NetSec-Pro Platform Solutions Services And Tools — All Questions With Answers

Question 1mediummultiple choice

Read the full Platform Solutions Services And Tools explanation →

You are configuring a new license subscription for a firewall managed by Panorama. You want to automate the activation process using the Panorama web interface. Which menu path should you navigate to?

Question 2easymultiple choice

Read the full Platform Solutions Services And Tools explanation →

Which command is used on a Palo Alto Networks firewall to verify current license entitlements from the CLI?

Question 3hardmultiple choice

Read the full Platform Solutions Services And Tools explanation →

An administrator needs to enforce a consistent security policy across 50 branch firewalls using SCM. They want to ensure that any changes made at the local firewall level are overridden by SCM. Which setting must be configured?

Question 4hardmultiple choice

Read the full Platform Solutions Services And Tools explanation →

You need to perform a firmware upgrade on 100 firewalls via Panorama. You want to ensure the firewalls don't reboot simultaneously. How do you achieve this?

Question 5easymultiple choice

Read the full Platform Solutions Services And Tools explanation →

Which protocol does Panorama use to communicate with managed firewalls for configuration synchronization?

Question 6mediummultiple choice

Read the full Platform Solutions Services And Tools explanation →

You are migrating existing on-premises Panorama appliances to Strata Cloud Manager (SCM). After establishing connectivity, you notice that your device groups are not appearing in the SCM interface. Which action is required to resolve this?

Question 7hardmultiple choice

Read the full Platform Solutions Services And Tools explanation →

You are setting up a High Availability (HA) pair on two firewalls. How should you manage these devices in Panorama?

Question 8mediummultiple choice

Read the full Platform Solutions Services And Tools explanation →

You are using the 'Policy Optimizer' in Panorama to identify unused rules. After identifying a rule, what is the safest way to remove it?

Question 9mediummulti select

Read the full Platform Solutions Services And Tools explanation →

Which TWO actions are required to successfully onboard a new firewall to Strata Cloud Manager?

Question 10hardmulti select

Read the full Platform Solutions Services And Tools explanation →

Which THREE features are provided by the Strata Cloud Manager 'Subscription Management' interface?

Question 11mediummulti select

Read the full Platform Solutions Services And Tools explanation →

Which TWO methods can be used to monitor the status of a configuration push from Panorama?

Question 12hardmulti select

Read the full NAT/PAT explanation →

Which THREE components are critical to ensure that Panorama can successfully manage a firewall behind a NAT/Firewall?

Question 13mediummultiple choice

Read the full network assurance explanation →

A network security administrator is configuring a Palo Alto Networks firewall to send logs to an external syslog server. The firewall must include the source IP address of the original sender in the log messages. Which log forwarding profile setting should be configured?

Question 14mediummultiple choice

Read the full Platform Solutions Services And Tools explanation →

An administrator wants to create a custom compliance check in Strata Cloud Manager to ensure that all managed firewalls have a specific security profile group applied to their internet-facing security rules. After defining the check, the administrator needs to associate it with a rule that determines when the check is evaluated. Which SCM component must be configured to define the evaluation logic and severity?

Question 15easymultiple choice

Read the full Platform Solutions Services And Tools explanation →

A security administrator is deploying a new Palo Alto Networks firewall that will be managed by Strata Cloud Manager (SCM). The administrator wants to ensure the firewall can communicate with SCM and receive configuration updates. Which action must be performed on the firewall to enable this connectivity?

Question 16mediummultiple choice

Read the full Platform Solutions Services And Tools explanation →

An administrator has deployed a pair of NetSec-Pro appliances in an active/passive high availability configuration. They want to test a new security policy that blocks risky applications without affecting production traffic. The administrator decides to use the 'Policy Optimizer' feature within the NetSec-Pro management console. What is the primary function of Policy Optimizer in this context?

Question 17easymultiple choice

Read the full Platform Solutions Services And Tools explanation →

A network security administrator is using the Strata Cloud Manager CLI to automate the retrieval of a list of all managed firewalls. Which command should the administrator use?

Question 18mediummultiple choice

Read the full Platform Solutions Services And Tools explanation →

An administrator is using the Strata Cloud Manager (SCM) to manage security policies across multiple firewalls. They need to create a policy rule that will be applied to all firewalls in a specific region. Which SCM feature should they use to group firewalls for policy application?

Question 19hardmultiple choice

Read the full Platform Solutions Services And Tools explanation →

A security operations team wants to automatically block IP addresses that exceed a threshold of failed SSH login attempts on a monitored Linux server. They plan to use the firewall's XML API to add the offending IPs to a Dynamic Address Group. Which API request method and endpoint should they use to add an IP address to a registered DAG?

