ACE.exam€¦ · 19.10.2018 · Taking into account only the information in the screenshot above, answer the following question: A span port or a switch is connected to e1/4, but

https://www.gratisexam.com/

ACE.exam.99q

Number: ACEPassing Score: 800Time Limit: 120 min


ACE

Accredited Configuration Engineer


Exam A

QUESTION 1A Config Lock may be removed by which of the following users?


A. The administrator who set it

B. Device administrators

C. Any administrator

D. Superusers

Correct Answer: ADSection: (none)Explanation

Explanation/Reference:

QUESTION 2After the installation of a new version of PANOS, the firewall must be rebooted.

A. True

B. False

Correct Answer: ASection: (none)Explanation


QUESTION 3When configuring a Decryption Policy Rule, which of the following are available as matching criteria in the rule? (Choose three.)


A. Source Zone

B. URL Category

C. Application

D. Service

E. Source User

Correct Answer: ABESection: (none)Explanation


QUESTION 4After the installation of the Threat Prevention license, the firewall must be rebooted.

A. True

B. False

Correct Answer: BSection: (none)Explanation


QUESTION 5What is the function of the GlobalProtect Portal?

A. To maintain the list of Global Protect Gateways and specify HIP data that the agent should report.

B. To loadbalance

C. GlobalProtect client connections to GlobalProtect Gateways.

D. To maintain the list of remote GlobalProtect Portals and the list of categories for checking the client machine.

E. To provide redundancy for tunneled connections through the GlobalProtect Gateways.

Correct Answer: DSection: (none)Explanation



QUESTION 6Which mode will allow a user to choose when they wish to connect to the Global Protect Network?

A. Always On mode

B. Optional mode

C. Single SignOn mode

D. On Demand mode



QUESTION 7After the installation of a new Application and Threat database, the firewall must be rebooted.

A. True

B. False



QUESTION 8


Taking into account only the information in the screenshot above, answer the following question: A span port or a switch is connected to e1/4, but there are no traffic logs. Which of the following conditions most likely explains this behavior?


A. The interface is not assigned a virtual router.

B. The interface is not assigned an IP address.

C. The interface is not up.

D. There is no zone assigned to the interface.



QUESTION 9Which of the following platforms supports the Decryption Port Mirror function?

A. PA3000

B. VMSeries 100


C. PA2000

D. PA4000



QUESTION 10An enterprise PKI system is required to deploy SSL Forward Proxy decryption capabilities.

A. True

B. False



QUESTION 11UserID is enabled in the configuration of:

A. a Security Profile.

B. an Interface.

C. a Security Policy.

D. a Zone.



QUESTION 12


Which of the following interface types can have an IP address assigned to it?

A. Layer 3

B. Layer 2

C. Tap

D. Virtual Wire



QUESTION 13As the Palo Alto Networks Administrator you have enabled Application Block pages.Afterwards, not knowing they are attempting to access a blocked web based application, users call the Help Desk to complain about network connectivity issues.What is the cause of the increased number of help desk calls?

A. The File Blocking Block Page was disabled.

B. Some AppID's are set with a Session Timeout value that is too low.

C. The firewall admin did not create a custom response page to notify potential users that their attempt to access the web based application is being blocked due topolicy.

D. Application Block Pages will only be displayed when Captive Portal is configured.



QUESTION 14An interface in tap mode can transmit packets on the wire.

A. True

B. False

Correct Answer: B


Section: (none)Explanation


QUESTION 15Which of the following is NOT a valid option for builtin CLI Admin roles?

A. deviceadmin

B. superuser

C. devicereader

D. read/write



QUESTION 16Which of the Dynamic Updates listed below are issued on a daily basis?

A. Applications

B. BrightCloud URL Filtering

C. Applications and Threats

D. Antivirus

Correct Answer: BDSection: (none)Explanation


QUESTION 17In PANOS 6.0 and later, which of these items may be used as match criterion in a PolicyBased Forwarding Rule? (Choose three.)


A. Source User

B. Source Zone

C. Destination Zone

D. Application

Correct Answer: ABDSection: (none)Explanation


QUESTION 18What is the maximum file size of .EXE files uploaded from the firewall to WildFire?

