A firewall is deployed in an environment with asymmetric routing. Packets belonging to the same TCP session enter on different interfaces due to multi-path upstream routing. What configuration change is required on the Palo Alto Networks firewall to prevent the traffic from being dropped?
An administrator needs to configure a security rule that applies specifically to traffic destined for a DMZ web server using its public NAT IP address (Destination NAT). Which IP address must be specified in the Destination field of the Security policy rule?
A network administrator observes that a specific internal subnet is experiencing intermittent connectivity to an external SaaS application. Inspection shows that packets exceeding a certain size are being dropped because the intermediate router does not support Path MTU Discovery, and the firewall is not adjusting the MSS. Where should the administrator enable Maximum Segment Size (MSS) adjustment on the firewall?
An administrator implements a decryption policy to block outbound traffic using obsolete TLS 1.0 protocols. When users attempt to access a legacy partner portal that only supports TLS 1.0, the connection fails with an decryption error. The administrator wants to gracefully alert users with a customizable response page instead of dropping the connection outright. Which setting must be enabled in the Decryption Profile?
A company is utilizing User-ID to identify Active Directory users. The administrator notices that users logging into workstations are not being mapped correctly, and IP-to-user mappings are missing for a specific subnet. The subnet is behind a router that performs NAT before traffic reaches the firewall. How should the administrator resolve this User-ID mapping issue?
An administrator needs to configure a Palo Alto Networks NGFW security rule to log traffic only when a new session is successfully established. Which setting in the Security Policy Rule options tab accomplishes this requirement?
A network engineer is configuring Source NAT (SNAT) with Dynamic IP and Port (DIPP). The administrator wants to ensure that a specific critical server always translates to the exact same public IP address and port range whenever it initiates outbound connections. Which DIPP translation allocation method should be selected?
An administrator needs to restrict access to malicious command-and-control (C2) domains. Which security profile should be attached to the outbound Security policy rules to inspect and block this traffic?
An enterprise firewall is configured with multiple virtual systems (vsys). An administrator needs to configure inter-vsys routing to allow traffic to flow securely between Vsys1 and Vsys2 without traversing physical external interfaces. What is the correct method to achieve this in PAN-OS?
An administrator notices that an internal client is infected with malware that is attempting to exfiltrate data over HTTPS using a custom encrypted protocol that evades standard signatures. The administrator wants to configure WildFire inline machine learning to block this zero-day threat in real-time. Which feature must be enabled and configured?
An administrator configures a decryption policy to 'No Decrypt' for financial institution websites to comply with privacy regulations. However, the firewall is still decrypting traffic to certain banking sites. Upon investigation, the administrator discovers that the firewall is matching a pre-defined PAN-OS SSL Decryption Exclusion list. How can the administrator override or modify this behavior?
An administrator is configuring a Destination NAT rule to forward inbound web traffic from the internet to an internal web server. The administrator notices that when internal users try to access the web server using its public IP address (Hairpinning/NAT Loopback), the connection fails. What additional rule is required to support NAT Loopback?
An administrator needs to configure Active Directory-based User-ID mapping without installing a dedicated User-ID agent on a Windows Server. Which TWO methods are natively supported by PAN-OS for agentless user mapping? (Choose two)
An administrator configures High Availability (HA) Active/Active mode on a pair of Palo Alto Networks firewalls. Which THREE operational considerations or configurations apply specifically to Active/Active deployments compared to Active/Passive? (Choose three)
An administrator is troubleshooting a high availability (HA1) heartbeat failure between two firewall peers. Which THREE configuration or physical items should be checked? (Choose three)
An administrator is deploying WildFire to protect an organization from zero-day malware. Which TWO configuration steps are required to ensure files are successfully forwarded to the WildFire cloud for analysis? (Choose two)
An administrator is configuring Source NAT (SNAT) and wants to understand how translation addresses are allocated when using Dynamic IP and Port (DIPP). Which TWO characteristics describe DIPP behavior on Palo Alto Networks firewalls? (Choose two)
An administrator needs to configure a Palo Alto Networks firewall to decrypt inbound SSL traffic destined for a public-facing web server. Which type of Decryption rule must be created?
An organization requires that internal clients accessing external HTTPS websites undergo URL filtering and decryption, but users must be able to opt-out of decryption for sensitive categories like Finance and Healthcare. Which configuration option inside the Decryption rule best achieves this bypass requirement?