Question 20hardmulti select

Read the full Platform Solutions Services And Tools explanation →

An administrator is configuring Palo Alto Networks firewall to integrate with a SIEM using the Log Forwarding profile. The administrator wants to ensure that logs are forwarded in a structured format that is easily parsed by the SIEM. Which two log format options should be considered? (Choose two.)

Question 21hardmulti select

Read the full Platform Solutions Services And Tools explanation →

An administrator is using Strata Cloud Manager to manage a group of firewalls. They need to ensure that a specific security policy rule is applied only to firewalls in the 'Retail' region and not to those in the 'Corporate' region. The administrator creates a new security policy rule and wants to target it appropriately. Which two configuration elements must be used to achieve this scoping? (Choose two.)

Question 22mediummultiple choice

Read the full NAT/PAT explanation →

An administrator needs to configure a new Palo Alto Networks next-generation firewall that will be managed by Panorama. The firewall is located behind a NAT device and cannot be directly reached from the Panorama management server. The administrator wants the firewall to initiate the connection to Panorama for management. Which Panorama component should be configured to allow this?

Question 23mediummulti select

Read the full Platform Solutions Services And Tools explanation →

An administrator is configuring a new Strata Cloud Manager tenant and needs to integrate it with an external SIEM for log forwarding. The administrator wants to ensure that logs are forwarded in a secure and reliable manner. Which two actions should the administrator perform? (Choose two.)

Question 24hardmulti select

Read the full Platform Solutions Services And Tools explanation →

An administrator is deploying a new Palo Alto Networks next-generation firewall and wants to ensure that it can be managed by Panorama. The firewall is in a remote branch with a dynamic IP address. The administrator has configured the Panorama Management Server with a pre-shared key. Which two additional steps must be performed on the firewall to enable management by Panorama? (Choose two.)

Question 25mediummultiple choice

Read the full Platform Solutions Services And Tools explanation →

An administrator is using the Strata Cloud Manager CLI to apply a security policy to a specific firewall. The administrator runs the command 'scm set policy security --device <serial> --file policy.json' but receives an error that the device is not found. Which of the following is the most likely reason?

Question 26easymultiple choice

Read the full network assurance explanation →

A security administrator is configuring a Palo Alto Networks firewall to forward logs to an external syslog server. The administrator wants to ensure that logs are sent in a structured format that is easily parsed by the SIEM. Which log format should be selected?

Question 27mediummultiple choice

Read the full Platform Solutions Services And Tools explanation →

A NetSec-Pro administrator maintains a fleet of 12 Palo Alto Networks PA-3200 Series firewalls managed by on-premises Panorama. The security team wants to ensure that all firewalls have the latest Advanced Threat Prevention signatures without waiting for a scheduled content update. Which Panorama feature should the administrator use to immediately push the newest content version to all managed firewalls?

Question 28mediummulti select

Read the full network assurance explanation →

A NetSec-Pro administrator is configuring a new Palo Alto Networks firewall to send logs to an external syslog server for long-term retention. The administrator wants to ensure that only threat logs and traffic logs are forwarded, and that the logs are sent in a format that includes the firewall's hostname. Which two actions should the administrator take to meet these requirements? (Choose two.)

Question 29hardmultiple choice

Read the full Platform Solutions Services And Tools explanation →

You are troubleshooting a connectivity issue between an SCM-managed firewall and the SCM cloud service. Which log source in the firewall UI provides the most detailed information regarding the management connection?

Question 30mediummultiple choice

Read the full Platform Solutions Services And Tools explanation →

When using Panorama, an administrator wants to push policies to specific firewalls based on their geographical location. Which feature should be used?

Question 31hardmultiple choice

Read the full Platform Solutions Services And Tools explanation →

When migrating from Panorama to SCM, what happens to the existing log data stored on the Panorama appliance?

Question 32mediummultiple choice

Read the full Platform Solutions Services And Tools explanation →

An administrator is unable to push a configuration to a firewall managed by Panorama. The error message indicates a 'Template conflict'. What is the most likely cause?

Question 33mediummultiple choice

Read the full Platform Solutions Services And Tools explanation →

Which feature in Strata Cloud Manager allows you to verify that a configuration change complies with security best practices before it is pushed to devices?

Question 34easymultiple choice

Read the full Platform Solutions Services And Tools explanation →

Where do you generate a 'Device Deployment' token for adding a new firewall to Strata Cloud Manager?

Question 35easymultiple choice

Read the full Platform Solutions Services And Tools explanation →

Which tool in the Palo Alto Networks ecosystem is best suited for centralized visibility and reporting across an entire enterprise?