A. Always 2 megabytes.

B. Always 10 megabytes.

C. Configurable up to 2 megabytes.

D. Configurable up to 10 megabytes.



QUESTION 19Which of the following most accurately describes Dynamic IP in a Source NAT configuration?

A. The next available address in the configured pool is used, and the source port number is changed.

B. A single IP address is used, and the source port number is unchanged.

C. A single IP address is used, and the source port number is changed.

D. The next available IP address in the configured pool is used, but the source port number is unchanged.




QUESTION 20All of the interfaces on a Palo Alto Networks device must be of the same interface type.

A. True

B. False




QUESTION 21With IKE Phase 1, each device is identified to the other by a Peer ID. In most cases, the Peer ID is just the public IP address of the device. In situations where thepublic IP address is not static, the Peer ID can be a text value.

A. True

B. False



QUESTION 22Which of the following facts about dynamic updates is correct?


A. Antivirus updates are released daily. Application and Threat updates are released weekly.

B. Application and Antivirus updates are released weekly. Threat and “Threat and URL Filtering” updates are released weekly.

C. Application and Threat updates are released daily. Antivirus and URL Filtering updates are released weekly.

D. Threat and URL Filtering updates are released daily. Application and Antivirus updates are released weekly.



QUESTION 23“What is the result of an Administrator submitting a WildFire report’s verdict back to Palo Alto Networks as “Incorrect”?

A. The signature will be updated for False positive and False negative files in the next AV signature update.

B. The signature will be updated for False positive and False negative files in the next Application signature update.

C. You will receive an email to disable the signature manually.

D. You will receive an update within 15 minutes.



QUESTION 24When configuring the firewall for UserID, what is the maximum number of Domain Controllers that can be configured?

A. 100

B. 50

C. 10

D. 150

Correct Answer: ASection: (none)


Explanation


QUESTION 25In a Palo Alto Networks firewall, every interface in use must be assigned to a zone in order to process traffic.

A. True

B. False



QUESTION 26

Taking into account only the information in the screenshot above, answer the following question. An administrator is pinging 4.4.4.4 and fails to receive a response.What is the most likely reason for the lack of response?

A. The interface is down.

B. There is a Security Policy that prevents ping.

C. There is no Management Profile.

D. There is no route back to the machine originating the ping.


Correct Answer: CSection: (none)Explanation


QUESTION 27

Taking into account only the information in the screenshot above, answer the following question. An administrator is using SSH on port 3333 and BitTorrent on port7777. Which statements are true?

A. The BitTorrent traffic will be allowed.

B. The SSH traffic will be allowed.

C. The SSH traffic will be denied.

D. The BitTorrent traffic will be denied.

Correct Answer: BDSection: (none)Explanation


QUESTION 28Which of the following statements is NOT True about Palo Alto Networks firewalls?

A. The Admin account may be disabled.


B. System defaults may be restored by performing a factory reset in Maintenance Mode.

C. The Admin account may not be disabled.

D. Initial configuration may be accomplished thru the MGT interface or the Console port.



QUESTION 29When using remote authentication for users (LDAP, RADIUS, Active Directory, etc.), what must be done to allow a user to authenticate through multiple methods?

A. Create an Authentication Sequence, dictating the order of authentication profiles.

B. Create multiple authentication profiles for the same user.

C. This cannot be done. A single user can only use one authentication type.

D. This cannot be done. Although multiple authentication methods exist, a firewall must choose a single, global authentication type and all users must use thismethod.



QUESTION 30If the Forward Proxy Ready shows “no” when running the command show system setting ssl-decrypt setting, what is most likely the cause?

A. SSL forward proxy certificate is not generated

B. Web interface certificate is not generated

C. Forward proxy license is not enabled on the box n

D. SSL decryption rule is not created




QUESTION 31When adding an application in a Policy-based Forwarding rule, only a subset of the entire App-ID database is represented. Why would this be?

A. Policy-based forwarding can only indentify certain applications at this stage of the packet flow, as the majority of applications are only identified once the sessionis created.

B. Policy-based forwarding rules require that a companion Security policy rule, allowing the needed Application traffic, must first be created.

C. The license for the Application ID database is no longer valid.

D. A custom application must first be defined before it can be added to a Policy-based forwarding rule.



QUESTION 32What option should be configured when using User Identification?

