A security analyst notices that the Threat Prevention subscription on a firewall is expired, but the firewall still has its previously downloaded signature database. Why might this happen?
An administrator is troubleshooting a synchronization issue between SCM and an on-premises firewall. Which log file is best for verifying communication between the two?
A security operations team wants to ensure that configuration changes on a Palo Alto Networks firewall are automatically backed up and that they can quickly roll back to a previous version if a change causes issues. They need to schedule automatic backups that include the complete configuration and device state. Which feature should they configure?
A security operations team wants to ensure that a critical change to a firewall's security policy is not accidentally left uncommitted after a maintenance window. They need to configure automatic commit reminders and enforce a commit after any configuration change. Which TWO settings or features should they use? (Choose two.)
A security operations team wants to automate the response to a specific threat: when a firewall detects a critical severity threat from an internal IP address, it should automatically add that IP to a dynamic block list and notify the team via Slack. Which Palo Alto Networks feature should be used to achieve this?
A security analyst is configuring a new firewall to send logs to an external syslog server. The analyst must ensure that logs are reliably delivered and that the firewall can continue to operate if the syslog server becomes unreachable. Which two actions should the analyst take? (Choose two.)
A security analyst notices that a firewall is dropping traffic from a specific internal subnet to an external server, even though a security policy exists to allow it. The analyst suspects that a policy-based forwarding (PBF) rule is redirecting the traffic. Which action should the analyst take to verify this?
A network security administrator is configuring a firewall to send logs to an external syslog server. The administrator wants to ensure that if the syslog server becomes unreachable, the firewall continues to log locally and does not drop traffic. Which configuration should be applied?
A security analyst at a financial institution needs to ensure that all administrative changes to the Palo Alto Networks NGFW are logged and can be audited. The compliance team requires that each configuration change be associated with the administrator who made it and the time it occurred. The analyst must also ensure that the logs are retained for at least one year. Which action should the analyst take to meet these requirements?
A network security administrator needs to ensure that only authorized administrators can access the firewall's management interface. The administrator wants to implement multi-factor authentication (MFA) for administrative logins. Which authentication method should be configured on the firewall to support MFA?
An administrator wants to automate the deployment of security policy updates across 50 branch firewalls using Strata Cloud Manager. Which feature should they use?
An administrator needs to manage multiple NGFWs from a single interface using Strata Cloud Manager. Which task must be performed first to enable centralized policy management?
A firewall is reporting 'License Expired' for Threat Prevention. The administrator renewed the license in the Support Portal. What is the most likely cause for the warning to persist?
An administrator attempts to commit configuration changes from SCM to a firewall, but the commit fails due to an 'invalid reference'. What is the most effective way to troubleshoot this?
An administrator is using SCM to manage multiple firewalls. What happens when an administrator pushes a configuration that contains a duplicate object name?
An analyst at a regional bank must produce a monthly access report showing every user who connected to the internal CRM over the previous 30 days, along with their source IP addresses and the specific application used. The report must be generated without querying each firewall individually, and it must be retained for one year. Which action should the analyst take first?
A security operations team wants to ensure that firewall configuration changes are reviewed and approved before being committed to production devices. The team uses a change management workflow and needs an audit trail of who made each change and when. Which capability should be implemented to meet these requirements?
A security analyst is reviewing the firewall's log forwarding configuration. The analyst needs to ensure that all traffic logs are sent to an external syslog server in a specific format. Which of the following must be configured to achieve this?
A security operations team is preparing to enable automated threat intelligence sharing between their Palo Alto Networks firewall and a third-party SIEM. They plan to use the firewall's built-in integration capabilities. Which TWO components must be configured to allow the firewall to send logs to the SIEM? (Choose two.)
A network security administrator is configuring a new firewall and needs to ensure that management traffic uses a specific interface and next-hop. Which feature should the administrator configure?