Question 36mediummultiple choice

Read the full Platform Solutions Services And Tools explanation →

You are configuring 'Log Forwarding' from Panorama to an external SIEM. Which object must you define in Panorama to facilitate this?

Question 37hardmultiple choice

Read the full Platform Solutions Services And Tools explanation →

You are troubleshooting an issue where a specific Threat Prevention profile is not applying correctly via Panorama. The setting is configured in a Template, but the firewall shows a different value. What should you check?

Question 38easymultiple choice

Read the full Platform Solutions Services And Tools explanation →

Which SCM feature allows you to view the health status of your entire global firewall deployment?

Question 39easymultiple choice

Read the full Platform Solutions Services And Tools explanation →

What is the primary function of the 'Panorama' context in the Web UI of a managed firewall?

Question 40hardmultiple choice

Read the full Platform Solutions Services And Tools explanation →

An administrator notices that the 'Commit' progress on Panorama hangs at 99%. What is the most effective way to troubleshoot this?

Question 41mediummultiple choice

Read the full Platform Solutions Services And Tools explanation →

You are using SCM to manage firewall policies. You want to audit who made a specific change to a security policy rule. Which feature should you use?

Question 42mediummultiple choice

Read the full Platform Solutions Services And Tools explanation →

You need to create a global address object that is available to all firewalls managed by Panorama. Where should you define this?

Question 43easymultiple choice

Read the full Platform Solutions Services And Tools explanation →

When a firewall is managed by Panorama, where is the authoritative configuration stored?

Question 44hardmultiple choice

Read the full Platform Solutions Services And Tools explanation →

You are managing firewalls across multiple time zones using Panorama. Where do you configure the time zone for the managed firewalls?

Question 45hardmulti select

Read the full Platform Solutions Services And Tools explanation →

Which THREE types of information are contained in the Panorama 'Device Health' report?

Question 46mediummulti select

Read the full Platform Solutions Services And Tools explanation →

Which THREE configuration elements are commonly managed via Panorama Templates?

Question 47hardmulti select

Read the full Platform Solutions Services And Tools explanation →

Which TWO factors contribute to 'Configuration Drift' between a firewall and Panorama?

Question 48mediummulti select

Read the full Platform Solutions Services And Tools explanation →

Which TWO steps are involved in the process of replacing a failed firewall that is managed by Panorama?

Question 49hardmulti select

Read the full Platform Solutions Services And Tools explanation →

Which THREE items are included in a Panorama configuration 'Export'?

Question 50mediummulti select

Read the full Platform Solutions Services And Tools explanation →

Which TWO actions should an administrator perform to prepare for a large-scale firmware upgrade across an enterprise using Panorama?

Question 51mediummulti select

Read the full Platform Solutions Services And Tools explanation →

Which TWO of the following are benefits of using Strata Cloud Manager over traditional on-premises Panorama?

Question 52mediummultiple choice

Read the full Platform Solutions Services And Tools explanation →

When managing multiple firewalls in Panorama, what is the best practice for handling software image updates?

Question 53hardmultiple choice

Read the full Platform Solutions Services And Tools explanation →

An administrator managing 200 Palo Alto Networks firewalls with Strata Cloud Manager needs to rapidly deploy a new decryption policy only to firewalls in the European branch offices, which are identified by the region tag 'EU'. The administrator wants to avoid manual per-firewall configuration and ensure the policy is applied consistently. Which SCM feature should the administrator use?

Question 54hardmultiple choice

Read the full Platform Solutions Services And Tools explanation →

A security engineer is using the Palo Alto Networks Expedition tool to migrate a configuration from a Cisco ASA firewall to a Palo Alto Networks firewall. After importing the ASA configuration, the engineer notices that some access control rules are not being translated correctly. What is the most likely cause?

Question 55easymultiple choice

Read the full Platform Solutions Services And Tools explanation →

A network security administrator needs to ensure that the Palo Alto Networks firewall can resolve domain names for security policy enforcement. Which service should be configured on the firewall?

Question 56easymultiple choice

Read the full Platform Solutions Services And Tools explanation →

A security administrator needs to allow the NetSec-Pro management plane to authenticate firewall administrators against the corporate Microsoft Active Directory. The AD servers are reachable only on the internal network. Which server profile type should the administrator configure on the firewall to meet this requirement?

Question 57mediummultiple choice

Read the full Platform Solutions Services And Tools explanation →

A security administrator is deploying a new Palo Alto Networks next-generation firewall in a remote branch office. The branch has limited on-site IT staff and no dedicated management server. The administrator wants to centrally manage this firewall, push security policies, and monitor traffic without deploying Panorama. Which Palo Alto Networks cloud-delivered service should be used?

