NGFW And SASE Solution Functionality

You have a Security Policy rule allowing 'web-browsing' and 'ssl'. A user cannot access a specific site, and the logs show the traffic as 'web-browsing' but failing a specific Security Profile. Which action is most appropriate?

You are troubleshooting a performance issue in Prisma Access. Users report slow access to SaaS applications. You suspect the issue is related to the path selection. Which tool should you use to analyze the latency between the user's mobile client and the Service Connection?

When using User-ID with Active Directory, what is the primary purpose of the User-ID Agent?

Which Content-ID component specifically prevents the exfiltration of sensitive data like credit card numbers?

What is the effect of setting a Security Policy rule action to 'Drop' versus 'Reset-Both'?

You are configuring App-ID for an application that uses non-standard ports. You have created a custom application object, but the traffic is still being identified as 'incomplete'. What is the most likely reason?

What happens when a security policy rule is set to 'Log at Session End'?

An administrator wants to categorize traffic based on the 'Server' role in the network. Which feature should be used to tag this traffic for policy grouping?

If a packet matches a Security Policy rule, but the application is not identified yet, what action does the firewall take?

Which NGFW feature allows for the inspection of files for malicious content based on signatures and heuristic analysis?

When configuring SSL Forward Proxy, which step is mandatory for the firewall to successfully inspect encrypted traffic?

You are configuring a 'Strict' security profile for a web server. Which profile action is best suited to block known exploit patterns while allowing the traffic?

Which command is used to display the current User-ID mapping information on the CLI?

You are setting up an SSL Decryption policy. If you want to exclude traffic to financial websites to comply with privacy laws, how do you configure it?

You need to ensure that traffic between two internal zones is inspected for threats. What must be configured on the Security Policy?

In Prisma Access, what is the role of the 'Compute Location' setting?

You are configuring an SD-WAN path for a branch office. Which metric does the firewall use to determine the best path when multiple paths are available?

Which TWO of the following are valid log types available on the Palo Alto Networks firewall?

Which TWO of the following are valid methods for mapping IP addresses to usernames in a Palo Alto Networks NGFW?

Which action in a Security Profile allows you to permit traffic but generate an alert in the logs?

Which TWO of the following are benefits of using App-ID over port-based security policies?

Which THREE of the following are considered 'App-ID' identification techniques?

Which THREE components are involved in the Prisma Access architecture for protecting mobile users?

Which THREE of the following are actions that can be taken when a file is detected by a File Blocking Profile?

Which TWO of the following are features of Content-ID?

Which THREE of the following are settings that can be configured in a URL Filtering profile?

Which THREE of the following items are required to successfully deploy a Prisma Access Service Connection?

A NetSec-Pro administrator is configuring a Palo Alto Networks NGFW for a SASE deployment. Remote users connect through Prisma Access, and the security team wants to enforce consistent security policies that inspect traffic based on application identity rather than just port and protocol. The administrator needs to ensure that the firewall can identify applications even when they use non-standard ports or encryption. Which Palo Alto Networks technology should the administrator rely on to achieve this?

A security analyst is reviewing logs and notices that a user's traffic to a known malicious domain is being allowed. The analyst checks the URL Filtering profile and sees that the domain is categorized as 'malware' and the action is set to 'alert'. The analyst wants to block this traffic immediately. What should the analyst change in the URL Filtering profile?

A security administrator is deploying Prisma Access for mobile users and needs to ensure that traffic from remote users is inspected for threats and sensitive data. The administrator wants to leverage the Prisma Access architecture to apply security policies consistently. Which TWO of the following components are essential for enforcing security policies on mobile user traffic in Prisma Access? (Choose two.)

A network security engineer is configuring a Security Policy rule on a Palo Alto Networks NGFW. The engineer wants to allow traffic but generate an alert in the logs for auditing purposes. Which action should be selected in the Security Policy rule?

A NetSec-Pro administrator is configuring a Security Policy rule to allow HTTP traffic from the Trust zone to the Untrust zone. The administrator wants to ensure that the firewall identifies the application as web-browsing regardless of the port used. Which Security Policy rule component should be used to achieve this requirement?

