL connections
D. Certificate Profile that contains the CA certificate needs to be selected
عرض الإجابة
اجابة صحيحة: D
السؤال #53
To protect your firewall and network from single source denial of service (DoS) attacks that can overwhelm its packet buffer and cause legitimate traffic to drop, you can configure:
A. BP (Protocol Based Protection)
B. GP (Border Gateway Protocol)
C. GP (Packet Gateway Protocol)
D. BP (Packet Buffer Protection)
عرض الإجابة
اجابة صحيحة: D
السؤال #54
An administrator sees several inbound sessions identified as unknown-tcp in the Traffic logs. The administrator determines that these sessions are form external users accessing the company’s proprietary accounting application. The administrator wants to reliably identify this traffic as their accounting application and to scan this traffic for threats.Which option would achieve this result?
A. reate a custom App-ID and enable scanning on the advanced tab
B. reate an Application Override policy
C. reate a custom App-ID and use the “ordered conditions” check box
D. reate an Application Override policy and a custom threat signature for the application
عرض الإجابة
اجابة صحيحة: A
السؤال #55
An administrator allocates bandwidth to a Prisma Access Remote Networks compute location with three remote networks. What is the minimum amount of bandwidth the administrator could configure at the compute location?
A. 0Mbps
B. 5Mbps
C. 0Mbps
D. 00Mbps
عرض الإجابة
اجابة صحيحة: C
السؤال #56
Which statement accurately describes service routes and virtual systems?
A. irtual systems can only use one interface for all global service and service routes of the firewall
B. irtual systems that do not have specific service routes configured inherit the global service and service route settings for the firewall
C. irtual systems cannot have dedicated service routes configured; and virtual systems always use the global service and service route settings for the firewall
D. he interface must be used for traffic to the required external services
عرض الإجابة
اجابة صحيحة: B
السؤال #57
An administrator wants to upgrade an NGFW from PAN-OS® 7.1.2 to PAN-OS® 8.1.0. The firewall is not a part of an HA pair.What needs to be updated first?
A. oad configuration version
B. ave candidate config
C. xport device state
D. oad named configuration snapshot
عرض الإجابة
اجابة صحيحة: A
السؤال #58
An administrator cannot see any Traffic logs from the Palo Alto Networks NGFW in Panorama reports. The configuration problem seems to be on the firewall. Which settings, if configured incorrectly, most likely would stop only Traffic logs from being sent from the NGFW to Panorama?
A. nable session logging at start
B. isable logging on the default deny rule
C. et the URL filtering action to send alerts
D. isable pre-defined reports
عرض الإجابة
اجابة صحيحة: A
السؤال #59
An engineer is planning an SSL decryption implementation.Which of the following statements is a best practice for SSL decryption?
A. erify that the IP addresses can be pinged and that routing issues are not causing the connection failure
B. heck whether the VPN peer on one end is set up correctly using policy-based VPN
C. n the IKE Gateway configuration, verify that the IP address for each VPN peer is accurate
D. n the IPSec Crypto profile configuration, verify that PFS is either enabled on both VPN peers or disabled on both VPN peers
عرض الإجابة
اجابة صحيحة: A
السؤال #60
Which data flow describes redistribution of user mappings?
A. ser-ID agent to firewall
B. omain Controller to User-ID agent
C. ser-ID agent to Panorama
D. irewall to firewall
عرض الإجابة
اجابة صحيحة: D
السؤال #61
DRAG DROP (Drag and Drop is not supported)Match each SD-WAN configuration element to the description of that element.
A. ee Explanation section for answer
عرض الإجابة
اجابة صحيحة: A
السؤال #62
An administrator with 84 firewalls and Panorama does not see any WildFire logs in Panorama.All 84 firewalls have an active WildFire subscription. On each firewall, WildFire logs are available.This issue is occurring because forwarding of which type of logs from the firewalls to Panorama is missing?
