An engineer must configure the Decryption Broker feature

Which Decryption Broker security chain supports bi-directional traffic flow?

When an in-band data port is set up to provide access to required services, what is required for an interface that is assigned to service routes?

What are two prerequisites for configuring a pair of Palo Alto Networks firewalls in an active/passive High Availability (HA) pair? (Choose two.)

How can packet butter protection be configured?

How are IPV6 DNS queries configured to user interface ethernet1/3?

Which Panorama objects restrict administrative access to specific device-groups?

A variable name must start with which symbol?

An engineer wants to implement the Palo Alto Networks firewall in VWire mode on the internet gateway and wants to be sure of the functions that are supported on the vwire interface

What are three supported functions on the VWire interface? (Choose three )

An administrator needs to evaluate a recent policy change that was committed and pushed to a firewall device group.

How should the administrator identify the configuration changes?

Which client software can be used to connect remote Linux client into a Palo Alto Networks Infrastructure without sacrificing the ability to scan traffic and protect against threats?

NO: 56

A firewall administrator is troubleshooting problems with traffic passing through the Palo Alto Networks firewall. Which method shows the global counters associated with the traffic after configuring the appropriate packet filters?

Which two logs on the firewall will contain authentication-related information useful for troubleshooting purpose (Choose two)

Which two virtualized environments support Active/Active High Availability (HA) in PAN-OS 8.0? (Choose two.)

A network security engineer is asked to perform a Return Merchandise Authorization (RMA) on a firewall

Which part of files needs to be imported back into the replacement firewall that is using Panorama?

A company has a pair of Palo Alto Networks firewalls configured as an Acitve/Passive High Availability (HA) pair.

What allows the firewall administrator to determine the last date a failover event occurred?

When configuring forward error correction (FEC) for PAN-OS SD-WAN, an administrator would turn on the feature inside which type of SD-WAN profile?

A security engineer needs to mitigate packet floods that occur on a set of servers behind the internet facing interface of the firewall. Which Security Profile should be applied to a policy to prevent these packet floods?

A superuser is tasked with creating administrator accounts for three contractors For compliance purposes, all three contractors will be working with different device-groups in their hierarchy to deploy policies and objects.

Which type of role-based access is most appropriate for this project?

An administrator device-group commit push is tailing due to a new URL category

How should the administrator correct this issue?

Which Captive Portal mode must be configured to support MFA authentication?

Which option would an administrator choose to define the certificate and protocol that Panorama and its managed devices use for SSL/TLS services?

Which is the maximum number of samples that can be submitted to WildFire per day, based on wildfire subscription?

What should an administrator consider when planning to revert Panorama to a pre-PAN-OS 8.1 version?

An administrator is defining protection settings on the Palo Alto Networks NGFW to guard against resource exhaustion. When platform utilization is considered, which steps must the administrator take to configure and apply packet buffer protection?

Which virtual router feature determines if a specific destination IP address is reachable?

Starling with PAN-OS version 9.1, GlobalProtect logging information is now recorded in which firewall log?

Which operation will impact the performance of the management plane?

A company needs to preconfigure firewalls to be sent to remote sites with the least amount of reconfiguration. Once deployed, each firewall must establish secure tunnels back to multiple regional data centers to include the future regional data centers.

Which VPN configuration would adapt to changes when deployed to the future site?

A client has a sensitive application server in their data center and is particularly concerned about session flooding because of denial of-service attacks.

How can the Palo Alto Networks NGFW be configured to specifically protect this server against session floods originating from a single IP address?

What file type upload is supported as part of the basic WildFire service?

A web server is hosted in the DMZ and the server is configured to listen for incoming connections on TCP port 443. A Security policies rules allowing access from the Trust zone to the DMZ zone needs to be configured to allow web-browsing access. The web server hosts its contents over HTTP(S). Traffic from Trust to DMZ is being decrypted with a Forward Proxy rule.

Which combination of service and application, and order of Security policy rules, needs to be configured to allow cleartext web- browsing traffic to this server on tcp/443.

Which log file can be used to identify SSL decryption failures?

A speed/duplex negotiation mismatch is between the Palo Alto Networks management port and the switch port which it connects. How would an administrator configure the interface to 1Gbps?

An administrator has created an SSL Decryption policy rule that decrypts SSL sessions on any port. Which log entry can the administrator use to verify that sessions are being decrypted?

An administrator using an enterprise PKI needs to establish a unique chain of trust to ensure mutual authentication between Panorama and the managed firewalls and Log Collectors.

How would the administrator establish the chain of trust?

An administrator has left a firewall to use the default port for all management services. Which three functions are performed by the dataplane? (Choose three.)

Which two options prevent the firewall from capturing traffic passing through it? (Choose two.)

Updates to dynamic user group membership are automatic therefore using dynamic user groups instead of static group objects allows you to:

Which four NGFW multi-factor authentication factors are supported by PAN-OS? (Choose four.)

An administrator has been asked to configure active/passive HA for a pair of Palo Alto Networks NGFWs. The administrator assigns priority 100 to the active firewall.

Which priority is correct for the passive firewall?

Site-A and Site-B need to use IKEv2 to establish a VPN connection. Site A connects directly to the internet using a public IP address. Site-B uses a private IP address behind an ISP router to connect to the internet.

How should NAT Traversal be implemented for the VPN connection to be established between Site-A and Site-B?

Which CLI command enables an administrator to check the CPU utilization of the dataplane?

What must be used in Security Policy Rule that contain addresses where NAT policy applies?

How is the Forward Untrust Certificate used?

Which CLI command displays the current management plan memory utilization?

Which three items are import considerations during SD-WAN configuration planning? (Choose three.)

What are three valid method of user mapping? (Choose three)

An enterprise information Security team has deployed policies based on AD groups to restrict user access to critical infrastructure systems However a recent phisning campaign against the organization has prompted Information Security to look for more controls that can secure access to critical assets For users that need to access these systems Information Security wants to use PAN-OS multi-factor authentication (MFA) integration to enforce MFA.

What should the enterprise do to use PAN-OS MFA1?

The administrator for a small company has recently enabled decryption on their Palo Alto Networks firewall using a self-signed root certificate. They have also created a Forward Trust and Forward Untrust certificate and set them as such

The admin has not yet installed the root certificate onto client systems

What effect would this have on decryption functionality?

A network security engineer wants to prevent resource-consumption issues on the firewall.

Which strategy is consistent with decryption best practices to ensure consistent performance?

A host attached to ethernet1/3 cannot access the internet. The default gateway is attached to ethernet1/4. After troubleshooting. It is determined that traffic cannot pass from the ethernet1/3 to ethernet1/4. What can be the cause of the problem?

A users traffic traversing a Palo Alto networks NGFW sometimes can reach http //www company com At other times the session times out. At other times the session times out The NGFW has been configured with a PBF rule that the user traffic matches when it goes to http://www.company.com

goes to http://www company com

How can the firewall be configured to automatically disable the PBF rule if the next hop goes down?

Which Panorama feature allows for logs generated by Panorama to be forwarded to an external Security Information and Event Management(SIEM) system?

Which CLI command displays the current management plane memory utilization?

An administrator allocates bandwidth to a Prisma Access Remote Networks compute location with three remote networks.

What is the minimum amount of bandwidth the administrator could configure at the compute location?

Which three fields can be included in a pcap filter? (Choose three)

Which setting allow a DOS protection profile to limit the maximum concurrent sessions from a source IP address?

What are three reasons for excluding a site from SSL decryption? (Choose three.)

Which URL Filtering Security Profile action togs the URL Filtering category to the URL Filtering log?