An administrator notices that traffic between two internal subnets connected to the same Palo Alto Networks firewall is not being inspected by security policies. The interfaces for both subnets are configured as Layer 3. What is the most likely reason for this behavior?
A network administrator notices that asymmetric routing is occurring on a multi-path firewall deployment, causing valid TCP sessions to be dropped by the firewall. Which feature should the administrator enable to resolve this issue?
An enterprise firewall receives traffic from a subnet that must be translated using Dynamic IP and Port (DIPP) Source NAT. The administrator needs to ensure that port allocation for a specific high-traffic server is predictable and does not get exhausted. Which NAT feature should be configured?
A network administrator configures a Layer 3 subinterface with DHCP Client enabled. However, the interface fails to receive an IP address from the upstream provider. Which CLI command should the administrator execute to troubleshoot the DHCP client process on the firewall?
An administrator needs to test DNS resolution from the Palo Alto Networks firewall command line interface (CLI) to ensure the management plane can reach external name servers. Which command should be used?
An administrator is setting up a Site-to-Site IPsec VPN tunnel on a Palo Alto Networks firewall. The VPN tunnel comes up, but traffic from the local subnet cannot reach the remote subnet. Upon checking the IPsec SA status, the phase 2 security associations are active. What is the most likely cause of the traffic failure?
An administrator needs to check the operational status and link speed of all physical Ethernet ports on a Palo Alto Networks firewall. Which CLI command should be executed?
A network engineer wants to ensure that ICMP Redirect messages are disabled on all Layer 3 interfaces of a Palo Alto Networks firewall to prevent routing manipulation attacks. Where can this setting be disabled?
An administrator configures Dynamic NAT on a Palo Alto Networks firewall using a pool of public IP addresses. After implementation, some internal clients intermittently fail to establish outbound connections. Upon reviewing traffic logs, the administrator notes that the NAT translation pool has exhausted all available ports for a specific source IP. Which feature should be enabled or adjusted to prevent this port exhaustion?
An administrator wants to check the current CPU utilization of the data plane (DP) and management plane (MP) on a Palo Alto Networks firewall. Which CLI command should be used?
An administrator is troubleshooting a complex routing issue where traffic is not taking the expected static route. Which TWO commands can the administrator use to inspect the routing table and test route lookup for a specific destination IP address? (Choose two)
An administrator is analyzing firewall packet flow and session behavior. Which THREE criteria are evaluated by the Palo Alto Networks firewall to uniquely identify and create a session? (Choose three)
An administrator is troubleshooting asymmetric routing issues where packets arrive out of order or fail stateful checks. Which TWO features or settings in PAN-OS can assist in handling or mitigating asymmetric routing challenges? (Choose two)
An administrator is troubleshooting packet drops on a Palo Alto Networks firewall and wants to inspect dropped packets or hardware counters using CLI diagnostic tools. Which TWO commands can be used to review packet drop information? (Choose two)
A cybersecurity apprentice is reviewing network traffic logs and observes that a user's device is sending multiple identical DNS queries to different DNS servers for the same domain name. The apprentice wants to understand which TWO characteristics of DNS could explain this behavior. (Choose two.)
A junior administrator is asked to verify the IP address, subnet mask, and default gateway of the management interface on a Palo Alto Networks firewall. Which CLI command should be used?
A network security engineer is configuring a Palo Alto Networks firewall to perform source NAT for outbound internet traffic. The internal network is 192.168.1.0/24, and the firewall's external interface is 203.0.113.5/24. The engineer wants all outbound traffic to appear as the external interface IP. Which NAT configuration is correct?
A cybersecurity apprentice is setting up a small office network and needs to connect two switches to allow devices on both switches to communicate as if they were on the same local area network. The apprentice wants to ensure that frames from one switch can reach the other without any routing. Which type of connection should the apprentice use between the switches?
