NEW QUESTION 1
How would an administrator monitor/capture traffic on the management interface of the Palo Alto Networks NGFW?

• A. Use the debug dataplane packet-diag set capture stage firewall file command.
• B. Enable all four stages of traffic capture (TX, RX, DROP, Firewall).
• C. Use the debug dataplane packet-diag set capture stage management file command.
• D. Use the topdump command.

Answer: A

NEW QUESTION 2
After Migrating from an ASA firewall to a Palo Alto Networks Firewall, the VPN connection between a remote network and the Palo Alto Networks Firewall is not establishing correctly. The following entry is appearing in the logs:
Pfs group mismatched: my:0 peer:2
Which setting should be changed on the Palo Alto Networks Firewall to resolve this error message?

• A. Update- the IPSec Crypto profile for the Vendor IPSec Tunnel from group2 to no-pfs.
• B. Update the IKE Crypto profile for the Vendor IKE gateway from no pfs to group2.
• C. Update the IKE Crypto profile for the Vendor IKE gateway from group2 to no pfs
• D. Update the IPSec Crypto profile for the Vendor IPSec Tunnel from no-pfs to group2.

Answer: D

NEW QUESTION 3
How can a candidate or running configuration be copied to a host external from Panorama?

• A. Commit a running configuration.
• B. Save a configuration snapshot.
• C. Save a candidate configuration.
• D. Export a named configuration snapshot.

Answer: D

NEW QUESTION 4
Which Security Policy Rule configuration option disables antivirus and anti-spyware scanning of server-to-client flows only?

• A. Disable Server Response Inspection
• B. Apply an Application Override
• C. Disable HIP Profile
• D. Add server IP Security Policy exception

Answer: A

NEW QUESTION 5
Click the Exhibit button

An administrator has noticed a large increase in bittorrent activity. The administrator wants to determine where the traffic is going on the company.
What would be the administrator's next step?

• A. Right-Click on the bittorrent link and select Value from the context menu
• B. Create a global filter for bittorrent traffic and then view Traffic logs.
• C. Create local filter for bittorrent traffic and then view Traffic logs.
• D. Click on the bittorrent application link to view network activity

Answer: D

NEW QUESTION 6
Which Panorama feature allows for logs generated by Panorama to be forwarded to an external Security Information and Event Management(SIEM) system?

• A. Panorama Log Settings
• B. Panorama Log Templates
• C. Panorama Device Group Log Forwarding
• D. Collector Log Forwarding for Collector Groups

Answer: A

Explanation: https://www.paloaltonetworks.com/documentation/61/panorama/panorama_adminguide/manage-log-collection/enable-log-forwarding-from-panorama-to-external-destinations

NEW QUESTION 7
A Palo Alto Networks NGFW just submitted a file to WildFire for analysis. Assume a 5- minute window for analysis. The firewall is configured to check for verdicts every 5 minutes.
How quickly will the firewall receive back a verdict?

• A. More than 15 minutes
• B. 5 minutes
• C. 10 to 15 minutes
• D. 5 to 10 minutes

Answer: D

NEW QUESTION 8
A company is upgrading its existing Palo Alto Networks firewall from version 7.0.1 to 7.0.4.
Which three methods can the firewall administrator use to install PAN-OS 7.0.4 across the enterprise?( Choose three)

• A. Download PAN-OS 7.0.4 files from the support site and install them on each firewall after manually uploading.
• B. Download PAN-OS 7.0.4 to a USB drive and the firewall will automatically update after the USB drive is inserted in the firewall.
• C. Push the PAN-OS 7.0.4 updates from the support site to install on each firewall.
• D. Push the PAN-OS 7.0.4 update from one firewall to all of the other remaining after updating one firewall.
• E. Download and install PAN-OS 7.0.4 directly on each firewall.
• F. Download and push PAN-OS 7.0.4 from Panorama to each firewall.

Answer: ACF

NEW QUESTION 9
Which two logs on the firewall will contain authentication-related information useful for troubleshooting purpose (Choose two)

• A. ms.log
• B. traffic.log
• C. system.log
• D. dp-monitor.log
• E. authd.log

Answer: CE

NEW QUESTION 10
Which CLI command displays the current management plane memory utilization?

