In regard to the Advanced Routing Engine (ARE), what must be enabled first when configuring a logical router on a PAN-OS firewall?
ALicense
BPlugin
CContent update
DGeneral setting
During an upgrade to the routing infrastructure in a customer environment, the network administrator wants to implement Advanced Routing Engine (ARE) on a Palo Alto Networks firewall.
Which firewall models support this configuration?
APA-5280, PA-7080, PA-3250, VM-Series
BPA-455, VM-Series, PA-1410, PA-5450
CPA-3260, PA-5410, PA-850, PA-460
DPA-7050, PA-1420, VM-Series, CN-Series
Which statement describes the role of Terraform in deploying Palo Alto Networks NGFWs?
AIt acts as a logging service for NGFW performance metrics.
BIt orchestrates real-time traffic inspection for network segments.
CIt provides Infrastructure-as-Code (IaC) to automate NGFW deployment.
DIt manages threat intelligence data synchronization with NGFWs.
Which configuration in the LACP tab will enable pre-negotiation for an Aggregate Ethernet (AE) interface on a Palo Alto Networks high availability (HA) active/passive pair?
ASet Transmission Rate to “fast.”
BSet passive link state to “Auto.”
CSet “Enable in HA Passive State.”
DSet LACP mode to “Active.”
Question 6
Integration and Automation
0
Question 7
PAN-OS Networking Configuration
Question 8
PAN-OS Networking Configuration
Question 9
PAN-OS Networking Configuration
Question 10
PAN-OS Networking Configuration
Question 11
PAN-OS Networking Configuration
Question 12
PAN-OS Device Setting Configuration
Question 13
PAN-OS Networking Configuration
Question 14
PAN-OS Networking Configuration
Question 15
PAN-OS Networking Configuration
Question 16
PAN-OS Networking Configuration
Question 17
PAN-OS Networking Configuration
Question 18
PAN-OS Device Setting Configuration
Question 19
PAN-OS Device Setting Configuration
Question 20
PAN-OS Device Setting Configuration
Question 21
PAN-OS Device Setting Configuration
Question 22
PAN-OS Networking Configuration
Question 23
Integration and Automation
Question 24
PAN-OS Networking Configuration
Question 25
PAN-OS Networking Configuration
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ad
Want a break from the ads?
Become a Supporter and enjoy a completely ad-free experience, plus unlock Learn Mode, Exam Mode, AstroTutor AI, and more.
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
When integrating Kubernetes with Palo Alto Networks NGFWs, what is used to secure traffic between microservices?
AService graph
BAnsible automation modules
CPanorama role-based access control (RBAC)
DCN-Series firewalls
When configuring a Zone Protection profile, in which section (protection type) would an NGFW engineer configure options to protect against activities such as spoofed IP addresses and split handshake session establishment attempts?
AFlood Protection
BProtocol Protection
CPacket-Based Attack Protection
DReconnaissance Protection
For which two purposes is an IP address configured on a tunnel interface? (Choose two.)
AUse of dynamic routing protocols
BTunnel monitoring
CUse of peer IP
DRedistribution of User-ID
Which type of firewall resource can be assigned when configuring a new firewall virtual system (VSYS)?
ACPU
BSessions limit
CMemory
DSecurity profile limit
How does a Palo Alto Networks firewall choose the best route when it receives routes for the same destination from different routing protocols?
AThe route that was received first will be entered into the forwarding table, and all subsequent routes will be rejected.
BIt will attempt to load balance the traffic across all routes.
CIt compares the administrative distance and chooses the one with the highest value.
DIt compares the administrative distance and chooses the one with the lowest value.
An NGFW engineer is configuring multiple Layer 2 interfaces on a Palo Alto Networks firewall, and all interfaces must be assigned to the same VLAN. During initial testing, it is reported that clients located behind the various interfaces cannot communicate with each other.
Which action taken by the engineer will resolve this issue?
AConfigure each interface to belong to the same Layer 2 zone and enable IP routing between them.
BAssign each interface to the appropriate Layer 2 zone and configure a policy that allows traffic within the VLAN.
CAssign each interface to the appropriate Layer 2 zone and configure Security policies for interfaces not assigned to the same zone.
DEnable IP routing between the interfaces and configure a Security policy to allow traffic between interfaces within the VLAN.
According to dynamic updates best practices, what is the recommended threshold value for content updates in a mission- critical network?
A8 hours
B16 hours
C32 hours
D48 hours
Which CLI command is used to configure the management interface as a DHCP client?
Aset network dhcp interface management
Bset network dhcp type management-interface
Cset deviceconfig system type dhcp-client
Dset deviceconfig management type dhcp-client
Which PAN-OS method of mapping users to IP addresses is the most reliable?
APort mapping
BGlobalProtect
CSyslog
DServer monitoring
In an active/active high availability (HA) configuration with two PA-Series firewalls, how do the firewalls use the HA3 interface?
ATo forward packets to the HA peer during session setup and asymmetric traffic flow
BTo exchange hellos, heartbeats, HA state information, and management plane synchronization for routing and User-ID information
CTo synchronize sessions, forwarding tables, IPSec security associations, and ARP tables between firewalls in an HA pair
DTo perform session cache synchronization among all HA peers having the same cluster ID
Which two actions in the IKE Gateways will allow implementation of post-quantum cryptography when building VPNs between multiple Palo Alto Networks NGFWs? (Choose two.)
ASelect IKE v2, enable the Advanced Options PQ PPK, then set a 64+ character string for the post-quantum pre shared key.
BEnsure Authentication is set to “certificate,” then import a post-quantum derived certificate.