A. onfigure an LDAP Server profile and enable the User-ID service on the management interface
B. onfigure a group mapping profile to retrieve the groups in the target template
C. onfigure a Data Redistribution Agent to receive IP User Mappings from User-ID agents
D. onfigure a master device within the device groups
عرض الإجابة
اجابة صحيحة: A
السؤال #63
An administrator has enabled OSPF on a virtual router on the NGFW. OSPF is not adding new routes to the virtual router.Which two options enable the administrator to troubleshoot this issue? (Choose two.)
A. View Runtime Stats in the virtual router
B. View System logs
C. Add a redistribution profile to forward as BGP updates
D. Perform a traffic pcap at the routing stage
عرض الإجابة
اجابة صحيحة: AB
السؤال #64
Starting with PAN-OS version 9.1, GlobalProtect logging information is now recorded in which firewall log?
A. lobalProtect
B. ystem
C. uthentication
D. onfiguration
عرض الإجابة
اجابة صحيحة: A
السؤال #65
Which tool provides an administrator the ability to see trends in traffic over periods of time, such as threats detected in the last 30 days?
A. orward Trust certificate
B. elf-Signed Root CA certificate
C. eb Server certificate
D. ublic CA signed certificate
عرض الإجابة
اجابة صحيحة: B
السؤال #66
An administrator sees several inbound sessions identified as unknown-tcp in the Traffic logs. The administrator determines that these sessions are form external users accessing the company?€?s proprietary accounting application. The administrator wants to reliably identify this traffic as their accounting application and to scan this traffic for threats.Which option would achieve this result?
A. Create a custom App-ID and enable scanning on the advanced tab
B. Create an Application Override policy
C. Create a custom App-ID and use the ?€ordered conditions?€ check box
D. Create an Application Override policy and a custom threat signature for the application
عرض الإجابة
اجابة صحيحة: A
السؤال #67
Which PAN-OS® policy must you configure to force a user to provide additional credentials before he is allowed to access an internal application that contains highly-sensitive business data?
A. ecurity policy
B. ecryption policy
C. uthentication policy
D. pplication Override policy
عرض الإجابة
اجابة صحيحة: C
السؤال #68
The administrator has enabled BGP on a virtual router on the Palo Alto Networks NGFW, but new routes do not seem to be populating the virtual router.Which two options would help the administrator troubleshoot this issue? (Choose two.)
A. eartbeat Monitoring
B. ailover
C. ath Monitoring
D. ing-Path
عرض الإجابة
اجابة صحيحة: BC
السؤال #69
To more easily reuse templates and template stacks, you can create template variables in place of firewall- specific and appliance-specific IP literals in your configurations.Which one is the correct configuration?
A. Panorama
B. Panorama
C. Panorama
D. Panorama
عرض الإجابة
اجابة صحيحة: C
السؤال #70
A prospect is eager to conduct a Security Lifecycle Review (SLR) with the aid of the Palo Alto Networks NGFW. Which interface type is best suited to provide the raw data for an SLR from the network in a way that is minimally invasive?
A. ayer 2
B. irtual Wire
C. ap
D. ayer 3
عرض الإجابة
اجابة صحيحة: C
السؤال #71
Decrypted packets from the website https://www.microsoft.com will appear as which application and service within the Traffic log?
A. eb-browsing and 443
B. SL and 80
C. SL and 443
D. eb-browsing and 80
عرض الإجابة
اجابة صحيحة: A
السؤال #72
Which protection feature is available only in a Zone Protection Profile?
A. YN Flood Protection using SYN Flood Cookies
B. CMP Flood Protection
C. ort Scan Protection
D. DP Flood Protections
عرض الإجابة
اجابة صحيحة: C
السؤال #73
What best describes the HA Promotion Hold Time?