Question 58hardmultiple choice

Read the full network assurance explanation →

A security engineer is configuring a NetSec-Pro appliance to forward logs to an external SIEM using syslog. The SIEM requires that logs be sent over TCP with TLS encryption for compliance. The engineer configures a syslog server profile with the SIEM's IP address and port 6514, and selects 'SSL' as the transport. However, the SIEM is not receiving any logs. Which of the following is the most likely cause of the failure?

Question 59hardmultiple choice

Read the full Platform Solutions Services And Tools explanation →

An administrator is using the Strata Cloud Manager API to programmatically create a security rule. The API request fails with a 400 Bad Request error. The administrator has verified that the authentication token is valid and the endpoint URL is correct. Which of the following is the most likely cause of the error?

Question 60easymultiple choice

Read the full Platform Solutions Services And Tools explanation →

A network administrator is configuring a NetSec-Pro firewall to send alerts to an external email server when a critical threat is detected. They navigate to the 'Log Settings' under the 'Device' tab and configure the email server profile. Which additional step is required to ensure that threat logs trigger email notifications?

Question 61mediummultiple choice

Read the full network assurance explanation →

A network security administrator is configuring a firewall to forward logs to an external syslog server. The syslog server uses a non-standard port and requires TCP for reliability. Which log forwarding destination configuration should the administrator use?

Question 62hardmultiple choice

Read the full Platform Solutions Services And Tools explanation →

A security operations team is using the NetSec-Pro 'Policy Optimizer' to review rule usage. They notice that a rule allowing 'any' application on port 80 has a high session count but no application identification. They want to safely transition this rule to a more secure, application-based rule. Which action should they take first according to best practices?

Question 63easymultiple choice

Read the full Platform Solutions Services And Tools explanation →

A network security engineer needs to verify that a newly created security policy in Strata Cloud Manager will not block critical business applications. The engineer wants to simulate the policy against recent traffic logs without enforcing it. Which Strata Cloud Manager feature should be used?

Question 64hardmultiple choice

Read the full Platform Solutions Services And Tools explanation →

A security engineer is using the firewall's REST API to retrieve the current list of all security rules in the 'vsys1' virtual system. The engineer wants to receive the response in JSON format. Which API request should be used?

Question 65hardmultiple choice

Read the full Platform Solutions Services And Tools explanation →

An administrator is using Strata Cloud Manager to manage a large number of firewalls. They need to generate a report that shows which security policy rules are unused across all managed firewalls over the past 90 days. The report should help identify rules that can be safely removed to improve performance. Which Strata Cloud Manager feature should be used?

Question 66mediummultiple choice

Read the full Platform Solutions Services And Tools explanation →

A security operations team is using Strata Cloud Manager to monitor firewall health. They want to receive alerts when a managed firewall's CPU utilization exceeds 80% for more than 10 minutes. Which Strata Cloud Manager capability should they configure?

Question 67mediummultiple choice

Read the full Platform Solutions Services And Tools explanation →

An administrator is using the Palo Alto Networks Expedition tool to migrate a configuration from a competitor firewall to a Palo Alto Networks firewall. After importing the competitor's configuration, the administrator notices that some rules are not being translated correctly. Which step should the administrator take to improve the translation accuracy?

Question 68hardmultiple choice

Read the full Platform Solutions Services And Tools explanation →

A network security administrator is using the Palo Alto Networks Best Practice Assessment (BPA) tool to evaluate the security posture of a firewall. The BPA report shows a low score in the 'Security Policy' category due to overly permissive rules. Which action should the administrator take to improve the score while maintaining necessary access?

Question 69hardmultiple choice

Read the full Platform Solutions Services And Tools explanation →

A NetSec-Pro administrator is using the Strata Cloud Manager API to automate the retrieval of security policy rule hit counts across multiple tenants. The API calls are failing with HTTP 403 errors. The administrator has verified that the API key is valid and has not expired. Which of the following is the most likely cause of the 403 errors?

Question 70easymultiple choice

Read the full network assurance explanation →

A NetSec-Pro administrator needs to verify that a newly configured security policy on a Palo Alto Networks firewall is correctly logging traffic to an external syslog server. The administrator has already configured the Log Forwarding profile and syslog server. Which tool in the firewall's web interface should the administrator use to view real-time logs and confirm that they are being forwarded?

Question 71mediummultiple choice

Read the full Platform Solutions Services And Tools explanation →

A NetSec-Pro administrator is using the Strata Cloud Manager to manage security policies across multiple tenants. The administrator wants to create a policy rule that applies to all tenants but with the ability to override it in a specific tenant if needed. Which Strata Cloud Manager feature should the administrator use to achieve this?

