Palo Alto Firewall Essentials

A strength of the Palo Alto Networks firewall is:

Select True or false. The CN-Series firewalls deliver the same capabilities as the PA-Series and VM-Series firewalls.

Select True or False. Traffic protection from external locations where the egress point is the perimeter is commonly referred to as “North-South” traffic.

The first important task of building a Zero Trust Architecture is to identify __________________.

What is the method used to create a Zero Trust policy that answers the 'who, what, when, where, why and how' definition?

Which object cannot be segmented using virtual systems on a firewall?

Which Palo Alto Networks Cortex technology prevents malware, blocks exploits, and analyzes suspicious patterns through behavioral threat protection?

Which Palo Alto Networks Next Generation VM Series Model requires a minimum of 16 GB of memory and 60 GB of dedicated disk drive capacity?

Which Palo Alto Networks Prisma technology provides continuous security monitoring, compliance validation, and cloud storage security capabilities across multi-cloud environments? In addition, you can simplify security operations through effective threat protections enhanced with comprehensive cloud context.

Which Palo Alto Networks product for securing the enterprise extends the enterprise perimeter to remote offices and mobile users?

Which series of a firewall is a high-performance physical appliance solution?

Which series of Palo Alto Networks Next Generation Firewall offers two modes, Secure Mode, and Express Mode?

Which Strata product provides centralized firewall management and logging?

What are the two attributes of the dedicated out-of-band network management port in Palo Alto Networks firewalls? (Choose two.)

Select True or False. To register a hardware firewall you will need the firewall's serial number..

Select True or False. Service routes can be used to configure an in-band port to access external services.

In the web interface, what is signified when a text box is highlighted in red?

Which two planes are found in the Palo Alto Networks single-pass platform architecture? (Choose two.)

Which object cannot be segmented using virtual systems on a firewall?

Which series of a firewall is a high-performance physical appliance solution?

Which strata product provides centralized firewall management and logging?

Select True or False. The CN-series firewalls deliver the same capabilities as the PA-series and VM-series firewalls.

Which two statements are true regarding the candidate configuration? (Choose two.)

Select True or False. The running configuration consists of configuration changes in progress but not active on the firewall.

When committing changes to a firewall, what is the result of clicking the Preview Changes link?

Select True or False. The Export operations transfer configurations as XML-formatted files from the firewall..

For guidance on continuing to deploy the security platform features to address your network security needs, review the PAN-OS Administrator's Guide section titled

In the web interface, what is signified when a text box is highlighted in red?

Select True or False. By default, the firewall uses the management (MGT) interface to access external services, such as DNS servers, external authentication servers, Palo Alto Networks services such as software, URL updates, licenses and AutoFocus.

Select True or false. Service routes can be used to configure an in-band port to access external services.

The Gartner Magic Quadrant for Network Firewalls rates company's:

Which attribute is associated with the dedicated out-of-band network management port in Palo Alto Networks firewalls?

Which command will reset a next generation firewall to its factory default settings if you know the admin account password?

Which type of firewall license or subscription provides a graphical analysis of firewall traffic logs and identifies potential risks to your network by using threat intelligence from a portal?

When committing changes to a firewall, what is the result of clicking the Preview Changes link?

When making changes to configuration settings on the PAN-OS firewall, which of the following options lists the individual changes for which you are committing changes:

Which Next Generation FW configuration type has settings active on the firewall?

Which statement is true regarding the Palo Alto Networks Firewall candidate configuration?

Select True or False. The running configuration consists of configuration changes in progress but not active on the firewall.

When creating a custom admin role, which four types of privileges can be defined? (Choose four.)

Global user authentication is supported by which three authentication services? (Choose three.)

Select True or False. Server profiles define connections that the firewall can make to external servers.

Select True or False. Certificate-based authentication replaces all other forms of either local or external authentication..

Global user authentication is not supported by which authentication service?

Select True or False. On the Next Generation firewall, a commit lock blocks other administrators from committing changes until all of the locks have been released.

Select True or False. Server Profiles define connections that the firewall can make to external servers.

True or false? Certificate-based authentication replaces all other forms of either local or external authentication.

When creating a custom admin role, which type of privileges can not be defined?

When creating PAN-OS firewall administrator accounts, which configuration step is required for Non-Local Administrators, but not for Local Administrators?

When resetting the PAN-OS firewall to factory defaults, you can save all configuration settings and logs by performing the following:

Which built-in administrator role allows all rights except for the creation of administrative accounts and virtual systems?

