Question No : 1
During the packet flow process, which two processes are performed in application identification? (Choose two.)

• A.Applicationchanged from content inspection
• B.session application identified
• C.pattern based application identification
• D.application override policy match

Show Answers

Answer:

Question No : 2
Which event will happen administrator uses an Application Override Policy?

• A.The application name assigned to the traffic by the security rule is written to the traffic log.
• B.The Palo Alto Networks NGFW Steps App-ID processing at Layer 4.
• C.Threat-ID processing time is decreased.
• D.App-ID processing time is increased.

Show Answers

Answer:

Question No : 3
When a malware-infected host attempts to resolve a known command-and-control server, the traffic matches a security policy with DNS sinhole enabled, generating a traffic log.
What will be the destination IP Address in that log entry?

• A.The IP Address of sinkhole.paloaltonetworks.com
• B.The IP Address of the command-and-control server
• C.The IP Address specified in the sinkhole configuration
• D.The IP Address of one of the external DNS servers identified in the anti-spyware database

Show Answers

Answer:
Explanation:
https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Verify-DNS-Sinkhole-Function-is-Working/ta-p/65864

Question No : 4
Which option would an administration choose to define the certificate and protect that Panorama and its managed devices uses for SSL/ITS services?

• A.Set Up SSL/TLS under Policies > Service/URL Category > Service.
• B.Configure on SSL/TLS Profile.
• C.Configure a Decryption Profile and select SSL/TLS services.
• D.Set up Security policy rule to allow SSL communication.

Show Answers

Answer:

Question No : 5
A global corporate office has a large-scale network with only one User-ID agent, which creates a bottleneck near the User-ID agent server.
Which solution in PAN -OS® software would help in this case?

• A.content inspection
• B.application override
• C.Virtual Wire mode
• D.redistribution of user mappings

Show Answers

Answer:

Question No : 6
Refer to the exhibit.



A web server in the DMZ is being mapped to a public address through DNAT.
Which Security policy rule will allow traffic to flow to the web server?

• A.Untrust (any) to Untrust (10. 1.1. 100), web browsing C Allow
• B.Untrust (any) to Untrust (1. 1. 1. 100), web browsing C Allow
• C.Untrust (any) to DMZ (1. 1. 1. 100), web browsing C Allow
• D.Untrust (any) to DMZ (10. 1. 1. 100), web browsing C Allow

Show Answers

Answer:

Question No : 7
Which PAN-OS® policy must you configure to force a user to provide additional credential before he is allowed to access an internal application that contains highly sensitive business data?

• A.Authentication policy
• B.Decryption policy
• C.Security policy
• D.Application Override policy

Show Answers

Answer:

Question No : 8
Which two methods can be used to verify firewall connectivity to Autofocus? (Choose two)

• A.Check the WebUl Dashboard Autofocus widget
• B.Check for WildFire forwarding logs.
• C.Verify AutoFocus is enabled below Device Management tab
• D.Verify AutoFocus status using the CLI "test"command.
• E.Check the license

Show Answers

Answer:

Question No : 9
If the firewall is configured for credential phishing prevention using the "Domain Credential Filter" method, which login will be detected as credential theft?

• A.Using the name user's corporate username and password.
• B.First four lettersof the username matching any valid corporate username.
• C.Matching any valid corporate username.
• D.Mapping to the IP address of the logged-in user.

Show Answers

Answer:

Question No : 10
An administrator has created an SSL Decryption policy rule that decrypts SSL sessions on any port.
Which log entry can the administrator use to verify that sessions are being decrypted?

• A.Decryption tag
• B.In the details of the Threat log entries
• C.In the details of the Traffic log entries
• D.Data filtering log

Show Answers

Answer: