An enterprise firewall is experiencing asymmetric routing where return packets take a different path, causing packets to be dropped by default. Which feature should be configured to handle this safely without disabling stateful inspection completely?
Which object type should an administrator create in PAN-OS to group multiple internal server IP addresses together for simplified Security policy management?
A security auditor reports that internal administrative sessions to firewall management interfaces are vulnerable to downgrade attacks and weak cipher suites. Where should an administrator modify the settings to enforce secure TLS versions and strong ciphers for management access?
A network administrator needs to verify whether a specific security policy rule is matching incoming traffic during a live troubleshooting session. Which CLI command provides real-time packet evaluation against the security rulebase?
An administrator is configuring Zone Protection Profiles on a Palo Alto Networks firewall. Which THREE types of network-layer attacks can be mitigated using this profile? (Choose three)
An administrator wants to configure High Availability (HA) Active/Passive on two firewalls. Which THREE prerequisites must be verified before enabling HA? (Choose three)
An administrator needs to monitor traffic and generate logs without blocking packets when evaluating a new application rule. Which TWO actions or logging configurations should be applied? (Choose two)
A company wants to protect its internal web server from SQL injection attacks. The security team decides to deploy a device that inspects HTTP traffic and blocks malicious requests based on known attack patterns. Which technology should be used?
A network administrator is configuring a Palo Alto Networks firewall to protect an internal web server from SYN flood attacks. The firewall is deployed in Layer 3 mode, and the web server is in the DMZ zone. The administrator wants to limit the number of incomplete TCP handshakes per second from any single source IP address. Which configuration should be applied to achieve this?
A network administrator is configuring a Palo Alto Networks firewall to protect an internal web server from SYN flood attacks. The administrator wants to limit the number of half-open connections from any single source IP address to the server. Which feature should the administrator configure?
A network engineer is configuring IPsec VPN tunnels between two sites. The engineer wants to ensure that if the primary tunnel fails, traffic automatically switches to a backup tunnel without manual intervention. Which protocol should be used to achieve dynamic failover?
A security team wants to detect when an attacker is performing a TCP SYN port scan against a web server on the internal network. Which IDS/IPS detection method would most directly identify this activity?
A security administrator is configuring a Palo Alto Networks firewall to protect against volumetric attacks. The administrator wants to enable SYN flood protection and set the action to randomly early drop. Which TWO statements are correct about this configuration? (Choose two.)
A security engineer is troubleshooting an issue where a Palo Alto Networks firewall in a high-availability active/passive pair is not failing over properly during a link failure on the active firewall's external interface. The engineer observes that the passive firewall is not taking over even though the active firewall's link is down. Which setting should the engineer verify to ensure proper failover?
A network security engineer is troubleshooting why a Palo Alto Networks firewall is not blocking traffic that should be denied by a Security policy rule. The rule is positioned at the top of the rulebase, has a source zone of 'Trust', destination zone of 'Untrusted', source IP 'any', destination IP 'any', application 'any', and action 'deny'. However, traffic from the Trust zone to the Untrusted zone is still allowed. What is the most likely cause?
A company is implementing a Network Access Control (NAC) solution to enforce endpoint compliance before allowing access to the corporate network. The security team wants to ensure that endpoints meet specific security requirements. Which TWO actions are part of a typical NAC posture assessment? (Choose two.)
A network security administrator is configuring a Palo Alto Networks firewall to allow only specific applications while blocking all others. The administrator wants to ensure that the firewall inspects the application layer to identify applications regardless of port. Which Security policy rule configuration should be used?
A security administrator is implementing a Palo Alto Networks firewall to protect an internal network from external threats. The administrator wants to ensure that the firewall can detect and prevent unknown malware in files transferred over HTTP and SMTP. The administrator configures a WildFire analysis profile and attaches it to a Security policy rule. Which TWO actions must the administrator take to ensure that files are forwarded to WildFire for analysis and that the firewall can enforce verdicts? (Choose two.)
A network administrator is troubleshooting why a new Security policy rule intended to block traffic from the untrusted zone to the DMZ is not taking effect. The administrator confirms that the rule is placed at the top of the rulebase and that the source and destination zones are correctly defined. However, traffic is still being allowed. What is the most likely cause?
A junior administrator is configuring a Palo Alto Networks firewall and needs to allow DNS queries from the internal network to a public DNS server at 8.8.8.8. The internal network is in the Trust zone, and the external network is in the Untrust zone. The administrator creates a Security policy rule allowing DNS (application-default) from Trust to Untrust. However, users report that DNS queries are not working. What is the most likely cause?
A junior network administrator is configuring a Palo Alto Networks firewall to allow outbound web traffic from the internal network to the internet. The security policy rule uses the 'trust' zone as source and the 'untrust' zone as destination. Users report they cannot access any websites, but the administrator confirms the firewall's management interface can reach the internet. Which action should the administrator take to resolve the issue?
A network security engineer is configuring a Palo Alto Networks firewall to protect an internal network from external threats. The engineer needs to ensure that the firewall can identify and control applications, regardless of port or protocol. Which two actions should the engineer take to achieve this? (Choose two.)