A. he time that the passive firewall will wait before taking over as the active firewall after communications with the HA peer have been lost
B. he time that is recommended to avoid a failover when both firewalls experience the same link/path monitor failure simultaneously
C. he time that is recommended to avoid an HA failover due to the occasional flapping of neighboring devices
D. he time that a passive firewall with a low device priority will wait before taking over as the active firewall if the firewall is operational again
عرض الإجابة
اجابة صحيحة: A
السؤال #74
Which log file can be used to identify SSL decryption failures?
A. raffic
B. CC
C. onfiguration
D. hreats
عرض الإجابة
اجابة صحيحة: A
السؤال #75
Refer to the exhibit.Which will be the egress interface if the traffic’s ingress interface is ethernet1/7 sourcing from 192.168.111.3 and to the destination 10.46.41.113?
A. thernet1/6
B. thernet1/3
C. thernet1/7
D. thernet1/5
عرض الإجابة
اجابة صحيحة: D
السؤال #76
Which feature can provide NGFWs with User-ID mapping information?
A. eb Captcha
B. ative 802
C. lobalProtect
D. ative 802
عرض الإجابة
اجابة صحيحة: C
السؤال #77
A network administrator wants to use a certificate for the SSL/TLS Service Profile. Which type of certificate should the administrator use?
A. achine certificate
B. erver certificate
C. ertificate authority (CA) certificate
D. lient certificate
عرض الإجابة
اجابة صحيحة: B
السؤال #78
What are the two behavior differences between Highlight Unused Rules and the Rule Usage Hit counter when a firewall is rebooted? (Choose two.)
A. g2 session count is the lowest compared to the other managed devices
B. s3 has a logging rate that deviates from the administrator-configured thresholds
C. k3 has a logging rate that deviates from the seven-day calculated baseline
D. g2 has misconfigured session thresholds
عرض الإجابة
اجابة صحيحة: AB
السؤال #79
A session in the Traffic log is reporting the application as “incomplete.” What does “incomplete” mean?
A. he three-way TCP handshake was observed, but the application could not be identified
B. he three-way TCP handshake did not complete
C. he traffic is coming across UDP, and the application could not be identified
D. ata was received but was instantly discarded because of a Deny policy was applied before App-ID could be applied
عرض الإجابة
اجابة صحيحة: B
السؤال #80
Which CLI command can be used to export the tcpdump capture?
A. cp export tcpdump from mgmt
B. cp extract mgmt-pcap from mgmt
C. cp export mgmt-pcap from mgmt
D. ownloadmgmt-pcap
عرض الإجابة
اجابة صحيحة: C
السؤال #81
An administrator has configured the Palo Alto Networks NGFW?€?s management interface to connect to the internet through a dedicated path that does not traverse back through the NGFW itself.Which configuration setting or step will allow the firewall to get automatic application signature updates?
A. A scheduler will need to be configured for application signatures
B. A Security policy rule will need to be configured to allow the update requests from the firewall to the update servers
C. A Threat Prevention license will need to be installed
D. A service route will need to be configured
عرض الإجابة
اجابة صحيحة: A
السؤال #82
A company wants to install a NGFW firewall between two core switches on a VLAN trunk link. They need to assign each VLAN to its own zone and to assign untagged (native) traffic to its own zone.Which option differentiates multiple VLANs into separate zones?
A. reate V-Wire objects with two V-Wire interfaces and define a range of “0-4096” in the “Tag Allowed” field of the V-Wire object
B. reate V-Wire objects with two V-Wire subinterfaces and assign only a single VLAN ID to the “Tag Allowed” field of the V-Wire object
C. reate Layer 3 subinterfaces that are each assigned to a single VLAN ID and a common virtual router
D. reate VLAN objects for each VLAN and assign VLAN interfaces matching each VLAN I Repeat for every additional VLAN and use a VLAN ID of 0 for untagged traffic
عرض الإجابة
اجابة صحيحة: B
السؤال #83
An administrator is building Security rules within a device group to block traffic to and from malicious locations. How should those rules be configured to ensure that they are evaluated with a high priority?
