PAN OS Device Setting Configuration

You are configuring a new NGFW and need to ensure administrative access is restricted to a specific management subnet. Which interface setting should you modify to enforce this?

Where do you configure the DNS servers that the firewall itself uses to resolve hostnames for updates?

Which object type should be used to group multiple IP addresses to simplify security policy management?

How do you ensure that the firewall automatically blocks traffic from a list of known malicious IP addresses?

Which tab in the web interface is used to create and manage security policies?

If you have a primary and secondary firewall, what is the best way to synchronize configuration changes?

An administrator wants to ensure that internal users only access approved websites. Which profile is used?

An administrator wants to use a specific user's group membership for policy enforcement. What is the requirement?

Which action in a security policy should be used to drop traffic silently without sending a notification to the client?

You notice that the firewall is not identifying traffic as 'web-browsing' even though it is on port 80. What is the most likely cause?

Which tab is used to configure logging settings for a specific security policy?

What is the primary function of a Security Profile Group?

Which feature is used to ensure the firewall clock is accurate?

You are experiencing issues with traffic passing through the firewall. What command is used to see the session table in the CLI?

Which tab allows you to configure the firewall's hostname and domain?

Which object should be configured for a server that needs to be accessed from the internet via a public IP?

What is the recommended way to manage certificates on a Palo Alto Networks firewall?

Which type of interface is used for connecting to a Layer 3 network?

How do you back up the firewall's configuration?

What is the purpose of a 'Zone' in a Palo Alto Networks firewall?

You need to perform a packet capture on a specific firewall interface. Which tool is used?

What is the consequence of having overlapping IP subnets on different interfaces?

Which tab is used to view real-time log activity?

What is the recommended method to update the firewall's threat signatures?

How do you ensure that only the most secure TLS versions are used for management access?

What must you do after making any change in the web interface to make it active?

Which feature helps to identify and block traffic from compromised hosts based on suspicious behavior?

What is the purpose of the 'Policy Optimizer' feature?

Where do you view the system logs to troubleshoot hardware issues?

How do you ensure that a specific security policy rule is only active during business hours?

What is the best way to monitor the firewall's CPU and memory usage?

When configuring an interface, what is the role of a 'Security Zone'?

What is the default action for the 'interzone-default' security policy?

Which object type should you use to handle large lists of URLs that you want to block or allow?

Which TWO settings are required to configure an Interface Management Profile?

Which TWO objects can be used as a source in a Security Policy?

Which TWO items are required to configure a site-to-site IPsec VPN?

Which THREE components are necessary to successfully implement SSL Forward Proxy?

Which TWO of the following are valid methods to authenticate administrators to the firewall?

Which TWO types of logs can be forwarded to an external server?

Which TWO features require a valid subscription license?

Which THREE options are available under the 'Actions' tab of a Security Policy?

Which TWO types of NAT are supported in PAN-OS?

Which THREE items are found under the 'Network' tab?

Which THREE settings can be modified in a custom Antivirus Profile?

Which TWO items can be configured in a Virtual Router?

Which THREE steps are involved in the standard User-ID agentless configuration?

Which THREE items are part of the 'Device > Setup' configuration?

Which TWO authentication protocols are commonly supported by PAN-OS for VPN user authentication?

Which THREE features are associated with Threat Prevention?

You are managing a firewall and need to ensure that dynamic updates are downloaded automatically. Where do you configure the schedule for these updates?

You are configuring a Security Profile to detect and prevent malware. Which profile is most appropriate for identifying malicious files being downloaded?

Which TWO of the following are valid methods for an administrator to authenticate to the Palo Alto Networks firewall management plane?

Which TWO of the following settings are required when configuring a Service Route to ensure the firewall uses a specific interface for external traffic?

You are configuring a Palo Alto Networks firewall to use an external log forwarding profile to send traffic logs to a syslog server. You want to ensure that only traffic logs from a specific security policy are forwarded. What is the correct way to achieve this?

An engineer is configuring a Palo Alto Networks firewall to allow management access only from a secure internal subnet. The firewall's management interface is currently on the default 192.168.1.1/24 network. The engineer wants to restrict management access to the 10.10.10.0/24 subnet and ensure that only HTTPS is used. Which configuration should be applied?

An engineer is configuring a Palo Alto Networks firewall to authenticate administrators against an external LDAP directory. The security team requires that only members of the group 'NGFW-Admins' can log in with full read-write access, while members of 'NGFW-Auditors' must receive read-only access. Which two configuration steps are required on the firewall to meet these requirements? (Choose two.)

An engineer is setting up a new Palo Alto Networks firewall and needs to configure the device to send logs to an external syslog server. Which configuration step is required to ensure that logs are forwarded to the syslog server?

You are deploying a new Palo Alto Networks NGFW at a branch office. The branch has a single ISP link that provides both IPv4 and IPv6 connectivity. You need to configure the firewall's external interface to obtain both an IPv4 and an IPv6 address dynamically from the ISP. What should you do?

You are configuring a Palo Alto Networks NGFW to enforce a security policy that allows only HTTP and HTTPS traffic from the untrusted zone to the DMZ. You want to ensure that the firewall performs application identification and applies the appropriate security profiles. Which tab in the WebUI do you use to create the security policy rule?

You are configuring a Palo Alto Networks firewall for a branch office that uses a single public IP address from the ISP. The ISP has assigned you 203.0.113.10/32 and requires that all outbound traffic from the 192.168.10.0/24 network appears to originate from that address. You must ensure return traffic is correctly routed back to the originating internal host. Which NAT configuration should you implement?

You are configuring a Palo Alto Networks firewall to integrate with an external LDAP server for User-ID. You have configured the LDAP server profile and the User-ID agent, but users are not being identified in the traffic logs. You have verified that the firewall can reach the LDAP server and that the agent is connected. Which action should you take next to troubleshoot the issue?

You are deploying a PA-3200 Series firewall at a branch office. The branch uses a single ISP link and you want the firewall to automatically fail over to a secondary ISP if the primary link goes down. You have both links connected to separate interfaces. Which PAN-OS feature should you configure to achieve this?

A network administrator needs to configure a Palo Alto Networks firewall to send syslog messages to an external server for auditing. Which configuration path should the administrator use to add a syslog server?

You are configuring a new Palo Alto Networks firewall and need to set up the management interface. You want to ensure that the firewall can be managed from a secure network and that administrative access is restricted. Which configuration should you apply to the management interface?

You are configuring a new firewall and need to set up the management interface. You want to restrict management access to only a specific subnet. Which type of interface should you configure to apply a management profile with permitted IP addresses?

You need to configure a Palo Alto Networks firewall to resolve domain names for its management traffic. Which DNS configuration should you set?

You are configuring a Palo Alto Networks firewall to authenticate administrators using an external LDAP server. You want to ensure that only members of the 'IT-Admins' group can log in with read-write privileges, while other authenticated users have read-only access. What should you configure?

An engineer is configuring a Palo Alto Networks firewall to use a custom certificate for the management interface (Web UI). The certificate is issued by an internal CA and has a CN of 'firewall.example.com'. After importing the certificate and private key, the engineer configures the management interface to use this certificate. However, when accessing the Web UI via https://firewall.example.com, the browser still shows a certificate warning. What is the most likely cause?

You are deploying a pair of Palo Alto Networks NGFWs in an active/passive high availability configuration. The two firewalls are directly connected via a dedicated HA link. You need to ensure that the passive firewall takes over seamlessly if the active firewall fails, preserving existing sessions. Which HA setting should you configure to achieve this?

An administrator wants to change the firewall's hostname and configure the timezone to UTC. Which configuration path should the administrator use?

You have a Palo Alto Networks firewall deployed in a data center with two ISPs. You need to configure the firewall so that if the primary ISP link fails, traffic automatically fails over to the secondary ISP without manual intervention. You have already configured both ISP interfaces with static IPs and default routes with different metrics. Which additional configuration is required to enable automatic failover?

You are configuring a Palo Alto Networks firewall to perform decryption of outbound SSL traffic for a specific set of users. You have created a decryption policy that matches the traffic and applied a decryption profile. However, after committing, you notice that some websites are not being decrypted, and users report certificate errors. You have verified that the forward trust certificate is installed and trusted by the endpoints. What is the most likely cause for the websites not being decrypted?

You are setting up a new Palo Alto Networks NGFW and need to configure the management interface. Which parameter must be configured to allow administrative access from a remote subnet?

You are setting up a new Palo Alto Networks firewall in a branch office. The management interface needs to be reachable from the internal network for administrators to manage the device. You have configured the management interface with an IP address and default gateway. Which additional configuration is required to allow management access from the internal network?

A network security engineer is deploying a Palo Alto Networks NGFW in a data center that uses a single public IP address block. The engineer must allow several internal web servers to be reached from the internet using different public IP addresses, but only has one egress interface. Which configuration should be used to meet this requirement?

A firewall administrator is configuring a Palo Alto Networks NGFW and needs to ensure that management access to the firewall's web interface is only allowed from the internal network 10.0.0.0/24. The management interface is on a dedicated out-of-band network. Which configuration should the administrator use?

An engineer is configuring a Palo Alto Networks NGFW to authenticate administrators using an external LDAP server. The LDAP server uses a self-signed certificate. The engineer needs to ensure that the firewall can validate the LDAP server's certificate during authentication. What should the engineer do?

A network security administrator is deploying a pair of Palo Alto Networks NGFWs in an active/passive high availability configuration at a data center. The two firewalls are connected by a dedicated HA link, and each has its own management interface. The administrator needs to ensure that after a failover, the new active device automatically takes over the management IP address that administrators use to reach the Web UI, without requiring DNS changes. Which setting must be configured?

A junior administrator is setting up a new Palo Alto Networks NGFW and wants to change the idle timeout for administrators logged into the Web UI so that sessions expire after 30 minutes of inactivity. Where should this change be made?