A network security analyst is reviewing the firewall's log settings and notices that the firewall is sending logs to an external syslog server. The analyst wants to ensure that only logs for denied traffic are forwarded to reduce noise. Which configuration should the analyst modify?
A network security analyst is reviewing the firewall's logs and notices a high number of denied sessions from a specific internal IP address to various external destinations. The analyst wants to quickly identify the user associated with that IP address to determine if the activity is malicious. Which feature should the analyst use?
A security administrator is configuring a firewall to send alerts when the number of failed login attempts exceeds a threshold. The administrator wants to avoid alerting on failed logins from the internal vulnerability scanner, which regularly performs brute-force tests. Which configuration should the administrator use?
A network security administrator needs to give a junior analyst read-only visibility into traffic logs and threat logs on a production Palo Alto Networks firewall, but must ensure the analyst cannot change any configuration. Which built-in administrator role should be assigned?
A security team is implementing a new firewall rule that allows access to a critical application. They want to ensure that the rule is only active during business hours (9 AM to 5 PM) on weekdays. Which configuration element should they use to enforce this time restriction?
A NetSec-Analyst is reviewing the firewall's management plane configuration. The administrator wants to ensure that the firewall can be managed securely from the internal network only, while still allowing the firewall to reach external services like DNS and NTP for updates. Which management interface configuration should be used?
A security analyst is reviewing the firewall's configuration to ensure that all administrative changes are logged and can be traced back to the individual administrator. The analyst notices that all administrators are using the default 'admin' account. Which action should the analyst recommend to meet the requirement for accountability?
A security analyst is reviewing the firewall's operational logs and notices that the firewall is not sending SNMP traps to the monitoring server. The analyst verifies that the SNMP community string is correct and the server is reachable. Which TWO additional configurations should the analyst check on the firewall? (Choose two.)
A security operations team wants to retain firewall traffic logs for 180 days for compliance, but the on-box log storage only holds about 30 days. They want to keep logs searchable in the firewall's Logs viewer without adding external storage. Which action should the administrator take?
A network security analyst is reviewing the firewall's dashboard and notices that the 'Threat Prevention' license is about to expire in 30 days. The analyst needs to verify the current license status and expiry date for all subscriptions on the firewall. Which action should the analyst take?
A security analyst is investigating a potential data exfiltration incident. The analyst needs to determine which files were transferred out of the network and whether any contained sensitive information. Which Palo Alto Networks feature should the analyst use to identify file transfers and inspect their content?
A security analyst is investigating a potential breach. The analyst needs to correlate network traffic logs with threat logs to identify which internal host triggered a specific threat signature. Which Palo Alto Networks feature should be used to efficiently perform this correlation?
A security administrator needs to ensure that the firewall's configuration is backed up automatically every day and stored on an external server. The administrator wants to use the firewall's built-in capabilities without installing additional software. Which method should the administrator use?
A firewall administrator must back up the current configuration before applying a risky change. The administrator wants a backup that can be restored directly through the firewall's web interface and that includes all configuration settings. Which action should be taken?
A network security administrator is configuring a firewall to send alerts to an external SIEM when a critical threat is detected. The administrator wants to ensure that the alerts include the source and destination IP addresses, threat name, and severity. Which configuration step is necessary to achieve this?
A security administrator is configuring a new Palo Alto Networks firewall and needs to ensure that management traffic (such as SSH and HTTPS) is only accessible from the internal management network. The firewall has multiple interfaces, and the administrator wants to restrict management access to a specific interface. Which configuration step should the administrator take?
A security administrator is configuring a new firewall to integrate with an external LDAP server for user authentication. The administrator needs to ensure that user groups are correctly mapped for policy enforcement. Which TWO actions must be performed to enable group mapping? (Choose two.)
A network security administrator is configuring a new firewall and wants to ensure that administrative access is logged for auditing purposes. Which configuration should be enabled to log all management access attempts?
A security administrator needs to grant a new team member read-only access to the firewall's web interface to view security policies and logs, but not make any changes. Which default administrator role should be assigned?
