Deployments / Platform
Name at least 2 Hypervisors supported by Palo Alto Networks VM-series Firewalls.
What is Amazon Web Services (AWS), Google Cloud Platform (GCP), KVM and KVM in OpenStack, Microsoft Azure, Microsoft Hyper-V, VMware ESXi, NSX, and vCloud Air.
There are four firewall access methods. What are they?
What is Web GUI, CLI, Panorama, and XML API
A Security Policy Rule in italic font indicates what?
What is, a disabled security rule.
Application block pages can be enabled for which applications?
a. web-based
b. any
c. non-TCP/IP
d. MGT port-based
What is a. web-based
Where does a GlobalProtect client connect to first when trying to connect to the network?
What is a GlobalProtect Portal
Which action in a File Blocking Security Profile results in the user being prompted to verify a file transfer?
a. Alert
b. Allow
c. Continue
d. Block
What is c. Continue
Which VM-Series firewall was introduced with the release of PAN-OS® 8.1?
What is VM-50 lite
True or false? Service routes can be used to configure an in-band port to access external services.
What is True
Which interface type does NOT require any changes being made to the existing network?
a. Layer 2
b. Tap
c. Virtual Wire
What is Virtual Wire.
Because a firewall examines every packet in a session, a firewall can detect application _______?
a. errors
b. shifts
c. filters
d. groups
What is b. shifts
What are three connection methods for the GlobalProtect agent? (Choose three)
a. On-demand
b. Captcha portal
c. User-Logon
d. Pre-Logon
What is a. On-demand, c. User-Logon, and d. Pre-Logon.
Which feature is a dynamic grouping of applications used in Security Policies?
a. dependent applications
b. application filters
c. application groups
d. implicit applications
What is b. Application filters
Cloud providers build data centers throughout the world to host cloud services. What is the name of the geographical location where the data centers reside?
a. zone
b. edge location
c. point of presence
d. region
What is D. Region
An Interface Management profile can be attached to which two interface types?
a. Layer 2
b. Tap
c. Layer 3
d. Virtual Wire
e. Loopback
What is Layer 3 and Loopback
In Destination NAT, which option accurately completes the following sentence? A Security policy rule should be written to match the _________.
a. pre-NAT IP, pre-NAT zone
b. post-NAT IP, Pre-NAT zone
c. pre-NAT IP, post-NAT zone
d. post-NAT IP, post-NAT zone
What is c. pre-NAT IP, post-NAT zone
What three content ID profiles can generate events in the "Threat" logs?
What is Vulnerability Protection, Antivirus, and Anti-Spyware profiles.
Which User mapping method is recommended for a highly mobile user base?
a. GlobalProtect
b. Client Probing
c. Session Monitoring
d. Server Monitoring
What is a. GlobalProtect
Which three types of traffic, flow across the HA Control link? (Choose three.)
a. configuration synchronization
b. session synchronization
c. heartbeats
d. hellos
What is a. configuration synchronization, c. heartbeats, and d. hellos
Which new firewall model was introduced with PAN-OS® 8.1 with double the data-plane memory?
a. PA-5260
b. PA-5270
c. PA-5280
d. PA-5290
What is C. PA-5280
You can save a candidate configuration in a couple ways. Which way stores the saved configuration to disk? Which one saves to memory? (Must answer both for credit)
What is "saved named configuration" for disk storage, and "save configuration" for memory.
Virtual routers provide support for static routing and dynamic routing using which three protocols? (Choose three.)
a. OSPF
b. RIP
c. EGRP
d. BGP
e. IS-IS
f. ID10-T
What is a, b, and d.
Zone Protection Profiles are applied to which item?
a. ingress ports
b. Security policy rules
c. egress ports
d. Address Groups
What is a. Ingress ports
Which two User-ID methods are used to verify known IP address-to-user mappings? (Choose two)
a. Session Monitoring
b. Sever Monitoring
c. Captive Portal
d. Client Probing
What is a. Session Monitoring and d. Client Probing
User-ID probes Windows systems to verify current user mappings and to discover new IP address-to-username mappings. User-ID also reads session tables to confirm known IP address-to-username mappings based on current Windows file and printer shares.
A log can be exported to which format?
a. CSV
b. PDF
c. PPT
d. XLS
What is a. CSV
What are virtual systems, and on which firewall models are they supported?
Virtual systems are separate, logical firewall instances within a single physical Palo Alto Networks firewall. Virtual systems are supported on the PA‐3x00, PA‐5x00, and PA‐7x00 Series firewalls.
At a minimum, what two profiles must be configured to set up a non-local administrator account for authentication?
What is Server profile and Authentication Profile.
In Security policies, name the default 6 action settings. (must name all for credit)
What is allow, deny, drop, reset client, reset server, or reset both.
Which anti-spyware feature enables an administrator to quickly identify a potentially infected host on the network?
What is a DNS Sinkhole.
The DNS Sinkhole capability enables you to quickly identify infected hosts on the network.
GlobalProtect clientless VPN provides secure remote access to web applications that use which three technologies? (Choose three)
a. java
b. Ruby
c. HTML5
d. Python
e. JavaScript
f. HTML
What is c. HTML5, e. JavaScript, and f. HTML
Which are four failure detection methods in a firewall HA cluster? (Partial credit for half answers)
What is Internal Health checks, link groups, path groups, and heartbeats/hellos.