A. Enable User Identification per Zone

B. Enable User Identification per Security Rule

C. Enable User Identification per interface

D. None of the above



QUESTION 33What needs to be done prior to committing a configuration in Panorama after making a change via the CLI or web interface on a device?

A. No additional actions required

B. Synchronize the configuration between the device and Panorama


C. Make the same change again via Panorama

D. Re-import the configuration from the device into Panorama



QUESTION 34Which local interface cannot be assigned to the IKE gateway?

A. Tunnel

B. L3

C. VLAN

D. Loopback



QUESTION 35To allow the PAN device to resolve internal and external DNS host names for reporting and for security policies, an administrator can do the following:

A. Create a DNS Proxy Object with a default DNS Server for external resolution and a DNS server for internal domain. Then, in the device settings, point to thisproxy object for DNS resolution.

B. In the device settings define internal hosts via a static list.

C. In the device settings set the Primary DNS server to an external server and the secondary to an internal server.

D. Create a DNS Proxy Object with a default DNS Server for external resolution and a DNS server for internal domain. Then, in the device settings, select theproxy object as the Primary DNS and create a custom security rule which references that object for




QUESTION 36With PAN-OS 5.0, how can a common NTP value be pushed to a cluster of firewalls?

A. Via a Panorama Template

B. Via a shared object in Panorama

C. Via a Panorama Device Group

D. Via a Device Group object in Panorama



QUESTION 37Which of the following Global Protect features requires a separate license?

A. Use of dynamic selection between multiple Gateways

B. Use of a Portal to allow users to connect

C. Allowing users to connect

D. Manual Gateway Selection



QUESTION 38Which of the following represents HTTP traffic events that can be used to identify potential Botnets?

A. Traffic from users that browse to IP addresses instead of fully-qualified domain names, downloading W32.Welchia.Worm from a Windows share, traffic todomains that have been registered in the last 30 days, downloading executable files from unknown URL's

B. Traffic from users that browse to IP addresses instead of fully-qualified domain names, traffic to domains that have been registered in the last 60 days,


downloading executable files from unknown URL's

C. Traffic from users that browse to IP addresses instead of fully-qualified domain names, traffic to domains that have been registered in the last 60 days,downloading executable files from unknown URL's, IRC-based Command and Control traffic

D. Traffic from users that browse to IP addresses instead of fully-qualified domain names, traffic to domains that have been registered in the last 30 days.



QUESTION 39For correct routing to SSL VPN clients to occur, the following must be configured:

A. Network Address Translation must be enabled for the SSL VPN client IP pool

B. A dynamic routing protocol between the Palo Alto Networks device and the next-hop gateway to advertise the SSL VPN client IP pool

C. A static route on the next-hop gateway of the SSL VPN client IP pool with a destination of the Palo Alto Networks device

D. No routing needs to be configured - the PAN device automatically responds to ARP requests for the SSL VPN client IP pool



QUESTION 40Which option allows an administrator to segrate Panorama and Syslog traffic, so that the Management Interface is not employed when sending these types oftraffic?


A. Custom entries in the Virtual Router, pointing to the IP addresses of the Panorama and Syslog devices.

B. Define a Loopback interface for the Panorama and Syslog Devices


C. On the Device tab in the Web UI, create custom server profiles for Syslog and Panorama

D. Service Route Configuration



QUESTION 41Which routing protocol is supported on the Palo Alto Networks platform?

A. BGP

B. RSTP

C. ISIS

D. RIPv1



QUESTION 42What happens at the point of Threat Prevention license expiration?

A. Threat Prevention no longer updated; existing database still effective

B. Threat Prevention is no longer used; applicable traffic is allowed

C. Threat Prevention no longer used; applicable traffic is blocked

D. Threat Prevention no longer used; traffic is allowed or blocked by configuration per Security Rule




QUESTION 43Administrative Alarms can be enabled for which of the following except?

A. Certificate Expirations

B. Security Violation Thresholds

C. Security Policy Tags

D. Traffic Log capacity



QUESTION 44Which of the following types of protection are available in DoS policy?

