Topic 1 Question 601 to 619

A root cause analysis investigation into a recent security incident reveals that several decryption rules have been disabled. The security team wants to generate email alerts when decryption rules are changed.

How should email log forwarding be configured to achieve this goal?

• With the relevant system log filter inside Device > Log Settings

• With the relevant configuration log filter inside Device > Log Settings

• With the relevant configuration log filter inside Objects > Log Forwarding

• With the relevant system log filter inside Objects > Log Forwarding

An engineer has been given approval to upgrade their environment to the latest of PAN-OS.

The environment consists of both physical and virtual firewalls, a virtual Panorama HA pair, and virtual log collectors.

What is the recommended order of operational steps when upgrading?

• Upgrade the firewalls, upgrade log collectors, upgrade Panorama

• Upgrade the firewalls, upgrade Panorama, upgrade the log collectors

• Upgrade the log collectors, upgrade the firewalls, upgrade Panorama

• Upgrade Panorama, upgrade the log collectors, upgrade the firewalls

An administrator has a Palo Alto Networks NGFW. All security subscriptions and decryption are enabled and the system is running close to its resource limits.

Knowing that using decryption can be resource-intensive, how can the administrator reduce the load on the firewall?

• Use SSL Forward Proxy instead of SSL Inbound Inspection for decryption.

• Use RSA instead of ECDSA for traffic that isn’t sensitive or high-priority.

• Use the highest TLS protocol version to maximize security.

• Use ECDSA instead of RSA for traffic that isn’t sensitive or high-priority.

A firewall engineer has determined that, in an application developed by the company’s internal team, sessions often remain idle for hours before the client and server exchange any data. The application is also currently identified as unknown-tcp by the firewalls. It is determined that because of a high level of trust, the application does not require to be scanned for threats, but it needs to be properly identified in Traffic logs for reporting purposes.

Which solution will take the least time to implement and will ensure the App-ID engine is used to identify the application?

• A. Create a custom application with specific timeouts and signatures based on patterns discovered in packet captures.

• B. Access the Palo Alto Networks website and complete the online form to request that a new application be added to App-ID.

• C. Create a custom application with specific timeouts, then create an application override rule and reference the custom application.

• D. Access the Palo Alto Networks website and raise a support request through the Customer Support Portal.

• Create a custom application with specific timeouts and signatures based on patterns discovered in packet captures.

• Access the Palo Alto Networks website and complete the online form to request that a new application be added to App-ID.

• Create a custom application with specific timeouts, then create an application override rule and reference the custom application

• Access the Palo Alto Networks website and raise a support request through the Customer Support Portal.

What happens when the log forwarding built-in action with tagging is used?

• Selected logs are forwarded to the Azure Security Center

• Destination zones of selected unwanted traffic are blocked.

• Destination IP addresses of selected unwanted traffic are blocked

• Selected unwanted traffic source zones are blocked.

A firewall engineer creates a source NAT rule to allow the company’s internal private network 10.0.0.0/23 to access the internet. However, for security reasons, one server in that subnet (10.0.0.10/32) should not be allowed to access the internet, and therefore should not be translated with the NAT rule.

• 
• 
• 
• 

What are three prerequisites to enable Credential Phishing Prevention over SSL? (Choose three.)

• Create a URL filtering profile

• Create an anti-virus profile.

• Enable User-ID.

• Configure a URL profile to block the phishing category.

• Create a decryption policy rule.

A company is expanding its existing log storage and alerting solutions. All company Palo Alto Networks firewalls currently forward logs to Panorama.

Which two additional log forwarding methods will PAN-OS support? (Choose two.)

• HTTP

• SSL

• Email

• TLS

A firewall administrator has confirmed reports of a website is not displaying as expected, and wants to ensure that decryption is not causing the issue.

Which three methods can the administrator use to determine if decryption is causing the website to fail? (Choose three)

• Move the policy with action decrypt to the top of the decryption policy rulebase.

• Investigate decryption logs of the specific traffic to determine reasons for failure.

• Temporarily disable SSL decryption for all websites to troubleshoot the issue.

• Disable SSL handshake logging.

• Create a policy-based "No Decrypt" rule in the decryption policy to exclude specific traffic from decryption.

After implementing a new NGFW, a firewall engineer is alerted to a VoIP traffic issue. After troubleshooting, the engineer confirms that the firewall is alerting the voice packets payload.

What can the engineer do to solve the VoIP traffic issue?

• Increase the TCP timeout under SIP application

• Disable ALG under SIP application

• Disable ALG under H.323 application

• Increase the TCP timeout under H.323 application