Policy Creation And Application

Which TWO methods can be used to identify traffic using App-ID when port-based rules are insufficient?

An administrator needs to allow traffic from the internal network to a public web server using Source NAT. Which configuration is required to ensure the internal client IP is translated to the firewall's public interface IP?

You are designing a QoS policy. You want to prioritize VoIP traffic over bulk file transfers. Which component must you create to classify the VoIP traffic?

Which THREE steps are required to correctly implement User-ID mapping using the Windows-based User-ID agent?

When configuring a QoS policy, what is the first step the administrator must take to ensure the traffic is correctly prioritized?

You are configuring a Security policy to allow web traffic. Why should you place the most specific rules at the top of the Security policy list?

Which TWO settings must be correctly configured to ensure User-ID can properly map an IP address to a user identity in a multi-site environment?

A user is unable to access a web application. The security policy log shows the traffic is hitting the default 'deny' rule. What is the most effective way to troubleshoot the App-ID identification?

An administrator configured a security policy with an App-ID of 'web-browsing' and 'ssl', but users cannot access a specific internal portal. The logs show 'ssl' and 'web-browsing' are matched, but the session is dropped. What is the likely cause?

An administrator wants to ensure that all internal traffic to the internet is encrypted. Which policy type would be used to enforce this?

Which THREE conditions must be met for a NAT policy to be successfully applied to an incoming packet?

Which TWO options describe valid ways to handle traffic that is identified as 'unknown-tcp' in a security policy?

When creating a NAT policy, which field defines the address that the traffic will be translated to on the destination side?

What is the function of an 'Application Group' in PAN-OS policy creation?

Which component is required to enable User-ID integration with Microsoft Active Directory using the Windows-based User-ID Agent?

An administrator notices that some traffic is not hitting the desired QoS policy. What is the most likely reason?

Which tab in the Palo Alto Networks GUI is primarily used to manage Security and NAT policies?

Which THREE items can be used as a match criterion in a Security Policy?

A policy rule is configured for 'web-browsing' and 'ssl', but the traffic is being dropped. The logs indicate the application is 'google-base'. What is the most appropriate fix?

If an administrator wants to ensure that a specific server can only be accessed from a specific internal subnet, where is this best configured?

Which configuration menu allows you to define an address object?

An administrator needs to perform NAT for a server that is in a DMZ but accessed via the public internet. Which NAT rule type is used for this?

Which THREE features are associated with an 'Application Filter'?

Which TWO items must be matched in a QoS policy?

Which THREE components are required for an Application Override policy?

An administrator wants to permit traffic based on a specific User-ID group. Where should this group be referenced in the Security Policy?

What is the purpose of the 'Service' field in a Security Policy?

When configuring App-ID, how does the firewall identify traffic?

An organization has a strict requirement that all web traffic must be inspected. Which policy is required in addition to the Security policy to achieve this?

What is the result of applying a 'Log at Session End' setting in a security policy?

Which THREE criteria are used to determine which security policy rule a packet matches?

Which object type should be used when you want to group several address objects together?

An administrator wants to prioritize VoIP traffic over all other traffic. Which policy type is the best choice?

Which THREE settings must be configured to allow inbound NAT traffic for a web server?

What is the purpose of the 'Zone' in a Palo Alto Networks firewall?

Which TWO of the following are valid source types for a Security Policy?

Which THREE items are required for a valid QoS policy match?

What happens if a packet matches multiple security policies?

If an administrator creates an Application Override policy, what impact does it have on security inspection?

Which of the following is the most efficient way to manage NAT policies for multiple similar servers?

Which TWO items are considered 'Objects' in the PAN-OS environment?

Which THREE actions can be applied to a Security Policy rule?

What is the purpose of the 'Policy Optimizer' feature?

Why might an Application Override policy be preferred over a Security Policy for a specific custom application?

Which configuration setting in a security policy rule is responsible for matching users based on their active directory group?

When you use an Application Group in a policy, what happens if you add a new application to that group?

Which THREE requirements must be met to enable User-ID integration with Microsoft Active Directory?

Which tab would you use to add a new Security policy rule?

Which of the following describes an 'Address Object'?

What is the primary difference between a 'Service' object and an 'App-ID' in a security policy?

A user is accessing an application, but the traffic is logged as 'unknown-udp'. What is the recommended way to secure this without allowing all UDP traffic?