A. Session Limit, SYN Flood, UDP Flood

B. Session Limit, Port Scanning, Host Swapping, UDP Flood

C. Session Limit, SYN Flood, Host Swapping, UDP Flood

D. Session Limit, SYN Flood, Port Scanning, Host Swapping



QUESTION 45Which one of the options describes the sequence of the GlobalProtect agent connecting to a Gateway?

A. The agent connects to the portal, obtains a list of the Gateways, and connects to the Gateway with the fastest SSL connect time

B. The agent connects to the portal and randomly establishes connect to the first available Gateway

C. The agent connects to the portal, obtains a list of the Gateways, and connects to the Gateway with the fastest PING response time

D. The agent connects to the closest Gateway and sends the HIP report to the portal




QUESTION 46A local/enterprise PKI system is required to deploy outbound forward proxy SSL decryption capabilities.

A. True

B. False



QUESTION 47To properly configure DOS protection to limit the number of sessions individually from specific source IPs you would configure a DOS Protection rule with thefollowing characteristics:

A. Action: Protect, Classified Profile with "Resources Protection" configured, and Classified Address with "source-ip-only" configured

B. Action: Deny, Aggregate Profile with "Resources Protection" configured

C. Action: Protect, Aggregate Profile with "Resources Protection" configured

D. Action: Deny, Classified Profile with "Resources Protection" configured, and Classified Address with "source-ip-only" configured



QUESTION 48When setting up GlobalProtect, what is the job of the GlobalProtect Portal?

A. To maintain the list of remote GlobalProtect Portals and list of categories for checking the client machine


B. To maintain the list of GlobalProtect Gateways and list of categories for checking the client machine

C. To load balance GlobalProtect client connections to GlobalProtect Gateways




QUESTION 49Which of the following fields is not available in DoS policy?

A. Destination Zone

B. Source Zone

C. Application

D. Service



QUESTION 50Which of the following are accurate statements describing the HA3 link in an Active-Active HA deployment?

A. HA3 is used for session synchronization

B. The HA3 link is used to transfer Layer 7 information

C. HA3 is used to handle asymmetric routing

D. HA3 is the control link




QUESTION 51What is the correct policy to most effectively block Skype?

A. Allow Skype, block Skype-probe

B. Allow Skype-probe, block Skype

C. Block Skype-probe, block Skype

D. Block Skype



QUESTION 52Which best describes how Palo Alto Networks firewall rules are applied to a session?

A. last match applied

B. first match applied

C. all matches applied

D. most specific match applied



QUESTION 53As the Palo Alto Networks administrator responsible for User Identification, you are looking for the simplest method of mapping network users that do not sign intoLDAP. Which information source would allow reliable User ID mapping for these users, requiring the least amount of configuration?

A. WMI Query

B. Exchange CAS Security Logs

C. Captive Portal


D. Active Directory Security Logs



QUESTION 54Which mode will allow a user to choose how they wish to connect to the GlobalProtect Network as they would like?

A. Single Sign-On Mode

B. On Demand Mode

C. Always On Mode

D. Optional Mode



QUESTION 55Which of the following must be configured when deploying User-ID to obtain information from an 802.1x authenticator?

A. Terminal Server Agent

B. An Agentless deployment of User-ID, employing only the Palo Alto Networks Firewall

C. A User-ID agent, with the "Use for NTLM Authentication" option enabled.

D. XML API for User-ID Agent




QUESTION 56When Network Address Translation has been performed on traffic, Destination Zones in Security rules should be based on:

A. Post-NAT addresses

B. The same zones used in the NAT rules

C. Pre-NAT addresses




QUESTION 57In Active/Active HA environments, redundancy for the HA3 interface can be achieved by:

A. Configuring a corresponding HA4 interface

B. Configuring HA3 as an Aggregate Ethernet bundle

C. Configuring multiple HA3 interfaces

D. Configuring HA3 in a redundant group



QUESTION 58An Outbound SSL forward-proxy decryption rule cannot be created using which type of zone?

A. Virtual Wire

B. Tap

C. L3

D. L2




QUESTION 59When a Palo Alto Networks firewall is forwarding traffic through interfaces configured for L2 mode, security policies can be set to match on multicast IP addresses.