A network security analyst is reviewing the firewall's configuration logs and notices that a recent commit changed the behavior of a security policy. The analyst wants to identify exactly which administrator made the change and what was modified. Which firewall feature should the analyst use?
A network security analyst is reviewing the firewall's Security Policy and notices that the 'Allow-Web' rule has 15,000 hits in the last 24 hours, while a rule named 'Deny-Telnet' has zero hits. The analyst wants to reduce clutter and improve performance. Which action is most appropriate according to security best practices?
A security analyst is reviewing firewall logs and notices that a specific internal host is generating a high volume of denied outbound connections to many external IP addresses on port 443. The analyst wants to quickly identify whether this host is compromised and what action to take. Which step should the analyst take first?
A security analyst is tasked with reviewing the firewall's logs to identify potential security incidents. The analyst needs to ensure that logs are being forwarded to an external SIEM for long-term retention and analysis. Which TWO actions must the analyst verify are configured correctly on the firewall? (Choose two.)
A security analyst is tasked with creating a report that shows the top application categories used by employees over the past week. The analyst needs to present this data to management. Which Palo Alto Networks feature provides this information with the least amount of manual effort?
A security operations team is planning to implement a new firewall rule that allows HTTP traffic from the guest network to an external web server. They want to ensure the rule is as specific as possible and adheres to the principle of least privilege. Which two additional parameters should they configure to restrict the rule? (Choose two.)
A security administrator needs to grant a new team member read-only access to the firewall's web interface for monitoring purposes. The administrator wants to ensure the team member can view configurations and logs but cannot make any changes. Which role should be assigned to the team member?
An administrator is configuring a Decryption policy on a Palo Alto Networks firewall. The policy must decrypt outbound SSL traffic to inspect for threats, but certain financial websites must be excluded from decryption to comply with privacy regulations. Which action should the administrator take?
A network security administrator is reviewing the firewall's licensing status and notices that the WildFire license is about to expire in 30 days. The administrator needs to ensure continuous WildFire analysis for submitted files. What is the most appropriate action to take?
A security analyst is asked to provide a report on the top applications used in the network over the past week. Which firewall feature should the analyst use to obtain this information?
A security analyst receives an alert that a critical server is communicating with a known malicious IP address. The analyst wants to block this traffic immediately without affecting other traffic. Which action should the analyst take?
A security analyst is reviewing the firewall's logs and notices a high number of 'session end' logs with reason 'policy-deny' for traffic from the internal network to an external IP. The analyst wants to determine if this is a security incident or misconfiguration. Which step should the analyst take first?
A network security administrator is managing a Palo Alto Networks NGFW in a high-security environment. The administrator needs to ensure that all administrative access to the firewall's web interface is encrypted and that administrators are authenticated using multi-factor authentication (MFA). The environment uses an external LDAP server for user credentials and a RADIUS server for MFA. Which configuration should the administrator implement to meet these requirements?
A security analyst is troubleshooting why the firewall is not generating a specific type of log. The analyst suspects that the log forwarding profile is not correctly attached to the security policy rule. Where in the PAN-OS web interface can the analyst verify which log forwarding profile is applied to a specific security rule?
A security analyst is reviewing the firewall's log settings and notices that logs are being stored locally on the firewall's disk. The analyst needs to ensure that logs are also sent to an external syslog server for long-term retention and analysis. Which configuration step is required to forward logs to a syslog server?
A security administrator is configuring a high-availability (HA) pair of firewalls. The administrator wants to ensure that if the active firewall fails, the passive firewall takes over with minimal disruption. Which HA configuration setting is critical to ensure that the passive firewall has the same session state as the active firewall?
A security analyst is reviewing the firewall's administrative accounts and wants to enforce the principle of least privilege. The analyst needs to create a custom administrative role that allows a user to view security policies and logs but not modify them. Which two permissions should be assigned to this custom role? (Choose two.)