A. reate the appropriate rules with a Block action and apply them at the top of the local firewall Security rules
B. reate the appropriate rules with a Block action and apply them at the top of the Security Pre-Rules
C. reate the appropriate rules with a Block action and apply them at the top of the Security Post-Rules
D. reate the appropriate rules with a Block action and apply them at the top of the Default Rules
عرض الإجابة
اجابة صحيحة: B
السؤال #84
SD-WAN is designed to support which two network topology types? (Choose two.)
A. t enables a firewall to revert to the previous configuration if rule shadowing is detected
B. t enables a firewall to revert to the previous configuration if application dependency errors are found
C. t enables a firewall to revert to the previous configuration if a commit causes HA partner connectivity failure
D. t enables a firewall to revert to the previous configuration if a commit causes Panorama connectivity failure
عرض الإجابة
اجابة صحيحة: BC
السؤال #85
A bootstrap USB flash drive has been prepared using a Linux workstation to load the initial configuration of a Palo Alto Networks firewall. The USB flash drive was formatted using file system ntfs and the initial configuration is stored in a file named init-cfg.txt.The contents of init-cfg.txt in the USB flash drive are as follows:The USB flash drive has been inserted in the firewalls’ USB port, and the firewall has been powered on. Upon boot, the firewall fails to begin the bootstrapping process. The failu
A. he bootstrap
B. it-cfg
C. he USB must be formatted using the ext4 file system
D. here must be commas between the parameter names and their values instead of the equal symbols
E. he USB drive has been formatted with an unsupported file system
عرض الإجابة
اجابة صحيحة: E
السؤال #86
A web server is hosted in the DMZ and the server is configured to listen for incoming connections on TCP port443. A Security policies rules allowing access from the Trust zone to the DMZ zone needs to be configured to allow web-browsing access. The web server hosts its contents over HTTP(S). Traffic from Trust to DMZ is being decrypted with a Forward Proxy rule.Which combination of service and application, and order of Security policy rules, needs to be configured to allow cleartext web-browsing traffic to
A. ule #1: application: web-browsing; service: application-default; action: allowRule #2: application: ssl; service: application-default; action: allow
B. ule #1: application: web-browsing; service: service-http; action: allowRule #2: application: ssl; service: application-default; action: allow
C. ule # 1: application: ssl; service: application-default; action: allowRule #2: application: web-browsing; service: application-default; action: allow
D. ule #1: application: web-browsing; service: service-https; action: allowRule #2: application: ssl; service: application-default; action: allow
عرض الإجابة
اجابة صحيحة: D
السؤال #87
05. Which two functions can be performed with a next­generation firewall but NOT with a legacy firewall?
A. ctive­Activemode
B. ctive­Passivemode
C. A­LiteActive­Passivemode
D. ctive­Passivemodewith"tcp­reject­non­syn"setto"no"
عرض الإجابة
اجابة صحيحة: CD
السؤال #88
Which DoS protection mechanism detects and prevents session exhaustion attacks?
A. acket Based Attack Protection
B. lood Protection
C. esource Protection
D. CP Port Scan Protection
عرض الإجابة
اجابة صحيحة: C
السؤال #89
Which three firewall states are valid? (Choose three.)
A. Active
B. Functional
C. Pending
D. Passive
E. Suspended
عرض الإجابة
اجابة صحيحة: ADE
السؤال #90
When you import the configuration of an HA pair into Panorama, how do you prevent the import from affecting ongoing traffic?
A. isable H
B. isable the HA2 link
C. et the passive link state to "shutdown
D. isable config sync
عرض الإجابة
اجابة صحيحة: D
السؤال #91
During the packet flow process, which two processes are performed in application identification? (Choose two.)
A. ession Browser
B. pplication Command Center
C. CP Dump
D. acket Capture
عرض الإجابة
اجابة صحيحة: AB
السؤال #92
An administrator needs to upgrade a Palo Alto Networks NGFW to the most current version of PAN-OS® software. The firewall has internet connectivity through an Ethernet interface, but no internet connectivity from the management interface. The Security policy has the default security rules and a rule that allows all web- browsing traffic from any to any zone.What must the administrator configure so that the PAN-OS® software can be upgraded?
