NEW QUESTION 1
A Security policy rule is configured with a Vulnerability Protection Profile and an action of ‘Deny”.
Which action will this cause configuration on the matched traffic?

• A. The configuration is invali
• B. The Profile Settings section will be grayed out when the Action is set to “Deny”.
• C. The configuration will allow the matched session unless a vulnerability is detecte
• D. The “Deny” action will supersede the per-severity defined actions defined in the associated Vulnerability Protection Profile.
• E. The configuration is invali
• F. It will cause the firewall to skip this Security policy rul
• G. A warning will be displayed during a commit.
• H. The configuration is vali
• I. It will cause the firewall to deny the matched session
• J. Any configured Security Profiles have no effect if the Security policy rule action is set to “Deny.”

Answer: B

NEW QUESTION 2
A file sharing application is being permitted and no one knows what this application is used for.
How should this application be blocked?

• A. Block all unauthorized applications using a security policy
• B. Block all known internal custom applications
• C. Create a WildFire Analysis Profile that blocks Layer 4 and Layer 7 attacks
• D. Create a File blocking profile that blocks Layer 4 and Layer 7 attacks

Answer: D

NEW QUESTION 3
Click the Exhibit button below,


A firewall has three PBF rules and a default route with a next hop of 172.20.10.1 that is configured in the default VR. A user named Will has a PC with a 192.168.10.10 IP address. He makes an HTTPS connection to 172.16.10.20.
Which is the next hop IP address for the HTTPS traffic from Will's PC?

• A. 172.20.30.1
• B. 172.20.40.1
• C. 172.20.20.1
• D. 172.20.10.1

Answer: C

NEW QUESTION 4
What are three valid method of user mapping? (Choose three)

• A. Syslog
• B. XML API
• C. 802.1X
• D. WildFire
• E. Server Monitoring

Answer: ABE

NEW QUESTION 5
An administrator sees several inbound sessions identified as unknown-tcp in the Traffic logs. The administrator determines that these sessions are form external users accessing the company’s proprietary accounting application. The administrator wants to reliably identify this traffic as their accounting application and to scan this traffic for threats.
Which option would achieve this result?

• A. Create a custom App-ID and enable scanning on the advanced tab.
• B. Create an Application Override policy.
• C. Create a custom App-ID and use the “ordered conditions” check box.
• D. Create an Application Override policy and custom threat signature for the application.

Answer: A

NEW QUESTION 6
Several offices are connected with VPNs using static IPV4 routes. An administrator has been tasked with implementing OSPF to replace static routing.
Which step is required to accoumplish this goal?

• A. Assign an IP address on each tunnel interface at each site
• B. Enable OSPFv3 on each tunnel interface and use Area ID 0.0.0.0
• C. Assign OSPF Area ID 0.0.0.0 to all Ethernet and tunnel interfaces
• D. Create new VPN zones at each site to terminate each VPN connection

Answer: C

NEW QUESTION 7
What can missing SSL packets when performing a packet capture on dataplane interfaces?

• A. The packets are hardware offloaded to the offloaded processor on the dataplane
• B. The missing packets are offloaded to the management plane CPU
• C. The packets are not captured because they are encrypted
• D. There is a hardware problem with offloading FPGA on the management plane

Answer: A

NEW QUESTION 8
An administrator logs in to the Palo Alto Networks NGFW and reports that the WebUI is missing the Policies tab. Which profile is the cause of the missing Policies tab?

• A. Admin Role
• B. WebUI
• C. Authentication
• D. Authorization

Answer: A

NEW QUESTION 9
Which Device Group option is assigned by default in Panorama whenever a new device group is created to manage a Firewall?

• A. Master
• B. Universal
• C. Shared
• D. Global

Answer: C

NEW QUESTION 10
Which three settings are defined within the Templates object of Panorama? (Choose three.)

• A. Setup
• B. Virtual Routers
• C. Interfaces
• D. Security
• E. Application Override

Answer: ADE

NEW QUESTION 11
Which Security policy rule will allow an admin to block facebook chat but allow Facebook in general?

• A. Deny application facebook-chat before allowing application facebook
• B. Deny application facebook on top
• C. Allow application facebook on top
• D. Allow application facebook before denying application facebook-chat

Answer: A

NEW QUESTION 12
An administrator needs to upgrade a Palo Alto Networks NGFW to the most current version of PAN-OS® software. The firewall has internet connectivity through an Ethernet interface, but no internet connectivity from the management interface. The Security policy has the default security rules and a rule that allows all web-browsing traffic from any to any zone.
What must the administrator configure so that the PAN-OS® software can be upgraded?

• A. Security policy rule
• B. CRL
• C. Service route
• D. Scheduler

Answer: A

NEW QUESTION 13
Which field is optional when creating a new Security Policy rule?

• A. Name
• B. Description
• C. Source Zone
• D. Destination Zone
• E. Action

Answer: B

NEW QUESTION 14
Which client software can be used to connect remote Linux client into a Palo Alto Networks Infrastructure without sacrificing the ability to scan traffic and protect against threats?

• A. X-Auth IPsec VPN
• B. GlobalProtect Apple IOS
• C. GlobalProtect SSL
• D. GlobalProtect Linux

Answer: A

Explanation: ( http://blog.webernetz.net/2014/03/31/palo-alto-globalprotect-for-linux-with-vpnc/ )

NEW QUESTION 15
Which method does an administrator use to integrate all non-native MFA platforms in PAN- OS® software?

• A. Okta
• B. DUO
• C. RADIUS
• D. PingID

Answer: C

NEW QUESTION 16
Which three firewall states are valid? (Choose three.)

• A. Active
• B. Functional
• C. Pending
• D. Passive
• E. Suspended

Answer: ADE

NEW QUESTION 17
Which URL Filtering Security Profile action togs the URL Filtering category to the URL Filtering log?

• A. Log
• B. Alert
• C. Allow
• D. Default

Answer: B

NEW QUESTION 18
A company needs to preconfigure firewalls to be sent to remote sites with the least amount of reconfiguration. Once deployed, each firewall must establish secure tunnels back to multiple regional data centers to include the future regional data centers.
Which VPN configuration would adapt to changes when deployed to the future site?

• A. Preconfigured GlobalProtect satellite
• B. Preconfigured GlobalProtect client
• C. Preconfigured PIsec tunnels
• D. Preconfigured PPTP Tunnels

Answer: A

NEW QUESTION 19
Which three options does the WF-500 appliance support for local analysis? (Choose three)

• A. E-mail links
• B. APK files
• C. jar files
• D. PNG files
• E. Portable Executable (PE) files

Answer: ACE