An administrator wants to inspect HTTPS traffic originating from an internal network segment without triggering certificate warnings on user browsers. What is the mandatory deployment prerequisite on the Palo Alto Networks firewall?
A security analyst notices that internal hosts are resolving domains associated with known command and control (C2) servers. Which profile should be attached to the Security policy rule to automatically block this DNS-based threat?
A company requires remote workers to establish a secure tunnel back to the corporate data center using GlobalProtect. Which component authenticates the users before assigning an IP address pool?
A network administrator needs to prioritize VoIP traffic over bulk file transfers using QoS on a PAN-OS firewall. Where must the QoS profile be applied to shape the traffic effectively?
An organization is adopting a Zero Trust architecture. Which foundational principle must be applied to all network traffic traversing the Palo Alto Networks firewall?
An administrator configures a WildFire analysis profile and attaches it to a Security policy rule. Under what condition does the firewall forward a sample to the WildFire cloud?
An administrator needs to configure a Palo Alto Networks firewall to prevent unauthorized outbound traffic by restricting users to only access approved internal web applications. Which security control should be implemented in the Security policy?
An administrator needs to ensure that users cannot upload sensitive corporate data containing specific credit card patterns to external cloud storage. Which security profile meets this requirement?
An administrator configures a Security policy rule to block access to known malicious websites categorized by PAN-DB. Which profile must be attached to the rule?
A security engineer notices that a specific vulnerability signature is generating false positives for a critical internal custom application. What is the recommended way to prevent this signature from blocking the application without disabling the entire vulnerability profile?
An administrator is troubleshooting a scenario where internal clients cannot establish connections to a newly published public web server hosted behind the firewall using its public NAT IP. What common firewall misconfiguration causes this behavior?
An administrator wants to dynamically block connections from IP addresses published on a trusted third-party threat feed. Which feature should be used to ingest this feed into firewall policies?
An administrator configures high availability (HA) active/passive mode between two identical firewall models. What happens to active sessions when a failover occurs if 'Session Synchronization' is enabled?
An administrator wants to restrict administrative access to the firewall GUI so that only members of the 'Domain Admins' group can log in using their Active Directory credentials. Which authentication method should be configured?
An administrator observes that CPU utilization on the dataplane is spiking due to extensive regular expression inspections in security profiles. Which feature can be leveraged to optimize inspection performance on supported hardware models?
An administrator needs to troubleshoot why a specific user is unable to access an internal application mapped via User-ID. Which TWO tools or commands can verify User-ID mapping status? (Choose two)
An administrator is designing a Zero Trust network architecture on a Palo Alto Networks firewall. Which TWO best practices should be implemented in the Security policy rulebase? (Choose two)
An administrator observes that specific internal users are bypassing security policies by utilizing unauthorized tunneling applications disguised as standard web traffic. Which PAN-OS feature should be used to identify and block these hidden application tunnels?
An administrator is reviewing security logs and notices several sessions marked as 'App-ID' change mid-session from 'unknown-tcp' to a specific application like 'ssl' or 'web-browsing'. Which TWO mechanisms explain this behavior? (Choose two)
An enterprise requires remote access users to connect securely via GlobalProtect. Which TWO authentication methods are natively supported by PAN-OS for verifying GlobalProtect user credentials? (Choose two)
An administrator is configuring External Dynamic Lists (EDLs) in PAN-OS. Which THREE list types are natively supported for import into the firewall? (Choose three)
A hospital network administrator must ensure that only authorized medical devices can connect to a dedicated VLAN. The devices support 802.1X and have unique certificates. The administrator wants to enforce identity-based access at the switch port and reject any device without valid credentials. Which technology should be implemented?
A security engineer at a mid-sized company is configuring a Palo Alto Networks firewall to allow users on the internal network to access specific external web services while blocking all other outbound traffic. The engineer creates a Security policy rule from the Trust zone to the Untrusted zone, sets the action to Allow, and attaches a URL Filtering profile that blocks categories such as 'malware' and 'phishing'. After committing, users report that they can still access any website, including those in the blocked categories. What is the most likely reason for this behavior?
A university campus network uses a Cisco Catalyst switch stack for its student residence halls. Network operations notices that students are plugging personal wireless routers into wall jacks, causing loops and DHCP conflicts. The team wants a control that limits each wall jack to a single learned MAC address and shuts the port down (err-disabled) if a second MAC is seen. Which feature should be configured on the access ports?
A system administrator at a small company receives an alert that an internal workstation is making repeated connection attempts to an external IP address on TCP port 445. The administrator wants to quickly identify which internal host is generating this traffic and verify whether the firewall is blocking it. Which action should the administrator take first?
A small business wants to let remote employees reach an internal file server without exposing it directly to the internet. The administrator plans to place a device at the network edge that terminates encrypted tunnels from employee laptops and forwards their traffic onto the internal LAN. Which technology best fits this requirement?
