Topic 1 Question 81 to 100

Which processing order will be enabled when a Panorama administrator selects the setting `Objects defined in ancestors will take higher precedence?

• Descendant objects will take precedence over ancestor objects.

• Ancestor objects will have precedence over descendant objects.

• Ancestor objects will have precedence over other ancestor objects.

• Descendant objects will take precedence over other descendant objects.

An administrator using an enterprise PKI needs to establish a unique chain of trust to ensure mutual authentication between Panorama and the managed firewalls and Log Collectors.
How would the administrator establish the chain of trust?

• Use custom certificates

• Enable LDAP or RADIUS integration

• Set up multi-factor authentication

• Configure strong password authentication

What will be the egress interface if the traffic's ingress interface is ethernet1/6 sourcing from 192.168.111.3 and to the destination 10.46.41.113 during the time shown in the image?

• ethernet1/7

• ethernet1/5

• ethernet1/6

• ethernet1/3

Refer to the exhibit. A web server in the DMZ is being mapped to a public address through DNAT.

Which Security policy rule will allow traffic to flow to the web server?

• Untrust (any) to Untrust (10.1.1.100), web browsing Allow

• Untrust (any) to Untrust (1.1.1.100), web browsing Allow

• Untrust (any) to DMZ (1.1.1.100), web browsing Allow

• Untrust (any) to DMZ (10.1.1.100), web browsing Allow

A web server is hosted in the DMZ and the server is configured to listen for incoming connections on TCP port 443. A Security policies rules allowing access from the Trust zone to the DMZ zone needs to be configured to allow web-browsing access. The web server hosts its contents over HTTP(S). Traffic from Trust to DMZ is being decrypted with a Forward Proxy rule.
Which combination of service and application, and order of Security policy rules, needs to be configured to allow cleartext web-browsing traffic to this server on tcp/443?

• Rule #1: application: web-browsing; service: application-default; action: allow Rule #2: application: ssl; service: application-default; action: allow

• Rule #1: application: web-browsing; service: service-http; action: allow Rule #2: application: ssl; service: application-default; action: allow

• Rule # 1: application: ssl; service: application-default; action: allow Rule #2: application: web-browsing; service: application-default; action: allow

• Rule #1: application: web-browsing; service: service-https; action: allow Rule #2: application: ssl; service: application-default; action: allow

Which two options prevent the firewall from capturing traffic passing through it? (Choose two.)

• The firewall is in multi-vsys mode.

• The traffic is offloaded.

• The traffic does not match the packet capture filter.

• The firewall's DP CPU is higher than 50%.

A global corporate office has a large-scale network with only one User-ID agent, which creates a bottleneck near the User-ID agent server.
Which solution in PAN-OSֲ® software would help in this case?

• application override

• Virtual Wire mode

• content inspection

• redistribution of user mappings

An administrator has been asked to create 100 virtual firewalls in a local, on-premise lab environment (not in ג€the cloudג€). Bootstrapping is the most expedient way to perform this task.
Which option describes deployment of a bootstrap package in an on-premise virtual environment?

• Use config-drive on a USB stick.

• Use an S3 bucket with an ISO.

• Create and attach a virtual hard disk (VHD).

• Use a virtual CD-ROM with an ISO.

Which two benefits come from assigning a Decryption Profile to a Decryption policy rule with a `No Decrypt` action? (Choose two.)

• Block sessions with expired certificates

• Block sessions with client authentication

• Block sessions with unsupported cipher suites

• Block sessions with untrusted issuers

• Block credential phishing

Which User-ID method should be configured to map IP addresses to usernames for users connected through a terminal serve

• port mapping

• server monitoring

• client probing

• XFF headers

Answer explanation

Anwer: Port mapping

reference:https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/user-id/configure-user-mapping-for-terminal-server-users