Management And Operations

Where can an administrator view the current version of the App-ID database installed on a firewall?

An administrator wants to automate the deployment of security policy updates across 50 branch firewalls using Strata Cloud Manager. Which feature should they use?

Which menu path in the NGFW GUI allows an administrator to view the status of all active security subscriptions?

Which license is required to receive real-time updates for malicious file identification in the cloud?

An administrator needs to manage multiple NGFWs from a single interface using Strata Cloud Manager. Which task must be performed first to enable centralized policy management?

A firewall is reporting 'License Expired' for Threat Prevention. The administrator renewed the license in the Support Portal. What is the most likely cause for the warning to persist?

An administrator wants to schedule signature updates to occur at 3:00 AM daily. Where is this configured?

What is the primary purpose of a 'Device Group' in the context of SCM?

Which type of account is typically used to manage Palo Alto Networks assets in the Customer Support Portal?

An administrator attempts to commit configuration changes from SCM to a firewall, but the commit fails due to an 'invalid reference'. What is the most effective way to troubleshoot this?

When configuring a firewall for Strata Cloud Manager, which connectivity requirement must be met?

A security analyst is reviewing logs in SCM and realizes that logs from a specific firewall are missing. What is the most likely cause?

How does an administrator perform a software update on a standalone firewall?

Which section of the NGFW GUI allows an administrator to configure local administrative accounts?

What action should be taken before upgrading the PAN-OS version on a production firewall?

When configuring log forwarding, which protocol is recommended for secure, encrypted transmission of logs to an external collector?

An administrator wants to verify that a specific security policy rule is hitting traffic. Which tool should they use?

An administrator is using SCM to manage multiple firewalls. What happens when an administrator pushes a configuration that contains a duplicate object name?

When deploying a new firewall, why is it critical to synchronize the clock with an NTP server?

An administrator needs to identify which rule is blocking legitimate traffic. What is the most effective approach?

What is the primary function of a 'Service Route' in a Palo Alto Networks firewall?

An administrator wants to run a report on all traffic blocked by the 'Block_Bad_Sites' security rule. Which tool should they use?

How can an administrator ensure that only specific IP addresses can access the firewall management interface?

How can an administrator quickly determine if the firewall is experiencing high CPU usage?

An administrator is configuring a high-availability (HA) pair. Which step is essential to ensure consistent configuration across both firewalls?

An administrator wants to ensure that all administrative sessions are logged out after 30 minutes of inactivity. Where is this configured?

Which action in the web interface generates a configuration commit operation?

Which THREE pieces of information are displayed on the firewall Dashboard by default?

Which TWO of the following are benefits of using Strata Cloud Manager for enterprise firewall management?

What is the difference between 'Candidate Configuration' and 'Running Configuration'?

Which TWO items can be managed or configured within the Device > Setup > Services tab?

Which THREE items are required to successfully register a new firewall in the Customer Support Portal?

Which TWO conditions must be met to use the Panorama/SCM 'Push' functionality to a managed firewall?

Which THREE actions occur when a 'Commit' is executed on a firewall?

Which THREE types of dynamic updates are managed in the Device > Dynamic Updates menu?

Which TWO log types can be forwarded to an external collector from a Palo Alto firewall?

Which THREE criteria can be used to filter traffic logs in the Monitor tab?

Which TWO administrative roles are standard within a Palo Alto Networks firewall?

Which TWO ways can an administrator verify that a security subscription is active?

Which TWO pieces of information must an administrator provide when setting up a Log Forwarding profile?

Which THREE things can be done via the CLI to check the health of a firewall?

Which THREE resources should an administrator use to stay updated on security advisories and product changes?

Which THREE factors can impact the performance of a firewall during a log-intensive period?

An analyst at a regional bank must produce a monthly access report showing every user who connected to the internal CRM over the previous 30 days, along with their source IP addresses and the specific application used. The report must be generated without querying each firewall individually, and it must be retained for one year. Which action should the analyst take first?

A security operations team wants to ensure that firewall configuration changes are reviewed and approved before being committed to production devices. The team uses a change management workflow and needs an audit trail of who made each change and when. Which capability should be implemented to meet these requirements?

