Refer to the exhibit. A web server in the DMZ is being mapped to a public address through DNAT.

Which Security policy rule will allow traffic to flow to the web server?

Which Security policy match condition would an administrator use to block traffic from IP addresses on the Palo Alto Networks EDL of Known Malicious IP

Addresses list?

Which feature would be useful for preventing traffic from hosting providers that place few restrictions on content whose services are frequently used by attackers to distribute illegal or unethical material?

An administrator is reviewing the Security policy rules shown in the screenshot below.

Which statement is correct about the information displayed?

In order to fulfill the corporate requirement to backup the configuration of Panorama and the Panorama-managed firewalls securely, which protocol should you select when adding a new scheduled config export?

What must be considered with regards to content updates deployed from Panorama?

Where in Panorama would Zone Protection profiles be configured?

What is a valid Security Zone type in PAN-OS?

What are the requirements for using Palo Alto Networks EDL Hosting Service?

Which action can be set in a URL Filtering Security profile to provide users temporary access to all websites in a given category using a provided password?

An administrator is trying to implement an exception to an external dynamic list manually. Some entries are shown underlined in red.

What would cause this error?

Which path in PAN-OS 10.2 is used to schedule a content update to managed devices using Panorama?

In which threat profile object would you configure the DNS Security service?

What can be achieved by disabling the Share Unused Address and Service Objects with Devices setting on Panorama?

Which solution is a viable option to capture user identification when Active Directory is not in use?

Which action would an administrator take to ensure that a service object will be available only to the selected device group?

Refer to the exhibit. An administrator is using DNAT to map two servers to a single public IP address. Traffic will be steered to the specific server based on the application, where Host A (10.1.1.100) receives HTTP traffic and Host B (10.1.1.101) receives SSH traffic.

Access to which feature requires a URL Filtering license?

During the App-ID update process, what should you click on to confirm whether an existing policy rule is affected by an App-ID update?

An administrator is creating a NAT policy.

Which combination of address and zone are used as match conditions? (Choose two.)

An administrator would like to block access to a web server, while also preserving resources and minimizing half-open sockets.

What are two security policy actions the administrator can select? (Choose two.)

What are the two default behaviors for the intrazone-default policy? (Choose two.)

When creating an Admin Role profile, if no changes are made, which two administrative methods will you have full access to? (Choose two.)

According to best practices, how frequently should WildFire updates he made to perimeter firewalls?

An administrator wants to prevent hacking attacks through DNS queries to malicious domains.

Which two DNS policy actions can the administrator choose in the Anti-Spyware Security Profile? (Choose two.)

What are three valid information sources that can be used when tagging users to dynamic user groups? (Choose three.)

An administrator would like to override the default deny action for a given application, and instead would like to block the traffic.

Which security policy action causes this?

An administrator would like to protect against inbound threats such as buffer overflows and illegal code execution.

Which Security profile should be used?

Given the network diagram, traffic should be permitted for both Trusted and Guest users to access general Internet and DMZ servers using SSH, web-browsing and SSL applications.

Which policy achieves the desired results?

What can be achieved by selecting a policy target prior to pushing policy rules from Panorama?

Which list of actions properly defines the order of steps needed to add a local database user account and create a new group to which this user will be assigned?

An administrator wants to create a NAT policy to allow multiple source IP addresses to be translated to the same public IP address.

What is the most appropriate NAT policy to achieve this?

Which built-in IP address EDL would be useful for preventing traffic from IP addresses that are verified as unsafe based on WildFire analysis, Unit 42 research, and data gathered from telemetry?

You notice that protection is needed for traffic within the network due to malicious lateral movement activity. Based on the image shown, which traffic would you need to monitor and block to mitigate the malicious activity?

View the diagram. What is the most restrictive, yet fully functional rule, to allow general Internet and SSH traffic into both the DMZ and Untrust/Internet zones from each of the IOT/Guest and Trust Zones?

An administrator needs to add capability to perform real time signature lookups to block or sinkhole all known malware domains.

Which type of single, unified engine will get this result?

Given the screenshot, what are two correct statements about the logged traffic? (Choose two.)

Which two rule types allow the administrator to modify the destination zone? (Choose two.)

An administrator needs to create a Security policy rule that matches DNS traffic within the LAN zone, and also needs to match DNS traffic within the DMZ zone.

The administrator does not want to allow traffic between the DMZ and LAN zones.

Which Security policy rule type should they use?

An address object of type IP Wildcard Mask can be referenced in which part of the configuration?

You receive notification about a new malware that infects hosts. An infection results in the infected host attempting to contact command-and-control server.

Which Security Profile, when applied to outbound Security policy rules, detects and prevents this threat from establishing a command-and-control connection?

An administrator would like to determine the default deny action for the application dns-over-https.

Which action would yield the information?

Which Security policy match condition would an administrator use to block traffic from IP addresses on the Palo Alto Networks EDL of Known Malicious IP

Addresses list?

Which statement best describes a common use of Policy Optimizer?

Selecting the option to revert firewall changes will replace what settings?

Prior to a maintenance-window activity, the administrator would like to make a backup of only the running configuration to an external location.

What command in Device > Setup > Operations would provide the most operationally efficient way to achieve this outcome?

An administrator would like to silently drop traffic from the internet to an ftp server.

Which Security policy action should the administrator select?

An administrator is investigating a log entry for a session that is allowed and has the end reason of aged-out.

Which two fields could help in determining if this is normal? (Choose two.)

An administrator is updating Security policy to align with best practices.

Which Policy Optimizer feature is shown in the screenshot below?

An administrator is creating a Security policy rule and sees that the destination zone is grayed out.

While creating the rule, which option was selected to cause this?

A network administrator created an intrazone Security policy rule on the firewall. The source zones were set to IT. Finance, and HR.

Which two types of traffic will the rule apply to? (Choose two)

What is a prerequisite before enabling an administrative account which relies on a local firewall user database?

An administrator is trying to enforce policy on some (but not all) of the entries in an external dynamic list.

What is the maximum number of entries that they can be excluded?

How many levels can there be in a device-group hierarchy, below the shared level?

An administrator is troubleshooting traffic that should match the interzone-default rule. However, the administrator doesn't see this traffic in the traffic logs on the firewall. The interzone-default was never changed from its default configuration.

Why doesn't the administrator see the traffic?

An administrator manages a network with 300 addresses that require translation. The administrator configured NAT with an address pool of 240 addresses and found that connections from addresses that needed new translations were being dropped.

Which type of NAT was configured?

Why should a company have a File Blocking profile that is attached to a Security policy?

After making multiple changes to the candidate configuration of a firewall, the administrator would like to start over with a candidate configuration that matches the running configuration.

Which command in Device > Setup > Operations would provide the most operationally efficient way to accomplish this?

If using group mapping with Active Directory Universal Groups, what must you do when configuring the User ID?