A network administrator is configuring a new subnet on a Layer 3 switch. The administrator must ensure that hosts on this subnet can communicate with hosts on remote subnets. Which TWO parameters must be configured on the Layer 3 switch interface to enable inter-subnet routing? (Choose two.)
A cybersecurity apprentice is documenting how a router handles IPv4 packets. She needs to identify TWO fields in the IPv4 header that can change as a packet is forwarded hop by hop across the network. (Choose two.)
A security analyst is examining a packet capture (PCAP) and observes that the TCP window size is dropping to zero during a data transfer between a client and a server through the firewall. What does a zero window size typically indicate in a TCP transmission?
An administrator is configuring a new Layer 2 subinterface on a Palo Alto Networks firewall and needs to associate it with an existing VLAN ID. Where is the VLAN tag specified for a Layer 2 subinterface?
An engineer is configuring a new Layer 3 interface on a Palo Alto Networks firewall and needs to ensure that the interface responds to ICMP echo requests for diagnostic purposes. Where must the administrator enable this setting?
An administrator needs to configure a static route on a Palo Alto Networks firewall so that traffic destined for a remote subnet (192.168.10.0/24) reaches its next-hop router (10.0.0.1). Which menu path must the administrator navigate to configure this?
An administrator is troubleshooting a connectivity issue between a host and a server across a Palo Alto Networks firewall. The administrator needs to verify whether the firewall is dropping the packets due to a security rule denial. Which CLI command should the administrator use to monitor packet drops in real time?
An administrator has configured BGP on a Palo Alto Networks virtual router, but the BGP peers are stuck in the 'Idle' state. What is the most likely configuration error causing this status?
An administrator needs to verify the MAC address associated with a specific IP address on the local network segment using the firewall CLI. Which command should be executed?
A network security engineer observes that TCP sessions are being terminated prematurely during periods of inactivity. The default application timeout is not meeting the business requirement for a custom database application. Where should the engineer modify the session timeout for this specific application?
An administrator configures a Virtual Wire (VWire) interface pair on a Palo Alto Networks firewall. Traffic passing between the two VWire interfaces is intermittently failing. Upon checking, the administrator realizes VLAN tags are being stripped or not matched properly. What setting should be checked in the VWire object configuration?
A network engineer configures OSPF on a Palo Alto Networks virtual router. Neighbors are stuck in the EXSTART/EXCHANGE state. What is the most likely cause of this issue?
A network security analyst is troubleshooting intermittent packet drops on a high-speed trunk interface connected to a core switch. The interface is configured as Layer 3 with 1 Gbps speed and full duplex. The switch port is also set to 1 Gbps full duplex. However, FCS (Frame Check Sequence) errors are incrementing rapidly. What is the most probable cause?
A network engineer needs to configure a redundant path for outbound traffic using static routes with different metrics (administrative distances). If the primary route has a metric of 10, what metric should be assigned to the backup static route to ensure it is only used when the primary route fails?
An administrator is troubleshooting a packet flow issue where traffic arriving on a Layer 3 interface is being dropped. The administrator runs the command 'show counter global filter packet-drop yes' and notices an increment in counters related to 'Discard due to zone mismatch'. What does this counter typically indicate?
A network engineer configures Equal-Cost Multi-Path (ECMP) routing on a Palo Alto Networks virtual router with two paths to the same destination. By default, how does PAN-OS select which path to use for a given session?
An administrator is configuring a new Layer 3 interface on a Palo Alto Networks firewall. Which TWO parameters must be defined for the interface to function correctly in a routed network? (Choose two)
An administrator is troubleshooting a scenario where BGP routes learned from a peer are not being installed in the Virtual Router's routing table. Upon checking the BGP routing table ('show routing protocol bgp rib-in'), the routes are visible, but they are marked as not best. What is the most common reason for a learned BGP route not to be selected as the best path?
