Topic 1 Question 180 to 200

The following objects and policies are defined in a device group hierarchy.

Dallas-Branch has Dallas-FW as a member of the Dallas-Branch device-group
NYC-DC has NYC-FW as a member of the NYC-DC device-group
What objects and policies will the Dallas-FW receive if "Share Unused Address and Service Objects" is enabled in Panorama?

• Address Objects -Shared Address1 -Branch Address1 Policies -Shared Policy1 -Branch Policy1

• Address Objects -Shared Address1 -Shared Address2 -Branch Address1 Policies -Shared Policy1 -Shared Policy2 -Branch Policy1

• Address Objects -Shared Address1 -Shared Address2 -Branch Address1 -DC Address1 Policies -Shared Policy1 -Shared Policy2 -Branch Policy1

• Address Objects -Shared Address1 -Shared Address2 -Branch Address1 Policies -Shared Policy1 -Branch Policy1

An administrator has purchased WildFire subscriptions for 90 firewalls globally.
What should the administrator consider with regards to the WildFire infrastructure?

• To comply with data privacy regulations, WildFire signatures and verdicts are not shared globally

• Palo Alto Networks owns and maintains one global cloud and four WildFire regional clouds.

• Each WildFire cloud analyzes samples and generates malware signatures and verdicts independently of the other WildFire clouds.

• The WildFire Global Cloud only provides bare metal analysis.

A firewall is configured with SSL Forward Proxy decryption and has the following four enterprise certificate authorities (CAs): i. Enterprise-Trusted-CA, which is verified as Forward Trust Certificate (The CA is also installed in the trusted store of the end-user browser and system.) ii. Enterprise-Untrusted-CA, which is verified as Forward Untrust Certificate iii. Enterprise-Intermediate-CA iv. Enterprise-Root-CA, which is verified only as Trusted Root CA
An end-user visits https://www.example-website.com/ with a server certificate Common Name (CN): www.example-website.com. The firewall does the SSL
Forward Proxy decryption for the website and the server certificate is not trusted by the firewall.
The end-user's browser will show that the certificate for www. example-website.com was issued by which of the following?

• Enterprise-Trusted-CA which is a self-signed CA

• Enterprise-Root-CA which is a self-signed CA

• Enterprise-Intermediate-CA which was, in turn, issued by Enterprise-Root-CA

• Enterprise-Untrusted-CA which is a self-signed CA

What are three reasons for excluding a site from SSL decryption? (Choose three.)

• the website is not present in English

• unsupported ciphers

• certificate pinning

• unsupported browser version

• mutual authentication

Match each SD-WAN configuration element to the description of that element.
Select and Place:

• Traffic Distribution Profile

• 
• SD-WAN Interface Profile

• 
• SD-WAN Interface Profile

• 
• Path Quality Profile

• 

When overriding a template configuration locally on a firewall, what should you consider?

• Panorama will update the template with the overridden value.

• The firewall template will show that it is out of sync within Panorama

• Only Panorama can revert the override.

• Panorama will lose visibility into the overridden configuration.

When setting up a security profile, which three items can you use? (Choose three.)

• Wildfire analysis

• anti-ransomware

• antivirus

• URL filtering

• decryption profile

An administrator wants to upgrade a firewall HA pair to PAN-OS 10.1. The firewalls are currently running PAN-OS 8.1.17. Which upgrade path maintains synchronization of the HA session (and prevents network outage)?

• Upgrade directly to the target major version.

• Upgrade the HA pair to a base image.

• Upgrade one major version at a time.

• Upgrade two major versions at a time.

What are three types of Decryption Policy rules? (Choose three.)

• SSL Inbound Inspection

• SSH Proxy

• SSL Forward Proxy

• Decryption Broker

• Decryption Mirror

During SSL decryption, which three factors affect resource consumption? (Choose three.)

• key exchange algorithm

• transaction size

• TLS protocol version

• applications ta non-standard ports

• certificate issuer