Which built-in role on the Next Generation firewall is the same as superuser except for creation of administrative accounts?

Which of the following is NOT a PAN-OS Firewall Administrator Dynamic Role?

Which role-based privilege allows full access to the Palo Alto Networks firewall, including defining new administrator accounts and virtual systems?

Which two items are supported routing protocols on a virtual router? (Choose two.)

Which three interface types are valid on Palo Alto Networks firewall? (Choose three.)

Which two firewall interface types can be added to a Layer3-type security zone? (Choose two.)

Which type of firewall interface enables passive monitoring of network traffic?

Which two actions affect all of the widgets in the Application Command Center?

Select True or False. A Layer 3 interface can be configured as dual stack with both IPv4 and IPv6 addresses.

Select True or False. All of the interfaces on a Next Generation firewall must be the same interface type.

Select True or False. In a Next Generation firewall, every interface in use must be assigned to a zone in order to process traffic.

Select True or False. In addition to routing to other network devices, virtual routers on the Next Generation firewall can route to other virtual routers.

What type of interface allows the Next Generation firewall to provide switching between two or more networks?

Which feature can be configured with an IPv6 address?

Which of the following is a routing protocol supported in a Next Generation firewall?

Which routing protocol is supported on a virtual router?

Which two firewall features display information using widgets?

Which type of interface will allow the firewall to be inserted into an existing topology without requiring any reallocation of network addresses or redesign on the network topology?

Which two items are required to match criteria in a Palo Alto Networks Security policy rule? (Choose two.)

Which type of Security policy rule is the default rule type?

Which action in a Security policy rule results in traffic being silently rejected?

Select True or false. Logging on intrazone-default and interzone-default Security policy rules is enabled by default.

NGFW QoS policies can be configured to apply:

When defining Security policy rules, why should you consider only the c2s flow direction, and define policy rules that allow or deny traffic from the source zone to the destination zone, that is, in the c2s direction?

Which of the following are NOT traffic attributes or criteria that can be defined in a Security policy rule?

Select True or False. Security policy rules on the Next Generation firewall specify a source and a destination interface.

Traffic going to a public IP address is being translated by a Next Generation firewall to an internal server private IP address. Which IP address should the security policy use as the destination IP in order to allow traffic to the server?

Which action in a Security policy rule results in traffic being silently rejected?

Which NGFW security policy rule applies to all matching traffic within the specified source zones?

In the Palo Alto Networks Application Command Center (ACC), which filter allows you to limit the display to the details you care about right now and to exclude the unrelated information from the current display?

Select the answer that best completes this sentence. Source NAT commonly is used for _________ users to access the ________ internet.

Select the answer that completes this sentence. DIPP source NAT will support a maximum of about ______________ concurrent sessions on each IP address configured within the NAT pool.

Which one of the following statements is true about NAT rules?

What feature on the Next Generation firewall can be used to identify, in real time, the applications taking up the most bandwidth?

Which statement about the automated correlation engine is not correct?

When using config audit to compare configuration files on a Next Generation firewall, what does the yellow indication reveal?

In the Palo Alto Networks Firewall WebUI, which type of report can be compiled into a single emailed PDF?

On the Palo Alto Networks Next Generation Firewall, which is the default port for transporting Syslog traffic?

When creating an application filter, which of the following is true?

Select True or False. On the Next Generation firewall, application groups are always automatically updated when new applications are added to the App-ID database.

In a Next Generation firewall, how many packet does it take to identify the application in a TCP exchange?

What feature on the Next Generation firewall will set the security policy to allow the application on the standard ports associated with the application?

What feature on the Next Generation firewall can be used to identify, in real time, the applications taking up the most bandwidth?

What are the three pre-defined tabs in the Next Generation firewall Application Command Center (ACC)?

How would App-ID label TCP traffic when the three-way handshake completes, but not enough data is sent to identify an application?

When an Applications and Threats content update is performed, which is the earliest point where you can review the impact of new application signatures on existing policies?

Which three methods does App-ID use to identify network traffic? Choose the 3 correct choices.

True or false? When migration is done from the firewall of another vendor to a Palo Alto Networks firewall, a best practice is to always migrate the existing Security policy.

True or false? If App-ID cannot identify the traffic, Content-ID cannot inspect the traffic for malware.

Which Palo Alto Networks Next Generation Firewall URL Category Action sends a response page to the user’s browser that prompts the user for the administrator-defined override password, and logs the action to the URL Filtering log?

