Select Two (Multi-Select) Questions

Multiple security rules are configured for the same traffic.

Why it fails: Multiple rules do not affect App-ID identification.

Traffic is forwarded through an HTTP proxy.

Why it fails: HTTP proxies can be handled by App-ID.

Leave the default admin password until the next audit

Why it fails: Leaving the default admin password exposes the firewall to trivial compromise, violating secure deployment. It is tempting because it defers configuration effort, and would be correct only if the password were changed immediately during initial setup before connecting the device to any network.

Use the default NAT policies provided by the initial configuration

Why it fails: Default NAT policies exist only to translate the untrust zone to the internet for management traffic; they do not provide the outbound source NAT or inbound destination NAT rules a branch requires. They are tempting because they ship pre-configured and work for basic internet access, which is the correct choice only for a lab firewall with no internal servers.

Manually download dynamic updates daily to ensure latest signatures

Why it fails: Dynamic updates are retrieved automatically from Palo Alto Networks update servers; manual daily downloads add effort without benefit. It is tempting because staying current on signatures matters, and would be correct in air-gapped environments where automatic updates are impossible and offline packages must be imported.

Create an SNMP trap profile under Device > Server Profiles > SNMP Trap.

Why it fails: SNMP trap profiles are used for SNMP notifications, not syslog forwarding.

Directly apply the syslog server profile to each Security policy rule.

Why it fails: Syslog server profiles cannot be directly applied to policy rules; they must be referenced via a Log Forwarding profile.

Enable log forwarding under the firewall's Device > Setup > Logging and Reporting settings.

Why it fails: There is no global log forwarding setting; it is configured per rule via Log Forwarding profiles.

Insufficient disk space on the log partition.

Why it fails: Disk space affects storage, not CPU directly.

BGP prefix flapping causing route recalculations.

Why it fails: BGP flapping can cause CPU, but it's less common than the others; may be considered plausible but not a top three.

LDAP

Why it fails: LDAP authenticates credentials against a directory but returns no Kerberos or SAML ticket, so the firewall cannot accept an existing session token for SSO. It tempts because LDAP is the usual directory source for user and group lookups, and it would be correct for plain directory-based authentication without SSO.

Local Database

Why it fails: The local database stores credentials on the firewall itself, so every login requires the user to re-enter a username and password; no external identity provider issues a reusable session token. It tempts as a fallback when no directory or IdP is reachable, which is exactly when SSO is impossible.

RADIUS

Why it fails: RADIUS authenticates each session against a shared secret and returns accept or reject, without issuing a Kerberos ticket the firewall can consume for SSO. It tempts because RADIUS is the standard choice for 802.1X and MFA-backed authentication, but that is authentication, not single sign-on.

Active/Passive HA with virtual router synchronization

Why it fails: Active/Passive HA with virtual router synchronisation protects against device failure, not WAN link failure; both peers still share the same upstream path. It is tempting because HA is the standard resilience mechanism, but it is the correct choice when the requirement is firewall hardware redundancy rather than outbound internet circuit diversity.

Use of multiple public IPs with NAT rules

Why it fails: Multiple public IPs with NAT rules provide address translation and source-port diversity, not path redundancy; if the single ISP link or interface fails, traffic still stops. It is tempting because multiple addresses suggest resilience, but this method suits scenarios needing address flexibility, not failover across independent connections.

The user is using a VPN connection from a remote location

Why it fails: VPN users can still have mappings if the agent receives authentication events.

The firewall's User-ID agent is in collector mode

Why it fails: Collector mode aggregates mappings from other agents, it does not prevent mapping.

The user's traffic is being decrypted by SSL decryption

Why it fails: SSL decryption does not interfere with User-ID mapping.

show session info

Why it fails: This command shows active sessions but does not directly indicate performance bottlenecks.

show log traffic

Why it fails: This command shows traffic logs, which are for historical analysis, not real-time bottleneck identification.

CDSS performs full application-level packet inspection.

Why it fails: Application-level inspection is performed by the Next-Generation Firewall's single-pass parallel processing engine; CDSS delivers cloud-hosted subscriptions such as DNS Security and WildFire that augment the firewall rather than inspect packets themselves. Full inspection would be the firewall's role in any deployment.

CDSS is a replacement for the firewall's local threat prevention functionality.

Why it fails: CDSS extends the firewall with cloud-based subscriptions; it does not replace local threat prevention, which continues to run on the firewall itself. Treating CDSS as a substitute would be tempting when offloading signature processing to the cloud, but the firewall retains its own content inspection.

User-ID

Why it fails: User-ID maps users to IPs and does not drop traffic.

SSL Decryption

Why it fails: SSL Decryption does not drop traffic; it decrypts or bypasses.

URL Filtering

Why it fails: URL Filtering blocks based on URL category but does not terminate existing sessions.

User-ID

Why it fails: User-ID is the outcome, not a condition for authentication policy.

Application ID

Why it fails: Application ID is not a condition in authentication policy; it is used in security policies.

Firewalls must be configured to send User-ID data to the Agent via Server Monitoring.

Why it fails: Server Monitoring is for the firewall to receive user mappings from the Agent, not send.

An Application Override policy must be created for User-ID traffic.

Why it fails: Application override is not needed for User-ID; the traffic is identified via service.

The User-ID Agent must be in the same Layer 2 subnet as the users.

Why it fails: User-ID Agent can be anywhere as long as network connectivity exists.

Enable aggregate Ethernet on all interfaces

Why it fails: Aggregate Ethernet is not required for basic HA operation.

Set up a management profile for each interface

Why it fails: Management profile is optional and not required for HA.

Set the Source Zone and Destination Zone.

Why it fails: Source and destination zones define where traffic originates and terminates, but they do not restrict matching to a specific application on its standard port. It is tempting because zones are mandatory in every rule, yet application detection requires the Application field and the default service, not zone scoping.

Enable Threat Prevention.

Why it fails: Threat Prevention profiles attach security inspection to permitted traffic; they do not determine whether the rule matches an application on its standard port. It is tempting because it strengthens policy, but matching depends on the Application field and the application-default service setting, not on threat inspection.

Configure Logging at session start.

Why it fails: Logging at session start only controls when traffic is recorded; it does not constrain application identification or port matching. It is tempting because logging is a familiar policy field, but the rule needs an application filter and a service definition to enforce detection on the standard port.

The firewall CPU is too slow to process packets.

Why it fails: App-ID marks sessions incomplete when it cannot identify the application, typically because of insufficient packets, asymmetric routing, or unsupported protocols — not CPU speed. A slow firewall drops or delays packets, but that is a performance symptom. CPU capacity would matter when sizing throughput for decryption or threat inspection, not for classification completeness.

The content-ID engine has not been licensed.

Why it fails: App-ID marks sessions incomplete when it cannot identify the application, typically because of insufficient packets, unknown protocols or decryption gaps; licensing the Content-ID engine governs file and threat inspection, not application identification. Content-ID licensing is the correct consideration when enabling antivirus, IPS or file blocking profiles.

A deny rule that blocks the traffic.

Why it fails: A deny rule terminates the session, producing a deny log entry rather than an incomplete App-ID verdict; incomplete classification arises when the application cannot be identified from the observed traffic. Deny rules are the correct tool when the requirement is simply to block specific traffic and log the enforcement action.

Firewall management interface

Why it fails: The firewall management interface configures the gateway and portal but is not itself a GlobalProtect infrastructure component; the infrastructure comprises the portal, gateway and agent. It is tempting because administrators do use it to configure GlobalProtect, yet the question asks what constitutes the infrastructure, not where settings live.

Authentication server

Why it fails: An authentication server is an external identity source that GlobalProtect can query; it is not a GlobalProtect infrastructure component. It is tempting because portal and gateway authentication depends on it, but the infrastructure comprises the portal, gateways, and agents, with authentication servers configured separately.

A management profile must be applied to the vwire.

Why it fails: Management profiles are for management access, not required for vwire.

A zone must be assigned to the vwire.

Why it fails: The vwire itself is not a zone; zones are assigned to the interfaces that are part of the vwire.

The interfaces must be of type 'aggregate'.

Why it fails: Any interface type can be used in a vwire.

Decryption Broker

Why it fails: Decryption Broker is not a standard Palo Alto Networks feature.

SSL Termination

Why it fails: SSL Termination is not a separate decryption scenario; it is part of inbound inspection.

SSH Proxy

Why it fails: SSH Proxy is not a decryption scenario; it handles non-SSL traffic.

Check that the session synchronization encryption is disabled to reduce latency.

Why it fails: Encryption is optional and does not cause sync failure; disabling it does not resolve the issue.

Validate that the heartbeat hold timer is set to a value greater than the failover delay.

Why it fails: Heartbeat hold timer influences failover timing, not session synchronization.

Confirm that the HA1 link is using the correct IP address and is in the same subnet.

Why it fails: HA1 is used for heartbeat and configuration sync, not session synchronization.

Dead peer detection interval

Why it fails: Dead peer detection intervals are configured independently on each peer and are not negotiated, so mismatched values still permit tunnel establishment. DPD timing matters for detecting failures, not for bringing the tunnel up; it would be the answer if the question asked about liveness detection.

Local certificate

Why it fails: Certificates are per-peer identity credentials, not negotiated parameters; each peer validates the other's certificate against a trusted CA, so the certificates themselves differ. Matching local certificates would be required only when both peers must present identical credentials, such as in some pre-shared-key-free lab setups.