Question 1mediummultiple choice

Read the full Platform Solutions Services And Tools explanation →

You are configuring a new license subscription for a firewall managed by Panorama. You want to automate the activation process using the Panorama web interface. Which menu path should you navigate to?

Question 2easymultiple choice

Read the full Platform Solutions Services And Tools explanation →

Which command is used on a Palo Alto Networks firewall to verify current license entitlements from the CLI?

Question 3hardmultiple choice

Read the full Platform Solutions Services And Tools explanation →

An administrator needs to enforce a consistent security policy across 50 branch firewalls using SCM. They want to ensure that any changes made at the local firewall level are overridden by SCM. Which setting must be configured?

Question 4hardmultiple choice

Read the full Platform Solutions Services And Tools explanation →

You need to perform a firmware upgrade on 100 firewalls via Panorama. You want to ensure the firewalls don't reboot simultaneously. How do you achieve this?

Question 5easymultiple choice

Read the full Platform Solutions Services And Tools explanation →

Which protocol does Panorama use to communicate with managed firewalls for configuration synchronization?

Question 6mediummultiple choice

Read the full Platform Solutions Services And Tools explanation →

You are migrating existing on-premises Panorama appliances to Strata Cloud Manager (SCM). After establishing connectivity, you notice that your device groups are not appearing in the SCM interface. Which action is required to resolve this?

Question 7hardmultiple choice

Read the full Platform Solutions Services And Tools explanation →

You are setting up a High Availability (HA) pair on two firewalls. How should you manage these devices in Panorama?

Question 8mediummultiple choice

Read the full Platform Solutions Services And Tools explanation →

You are using the 'Policy Optimizer' in Panorama to identify unused rules. After identifying a rule, what is the safest way to remove it?

Question 9mediummulti select

Read the full Platform Solutions Services And Tools explanation →

Which TWO actions are required to successfully onboard a new firewall to Strata Cloud Manager?

Question 10hardmulti select

Read the full Platform Solutions Services And Tools explanation →

Which THREE features are provided by the Strata Cloud Manager 'Subscription Management' interface?

Question 11mediummulti select

Read the full Platform Solutions Services And Tools explanation →

Which TWO methods can be used to monitor the status of a configuration push from Panorama?

Question 12hardmulti select

Read the full NAT/PAT explanation →

Which THREE components are critical to ensure that Panorama can successfully manage a firewall behind a NAT/Firewall?

Question 13mediummultiple choice

Read the full network assurance explanation →

A network security administrator is configuring a Palo Alto Networks firewall to send logs to an external syslog server. The firewall must include the source IP address of the original sender in the log messages. Which log forwarding profile setting should be configured?

Question 14mediummultiple choice

Read the full Platform Solutions Services And Tools explanation →

An administrator wants to create a custom compliance check in Strata Cloud Manager to ensure that all managed firewalls have a specific security profile group applied to their internet-facing security rules. After defining the check, the administrator needs to associate it with a rule that determines when the check is evaluated. Which SCM component must be configured to define the evaluation logic and severity?

Question 15easymultiple choice

Read the full Platform Solutions Services And Tools explanation →

A security administrator is deploying a new Palo Alto Networks firewall that will be managed by Strata Cloud Manager (SCM). The administrator wants to ensure the firewall can communicate with SCM and receive configuration updates. Which action must be performed on the firewall to enable this connectivity?

Question 16mediummultiple choice

Read the full Platform Solutions Services And Tools explanation →

An administrator has deployed a pair of NetSec-Pro appliances in an active/passive high availability configuration. They want to test a new security policy that blocks risky applications without affecting production traffic. The administrator decides to use the 'Policy Optimizer' feature within the NetSec-Pro management console. What is the primary function of Policy Optimizer in this context?

Question 17easymultiple choice

Read the full Platform Solutions Services And Tools explanation →

A network security administrator is using the Strata Cloud Manager CLI to automate the retrieval of a list of all managed firewalls. Which command should the administrator use?

Question 18mediummultiple choice

Read the full Platform Solutions Services And Tools explanation →

An administrator is using the Strata Cloud Manager (SCM) to manage security policies across multiple firewalls. They need to create a policy rule that will be applied to all firewalls in a specific region. Which SCM feature should they use to group firewalls for policy application?

Question 19hardmultiple choice

Read the full Platform Solutions Services And Tools explanation →

A security operations team wants to automatically block IP addresses that exceed a threshold of failed SSH login attempts on a monitored Linux server. They plan to use the firewall's XML API to add the offending IPs to a Dynamic Address Group. Which API request method and endpoint should they use to add an IP address to a registered DAG?