Which Next Generation Firewall URL filter setting is used to prevent users who use the Google, Yahoo, Bing, Yandex, or YouTube search engines from viewing search results unless their browser is configured with the strict safe search option.

A "continue" action can be configured on the following security profiles in the Next Generation firewall:

Which URL filtering security profile action logs the category to the URL filtering log?

Which is the correct URL matching order on a Palo Alto Networks Next Generation Firewall?

Which URL Filtering Profile action will result in a user being interactively prompted for a password?

Which statement about the predefined reports is not correct?

Which statement is not true regarding Safe Search Enforcement?

True or false? A URL Filtering license is not required to define and use custom URL categories.

True or false? SNMP GET requests to a firewall return operational statistics, and SNMP SET requests update the firewall configuration.

Without a Wildfire licensed subscription, which of the following files can be submitted by the Next Generation Firewall to the hosted Wildfire virtualized sandbox?

In the latest Next Generation firewall version, what is the shortest time that can be configured on the firewall to check for Wildfire updates?

Which CLI command is used to verify successful file uploads to WildFire?

True or False. If a file type is matched in the File Blocking Profile and WildFire Analysis Profile, and if the File Blocking Profile action is set to “block,” then the file is not forwarded to WildFire.

Which file type can a firewall send to WildFire when the firewall does not have a WildFire subscription?

Which WildFire verdict might indicate obtrusive behavior but not a security threat?

True or false? When a malicious file or link is detected in an email, WildFire can update antivirus signatures in the PAN-DB database.

Assume you have a WildFire subscription. Which file state or condition would trigger a Wildfire file analysis?

Which User-ID component and mapping method is recommended for web clients that do not use the domain server?

Which port does the Palo Alto Networks Windows-based User-ID agent use by default?

The User-ID feature identifies the user and IP address of the computer the user is logged into for Next Generation firewall policy enforcement.

Which two statements are true regarding User-ID and firewall configuration?

Which statement is true regarding User-ID and Security policy rules?

Which item is not a valid choice when the Source User field is configured in a Security policy rule?

Which URL Filtering Profile action will result in a user being interactively prompted for a password?

According to best practices, which two URL filtering categories should be blocked in most URL Filtering Profiles? (Choose two.)

Which three statements are true regarding Safe Search Enforcement? (Choose three.)

True or False? A URL Filtering license is not required to define and use custom URL categories.

To properly configure DOS protection to limit the number of sessions individually from specific source IPS you would configure a DOS Protection rule with the following characteristics:

What action will show whether a downloaded PDF file from a user has been blocked by a security profile on the Next Generation firewall?

What component of the Next Generation Firewall will protect from port scans?

Which anti-spyware feature enables an administrator to quickly identify a potentially infected host on the network?

True or false? A Security Profile attached to a Security policy rule is evaluated only if the Security policy rule matches traffic and the rule action is set to “allow.”

A Zone Protection Profile is applied to which item?

Network traffic matches an “allow” rule in the Security policy, but the attached File Blocking Profile is configured with a “block” action. To which two locations will the traffic be logged? (Choose two.)

Which profile type is designed to protect against reconnaissance attacks such as host sweeps and port scans?

Which feature can be configured to block sessions that the firewall cannot decrypt?

What is the default setting for "Action" in a decryption policy rule?

Which type of Next Generation Firewall decryption inspects SSL traffic between an internal host and an external web server?

When SSL encrypted traffic first arrives at the Next Generation Firewall, which technology initially identifies the application as web-browsing?

Which type of Next Generation Firewall decryption inspects SSL traffic coming from external users to internal servers?

True or False. In the Next Generation Firewall, even if the Decryption policy rule action is “no-decrypt,” the Decryption Profile attached to the rule can still be configured to block sessions with expired or untrusted certificates.

Which two types of activities does SSL/TLS decryption on the firewall help to block?

True or false? If OCSP and CRL are configured on a firewall, CRL is consulted first.

Which type of firewall decryption requires the administrator to import a server certificate and a private key into the firewall?

True or false? The SSL forward untrusted certificate should not be trusted by the client but should still be a CA certificate.

True or false? The firewall still can check for expired or untrusted certificates even if the SSL traffic is not being decrypted.

In the Palo Alto Networks Application Command Center (ACC), which filter allows you to limit the display to the details you care about right now and to exclude the unrelated information from the current display?

What feature on the Next Generation firewall can be used to identify, in real time, the applications taking up the most bandwidth?

What is the recommended maximum default size of PE - executable - files forwarded from the Next Generation firewall to Wildfire?