A. ecurity policy rule
B. RL
C. ervice route
D. cheduler
عرض الإجابة
اجابة صحيحة: C
السؤال #93
The certificate information displayed in the following image is for which type of certificate?
A. Forward Trust certificate
B. Self-Signed Root CA certificate
C. Web Server certificate
D. Public CA signed certificate
عرض الإجابة
اجابة صحيحة: B
السؤال #94
Your company has 10 Active Directory domain controllers spread across multiple WAN links. All users authenticate to Active Directory. Each link has substantial network bandwidth to support all mission-critical applications. The firewall's management plane is highly utilized. Given this scenario, which type of User-ID agent is considered a best practice by Palo Alto Networks?
A. AN-OS integrated agent
B. itrix terminal server agent with adequate data-plane resources
C. aptive Portal
D. indows-based User-ID agent on a standalone server
عرض الإجابة
اجابة صحيحة: D
السؤال #95
Which value in the Application column indicates UDP traffic that did not match an App-ID signature?
A. nknown-udp
B. nknown-ip
C. ncomplete
D. ot-applicable
عرض الإجابة
اجابة صحيحة: A
السؤال #96
Which menu item enables a firewall administrator to see details about traffic that is currently active through the NGFW?
A. CC
B. ystem Logs
C. pp Scope
D. ession Browser
عرض الإجابة
اجابة صحيحة: D
السؤال #97
When configuring a GlobalProtect Portal, what is the purpose of specifying an Authentication Profile?
A. he settings assigned to the template that is on top of the stack
B. he administrator will be promoted to choose the settings for that chosen firewall
C. ll the settings configured in all templates
D. epending on the firewall location, Panorama decides with settings to send
عرض الإجابة
اجابة صحيحة: C
السؤال #98
Which three steps will reduce the CPU utilization on the management plane? (Choose three.)
A. Disable SNMP on the management interface
B. Application override of SSL application
C. Disable logging at session start in Security policies
D. Disable predefined reports
E. Reduce the traffic being decrypted by the firewall
عرض الإجابة
اجابة صحيحة: ACD
السؤال #99
A firewall administrator has been asked to configure a Palo Alto Networks NGFW to prevent against compromised hosts trying to phone-home or beacon out to external command-and-control (C2) servers.Which Security Profile type will prevent these behaviors?
A. nti-Spyware
B. ildFire
C. ulnerability Protection
D. ntivirus
عرض الإجابة
اجابة صحيحة: A
السؤال #100
If an administrator does not possess a website’s certificate, which SSL decryption mode will allow the Palo Alto Networks NGFW to inspect traffic when users browse to HTTP(S) websites?
A. SL Forward Proxy
B. SL Inbound Inspection
C. LS Bidirectional proxy
D. SL Outbound Inspection
عرض الإجابة
اجابة صحيحة: A
السؤال #101
How would an administrator monitor/capture traffic on the management interface of the Palo Alto Networks NGFW?
A. se the debug dataplane packet-diag set capture stage firewall file command
B. nable all four stages of traffic capture (TX, RX, DROP, Firewall)
C. se the debug dataplane packet-diag set capture stage management file command
D. se the tcpdump command
عرض الإجابة
اجابة صحيحة: D
السؤال #102
An administrator is using Panorama to manage multiple firewalls. After upgrading all devices to the latest PAN-OS software, the administrator enables log forwarding from the firewalls to Panorama. However, pre-existing logs from the firewalls are not appearing in Panorama. Which action should be taken to enable the firewalls to send their pre-existing logs to Panorama?
A. se the import option to pull logs
B. se the scp logdb export command
C. xport the log database
D. se the ACC to consolidate the logs
عرض الإجابة
اجابة صحيحة: B
السؤال #103
Which operation will impact the performance of the management plane?