Question 20hardmulti select

Read the full Platform Solutions Services And Tools explanation →

An administrator is configuring Palo Alto Networks firewall to integrate with a SIEM using the Log Forwarding profile. The administrator wants to ensure that logs are forwarded in a structured format that is easily parsed by the SIEM. Which two log format options should be considered? (Choose two.)

Question 21hardmulti select

Read the full Platform Solutions Services And Tools explanation →

An administrator is using Strata Cloud Manager to manage a group of firewalls. They need to ensure that a specific security policy rule is applied only to firewalls in the 'Retail' region and not to those in the 'Corporate' region. The administrator creates a new security policy rule and wants to target it appropriately. Which two configuration elements must be used to achieve this scoping? (Choose two.)

Question 22mediummultiple choice

Read the full NAT/PAT explanation →

An administrator needs to configure a new Palo Alto Networks next-generation firewall that will be managed by Panorama. The firewall is located behind a NAT device and cannot be directly reached from the Panorama management server. The administrator wants the firewall to initiate the connection to Panorama for management. Which Panorama component should be configured to allow this?

Question 23mediummulti select

Read the full Platform Solutions Services And Tools explanation →

An administrator is configuring a new Strata Cloud Manager tenant and needs to integrate it with an external SIEM for log forwarding. The administrator wants to ensure that logs are forwarded in a secure and reliable manner. Which two actions should the administrator perform? (Choose two.)

Question 24hardmulti select

Read the full Platform Solutions Services And Tools explanation →

An administrator is deploying a new Palo Alto Networks next-generation firewall and wants to ensure that it can be managed by Panorama. The firewall is in a remote branch with a dynamic IP address. The administrator has configured the Panorama Management Server with a pre-shared key. Which two additional steps must be performed on the firewall to enable management by Panorama? (Choose two.)

Question 25mediummultiple choice

Read the full Platform Solutions Services And Tools explanation →

An administrator is using the Strata Cloud Manager CLI to apply a security policy to a specific firewall. The administrator runs the command 'scm set policy security --device <serial> --file policy.json' but receives an error that the device is not found. Which of the following is the most likely reason?

Question 26easymultiple choice

Read the full network assurance explanation →

A security administrator is configuring a Palo Alto Networks firewall to forward logs to an external syslog server. The administrator wants to ensure that logs are sent in a structured format that is easily parsed by the SIEM. Which log format should be selected?

Question 27mediummultiple choice

Read the full Platform Solutions Services And Tools explanation →

A NetSec-Pro administrator maintains a fleet of 12 Palo Alto Networks PA-3200 Series firewalls managed by on-premises Panorama. The security team wants to ensure that all firewalls have the latest Advanced Threat Prevention signatures without waiting for a scheduled content update. Which Panorama feature should the administrator use to immediately push the newest content version to all managed firewalls?

Question 28mediummulti select

Read the full network assurance explanation →

A NetSec-Pro administrator is configuring a new Palo Alto Networks firewall to send logs to an external syslog server for long-term retention. The administrator wants to ensure that only threat logs and traffic logs are forwarded, and that the logs are sent in a format that includes the firewall's hostname. Which two actions should the administrator take to meet these requirements? (Choose two.)

Question 29hardmultiple choice

Read the full Platform Solutions Services And Tools explanation →

You are troubleshooting a connectivity issue between an SCM-managed firewall and the SCM cloud service. Which log source in the firewall UI provides the most detailed information regarding the management connection?

Question 30mediummultiple choice

Read the full Platform Solutions Services And Tools explanation →

When using Panorama, an administrator wants to push policies to specific firewalls based on their geographical location. Which feature should be used?

Question 31hardmultiple choice

Read the full Platform Solutions Services And Tools explanation →

When migrating from Panorama to SCM, what happens to the existing log data stored on the Panorama appliance?

Question 32mediummultiple choice

Read the full Platform Solutions Services And Tools explanation →

An administrator is unable to push a configuration to a firewall managed by Panorama. The error message indicates a 'Template conflict'. What is the most likely cause?

Question 33mediummultiple choice

Read the full Platform Solutions Services And Tools explanation →

Which feature in Strata Cloud Manager allows you to verify that a configuration change complies with security best practices before it is pushed to devices?

Question 34easymultiple choice

Read the full Platform Solutions Services And Tools explanation →

Where do you generate a 'Device Deployment' token for adding a new firewall to Strata Cloud Manager?

Question 35easymultiple choice

Read the full Platform Solutions Services And Tools explanation →

Which tool in the Palo Alto Networks ecosystem is best suited for centralized visibility and reporting across an entire enterprise?