A. True

B. False



QUESTION 60In an Anti-Virus profile, changing the action to “Block” for IMAP or POP decoders will result in the following:

A. The connection from the server will be reset

B. The Anti-virus profile will behave as if “Alert” had been specified for the action

C. The traffic will be dropped by the firewall

D. Error 541 being sent back to the server



QUESTION 61After configuring Captive Portal in Layer 3 mode, users in the Trust Zone are not receiving the Captive Portal authentication page when they launch their webbrowsers. How can this be corrected?

A. Ensure that all users in the Trust Zone are using NTLM-capable browsers


B. Enable "Response Pages" in the Interface Management Profile that is applied to the L3 Interface in the Trust Zone.

C. Confirm that Captive Portal Timeout value is not set below 2 seconds

D. Enable "Redirect " as the Mode type in the Captive Portal Settings

Correct Answer: ABSection: (none)Explanation


QUESTION 62The "Disable Server Return Inspection" option on a security profile:

A. Can only be configured in Tap Mode

B. Should only be enabled on security policies allowing traffic to a trusted server.

C. Does not perform higher-level inspection of traffic from the side that originated the TCP SYN packet

D. Only performs inspection of traffic from the side that originated the TCP SYN-ACK packet



QUESTION 63A user complains that they are no longer able to access a needed work application after you have implemented vulnerability and anti-spyware profiles. The user'sapplication uses a unique port. What is the most efficient way to allow the user access to this application?

. https://www.gratisexam.com/

A. Utilize an Application Override Rule, referencing the custom port utilized by this application. Application Override rules bypass all Layer 7 inspection, therebyallowing access to this application.

B. In the Threat log, locate the event which is blocking access to the user's application and create a IP-based exemption for this user.


C. In the vulnerability and anti-spyware profiles, create an application exemption for the user's application.

D. Create a custom Security rule for this user to access the required application. Do not apply vulnerability and anti-spyware profiles to this rule.



QUESTION 64You’d like to schedule a firewall policy to only allow a certain application during a particular time of day. Where can this policy option be configured?

A. Policies > Security > Service

B. Policies > Security > Options

C. Policies > Security > Application

D. Policies > Security > Profile



QUESTION 65What is the size limitation of files manually uploaded to WildFire?

A. Configurable up to 10 megabytes

B. Hard-coded at 10 megabytes

C. Hard-coded at 2 megabytes

D. Configurable up to 20 megabytes




QUESTION 66Enabling "Highlight Unused Rules" in the Security policy window will:

A. Highlight all rules that did not immediately match traffic.

B. Highlight all rules that did not match traffic since the rule was created or since last reboot of the firewall.

C. Allows the administrator to troubleshoot rules when a validation error occurs at the time of commit.

D. Allow the administrator to temporarily disable rules that do not match traffic, for testing purposes.



QUESTION 67In PAN-OS 5.0, which of the following features is supported with regards to IPv6?

A. OSPF

B. NAT64

C. IPSec VPN tunnels




QUESTION 68Which statement accurately reflects the functionality of using regions as objects in Security policies?

A. Predefined regions are provided for countries, not but not for cities. The administrator can set up custom regions, including latitude and longitude, to specify thegeographic position of that particular region.

B. The administrator can set up custom regions, including latitude and longitude, to specify the geographic position of that particular region. These custom regionscan be used in the "Source User" field of the Security Policies.

C. Regions cannot be used in the "Source User" field of the Security Policies, unless the administrator has set up custom regions.


D. The administrator can set up custom regions, including latitude and longitude, to specify the geographic position of that particular region. Both predefinedregions and custom regions can be used in the "Source User" field.



QUESTION 69When employing the Brightcloud URL filtering database on the Palo Alto Networks firewalls, the order of checking within a profile is:

A. Block List, Allow List, Custom Categories, Cache Files, Predefined Categories, Dynamic URL Filtering

B. Block List, Allow List, Cache Files, Custom Categories, Predefined Categories, Dynamic URL Filtering

C. Dynamic URL Filtering, Block List, Allow List, Cache Files, Custom Categories, Predefined Categories




QUESTION 70When allowing an Application in a Security policy on a PAN-OS 5.0 device, would a dependency Application need to also be enabled if the application does notemploy HTTP, SSL, MSRPC, RPC, t.120, RTSP, RTMP, and NETBIOS-SS.