A security administrator is deploying Prisma Access for a branch office. The branch office needs to access internal applications hosted in the corporate data center. Which Prisma Access component should be configured to enable this connectivity?

A security administrator is deploying Prisma Access for mobile users. The administrator wants to ensure that traffic from mobile users is inspected for threats and that access to certain applications is controlled based on user identity. Which component of Prisma Access is responsible for enforcing security policies and inspecting traffic?

A security engineer is deploying a SASE solution to protect remote users accessing SaaS applications. The engineer needs to ensure that traffic from remote users is inspected for threats and that access to sanctioned SaaS applications is controlled based on user identity. Which SASE component should the engineer configure to achieve these goals?

A security engineer is configuring a Security Policy rule on a Palo Alto Networks NGFW to block traffic and send a TCP reset to both the client and server. Which action should be selected?

A NetSec-Pro administrator is configuring a Security Profile to block malicious files. The administrator wants to ensure that files are analyzed for zero-day exploits and that a verdict is returned to the firewall to block malicious files. Which Palo Alto Networks service should be enabled to achieve this?

A security administrator is configuring a Security Policy rule to allow web traffic but wants to ensure that users cannot download executable files. The administrator decides to attach a File Blocking profile to the rule. Which action should be set in the File Blocking profile to prevent the download of executable files while still allowing other file types?

A network security administrator is configuring a Security Policy rule to allow access to a specific SaaS application, but wants to block file uploads to that application. Which Palo Alto Networks feature should the administrator use to achieve this granular control?

A network security engineer is configuring a Security Policy rule to allow access to a specific SaaS application but wants to enforce data loss prevention by blocking the upload of files containing credit card numbers. The engineer also wants to ensure that the application is identified correctly even if it uses non-standard ports. Which two Palo Alto Networks features should be used together to achieve these goals? (Choose two.)

A company is deploying Prisma Access for remote users. The security team wants to ensure that all traffic from remote users is inspected by the full security stack, including threat prevention and URL filtering, while also providing optimal performance for SaaS applications. Which two components are required to achieve this? (Choose two.)

A network security engineer is troubleshooting a Security policy rule that is supposed to block traffic to a known malicious IP address. The rule is configured with the action 'deny' and is placed at the top of the rulebase. However, traffic to that IP is still being allowed. What is the most likely cause?

A security team is deploying Prisma Access for remote users and wants to ensure that traffic to sanctioned SaaS applications is inspected for data loss while traffic to unsanctioned SaaS is blocked. They also need to apply different inspection profiles based on user group. Which combination of Prisma Access and NGFW features should they use to meet these requirements?

A multinational company uses Prisma Access to secure remote workers. They want to ensure that employees can access only approved SaaS applications and that any attempt to use unsanctioned SaaS is blocked and logged for compliance. They also need to apply different policies based on the user's department. Which Prisma Access feature should they use to enforce application-level access control with department-based granularity?

A network security engineer is deploying Prisma Access to secure remote workers. The engineer needs to ensure that traffic from remote users is inspected for threats and that access to SaaS applications is controlled based on user identity and device posture. Which two components are required to achieve these goals? (Choose two.)

A security administrator is configuring a Security Profile to protect against unknown threats. The administrator wants to ensure that files downloaded from the internet are analyzed for malicious behavior and that zero-day exploits are detected. Which Security Profile component should be configured?

A security administrator is troubleshooting why a Security policy rule that allows access to a specific SaaS application is not working for some users. The rule uses App-ID and User-ID, and the users are authenticated via GlobalProtect. The administrator notices that the rule matches for some users but not others, even though they are in the same User-ID group. What is the most likely cause?

A security administrator is configuring a Security Policy rule to allow access to a sanctioned SaaS application. The administrator wants to ensure that the rule only allows the specific SaaS application and not other applications that might use the same underlying protocol. Which App-ID characteristic should be used to achieve this?

A network administrator is configuring a Security Policy rule to block traffic from a specific IP address. The administrator wants to ensure that the rule is evaluated before other rules that might allow the traffic. What should be configured to achieve this?

A network security administrator is configuring a Security Policy rule to allow access to a web application. The rule includes the application 'web-browsing' and 'ssl'. Users report that they cannot access the application, and the traffic logs show the application as 'incomplete'. What is the most likely cause?