Font size
WorksheetsTopic 1 Question 201 to 220
Total questions: 20
Worksheet time: 14mins
Which value in the Application column indicates UDP traffic that did not match an App-ID signature?
unknown-udp
unknown-ip
incomplete
not-applicable
What are three valid qualifiers for a Decryption Policy Rule match? (Choose three.)
App-ID
Custom URL Category
User-ID
Destination Zone
Source Interface
An administrator needs to gather information about the CPU utilization on both the management plane and the data plane.
Where does the administrator view the desired data?
Resources Widget on the Dashboard
Monitor > Utilization
Support > Resources
Application Command and Control Center
Which CLI command displays the physical media that are connected to ethernet1/8?
> show system state filter-pretty sys.s1.p8.stats
> show system state filter-pretty sys.s1.p8.med
> show interface ethernet1/8
> show system state filter-pretty sys.s1.p8.phy
A variable name must start with which symbol?
$
!
#
&
Given the following configuration, which route is used for destination 10.10.0.4? set network virtual-router 2 routing-table ip static-route "Route 1" nexthop ip-address 192.168.1.2 set network virtual-router 2 routing-table ip static-route "Route 1" metric 30 set network virtual-router 2 routing-table ip static-route "Route 1" destination 10.10.0.0/24 set network virtual-router 2 routing-table ip static-route "Route 1" re route-table unicast set network virtual-router 2 routing-table ip static-route "Route 2" nexthop ip-address 192.168.1.2 set network virtual-router 2 routing-table ip static-route "Route 2" metric 20 set network virtual-router 2 routing-table ip static-route "Route 2" destination 10.10.0.0/24 set network virtual-router 2 routing-table ip static-route "Route 2" route-table unicast set network virtual-router 2 routing-table ip static-route "Route 3" nexthop ip-address 10.10.20.1 set network virtual-router 2 routing-table ip static-route "Route 3" metric 5 set network virtual-router 2 routing-table ip static-route "Route 3" destination 0.0.0.0/0 set network virtual-router 2 routing-table ip static-route "Route 3" route-table unicast set network virtual-router 2 routing-table ip static-route "Route 4" nexthop ip-address 192.168.1.2 set network virtual-router 2 routing-table ip static-route "Route 4" metric 10 set network virtual-router 2 routing-table ip static-route "Route 4" destination 10.10.1.0/25 set network virtual-router 2 routing-table ip static-route "Route 4" route-table unicast
Route 1
Route 3
Route 2
Route 4
In SSL Forward Proxy decryption, which two certificates can be used for certificate signing? (Choose two.)
self-signed CA certificate
server certificate
wildcard server certificate
client certificate
enterprise CA certificate
An administrator plans to deploy 15 firewalls to act as GlobalProtect gateways around the world. Panorama will manage the firewalls.
The firewalls will provide access to mobile users and act as edge locations to on-premises infrastructure. The administrator wants to scale the configuration out quickly and wants all of the firewalls to use the same template configuration.
Which two solutions can the administrator use to scale this configuration? (Choose two.)
Which three statements accurately describe Decryption Mirror? (Choose three.)
Decryption, storage, inspection, and use of SSL traffic regulated in certain countries.
You should consult with your corporate counsel before activating and using Decryption Mirror in a production environment.
Decryption Mirror requires a tap interface on the firewall.
Only management consent is required to use the Decryption Mirror future.
Use of Decryption Mirror might enable malicious users with administrative access to the firewall to harvest sensitive information that is submitted via an encrypted channel.
As a best practice, which URL category should you target first for SSL decryption?
Health and Medicine
High Risk
Online Storage and Backup
Financial Services
Which User-ID mapping method should be used in a high-security environment where all IP address-to-user mappings should always be explicitly known?
LDAP Server Profile configuration
GlobalProtect
Windows-based User-ID agent
PAN-OS integrated User-ID agent
DRAG DROP -
Below are the steps in the workflow for creating a Best Practice Assessment in a firewall and Panorama configuration. Place the steps in order.
Select and Place:
STEP 1
STEP 2
STEP 3
STEP 4
STEP 5
DRAG DROP -
Place the steps in the WildFire process workflow in their correct order.
Select and Place:
FIRST
SECOND
THIRD
FOURTH
In a Panorama template, which three types of objects are configurable? (Choose three.)
certificate profiles
HIP objects
QoS profiles
security profiles
interface management profiles
An internal system is not functioning. The firewall administrator has determined that the incorrect egress interface is being used. After looking at the configuration, the administrator believes that the firewall is not using a static route.
What are two reasons why the firewall might not use a static route? (Choose two.)
duplicate static route
no install on the route
disabling of the static route
path monitoring on the static route
A customer is replacing its legacy remote-access VPN solution. Prisma Access has been selected as the replacement. During onboarding, the following options and licenses were selected and enabled:
- Prisma Access for Remote Networks: 300Mbps
- Prisma Access for Mobile Users: 1500 Users
- Cortex Data Lake: 2TB
- Trusted Zones: trust
- Untrusted Zones: untrust
- Parent Device Group: shared
The customer wants to forward to a Splunk SIEM the logs that are generated by users that are connected to Prisma Access for Mobile Users. Which two settings must the customer configure? (Choose two.)
Configure Panorama Collector group device log forwarding to send logs to the Splunk syslog server.
Configure Cortex Data Lake log forwarding and add the Splunk syslog server.
Configure a log forwarding profile and select the Panorama/Cortex Data Lake checkbox. Apply the Log Forwarding profile to all of the security policy rules in Mobile_User_Device_Group.
Configure a log forwarding profile and select the Panorama/Cortex Data Lake checkbox. Apply the Log Forwarding profile to all of the security policy rules in Mobile_User_Device_Group.
A network administrator wants to use a certificate for the SSL/TLS Service Profile. Which type of certificate should the administrator use?
machine certificate
server certificate
certificate authority (CA) certificate
client certificate
In a security-first network, what is the recommended threshold value for content updates to be dynamically updated?
1 to 4 hours
6 to 12 hours
24 hours
36 hours
A network security engineer has applied a File Blocking profile to a rule with the action of Block. The user of a Linux CLI operating system has opened a ticket.
The ticket states that the user is being blocked by the firewall when trying to download a TAR file. The user is getting no error response on the system.
Where is the best place to validate if the firewall is blocking the user's TAR file?
Threat log
Data Filtering log
WildFire Submissions log
URL Filtering log
In a firewall, which three decryption methods are valid? (Choose three.)
SSL Outbound Proxyless Inspection
SSL Inbound Inspection M
SSH Proxy
SSL Inbound Proxy
Decryption Mirror