CSelect IKE v2 Preferred, enable the Advanced Options PQ KEM, then add one or more “Rounds.”
DSelect IKE v2, enable the Advanced Options PQ KEM, then create an IKE Crypto Profile with Advanced Options adding one or more “Rounds.”
An NGFW engineer is establishing bidirectional connectivity between the accounting virtual system (VSYS) and the marketing VSYS. The traffic needs to transition between zones without leaving the firewall (no external physical connections). The interfaces for each VSYS are assigned to separate virtual routers (VRs), and inter-VR static routes have been configured. An external zone has been created correctly for each VSYS. Security policies have been added to permit the desired traffic between each zone and its respective external zone. However, the desired traffic is still unable to successfully pass from one VSYS to the other in either direction.
Which additional configuration task is required to resolve this issue?
ACreate a transit VSYS and route all inter-VSYS traffic through it.
BAdd each VSYS to the list of visible virtual systems of the other VSYS.
CEnable the “allow inter-VSYS traffic” option in both external zone configurations.
DCreate Security policies to allow the traffic between the two external zones.
An engineer is implementing a new rollout of SAML for administrator authentication across a company’s Palo Alto Networks NGFWs. User authentication on company firewalls is currently performed with RADIUS, which will remain available for six months, until it is decommissioned. The company wants both authentication types to be running in parallel during the transition to SAML.
Which two actions meet the criteria? (Choose two.)
ACreate a testing and rollback plan for the transition from Radius to SAML, as the two authentication profiles cannot be run in tandem.
BCreate an authentication sequence that includes both the “RADIUS” Server Profile and “SAML Identity Provider” Server Profile to run the two services in tandem.
CCreate and apply an authentication profile with the “SAML Identity Provider” Server Profile.
DCreate and add the “SAML Identity Provider” Server Profile to the authentication profile for the “RADIUS” Server Profile.
Which statement applies to Log Collector Groups?
ALog redundancy is available only if each Log Collector has the same amount of total disk storage.
BEnabling redundancy increases the log processing traffic in a Collector Group by 50%.
CIn any single Collector Group, all the Log Collectors must run on the same Panorama model. D. The maximum number of Log Collectors in a Log Collector Group is 18 plus two hot spares.
An NGFW engineer is configuring multiple Panorama-managed firewalls to start sending all logs to Strata Logging Service. The Strata Logging Service instance has been provisioned, the required device certificates have been installed, and Panorama and the firewalls have been successfully onboarded to Strata Logging Service.
Which configuration task must be performed to start sending the logs to Strata Logging Service and continue forwarding them to the Panorama log collectors as well?
AModify all active Log Forwarding profiles to select the “Cloud Logging” option in each profile match list in the appropriate device groups.
BEnable the “Panorama/Cloud Logging” option in the Logging and Reporting Settings section under Device --> Setup --> Management in the appropriate templates.
CSelect the “Enable Duplicate Logging” option in the Cloud Logging section under Device --> Setup --> Management in the appropriate templates.
DSelect the “Enable Cloud Logging” option in the Cloud Logging section under Device --> Setup --> Management in the appropriate templates.
Without performing a context switch, which set of operations can be performed that will affect the operation of a connected firewall on the Panorama GUI?
ARestarting the local firewall, running a packet capture, accessing the firewall CLI
BModification of local security rules, modification of a Layer 3 interface, modification of the firewall device hostname
CModification of pre-security rules, modification of a virtual router, modification of an IKE Gateway Network Profile
DModification of post NAT rules, creation of new views on the local firewall ACC tab, creation of local custom reports
Which two statements describe an external zone in the context of virtual systems (VSYS) on a Palo Alto Networks firewall? (Choose two.)
AIt is associated with an interface within a VSYS of a firewall.
BIt is a security object associated with a specific virtual router of a VSYS.
CIt is not associated with an interface; it is associated with a VSYS itself.
DIt is a security object associated with a specific VSYS.
A multinational organization wants to use the Cloud Identity Engine (CIE) to aggregate identity data from multiple sources (on premises AD, Azure AD, Okta) while enforcing strict data isolation for different regional business units. Each region’s firewalls, managed via Panorama, must only receive the user and group information relevant to that region. The organization aims to minimize administrative overhead while meeting data sovereignty requirements.
Which approach achieves this segmentation of identity data?
ACreate one CIE tenant, aggregate all identity data into a single view, and redistribute the full dataset to all firewalls. Rely on per-firewall Security policies to restrict access to out-of-scope user and group information.
BEstablish separate CIE tenants for each business unit, integrating each tenant with the relevant identity sources. Redistribute user and group data from each tenant only to the region’s firewalls, maintaining a strict one-to-one mapping of tenant to business unit.
CDisable redistribution of identity data entirely. Instead, configure each regional firewall to pull user and group details directly from its local identity providers (IdPs).
DDeploy a single CIE tenant that collects all identity data, then configure segments within the tenant to filter and redistribute only the relevant user/group sets to each regional firewall group.
Which two statements apply to configuring required security rules when setting up an IPSec tunnel between a Palo Alto Networks firewall and a third- party gateway? (Choose two.)
AFor incoming and outgoing traffic through the tunnel, creating separate rules for each direction is optional.
BThe IKE negotiation and IPSec/ESP packets are allowed by default via the intrazone default allow policy.
CFor incoming and outgoing traffic through the tunnel, separate rules must be created for each direction.
DThe IKE negotiation and IPSec/ESP packets are denied by default via the interzone default deny policy.
Which networking technology can be configured on Layer 3 interfaces but not on Layer 2 interfaces?