Connectivity And Security

An administrator notices intermittent packet loss in a GlobalProtect deployment where users connect via IPv6. Which configuration change is likely to resolve the issue if MTU fragmentation is suspected?

An administrator wants to use DHCP to assign IP addresses to GlobalProtect clients. Where is this setting configured?

Which CLI command is most effective for verifying if a specific packet is being blocked by a security policy in real-time?

When troubleshooting a BGP peering issue between a Palo Alto Networks firewall and an ISP, which log should be reviewed to see state changes and neighbor messages?

An administrator is configuring a Site-to-Site VPN and needs to ensure that the tunnel interface is included in the routing table. What must be done to ensure traffic can be routed across the tunnel?

Which log type should be filtered if you are searching for specific firewall configuration changes made by an administrator?

A user is unable to access an application via GlobalProtect. The logs show the user is authenticated, but the session is reset. What should the administrator check first?

An administrator needs to restrict access to a specific internal server to only one remote VPN user. What is the most secure method?

An administrator observes that traffic is being correctly identified by App-ID, but the firewall is not applying the expected security profile. What is the most likely reason?

When troubleshooting a site-to-site VPN that is stuck in 'INIT' status, what is the most likely cause?

An administrator is implementing PBF (Policy Based Forwarding). What is a requirement for PBF to function correctly?

What is the result of having two security policies with the same source, destination, and service, but different applications?

Which object type allows you to group multiple IP addresses into a single entity for use in security policies?

Which TWO of the following steps are required to implement a successful Site-to-Site VPN with a third-party vendor?

Which feature would you use to verify that a specific interface is properly connected to the upstream ISP?

Which THREE tasks are performed by the Dataplane during traffic processing?

Which THREE items must be verified when troubleshooting traffic that is not being correctly identified as the intended application?

Which THREE criteria can be used to define a security policy for granular control?

Which TWO methods can be used to ensure the firewall has the latest threat intelligence for blocking malicious traffic?

Which TWO logs are essential when troubleshooting a user who cannot connect to the internet?

Which THREE components are involved in configuring an IKE Gateway for a VPN?

An administrator notices that a firewall is not blocking traffic that matches a security profile group configured with anti-spyware and vulnerability protection. The traffic log shows the session is allowed, but no threat logs are generated. What is the most likely cause?

A security administrator is configuring a Site-to-Site VPN with a partner organization. The partner uses a policy-based VPN, while your organization uses a route-based VPN with a tunnel interface. The tunnel is up, but traffic is not passing. The administrator confirms that the proxy IDs match on both sides. What is the most likely cause of the issue?

An engineer is deploying a new Palo Alto Networks firewall and needs to enable DNS sinkholing for malware command-and-control domains. The firewall must respond to internal clients with a sinkhole IP address when they query known malicious domains. Which configuration step is required to make the firewall perform DNS sinkholing?

A network security engineer is configuring a Palo Alto Networks firewall to inspect traffic between two internal zones. The engineer wants to ensure that the firewall performs application identification and applies security profiles to the traffic. The traffic is currently being allowed by a security policy, but no security profiles are being applied. What is the most likely cause?

A security administrator is troubleshooting why a user's GlobalProtect connection is failing. The user can authenticate successfully, but the GlobalProtect client shows 'Connected' yet cannot access internal resources. The administrator checks the GlobalProtect Gateway configuration and sees that the tunnel interface is configured with an IP address and the client IP pool is set. What is the most likely cause of the issue?

A network engineer is setting up a new Security Zone on a Palo Alto Networks firewall. The engineer wants to ensure that traffic entering this zone from any other zone is denied by default. Which action should be taken?

A network administrator is configuring a Site-to-Site VPN between two Palo Alto Networks firewalls. The administrator notices that the VPN tunnel is up, but traffic is not passing through it. The administrator checks the routing table and sees that the route to the remote network is pointing to the tunnel interface. What is the most likely reason for the traffic not passing?

A network administrator is troubleshooting a Palo Alto Networks firewall and needs to verify which security policy rule is allowing or denying a specific session. The administrator wants to see the rule name and the action taken for a particular flow. Which CLI command should be used?

A security engineer is configuring GlobalProtect on a Palo Alto Networks firewall. The engineer wants to ensure that users are authenticated before they can access internal resources. The engineer has configured the GlobalProtect portal and gateway, but users are able to connect without providing credentials. What is the most likely cause?

A network administrator is deploying a new Palo Alto Networks firewall in a data center. The security policy requires that all traffic to the DMZ be inspected for threats, but the administrator wants to ensure that SSL encrypted traffic is decrypted and inspected without breaking applications that use certificate pinning. Which feature should the administrator configure to selectively decrypt traffic based on the destination URL category?

A security administrator is configuring a Site-to-Site VPN between two Palo Alto Networks firewalls. The administrator wants to ensure that the VPN tunnel is established and that traffic is routed correctly. Which interface type should be used for the tunnel interface to allow dynamic routing protocols to run over the VPN?

A security administrator is investigating a suspected data exfiltration incident. The administrator needs to identify which user account uploaded a large file to an external cloud storage service. Which log type should the administrator examine to find the username associated with the upload?