A network security engineer is configuring a new Palo Alto Networks firewall. The company policy requires that all outbound web traffic from the internal network be inspected for threats, but the firewall must not decrypt traffic to banking or healthcare websites due to privacy regulations. The engineer creates a decryption policy rule to exclude those categories. What should the engineer do next to ensure that the excluded traffic is still scanned for threats?
A security team is deploying an intrusion prevention system (IPS) inline between an internal segment and the internet gateway. During testing, legitimate business traffic is being dropped because the IPS is matching benign patterns. The team wants to reduce false positives while keeping meaningful detection. Which TWO tuning actions are appropriate? (Choose two.)
A network administrator is reviewing a firewall's session table and notices that a file transfer from a trusted internal host to an external IP address is permitted, but deep packet inspection shows the file contains a known malware hash. The administrator wants to ensure that any future transfer of a file with that hash is blocked and logged. Which action should the administrator take?
An administrator is hardening a Linux web server that faces the internet. The goal is to reduce the attack surface by ensuring only the ports required for HTTPS management and web traffic are reachable, while all other inbound connection attempts are silently dropped. Which control should be implemented on the server itself?
A security operations team notices that an attacker is using a compromised internal host to perform DNS tunneling to exfiltrate data to an external command-and-control server. The firewall is configured with a Security policy that allows DNS (UDP/53) from the internal zone to the external zone, and the DNS traffic is not being inspected by any security profile. The team wants to detect and block this activity with minimal impact on legitimate DNS traffic. Which Palo Alto Networks feature should they implement?
A security analyst is investigating a suspected network intrusion. The analyst needs to capture full packet payloads for offline analysis and has physical access to a SPAN port on a switch. Which tool should be used to capture the traffic?
An organization is designing segmentation for a data center. The security architect wants east-west traffic between application tiers to be inspected and policy-controlled without forcing all traffic through a single physical appliance that could become a bottleneck. The design should also allow security policy to follow workloads as they move between hypervisors. Which approach best meets these goals?
A security analyst is examining network traffic logs and notices that an internal host is sending a large number of SYN packets to multiple external IP addresses on port 80, but never completing the TCP handshake. The analyst suspects a SYN flood attack originating from the internal host. Which security feature should the analyst configure on the firewall to mitigate this type of attack?
A network security engineer is configuring a new Palo Alto Networks firewall to securely allow remote users to access internal applications. The engineer decides to implement GlobalProtect with SSL VPN. Which TWO configurations are required to enable user authentication and ensure that only authorized users can access the internal applications? (Choose two.)
A company uses a demilitarized zone (DMZ) to host a public web server. The security policy requires that the web server can only initiate outbound connections to a specific database server on the internal network and must not initiate any other outbound connections. Which firewall rule placement and action best enforces this requirement?
A security engineer is deploying a Palo Alto Networks firewall in a network that uses NAT. The engineer needs to ensure that the firewall can identify applications that use dynamic ports, such as FTP, and apply the correct security policy. Which feature should the engineer configure to achieve this?
A network administrator is configuring a site-to-site VPN between two offices using IPsec in tunnel mode. The administrator wants to ensure that only specific subnets can communicate over the VPN, and that the traffic is encrypted and authenticated. Which combination of IPsec components achieves this?
An organization wants to protect its internal DNS servers from being used in DNS amplification attacks. The security team decides to implement DNS response rate limiting (RRL). Which statement best describes how RRL mitigates this threat?
A company is deploying a Network Intrusion Prevention System (NIPS) inline at the perimeter. The security team wants to minimize false positives while ensuring that malicious traffic is blocked. Which TWO actions should be taken during NIPS tuning? (Choose two.)
A security administrator is configuring a Palo Alto Networks firewall to protect against network reconnaissance attacks. The administrator wants to detect and block port scans and host sweeps on the untrusted zone. Which TWO actions should be taken to achieve this? (Choose two.)
A security operations center (SOC) analyst receives an alert about a potential data exfiltration attempt. The analyst needs to determine which internal host is communicating with a known malicious IP address and what application is being used. Which PAN-OS feature should the analyst use to quickly correlate the traffic and identify the host and application?
A security operations center (SOC) analyst is investigating a series of alerts indicating that internal users are accessing malicious domains. The analyst wants to verify whether the Palo Alto Networks firewall is blocking these domains based on DNS sinkholing. Which firewall feature should the analyst check to confirm that DNS sinkholing is properly configured and operational?
A network administrator is configuring a new Palo Alto Networks firewall and wants to ensure that users on the internal network can access the internet but cannot directly reach the firewall's management interface from the dataplane. The firewall has three zones: Trust, Untrust, and Management. Which configuration should the administrator implement to achieve this requirement?
A security engineer is deploying a Palo Alto Networks firewall in a hybrid cloud environment. The engineer needs to ensure that outbound traffic from the internal network to the internet is inspected for threats and that users are identified by their Active Directory credentials. The firewall is configured with a Trust zone for internal users and an Untrust zone for the internet. Which TWO actions should the engineer take to meet these requirements? (Choose two.)