A security engineer is configuring a Palo Alto Networks firewall to protect an internal web server farm. The requirement is to detect and block brute-force SSH attacks targeting the servers while allowing legitimate administrative SSH sessions from the management subnet. The engineer has already created a Zone Protection profile. Which configuration step should be taken to meet this requirement?
A network security administrator is configuring a Palo Alto Networks firewall to inspect traffic between two internal zones: 'Trust' and 'Untrust'. The administrator wants to ensure that all traffic from Trust to Untrust is decrypted and inspected for threats, but traffic from Untrust to Trust should only be allowed for established sessions. The administrator has already configured SSL Forward Proxy decryption. Which additional configuration is required to meet these requirements?
A network security engineer is configuring a Layer 3 interface on a Palo Alto Networks firewall for a subnet that will host both trusted internal users and a guest wireless network. Rather than creating separate physical interfaces, the engineer wants to use one physical interface with two logical interfaces, each assigned to a different security zone. Which technology should the engineer configure to accomplish this?
A network security engineer is configuring a Palo Alto Networks firewall to protect against IP spoofing attacks. The engineer wants to ensure that packets with a source IP address that does not match the ingress interface's subnet are dropped. Which feature should the engineer enable on the ingress interface?
A security administrator is configuring a new Palo Alto Networks firewall and needs to ensure that management access is only available from the internal management network (10.10.10.0/24). The administrator has already set the management interface IP address. Which additional step must be taken to restrict management access to this subnet?
A security engineer is configuring a Palo Alto Networks firewall to decrypt outbound SSL traffic for inspection. The engineer needs to ensure that the firewall can decrypt traffic while maintaining security and performance. Which TWO actions are required to enable SSL Forward Proxy decryption? (Choose two.)
A security engineer is deploying a pair of Palo Alto Networks firewalls in an active/passive high availability configuration. The engineer needs to ensure that the HA pair can maintain session state and fail over smoothly if the active firewall fails. Which TWO HA settings or links are required to synchronize session and configuration state between the peers? (Choose two.)
A security administrator is configuring a Palo Alto Networks firewall to decrypt outbound SSL traffic for inspection. The administrator wants to ensure that traffic to certain categories, such as financial services and health care, is not decrypted due to privacy regulations. Which two configurations should be used to achieve this? (Choose two.)
An organization wants to inspect encrypted outbound HTTPS traffic to detect malware without causing certificate warnings on user workstations. Which component must be installed on the client endpoints to achieve this?
An administrator configures a dynamic address group (DAG) based on User-ID tags, but security rules referencing this DAG fail to match traffic from users who have successfully authenticated via GlobalProtect. What is the most likely root cause?
An administrator configures a Security policy rule to block all file-sharing applications. However, users are still able to upload files using an authorized cloud collaboration tool that shares the same parent application family. Which feature should the administrator use to granularly block file uploads while permitting standard document viewing?
An administrator configures an external dynamic list (EDL) pointing to a URL hosting a plain-text list of malicious IP addresses. The firewall successfully downloads the EDL, but security rules referencing this EDL fail to block traffic to those IPs. Inspection reveals that the EDL entries are showing as 'parsing error' in the system logs. What is the most likely cause of this issue?
An administrator wants to ensure that critical database servers are protected against vulnerability exploits, SQL injections, and buffer overflows. Which security profile must be applied to the relevant Security policy rule to provide this protection?
An administrator is reviewing the Palo Alto Networks firewall traffic logs and sees a session marked with the application 'unknown-tcp'. What does this application classification typically indicate?
An administrator configures high availability (HA) active/passive mode between two Palo Alto Networks firewalls. During a failover test, the administrator observes that stateful sessions are dropped, forcing users to re-authenticate and re-establish their TCP connections. What is the most likely configuration error?
An administrator configures a QoS profile to prioritize VoIP traffic over bulk data transfers. However, after applying the profile, VoIP packets are still experiencing high latency during peak business hours. Inspection shows that the QoS profile is applied correctly to the security rules, but the packets are not being placed into the correct QoS class. What is missing in the interface configuration?
An administrator wants to prevent users from accessing specific URL categories such as 'gambling' and 'adult' while allowing all other business-related sites. Where should this restriction be configured?
An administrator deploys User-ID using Palo Alto Networks User-ID Agent on a Windows Server. Users report that after logging off their workstations, the firewall continues to attribute their web traffic to them for up to 45 minutes. How can the administrator reduce this timeout duration?