An administrator is configuring NAT on a Palo Alto Networks firewall. Which THREE address types can be used as translation sources in a Source NAT rule? (Choose three)
An administrator is configuring OSPF on a Palo Alto Networks virtual router. Which THREE parameters must match between OSPF routers for an adjacency to form successfully? (Choose three)
An administrator needs to configure static routing on a PAN-OS Virtual Router. Which THREE parameters are required when defining a static route entry? (Choose three)
A cybersecurity apprentice is analyzing traffic captures and notices that a workstation sends a single packet to a server, and the server responds with a packet that is much larger than the original. The apprentice suspects that the network path cannot handle the larger frame size. Which protocol should the apprentice examine to confirm that the path supports the larger frame size without fragmentation?
A network administrator is setting up a new branch office firewall. The ISP provides a single public IP address and requires the branch's internal web server (10.1.1.10) to be reachable from the internet on TCP port 443. The administrator configures a destination NAT rule translating the public IP to 10.1.1.10. However, external users still cannot access the web server. What is the most likely missing configuration?
A network administrator is troubleshooting a connectivity issue between two hosts on the same VLAN. The hosts are connected to the same switch, but they cannot ping each other. The administrator suspects a Layer 2 problem. Which command should be used on the switch to verify the MAC address table and confirm that the switch has learned the MAC addresses of both hosts?
A network engineer is configuring a router interface with the IPv4 address 172.16.10.33 and subnet mask 255.255.255.224. The engineer needs to determine the network address and broadcast address for this subnet. What are the network and broadcast addresses, respectively?
A junior security analyst is reviewing the TCP/IP model as part of onboarding. She needs to identify which layer is responsible for logical addressing and routing of packets between different networks. Which layer of the TCP/IP model performs this function?
A junior administrator is asked to identify the default administrative distance values used by a Palo Alto Networks firewall for routes learned from different sources. Which statement correctly identifies the default administrative distance for OSPF internal routes?
A help desk technician is on a support call with a remote user whose workstation cannot reach any resources on the corporate network. The technician asks the user to run a command that will show the workstation's IP address, subnet mask, and default gateway. Which command should the user run?
A help desk technician is diagnosing a user's workstation that can reach a server by IP address but cannot reach it by hostname. The technician confirms the workstation has a valid IP address, default gateway, and can ping the server's IP successfully. Which network service should the technician investigate first?
A company is deploying a new VoIP phone system. The network administrator needs to ensure that voice traffic is prioritized over regular data traffic on the LAN. Which technology should be implemented on the switches to achieve this?
A network administrator is configuring a Layer 3 interface on a Palo Alto Networks firewall to participate in a broadcast domain. The interface must obtain its IP address automatically from a DHCP server on the same subnet. Which interface configuration setting must be enabled to allow the firewall to act as a DHCP client?
A security analyst is reviewing captured traffic and needs to identify which protocol resolves a known IPv4 address to its corresponding MAC address on the local segment. Which protocol performs this function?
A network engineer is analyzing a packet capture and observes that a workstation sends a TCP segment with the SYN flag and a destination port of 443 to a web server. The server responds with SYN-ACK, and the workstation completes the handshake with ACK. Shortly after, the workstation sends a segment with the RST flag. Which statement best describes what the RST segment indicates in this scenario?
A network security analyst is investigating a suspected ARP spoofing attack on the local network. The analyst needs to verify the ARP cache on a Windows workstation to identify any duplicate IP addresses mapped to different MAC addresses. Which TWO commands can be used to display the ARP cache on the workstation? (Choose two.)
A security administrator is planning a network segmentation design and needs to understand how devices communicate at Layer 2. Which TWO statements accurately describe Ethernet MAC address behavior in a switched network? (Choose two.)
A junior administrator is documenting the corporate network and must list services that operate at the transport layer of the TCP/IP model. Which TWO protocols operate at the transport layer? (Choose two.)
A junior administrator is documenting the TCP/IP model layers for a training manual. The administrator needs to map the OSI model's Transport layer to its equivalent layer in the TCP/IP model. Which layer of the TCP/IP model corresponds to the OSI Transport layer?