• A. > debug management-server show
• B. > show running resource-monitor
• C. > show system info
• D. > show system resources

Answer: D

Explanation: https://live.paloaltonetworks.com/t5/Learning-Articles/How-to-Interpret-show-system-resources/ta-p/59364
"The command show system resources gives a snapshot of Management Plane (MP) resource utilization including memory and CPU. This is similar to the ‘top’ command in Linux."https://live.paloaltonetworks.com/t5/Learning-Articles/How-to-Interpret-show-system-resources/ta-p/59364

NEW QUESTION 11
Which Palo Alto Networks VM-Series firewall is valid?

• A. VM-25
• B. VM-800
• C. VM-50
• D. VM-400

Answer: C

NEW QUESTION 12
DRAG DROP
When using the predefined default profile, the policy will inspect for viruses on the decoders. Match each decoder with its default action.
Answer options may be used more than once or not at all.

Answer:

Explanation: IMAP , POP3 , SMTP - > Alert
HTTP,FTP,SMB -> Reset-both

NEW QUESTION 13
Which three fields can be included in a pcap filter? (Choose three)

• A. Egress interface
• B. Source IP
• C. Rule number
• D. Destination IP
• E. Ingress interface

Answer: BCD

Explanation: (https://live.paloaltonetworks.com/t5/Featured-Articles/Getting-Started-Packet-Capture/ta- p/72069)

NEW QUESTION 14
An administrator is using Panorama and multiple Palo Alto Networks NGFWs. After upgrading all devices to the latest PAN-OS® software, the administrator enables log forwarding from the firewalls to Panorama. Pre-existing logs from the firewalls are not appearing in Panorama.
Which action would enable the firewalls to send their pre-existing logs to Panorama?

• A. Use the import option to pull logs into Panorama.
• B. A CLI command will forward the pre-existing logs to Panorama.
• C. Use the ACC to consolidate pre-existing logs.
• D. The log database will need to exported form the firewalls and manually imported intoPanorama.

Answer: B

NEW QUESTION 15
A network security engineer for a large company has just installed a PA-5060 Firewall to isolate the company’s PCI environment from its production network. The company’s engineers made configuration changes to the switches on both network segments, and connected them to the new firewall.
Soon after the cutover, however, users began to complain about latency and some servicers stopped communicating. There are no security policies that deny traffic between the two networks segments. You suspect that there is an interface misconfiguration on Ethernet 1/1.
Which two commands should be used to troubleshoot the issue? (Choose two)

• A. show interface hardware
• B. show interface management
• C. show interface ethernet1/1
• D. show interface logical

Answer: CD

NEW QUESTION 16
A critical US-CERT notification is published regarding a newly discovered botnet. The malware is very evasive and is not reliably detected by endpoint antivirus software. Furthermore, SSL is used to tunnel malicious traffic to command-and-control servers on the internet and SSL Forward Proxy Decryption is not enabled.
Which component once enabled on a perirneter firewall will allow the identification of existing infected hosts in an environment?

• A. Anti-Spyware profiles applied outbound security policies with DNS Query action set to sinkhole
• B. File Blocking profiles applied to outbound security policies with action set to alert
• C. Vulnerability Protection profiles applied to outbound security policies with action set to block
• D. Antivirus profiles applied to outbound security policies with action set to alert

Answer: A

NEW QUESTION 17
Which three types of software will receive a Grayware verdict from WildFire? (Choose Three)

• A. Browser Toolbar
• B. Trojans
• C. Ransomeware
• D. Potentially unwanted programs
• E. Adware.

Answer: ADE

Explanation: https://www.paloaltonetworks.com/documentation/translated/70/newfeaturesguide/wildfire-features/wildfire-grayware-verdict

NEW QUESTION 18
A company has a pair of Palo Alto Networks firewalls configured as an Acitve/Passive High Availability (HA) pair.
What allows the firewall administrator to determine the last date a failover event occurred?

• A. From the CLI issue use the show System log
• B. Apply the filter subtype eq ha to the System log
• C. Apply the filter subtype eq ha to the configuration log
• D. Check the status of the High Availability widget on the Dashboard of the GUI

Answer: B

NEW QUESTION 19
A company.com wants to enable Application Override. Given the following screenshot:

Which two statements are true if Source and Destination traffic match the Application Override policy? (Choose two)

• A. Traffic that matches "rtp-base" will bypass the App-ID and Content-ID engines.
• B. Traffic will be forced to operate over UDP Port 16384.
• C. Traffic utilizing UDP Port 16384 will now be identified as "rtp-base".
• D. Traffic utilizing UDP Port 16384 will bypass the App-ID and Content-ID engines.

Answer: AC