An administrator needs to configure a Palo Alto Networks firewall interface to connect to an untrusted ISP router. Which interface type is appropriate for this connection?
An administrator is troubleshooting a BGP routing peer connection between the Palo Alto Networks firewall and an external provider router. The BGP session is stuck in the 'Connect' state. Inspection of system logs indicates TCP port 179 packets sent by the firewall are being transmitted, but no SYN-ACK is received. Which troubleshooting step or feature verification should be performed first?
An administrator wants to view real-time session information, including source/destination ports, translated IPs, and matched security rules, for active traffic flowing through the firewall. Which CLI command should the administrator execute?
An administrator is configuring security policies on a Palo Alto Networks firewall and wants to ensure best practices for rule organization and management. Which TWO practices are recommended when designing security rules? (Choose two)
An administrator configures a decryption exclusion based on the 'Pre-defined SSL Decryption Exclusions' list. However, an internal audit reveals that a specific sensitive medical portal is still being intercepted and decrypted. The portal uses certificate pinning and a non-standard port (TCP 8443). How can the administrator ensure this specific traffic is never decrypted?
An administrator is troubleshooting a scenario where internal clients cannot resolve external domain names through the firewall configured as a DNS proxy. Which TWO settings should be verified on the firewall? (Choose two)
An administrator notices that the firewall's management plane CPU utilization is consistently at 99%. Which THREE factors or troubleshooting steps should the administrator investigate? (Choose three)
An administrator configures a dynamic update schedule for Antivirus and WildFire signatures. The firewall successfully downloads the updates, but fails to install them automatically. Where should the administrator check to verify and configure the installation schedule settings in PAN-OS?
An administrator is configuring a complex network environment with multiple virtual routers and needs to ensure proper routing and path selection. Which THREE statements regarding Palo Alto Networks virtual routers are accurate? (Choose three)
An administrator wants to configure Zone Protection Profiles to safeguard the internal network against common layer 2 and layer 3 attacks. Which THREE attack mitigation features are available within a Zone Protection Profile? (Choose three)
An administrator wants to secure outbound web browsing traffic by inspecting HTTP/HTTPS traffic for malicious URLs, malware, and exploits. Which TWO security profiles should be attached to the Security policy rule to achieve comprehensive protection? (Choose two)
An administrator needs to implement authentication for administrative access to the Palo Alto Networks firewall using an external RADIUS server. Which TWO components must be configured on the firewall to achieve this? (Choose two)
A security administrator is troubleshooting an issue where internal users cannot reach a specific external website, and the traffic is being dropped by the firewall. The administrator suspects a Threat Prevention profile is blocking the response as a command-and-control callback. Where should the administrator look to verify the exact threat signature ID and packet capture that triggered the block?
A network engineer has deployed an active/passive HA pair of PA-5220 firewalls. During a routine failover test, the engineer notices that existing TCP sessions are dropped and must be re-established. Which feature should be enabled to prevent session disruption during failover?
An administrator wants to ensure that critical server traffic is always prioritized over standard guest internet traffic during periods of network congestion. Which feature should be configured?
An administrator configures a Security policy rule with an application dependency on 'ssl', but the target application is 'custom-app'. When committing the configuration, the firewall generates a warning or error regarding application dependencies. What is the correct way to handle application dependencies in Palo Alto Networks firewalls?
An administrator is designing a high-availability network using Panorama and Palo Alto Networks firewalls. Which TWO tasks can be performed directly by Panorama regarding firewall management and deployment? (Choose two)
An administrator needs to prevent known malware and spyware from entering the network through downloaded files and web traffic. Which security profile type should be attached to the Security policy rule?
An administrator is configuring Zone Protection profiles to mitigate potential network attacks. Which TWO flood protection mechanisms are available within a Zone Protection profile? (Choose two)
A security administrator is configuring a Palo Alto Networks firewall to protect a web server in a DMZ zone. The administrator wants the firewall to inspect the HTTP traffic for known attack patterns and block malicious requests while allowing legitimate web traffic. Which Security Profile type should the administrator apply to the Security policy rule that permits HTTP traffic to the web server?
A security administrator is reviewing traffic logs on a Palo Alto Networks firewall and notices that a large volume of sessions from the internal network is matching a Security policy rule that permits any application on any port. The administrator wants to reduce the attack surface by ensuring that only specific applications are allowed, even when they use non-standard ports. Which feature should the administrator implement to achieve this?
