Topic 1 Question 500 to 520

A firewall engineer creates a destination static NAT rule to allow traffic from the internet to a webserver hosted behind the edge firewall. The pre-NAT IP address of the server is 153.6.12.10, and the post-NAT IP address is 192.168.10.10. Refer to the routing and interfaces information below.

What should the NAT rule destination zone be set to?

• None

• Inside

• DMZ

• Outside

A consultant deploys a PAN-OS 11.0 VM-Series firewall with the Web Proxy feature in Transparent Proxy mode.

Which three elements must be in place before a transparent web proxy can function? (Choose three.)

• User-ID for the proxy zone

• DNS Security license

• Prisma Access explicit proxy license

• Cortex Data Lake license

• Authentication Policy Rule set to default-web-form

Which source is the most reliable for collecting User-ID user mapping?

• Microsoft Active Directory

• Microsoft Exchange

• GlobalProtect

• Syslog Listener

Which type of zone will allow different virtual systems to communicate with each other?

• Tap

• Tunnel

• Virtual Wire

• External

An organization is interested in migrating from their existing web proxy architecture to the Web Proxy feature of their PAN-OS 11.0 firewalls. Currently, HTTP and SSL requests contain the destination IP address of the web server and the client browser is redirected to the proxy.

Which PAN-OS proxy method should be configured to maintain this type of traffic flow?

• SSL forward proxy

• Explicit proxy

• Transparent proxy

• DNS proxy

An engineer discovers the management interface is not routable to the User-ID agent.

What configuration is needed to allow the firewall to communicate to the User-ID agent?

• Add a Policy Based Forwarding (PBF) policy to the User-ID agent IP

• Create a NAT policy for the User-ID agent server

• Create a custom service route for the UID Agent

• Add a static route to the virtual router

An engineer receives reports from users that applications are not working and that websites are only partially loading in an asymmetric environment. After investigating, the engineer observes the flow_tcp_non_syn_drop counter increasing in the show counters global output.

Which troubleshooting command should the engineer use to work around this issue?

• set deviceconfig setting tcp asymmetric-path drop

• set session tcp-reject-non-syn yes

• set deviceconfig setting tcp asymmetric-path bypass

• set deviceconfig setting session tcp-reject-non-syn no

Where is Palo Alto Networks Device Telemetry data stored on a firewall with a device certificate installed?

• Panorama

• M600 Log Collectors

• Cortex Data Lake

• On Palo Alto Networks Update Servers

Which GlobalProtect gateway setting is required to enable split-tunneling by access route, destination domain, and application?

• Satellite mode

• Tunnel mode

• No Direct Access to local networks

• IPSec mode

A superuser is tasked with creating administrator accounts for three contractors. For compliance purposes, all three contractors will be working with different device-groups in their hierarchy to deploy policies and objects.

Which type of role-based access is most appropriate for this project?

• Create a Dynamic Admin with the Panorama Administrator role.

• Create a Dynamic Read only superuser.

• Create a Device Group and Template Admin

• Create a Custom Panorama Admin.