Firewall Fundamentals Day 6

Which statement is true about Panorama managed devices? (Choose two.)

• Panorama automatically removes local configuration locks after a commit from Panorama.

• Local configuration locks prohibit Security policy changes for a Panorama managed device.

• Security policy rules configured on local firewalls always take precedence.

• Local configuration locks can be manually unlocked from Panorama.

Answer explanation

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CltACAS

Which Palo Alto Networks component provides consolidated policy creation and centralized management?

• GlobalProtect

• Panorama

• Prisma SaaS

• AutoFocus

What is a recommended consideration when deploying content updates to the firewall from Panorama?

• Before deploying content updates, always check content release version compatibility.

• Content updates for firewall A/P HA pairs can only be pushed to the active firewall.

• Content updates for firewall A/A HA pairs need a defined master device.

• After deploying content updates, perform a commit and push to Panorama.

Answer explanation

https://docs.paloaltonetworks.com/panorama/9-1/panorama-admin/set-up-panorama/install-content-and-software-updates-for-panorama/panorama-log-collector-firewall-and-wildfire-version-compatibility

What can be achieved by selecting a policy target prior to pushing policy rules from Panorama?

• You can specify the location as pre- or post-rules to push policy rules

• You can specify the firewalls in a device group to which to push policy rules

• Doing so provides audit information prior to making changes for selected policy rules

• Doing so limits the templates that receive the policy rules

Answer explanation

https://docs.paloaltonetworks.com/panorama/9-1/panorama-admin/manage-firewalls/manage-device-groups/push-a-policy-rule-to-a-subset-of-firewalls

When backing up and saving configuration files, what is achieved using only the firewall and is not available in Panorama?

• Load configuration version

• Save candidate config

• Export device state

• Load named configuration snapshot

Answer explanation

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRcCAK

Which three actions can Panorama perform when deploying PAN-OS images to its managed devices? (Choose three.)

• upload-only

• install and reboot

• install

• upload and install and reboot

• verify and install

Which two settings can be configured only locally on the firewall and not pushed from a Panorama template or template stack? (Choose two.)

• HA1 IP Address

• Master Key

• Zone Protection Profile

• Network Interface Type

Answer explanation

https://docs.paloaltonetworks.com/panorama/10-2/panorama-admin/manage-firewalls/manage-templates-and-template-stacks/template-capabilities-and-exceptions

Which Panorama mode should be used so that all logs are sent to, and only stored in, Cortex Data Lake?

• Legacy

• Management Only

• Log Collector

• Panorama

Answer explanation

https://docs.paloaltonetworks.com/panorama/10-2/panorama-admin/panorama-overview/panorama-models