A network engineer needs to monitor traffic between two zones using a specific interface. Which feature must be enabled to view application-level traffic details without affecting the traffic flow?
A firewall is experiencing high CPU usage on the management plane. Which command can identify if specific logging tasks are consuming excessive resources?
When using OSPF with a Palo Alto Networks firewall, which area type would you configure to ensure the firewall does not receive external routing information while still maintaining connectivity to the backbone?
You are troubleshooting a scenario where internal users cannot access an external server. The traffic log shows the traffic is 'allowed', but the byte count is 0. What is the most likely cause?
A NetSec-Pro administrator has deployed a Palo Alto Networks firewall with two ISP links and wants to ensure that outbound web traffic fails over to the secondary ISP only when the primary path's latency exceeds 200 ms, while preserving existing sessions during the transition. Which configuration should the administrator implement?
A network security engineer is configuring a Policy-Based Forwarding (PBF) rule to redirect HTTP traffic from the guest VLAN to a web proxy. After committing, the engineer notices that the traffic is still following the default route to the internet. The PBF rule is enabled, and the source zone and source address are correct. What is the most likely reason the PBF rule is not being matched?
A security engineer is configuring a Site-to-Site VPN between two Palo Alto Networks firewalls. After committing the configuration, the tunnel status shows 'red' and no traffic passes. The engineer confirms that the IKE Phase 1 and Phase 2 settings match on both peers. Which additional configuration is required on both firewalls to allow the tunnel to establish?
A network security engineer is configuring a Palo Alto Networks firewall to enforce security profiles on decrypted traffic. After applying a Decryption policy, the engineer notices that the firewall is not decrypting traffic to a specific website because the certificate is signed by an untrusted CA. The engineer wants to allow decryption while avoiding certificate errors for users. What should the engineer configure?
An administrator is configuring a Security Profile Group to apply to a security policy rule. The goal is to inspect traffic for threats and block malicious files. Which TWO security profiles are mandatory to include in the group to achieve this? (Choose two.)
A network security engineer is configuring a Site-to-Site VPN between a Palo Alto Networks firewall and a third-party VPN gateway. The engineer wants to ensure that the tunnel interface is included in the routing table so that traffic destined for the remote network is routed correctly. Which action must the engineer take?
A security administrator is configuring a new security policy on a Palo Alto Networks firewall. The administrator wants to ensure that the policy only allows traffic from the 'Trust' zone to the 'Untrust' zone for web browsing (HTTP and HTTPS) and blocks all other applications. Which type of security policy rule should the administrator create?
A security administrator is configuring a Site-to-Site VPN between two Palo Alto Networks firewalls. The administrator needs to ensure that the tunnel interface is included in the routing table so that traffic destined for the remote network is routed through the VPN tunnel. Which two configurations are required to achieve this? (Choose two.)
An administrator is configuring a GlobalProtect portal and wants to ensure that users are authenticated using a certificate before they can download the GlobalProtect agent. Which setting should be configured in the portal?
A network engineer is configuring a Palo Alto Networks firewall to route traffic between two virtual routers. The engineer wants to ensure that if one virtual router fails, traffic is automatically rerouted through the other. Which feature should be configured to achieve this?
An administrator notices intermittent packet loss in a GlobalProtect deployment where users connect via IPv6. Which configuration change is likely to resolve the issue if MTU fragmentation is suspected?
When troubleshooting a BGP peering issue between a Palo Alto Networks firewall and an ISP, which log should be reviewed to see state changes and neighbor messages?
An administrator is configuring a Site-to-Site VPN and needs to ensure that the tunnel interface is included in the routing table. What must be done to ensure traffic can be routed across the tunnel?
A user is unable to access an application via GlobalProtect. The logs show the user is authenticated, but the session is reset. What should the administrator check first?
An administrator observes that traffic is being correctly identified by App-ID, but the firewall is not applying the expected security profile. What is the most likely reason?
An administrator notices that a firewall is not blocking traffic that matches a security profile group configured with anti-spyware and vulnerability protection. The traffic log shows the session is allowed, but no threat logs are generated. What is the most likely cause?
A security administrator is configuring a Site-to-Site VPN with a partner organization. The partner uses a policy-based VPN, while your organization uses a route-based VPN with a tunnel interface. The tunnel is up, but traffic is not passing. The administrator confirms that the proxy IDs match on both sides. What is the most likely cause of the issue?
An engineer is deploying a new Palo Alto Networks firewall and needs to enable DNS sinkholing for malware command-and-control domains. The firewall must respond to internal clients with a sinkhole IP address when they query known malicious domains. Which configuration step is required to make the firewall perform DNS sinkholing?
A network security engineer is configuring a Palo Alto Networks firewall to inspect traffic between two internal zones. The engineer wants to ensure that the firewall performs application identification and applies security profiles to the traffic. The traffic is currently being allowed by a security policy, but no security profiles are being applied. What is the most likely cause?
A security administrator is troubleshooting why a user's GlobalProtect connection is failing. The user can authenticate successfully, but the GlobalProtect client shows 'Connected' yet cannot access internal resources. The administrator checks the GlobalProtect Gateway configuration and sees that the tunnel interface is configured with an IP address and the client IP pool is set. What is the most likely cause of the issue?
A network engineer is setting up a new Security Zone on a Palo Alto Networks firewall. The engineer wants to ensure that traffic entering this zone from any other zone is denied by default. Which action should be taken?
A network administrator is configuring a Site-to-Site VPN between two Palo Alto Networks firewalls. The administrator notices that the VPN tunnel is up, but traffic is not passing through it. The administrator checks the routing table and sees that the route to the remote network is pointing to the tunnel interface. What is the most likely reason for the traffic not passing?
A network administrator is troubleshooting a Palo Alto Networks firewall and needs to verify which security policy rule is allowing or denying a specific session. The administrator wants to see the rule name and the action taken for a particular flow. Which CLI command should be used?
A security engineer is configuring GlobalProtect on a Palo Alto Networks firewall. The engineer wants to ensure that users are authenticated before they can access internal resources. The engineer has configured the GlobalProtect portal and gateway, but users are able to connect without providing credentials. What is the most likely cause?
A network administrator is deploying a new Palo Alto Networks firewall in a data center. The security policy requires that all traffic to the DMZ be inspected for threats, but the administrator wants to ensure that SSL encrypted traffic is decrypted and inspected without breaking applications that use certificate pinning. Which feature should the administrator configure to selectively decrypt traffic based on the destination URL category?
A security administrator is configuring a Site-to-Site VPN between two Palo Alto Networks firewalls. The administrator wants to ensure that the VPN tunnel is established and that traffic is routed correctly. Which interface type should be used for the tunnel interface to allow dynamic routing protocols to run over the VPN?
A security administrator is investigating a suspected data exfiltration incident. The administrator needs to identify which user account uploaded a large file to an external cloud storage service. Which log type should the administrator examine to find the username associated with the upload?