Question 36mediummultiple choice

Read the full Platform Solutions Services And Tools explanation →

You are configuring 'Log Forwarding' from Panorama to an external SIEM. Which object must you define in Panorama to facilitate this?

Question 37hardmultiple choice

Read the full Platform Solutions Services And Tools explanation →

You are troubleshooting an issue where a specific Threat Prevention profile is not applying correctly via Panorama. The setting is configured in a Template, but the firewall shows a different value. What should you check?

Question 38easymultiple choice

Read the full Platform Solutions Services And Tools explanation →

Which SCM feature allows you to view the health status of your entire global firewall deployment?

Question 39easymultiple choice

Read the full Platform Solutions Services And Tools explanation →

What is the primary function of the 'Panorama' context in the Web UI of a managed firewall?

Question 40hardmultiple choice

Read the full Platform Solutions Services And Tools explanation →

An administrator notices that the 'Commit' progress on Panorama hangs at 99%. What is the most effective way to troubleshoot this?

Question 41mediummultiple choice

Read the full Platform Solutions Services And Tools explanation →

You are using SCM to manage firewall policies. You want to audit who made a specific change to a security policy rule. Which feature should you use?

Question 42mediummultiple choice

Read the full Platform Solutions Services And Tools explanation →

You need to create a global address object that is available to all firewalls managed by Panorama. Where should you define this?

Question 43easymultiple choice

Read the full Platform Solutions Services And Tools explanation →

When a firewall is managed by Panorama, where is the authoritative configuration stored?

Question 44hardmultiple choice

Read the full Platform Solutions Services And Tools explanation →

You are managing firewalls across multiple time zones using Panorama. Where do you configure the time zone for the managed firewalls?

Question 45hardmulti select

Read the full Platform Solutions Services And Tools explanation →

Which THREE types of information are contained in the Panorama 'Device Health' report?

Question 46mediummulti select

Read the full Platform Solutions Services And Tools explanation →

Which THREE configuration elements are commonly managed via Panorama Templates?

Question 47hardmulti select

Read the full Platform Solutions Services And Tools explanation →

Which TWO factors contribute to 'Configuration Drift' between a firewall and Panorama?

Question 48mediummulti select

Read the full Platform Solutions Services And Tools explanation →

Which TWO steps are involved in the process of replacing a failed firewall that is managed by Panorama?

Question 49hardmulti select

Read the full Platform Solutions Services And Tools explanation →

Which THREE items are included in a Panorama configuration 'Export'?

Question 50mediummulti select

Read the full Platform Solutions Services And Tools explanation →

Which TWO actions should an administrator perform to prepare for a large-scale firmware upgrade across an enterprise using Panorama?

Question 51mediummulti select

Read the full Platform Solutions Services And Tools explanation →

Which TWO of the following are benefits of using Strata Cloud Manager over traditional on-premises Panorama?

Question 52mediummultiple choice

Read the full Platform Solutions Services And Tools explanation →

When managing multiple firewalls in Panorama, what is the best practice for handling software image updates?

Question 53hardmultiple choice

Read the full Platform Solutions Services And Tools explanation →

An administrator managing 200 Palo Alto Networks firewalls with Strata Cloud Manager needs to rapidly deploy a new decryption policy only to firewalls in the European branch offices, which are identified by the region tag 'EU'. The administrator wants to avoid manual per-firewall configuration and ensure the policy is applied consistently. Which SCM feature should the administrator use?

Question 54hardmultiple choice

Read the full Platform Solutions Services And Tools explanation →

A security engineer is using the Palo Alto Networks Expedition tool to migrate a configuration from a Cisco ASA firewall to a Palo Alto Networks firewall. After importing the ASA configuration, the engineer notices that some access control rules are not being translated correctly. What is the most likely cause?

Question 55easymultiple choice

Read the full Platform Solutions Services And Tools explanation →

A network security administrator needs to ensure that the Palo Alto Networks firewall can resolve domain names for security policy enforcement. Which service should be configured on the firewall?

Question 56easymultiple choice

Read the full Platform Solutions Services And Tools explanation →

A security administrator needs to allow the NetSec-Pro management plane to authenticate firewall administrators against the corporate Microsoft Active Directory. The AD servers are reachable only on the internal network. Which server profile type should the administrator configure on the firewall to meet this requirement?

Question 57mediummultiple choice

Read the full Platform Solutions Services And Tools explanation →

A security administrator is deploying a new Palo Alto Networks next-generation firewall in a remote branch office. The branch has limited on-site IT staff and no dedicated management server. The administrator wants to centrally manage this firewall, push security policies, and monitor traffic without deploying Panorama. Which Palo Alto Networks cloud-delivered service should be used?