A security analyst is reviewing how data moves through the TCP/IP stack. She needs to identify TWO protocols that operate at the Transport layer and provide end-to-end communication between applications on different hosts. (Choose two.)
A junior SOC analyst is examining a packet capture taken from a workstation that is failing to reach an internal web server. The capture shows the workstation sending a frame with destination MAC address 01:00:5E:00:00:FB and a destination IP address of 224.0.0.251. What is the workstation most likely attempting to do?
A network engineer is troubleshooting an issue where a Palo Alto Networks firewall is not installing a static route into the virtual router's forwarding table. The route is configured with a next-hop IP address that is not directly connected to any interface on the firewall. What is the most likely reason the route is not active?
A network technician is configuring a small branch office where the ISP provides a single public IPv4 address. Multiple internal hosts must reach the internet simultaneously using that one address. Which technology should the technician implement?
A network technician is troubleshooting a connectivity issue between two hosts on the same VLAN. The technician suspects a duplicate IP address on the network. Which command should the technician use on a Windows host to display the MAC address associated with an IP address in the local ARP cache?
A new administrator is documenting the address scheme of a small office network. She notes that workstations use addresses in the 192.168.1.0/24 range and that these addresses are not routable on the public Internet. Which type of address is she documenting?
An administrator is assigning IPv4 addresses to devices in a lab subnet. One host must be configured so that it can always be reached at the same address by other lab systems, and it must not depend on a DHCP server being available. Which configuration approach should the administrator use?
A help desk technician reports that a user's workstation can reach servers on the local /24 subnet but cannot reach any host on a remote subnet. The workstation has IP address 10.20.30.45/24 and default gateway 10.20.30.1. The technician runs ipconfig and sees the correct address and mask, but pinging 10.20.40.10 fails. Which troubleshooting step should the technician perform FIRST to determine whether the problem is local or beyond the gateway?
A help desk technician is explaining basic network concepts to a new hire. The technician needs to describe which protocol operates at the Transport layer of the OSI model and provides reliable, connection-oriented delivery. Which protocol should the technician identify?
A security analyst is reviewing network traffic and observes a series of TCP packets where the flags field is set to SYN, then SYN-ACK, then ACK. The analyst needs to document the purpose of this exchange. What is the primary function of this three-way handshake?
A security analyst is reviewing a packet capture of a TCP session between an internal client and an external server. The capture shows the client sending a segment with the SYN flag set and the server responding with a segment that has both SYN and ACK set. The client then sends an ACK. What does this sequence indicate about the session?
An analyst is troubleshooting why a workstation with IP address 172.16.5.20/24 cannot communicate with a server at 172.16.6.10/24, even though both are connected to the same Layer 2 switch and the switch shows both ports up. The analyst confirms there are no VLAN or ACL restrictions. Which network fundamental best explains the failure?
A network engineer is analyzing a packet capture and notices that a host is sending a series of ICMP Echo Requests to a remote server. The host receives ICMP Echo Replies, but the payload sizes vary. The engineer wants to determine the maximum transmission unit (MTU) of the path to avoid fragmentation. Which protocol or mechanism is used to discover the path MTU?
A network security analyst is reviewing how a host on a corporate LAN resolves names and discovers services. The analyst wants to identify TWO protocols or mechanisms that operate at the application layer and rely on UDP for transport. (Choose two.)
A cybersecurity apprentice is examining a suspicious packet capture. The captured frame shows a source MAC address of 00:1A:2B:3C:4D:5E, a destination MAC address of FF:FF:FF:FF:FF:FF, and an EtherType value of 0x0806. Based on these layer 2 header fields, which type of traffic is this?
A security analyst is reviewing traffic from a workstation that has been assigned the IPv4 address 192.168.10.77 with a subnet mask of 255.255.255.192. The workstation needs to send a packet to 192.168.10.130. What will the workstation do with this packet?