A. oS protection
B. ildFire submissions
C. enerating a SaaS Application report
D. ecrypting SSL sessions
عرض الإجابة
اجابة صحيحة: C
السؤال #104
Which option enables a Palo Alto Networks NGFW administrator to schedule Application and Threat updates while applying only new content-IDs to traffic?
A. elect download-and-install
B. elect download-only
C. elect download-and-install, with “Disable new apps in content update” selected
D. elect disable application updates and select “Install only Threat updates”
عرض الإجابة
اجابة صحيحة: C
السؤال #105
A bootstrap USB flash drive has been prepared using a Windows workstation to load the initial configuration of a Palo Alto Networks firewall that was previously being used in a lab. The USB flash drive was formatted using file system FAT32 and the initial configuration is stored in a file named init-cfg.txt. The firewall is currently running PAN-OS 10.0 and using a lab config. The contents of init-cfg.txt in the USB flash drive are as follows:The USB flash drive has been inserted in the firewalls’ USB port,
A. he bootstrap
B. irewall must be in factory default state or have all private data deleted for bootstrapping
C. he hostname is a required parameter, but it is missing in init-cfg
D. AN-CS version must be 9
E. he USB must be formatted using the ext3 file system
عرض الإجابة
اجابة صحيحة: D
السؤال #106
What is considered the best practice with regards to zone protection?
A. se separate log-forwarding profiles to forward DoS and zone threshold event logs separately from other threat logs
B. eview DoS threat activity (ACC > Block Activity) and look for patterns of abuse
C. et the Alarm Rate threshold for event-log messages to high severity or critical severity
D. f the levels of zone and DoS protection consume too many firewall resources, disable zone protection
عرض الإجابة
اجابة صحيحة: D
السؤال #107
Before an administrator of a VM-500 can enable DoS and zone protection, what actions need to be taken?
A. ee Explanation section for answer
عرض الإجابة
اجابة صحيحة: D
السؤال #108
An administrator needs to optimize traffic to prefer business-critical applications over non-critical applications. QoS natively integrates with which feature to provide service quality?
A. ort Inspection
B. ertificate revocation
C. ontent-ID
D. pp-ID
عرض الإجابة
اجابة صحيحة: D
السؤال #109
A customer wants to set up a VLAN interface for a Layer 2 Ethernet port.Which two mandatory options are used to configure a VLAN interface? (Choose two.)
A. nti-Spyware
B. nstruction Prevention
C. ile Blocking
D. ntivirus
عرض الإجابة
اجابة صحيحة: CD
السؤال #110
An administrator is considering upgrading the Palo Alto Networks NGFW and central management Panorama version.What is considered best practice for this scenario?
A. erform the Panorama and firewall upgrades simultaneously
B. pgrade the firewall first, wait at least 24 hours, and then upgrade the Panorama version
C. pgrade Panorama to a version at or above the target firewall version
D. xport the device state, perform the update, and then import the device state
عرض الإجابة
اجابة صحيحة: C
السؤال #111
In URL filtering, which component matches URL patterns?
A. ive URL feeds on the management plane
B. ecurity processing on the data plane
C. ingle-pass pattern matching on the data plane
D. ignature matching on the data plane
عرض الإجابة
اجابة صحيحة: C
السؤال #112
Which method does an administrator use to integrate all non-native MFA platforms in PAN-OS® software?
A. kta
B. UO
C. ADIUS
D. ingID
عرض الإجابة
اجابة صحيحة: C
السؤال #113
An administrator has left a firewall to use the default port for all management services. Which three functions are performed by the dataplane? (Choose three.)
A. se the import option to pull logs into Panorama
B. CLI command will forward the pre-existing logs to Panorama
C. se the ACC to consolidate pre-existing logs
D. he log database will need to exported form the firewalls and manually imported into Panorama
عرض الإجابة
اجابة صحيحة: BDE
السؤال #114
An administrator has been asked to configure active/passive HA for a pair of Palo Alto Networks NGFWs. The administrator assigns priority 100 to the active firewall.Which priority is correct for the passive firewall?