Question 58hardmultiple choice

Read the full network assurance explanation →

A security engineer is configuring a NetSec-Pro appliance to forward logs to an external SIEM using syslog. The SIEM requires that logs be sent over TCP with TLS encryption for compliance. The engineer configures a syslog server profile with the SIEM's IP address and port 6514, and selects 'SSL' as the transport. However, the SIEM is not receiving any logs. Which of the following is the most likely cause of the failure?

Question 59hardmultiple choice

Read the full Platform Solutions Services And Tools explanation →

An administrator is using the Strata Cloud Manager API to programmatically create a security rule. The API request fails with a 400 Bad Request error. The administrator has verified that the authentication token is valid and the endpoint URL is correct. Which of the following is the most likely cause of the error?

Question 60easymultiple choice

Read the full Platform Solutions Services And Tools explanation →

A network administrator is configuring a NetSec-Pro firewall to send alerts to an external email server when a critical threat is detected. They navigate to the 'Log Settings' under the 'Device' tab and configure the email server profile. Which additional step is required to ensure that threat logs trigger email notifications?

Question 61mediummultiple choice

Read the full network assurance explanation →

A network security administrator is configuring a firewall to forward logs to an external syslog server. The syslog server uses a non-standard port and requires TCP for reliability. Which log forwarding destination configuration should the administrator use?

Question 62hardmultiple choice

Read the full Platform Solutions Services And Tools explanation →

A security operations team is using the NetSec-Pro 'Policy Optimizer' to review rule usage. They notice that a rule allowing 'any' application on port 80 has a high session count but no application identification. They want to safely transition this rule to a more secure, application-based rule. Which action should they take first according to best practices?

Question 63easymultiple choice

Read the full Platform Solutions Services And Tools explanation →

A network security engineer needs to verify that a newly created security policy in Strata Cloud Manager will not block critical business applications. The engineer wants to simulate the policy against recent traffic logs without enforcing it. Which Strata Cloud Manager feature should be used?

Question 64hardmultiple choice

Read the full Platform Solutions Services And Tools explanation →

A security engineer is using the firewall's REST API to retrieve the current list of all security rules in the 'vsys1' virtual system. The engineer wants to receive the response in JSON format. Which API request should be used?

Question 65hardmultiple choice

Read the full Platform Solutions Services And Tools explanation →

An administrator is using Strata Cloud Manager to manage a large number of firewalls. They need to generate a report that shows which security policy rules are unused across all managed firewalls over the past 90 days. The report should help identify rules that can be safely removed to improve performance. Which Strata Cloud Manager feature should be used?

Question 66mediummultiple choice

Read the full Platform Solutions Services And Tools explanation →

A security operations team is using Strata Cloud Manager to monitor firewall health. They want to receive alerts when a managed firewall's CPU utilization exceeds 80% for more than 10 minutes. Which Strata Cloud Manager capability should they configure?

Question 67mediummultiple choice

Read the full Platform Solutions Services And Tools explanation →

An administrator is using the Palo Alto Networks Expedition tool to migrate a configuration from a competitor firewall to a Palo Alto Networks firewall. After importing the competitor's configuration, the administrator notices that some rules are not being translated correctly. Which step should the administrator take to improve the translation accuracy?

Question 68hardmultiple choice

Read the full Platform Solutions Services And Tools explanation →

A network security administrator is using the Palo Alto Networks Best Practice Assessment (BPA) tool to evaluate the security posture of a firewall. The BPA report shows a low score in the 'Security Policy' category due to overly permissive rules. Which action should the administrator take to improve the score while maintaining necessary access?

Question 69hardmultiple choice

Read the full Platform Solutions Services And Tools explanation →

A NetSec-Pro administrator is using the Strata Cloud Manager API to automate the retrieval of security policy rule hit counts across multiple tenants. The API calls are failing with HTTP 403 errors. The administrator has verified that the API key is valid and has not expired. Which of the following is the most likely cause of the 403 errors?

Question 70easymultiple choice

Read the full network assurance explanation →

A NetSec-Pro administrator needs to verify that a newly configured security policy on a Palo Alto Networks firewall is correctly logging traffic to an external syslog server. The administrator has already configured the Log Forwarding profile and syslog server. Which tool in the firewall's web interface should the administrator use to view real-time logs and confirm that they are being forwarded?

Question 71mediummultiple choice

Read the full Platform Solutions Services And Tools explanation →

A NetSec-Pro administrator is using the Strata Cloud Manager to manage security policies across multiple tenants. The administrator wants to create a policy rule that applies to all tenants but with the ability to override it in a specific tenant if needed. Which Strata Cloud Manager feature should the administrator use to achieve this?