A. Yes

B. No



QUESTION 71


Users can be authenticated serially to multiple authentication servers by configuring:

A. Multiple RADIUS Servers sharing a VSA configuration

B. Authentication Sequence

C. Authentication Profile

D. A custom Administrator Profile



QUESTION 72When creating a Security Policy to allow Facebook in PAN-OS 5.0, how can you be sure that no other web-browsing traffic is permitted?

A. Ensure that the Service column is defined as "application-default" for this security rule. This will automatically include the implicit web-browsing applicationdependency.

B. Create a subsequent rule which blocks all other traffic

C. When creating the rule, ensure that web-browsing is added to the same rule. Both applications will be processed by the Security policy, allowing only Facebookto be accessed. Any other applications can be permitted in subsequent rules.

D. No other configuration is required on the part of the administrator, since implicit application dependencies will be added automatically.



QUESTION 73In PAN-OS 5.0, how is Wildfire enabled?

A. Via the URL-Filtering "Continue" Action

B. Wildfire is automatically enabled with a valid URL-Filtering license

C. A custom file blocking action must be enabled for all PDF and PE type files

D. Via the "Forward" and "Continue and Forward" File-Blocking actions




QUESTION 74When configuring Security rules based on FQDN objects, which of the following statements are true?

A. The firewall resolves the FQDN first when the policy is committed, and is refreshed each time Security rules are evaluated.

B. The firewall resolves the FQDN first when the policy is committed, and is refreshed at TTL expiration. There is no limit on the number of IP addresses stored foreach resolved FQDN.

C. In order to create FQDN-based objects, you need to manually define a list of associated IP. Up to 10 IP addresses can be configured for each FQDN entry.

D. The firewall resolves the FQDN first when the policy is committed, and is refreshed at TTL expiration. The resolution of this FQDN stores up to 10 different IPaddresses.



QUESTION 75When troubleshooting Phase 1 of an IPSec VPN tunnel, what location will have the most informative logs?

A. Responding side, Traffic Logs

B. Initiating side, Traffic Logs

C. Responding side, System Logs

D. Initiating side, System Logs




QUESTION 76Configuring a pair of devices into an Active/Active HA pair provides support for:

A. Higher session count

B. Redundant Virtual Routers

C. Asymmetric routing environments

D. Lower fail-over times



QUESTION 77Which of the Dynamic Updates listed below are issued on a daily basis?

A. Global Protect

B. URL Filtering

C. Antivirus

D. Applications and Threats

Correct Answer: BCSection: (none)Explanation


QUESTION 78Palo Alto Networks firewalls support the use of both Dynamic (built-in user roles) and Role-Based (customized user roles).

A. True

B. False




QUESTION 79In PAN-OS 6.0, rule numbers were introduced. Rule Numbers are:

A. Dynamic numbers that refer to a security policy’s order and are especially useful when filtering security policies by tags

B. Numbers referring to when the security policy was created and do not have a bearing on the order of policy enforcement

C. Static numbers that must be manually re-numbered whenever a new security policy is added



QUESTION 80Which of the following is NOT a valid option for built-in CLI access roles?

A. read/write

B. superusers

C. vsysadmin

D. deviceadmin



QUESTION 81Which of the following objects cannot use User-ID as a match criteria?

A. Security Policies

B. QoS

C. Policy Based Forwarding


D. DoS Protection

E. None of the above

Correct Answer: ESection: (none)Explanation


QUESTION 82Wildfire may be used for identifying which of the following types of traffic?

A. Malware

B. DNS

C. DHCP

D. URL Content



QUESTION 83What are two sources of information for determining if the firewall has been successful in communicating with an external User-ID Agent?

A. System Logs and the indicator light under the User-ID Agent settings in the firewall

B. There's only one location - System Logs

C. There's only one location - Traffic Logs

D. System Logs and indicator light on the chassis




QUESTION 84Which of the following interfaces types will have a MAC address?

A. Layer 3

B. Tap

C. Vwire

D. Layer 2



QUESTION 85WildFire Analysis Reports are available for the following Operating Systems:

A. Windows XP

B. Windows 7

C. Windows 8

D. Mac OS-X

Correct Answer: ABCSection: (none)Explanation


QUESTION 86What will the user experience when browsing a Blocked hacking website such as www.2600.com via Google Translator?