A.
B. 9
C.
D. 55
عرض الإجابة
اجابة صحيحة: D
السؤال #115
An administrator needs to validate that policies that will be deployed will match the appropriate rules in the device-group hierarchy.Which tool can the administrator use to review the policy creation logic and verify that unwanted traffic is not allowed?
A. review Changes
B. olicy Optimizer
C. anaged Devices Health
D. est Policy Match
عرض الإجابة
اجابة صحيحة: D
السؤال #116
A firewall is configured with SSL Forward Proxy decryption and has the following four enterprise certificate authorities (CAs):I) Enterprise-Trusted-CA, which is verified as Forward Trust Certificate (The CA is also installed in the trusted store of the end-user browser and system.)ii) Enterprise-Untrusted-CA, which is verified as Forward Untrust Certificateiii) Enterprise-Intermediate-CAiv) Enterprise-Root-CA, which is verified only as Trusted Root CAAn end-user visits https://www.example-website.com/ with
A. nterprise-Trusted-CA which is a self-signed CA
B. nterprise-Root-CA which is a self-signed CA
C. nterprise-Intermediate-CA which was, in turn, issued by Enterprise-Root-CA
D. nterprise-Untrusted-CA which is a self-signed CA
عرض الإجابة
اجابة صحيحة: D
السؤال #117
How can packet buffer protection be configured?
A. t zone level to protect firewall resources and ingress zones, but not at the device level
B. t the interface level to protect firewall resources
C. t the device level (globally) to protect firewall resources and ingress zones, but not at the zone level
D. t the device level (globally) and, if enabled globally, at the zone level
عرض الإجابة
اجابة صحيحة: D
السؤال #118
Which CLI command enables an administrator to check the CPU utilization of the dataplane?
A. how running resource-monitor
B. ebug data-plane dp-cpu
C. how system resources
D. ebug running resources
عرض الإجابة
اجابة صحيحة: A
السؤال #119
The UDP-4501 protocol-port is used between which two GlobalProtect components?
A. lobalProtect app and GlobalProtect satellite
B. lobalProtect app and GlobalProtect portal
C. lobalProtect app and GlobalProtect gateway
D. lobalProtect portal and GlobalProtect gateway
عرض الإجابة
اجابة صحيحة: C
السؤال #120
Which three user authentication services can be modified to provide the Palo Alto Networks NGFW with both usernames and role names? (Choose three.)
A. ello heartbeats
B. ser-ID information
C. ession synchronization
D. A state information
عرض الإجابة
اجابة صحيحة: AEF
السؤال #121
What are three reasons why an installed session can be identified with the "application incomplete" tag? (Choose three.)
A. pdate the Firewall Apps and Threat version to match the version of Panorama
B. hange the new category action to "alert" and push the configuration again
C. nsure that the firewall can communicate with the URL cloud
D. erity that the URL seed tile has been downloaded and activated on the firewall
عرض الإجابة
اجابة صحيحة: ADE
السؤال #122
Refer to the exhibit.Which certificates can be used as a Forward Trust certificate?
A. ertificate from Default Trust Certificate Authorities
B. omain Sub-CA
C. orward_Trust
D. omain-Root-Cert
عرض الإجابة
اجابة صحيحة: B

عرض الإجابات بعد التقديم

يرجى إرسال البريد الإلكتروني الخاص بك والواتس اب للحصول على إجابات الأسئلة.

ملحوظة: يرجى التأكد من صلاحية معرف البريد الإلكتروني وWhatsApp حتى تتمكن من الحصول على نتائج الاختبار الصحيحة.

بريد إلكتروني:
رقم الواتس اب/الهاتف:


Copyright © 2024. Designer by SPOTO Official Website. All Rights Reserved.