A security analyst is reviewing the firewall's log forwarding configuration. The analyst needs to ensure that all traffic logs are sent to an external syslog server in a specific format. Which of the following must be configured to achieve this?

A security operations team is preparing to enable automated threat intelligence sharing between their Palo Alto Networks firewall and a third-party SIEM. They plan to use the firewall's built-in integration capabilities. Which TWO components must be configured to allow the firewall to send logs to the SIEM? (Choose two.)

A network security administrator is configuring a new firewall and needs to ensure that management traffic uses a specific interface and next-hop. Which feature should the administrator configure?

A network security analyst is reviewing the firewall's log settings and notices that the firewall is sending logs to an external syslog server. The analyst wants to ensure that only logs for denied traffic are forwarded to reduce noise. Which configuration should the analyst modify?

A network security analyst is reviewing the firewall's logs and notices a high number of denied sessions from a specific internal IP address to various external destinations. The analyst wants to quickly identify the user associated with that IP address to determine if the activity is malicious. Which feature should the analyst use?

A security administrator is configuring a firewall to send alerts when the number of failed login attempts exceeds a threshold. The administrator wants to avoid alerting on failed logins from the internal vulnerability scanner, which regularly performs brute-force tests. Which configuration should the administrator use?

A network security administrator needs to give a junior analyst read-only visibility into traffic logs and threat logs on a production Palo Alto Networks firewall, but must ensure the analyst cannot change any configuration. Which built-in administrator role should be assigned?

A security team is implementing a new firewall rule that allows access to a critical application. They want to ensure that the rule is only active during business hours (9 AM to 5 PM) on weekdays. Which configuration element should they use to enforce this time restriction?

A NetSec-Analyst is reviewing the firewall's management plane configuration. The administrator wants to ensure that the firewall can be managed securely from the internal network only, while still allowing the firewall to reach external services like DNS and NTP for updates. Which management interface configuration should be used?

A security analyst is reviewing the firewall's configuration to ensure that all administrative changes are logged and can be traced back to the individual administrator. The analyst notices that all administrators are using the default 'admin' account. Which action should the analyst recommend to meet the requirement for accountability?

A security analyst is reviewing the firewall's operational logs and notices that the firewall is not sending SNMP traps to the monitoring server. The analyst verifies that the SNMP community string is correct and the server is reachable. Which TWO additional configurations should the analyst check on the firewall? (Choose two.)

A security operations team wants to retain firewall traffic logs for 180 days for compliance, but the on-box log storage only holds about 30 days. They want to keep logs searchable in the firewall's Logs viewer without adding external storage. Which action should the administrator take?

A network security analyst is reviewing the firewall's dashboard and notices that the 'Threat Prevention' license is about to expire in 30 days. The analyst needs to verify the current license status and expiry date for all subscriptions on the firewall. Which action should the analyst take?

A security analyst is investigating a potential data exfiltration incident. The analyst needs to determine which files were transferred out of the network and whether any contained sensitive information. Which Palo Alto Networks feature should the analyst use to identify file transfers and inspect their content?

A security analyst is investigating a potential breach. The analyst needs to correlate network traffic logs with threat logs to identify which internal host triggered a specific threat signature. Which Palo Alto Networks feature should be used to efficiently perform this correlation?

A security administrator needs to ensure that the firewall's configuration is backed up automatically every day and stored on an external server. The administrator wants to use the firewall's built-in capabilities without installing additional software. Which method should the administrator use?

A firewall administrator must back up the current configuration before applying a risky change. The administrator wants a backup that can be restored directly through the firewall's web interface and that includes all configuration settings. Which action should be taken?

A network security administrator is configuring a firewall to send alerts to an external SIEM when a critical threat is detected. The administrator wants to ensure that the alerts include the source and destination IP addresses, threat name, and severity. Which configuration step is necessary to achieve this?

A security administrator is configuring a new Palo Alto Networks firewall and needs to ensure that management traffic (such as SSH and HTTPS) is only accessible from the internal management network. The firewall has multiple interfaces, and the administrator wants to restrict management access to a specific interface. Which configuration step should the administrator take?

A security administrator is configuring a new firewall to integrate with an external LDAP server for user authentication. The administrator needs to ensure that user groups are correctly mapped for policy enforcement. Which TWO actions must be performed to enable group mapping? (Choose two.)