A security administrator is configuring a Palo Alto Networks firewall to protect against network reconnaissance. The administrator wants to detect and block TCP port scans targeting the internal network from external sources. Which feature should the administrator configure to achieve this?
A network administrator is configuring a Palo Alto Networks firewall to allow outbound access to the internet for internal users. The administrator wants to ensure that users can access any website but must not bypass security controls using proxy sites or anonymizers. Which Security policy configuration should the administrator implement?
A security administrator is reviewing a Palo Alto Networks firewall configuration and notices that a Security policy rule allowing outbound web traffic has no security profiles attached. The administrator wants to ensure that the rule is protected against known vulnerabilities, malware, and command-and-control traffic. Which security profile group should the administrator attach to the rule to provide this protection?
A security engineer is tuning a Decryption policy on a Palo Alto Networks firewall. The organization must inspect TLS traffic to a sanctioned SaaS application, but must not break sessions to a banking portal that uses certificate pinning. Which action in the Decryption policy rule should be applied to the banking portal traffic to achieve this?
A security engineer is configuring a Palo Alto Networks firewall to inspect traffic between two internal zones. The engineer wants to ensure that the firewall can identify applications that use non-standard ports and apply appropriate security policies. Which technology should the engineer rely on to achieve this?
A security analyst is investigating unusual outbound traffic from an internal server. The analyst suspects the server may be communicating with a command-and-control server. Which Palo Alto Networks firewall feature should the analyst use to identify the application generating the traffic, regardless of the port being used?
A network administrator is configuring a Palo Alto Networks firewall to protect an internal web server. The administrator wants to allow only HTTP and HTTPS traffic to the server from the internet while blocking all other inbound traffic. Which type of security policy rule should be created to achieve this?
A network administrator is documenting the security zones on a Palo Alto Networks firewall. The firewall has an interface connected to the public internet and another connected to a DMZ hosting a web server. Which zone type should be assigned to the interface facing the public internet to apply the strictest default posture?
An administrator is configuring a Palo Alto Networks firewall to provide secure remote access for employees. The requirement is to allow employees to connect to the corporate network from home using a client that establishes an encrypted tunnel to the firewall. Which feature should the administrator configure?
A security administrator is configuring a Palo Alto Networks firewall to protect against brute force attacks on the management interface. The administrator wants to limit the number of failed login attempts and automatically block the source IP after a threshold is reached. Which configuration should be implemented?
A security administrator is configuring a NAT policy on a Palo Alto Networks firewall. Internal users in the 10.1.1.0/24 subnet need to access the internet, but the organization has only a single public IP address, 203.0.113.5, on the untrusted interface. The administrator wants all internal users to share this public IP address when accessing external resources. Which NAT type should the administrator configure?
A network security engineer is configuring a Palo Alto Networks firewall to prevent users from accessing known malicious websites. The engineer wants to ensure that the firewall blocks access based on a dynamically updated list of malicious URLs and IP addresses. Which feature should be configured to achieve this?
A security operations analyst is investigating asymmetric routing through a Palo Alto Networks firewall. Return traffic from an external server arrives on a different interface than the interface that forwarded the original outbound request. Which firewall behavior should the analyst expect to see, and what is the appropriate mitigation?
A network administrator is configuring a Palo Alto Networks firewall to prevent TCP SYN flood attacks. The administrator wants to limit the number of half-open connections from a single source IP address to a specific destination. Which feature should the administrator configure?
A security architect is designing a network segmentation strategy using Palo Alto Networks firewalls. The design must limit lateral movement and enforce least privilege between internal tiers. Which TWO practices support this goal? (Choose two.)
A network security team is deploying a Palo Alto Networks firewall in Layer 2 mode between two internal segments. Users report that ARP resolution works but traffic between the segments is silently discarded. Which configuration element most likely explains why the traffic is dropped despite correct Layer 2 forwarding?
A network security engineer is configuring a Palo Alto Networks firewall to protect against SYN flood attacks. The engineer wants to limit the number of half-open connections from a single source IP address to 100 per second. Which feature should be configured to achieve this?
A network administrator is configuring a Palo Alto Networks firewall to allow DNS traffic from the trust zone to the untrust zone. The administrator wants to ensure that only DNS queries to specific external DNS servers are allowed, and that all other DNS traffic is blocked. Which configuration should be used?