A. The URL filtering policy to Block is enforced

B. It will be translated successfully

C. It will be redirected to www.2600.com

D. User will get "HTTP Error 503 - Service unavailable" message




QUESTION 87When configuring a Decryption Policy, which of the following are available as matching criteria in a policy? (Choose three.)

A. Source Zone

B. Source User

C. Service

D. URL-Category

E. Application



QUESTION 88Which of the following are methods HA clusters use to identify network outages?

A. Path and Link Monitoring

B. VR and VSys Monitors

C. Heartbeat and Session Monitors

D. Link and Session Monitors



QUESTION 89


As a Palo Alto Networks firewall administrator, you have made unwanted changes to the Candidate configuration. These changes may be undone by Device >Setup > Operations >Configuration Management>.... and then what operation?

A. Revert to Running Configuration

B. Revert to last Saved Configuration

C. Load Configuration Version

D. Import Named Configuration Snapshot



QUESTION 90When employing the BrightCloud URL filtering database in a Palo Alto Networks firewall, the order of evaluation within a profile is:

A. Block list, Custom Categories, Predefined categories, Dynamic URL filtering, Allow list, Cache files.

B. Block list, Allow list, Custom Categories, Cache files, Local URL DB file.

C. Block list, Custom Categories, Cache files, Predefined categories, Dynamic URL filtering, Allow list.

D. Dynamic URL filtering, Block list, Allow list, Cache files, Custom categories, Predefined categories.



QUESTION 91When Destination Network Address Translation is being performed, the destination in the corresponding Security Policy Rule should use:

A. The PostNAT destination zone and PostNAT IP address.

B. The PreNAT destination zone and PreNAT IP address.

C. The PreNAT destination zone and PostNAT IP address.

D. The PostNAT destination zone and PreNAT IP address.




QUESTION 92What are the benefits gained when the "Enable Passive DNS Monitoring" checkbox is chosen on the firewall?

A. Improved DNS-based C&C signatures.

B. Improved PANDB malware detection.

C. Improved BrightCloud malware detection.

D. Improved malware detection in WildFire.



QUESTION 93In PANOS 6.0, rule numbers are:

A. Numbers that specify the order in which security policies are evaluated.

B. Numbers created to be unique identifiers in each firewall’s policy database.

C. Numbers on a scale of 0 to 99 that specify priorities when two or more rules are in conflict.

D. Numbers created to make it easier for users to discuss a complicated or difficult sequence of rules.



QUESTION 94Which of the following is a routing protocol supported in a Palo Alto Networks firewall?


A. RIPv2

B. ISIS

C. IGRP

D. EIGRP



QUESTION 95WildFire analyzes files to determine whether or not they are malicious. When doing so, WildFire will classify the file with an official verdict. This verdict is known asthe WildFire Analysis verdict. Choose the three correct classifications as a result of this analysis and classification?

A. Benign

B. Adware

C. Spyware

D. Malware detection

E. Safeware

F. Grayware

Correct Answer: ADFSection: (none)Explanation


QUESTION 96Select the implicit rules that are applied to traffic that fails to match any administrator-defined Security Policies.

A. Intra-zone traffic is allowed

B. Inter-zone traffic is denied

C. Intra-zone traffic is denied

D. Inter-zone traffic is allowed




QUESTION 97Without a WildFire subscription, which of the following files can be submitted by the Firewall to the hosted WildFire virtualized sandbox?

A. PE files only

B. PDF files only

C. MS Office doc/docx, xls/xlsx, and ppt/pptx files only

D. PE and Java Applet (jar and class) only



QUESTION 98Using the API in PAN-OS 6.1, WildFire subscribers can upload up to how many samples per day?

A. 500

B. 50

C. 1000

D. 10



QUESTION 99


Which of the following services are enabled on the MGT interface by default?

A. HTTPS

B. SSH

C. Telnet

D. HTTP




Documents

ACE.exam€¦ · 19.10.2018 · Taking into account only the information in the screenshot above, answer the following question: A span port or a switch is connected to e1/4, but