A network security administrator is configuring a new firewall and wants to ensure that administrative access is logged for auditing purposes. Which configuration should be enabled to log all management access attempts?

A security administrator needs to grant a new team member read-only access to the firewall's web interface to view security policies and logs, but not make any changes. Which default administrator role should be assigned?

A network security analyst is reviewing the firewall's configuration logs and notices that a recent commit changed the behavior of a security policy. The analyst wants to identify exactly which administrator made the change and what was modified. Which firewall feature should the analyst use?

A network security analyst is reviewing the firewall's Security Policy and notices that the 'Allow-Web' rule has 15,000 hits in the last 24 hours, while a rule named 'Deny-Telnet' has zero hits. The analyst wants to reduce clutter and improve performance. Which action is most appropriate according to security best practices?

A security analyst is reviewing firewall logs and notices that a specific internal host is generating a high volume of denied outbound connections to many external IP addresses on port 443. The analyst wants to quickly identify whether this host is compromised and what action to take. Which step should the analyst take first?

A security analyst is tasked with reviewing the firewall's logs to identify potential security incidents. The analyst needs to ensure that logs are being forwarded to an external SIEM for long-term retention and analysis. Which TWO actions must the analyst verify are configured correctly on the firewall? (Choose two.)

A security analyst is tasked with creating a report that shows the top application categories used by employees over the past week. The analyst needs to present this data to management. Which Palo Alto Networks feature provides this information with the least amount of manual effort?

A security operations team is planning to implement a new firewall rule that allows HTTP traffic from the guest network to an external web server. They want to ensure the rule is as specific as possible and adheres to the principle of least privilege. Which two additional parameters should they configure to restrict the rule? (Choose two.)

A security administrator needs to grant a new team member read-only access to the firewall's web interface for monitoring purposes. The administrator wants to ensure the team member can view configurations and logs but cannot make any changes. Which role should be assigned to the team member?

An administrator is configuring a Decryption policy on a Palo Alto Networks firewall. The policy must decrypt outbound SSL traffic to inspect for threats, but certain financial websites must be excluded from decryption to comply with privacy regulations. Which action should the administrator take?

A network security administrator is reviewing the firewall's licensing status and notices that the WildFire license is about to expire in 30 days. The administrator needs to ensure continuous WildFire analysis for submitted files. What is the most appropriate action to take?

A security analyst is asked to provide a report on the top applications used in the network over the past week. Which firewall feature should the analyst use to obtain this information?

A security analyst receives an alert that a critical server is communicating with a known malicious IP address. The analyst wants to block this traffic immediately without affecting other traffic. Which action should the analyst take?

A security analyst is reviewing the firewall's logs and notices a high number of 'session end' logs with reason 'policy-deny' for traffic from the internal network to an external IP. The analyst wants to determine if this is a security incident or misconfiguration. Which step should the analyst take first?

A network security administrator is managing a Palo Alto Networks NGFW in a high-security environment. The administrator needs to ensure that all administrative access to the firewall's web interface is encrypted and that administrators are authenticated using multi-factor authentication (MFA). The environment uses an external LDAP server for user credentials and a RADIUS server for MFA. Which configuration should the administrator implement to meet these requirements?

A security analyst is troubleshooting why the firewall is not generating a specific type of log. The analyst suspects that the log forwarding profile is not correctly attached to the security policy rule. Where in the PAN-OS web interface can the analyst verify which log forwarding profile is applied to a specific security rule?

A security analyst is reviewing the firewall's log settings and notices that logs are being stored locally on the firewall's disk. The analyst needs to ensure that logs are also sent to an external syslog server for long-term retention and analysis. Which configuration step is required to forward logs to a syslog server?

A security administrator is configuring a high-availability (HA) pair of firewalls. The administrator wants to ensure that if the active firewall fails, the passive firewall takes over with minimal disruption. Which HA configuration setting is critical to ensure that the passive firewall has the same session state as the active firewall?

A security analyst is reviewing the firewall's administrative accounts and wants to enforce the principle of least privilege. The analyst needs to create a custom administrative role that allows a user to view security policies and logs but not modify them. Which two permissions should be assigned to this custom role? (Choose two.)