Network Security

An organization wants to inspect encrypted outbound HTTPS traffic to detect malware without causing certificate warnings on user workstations. Which component must be installed on the client endpoints to achieve this?

An administrator notices that the firewall's management plane CPU utilization is consistently at 99%. Which THREE factors or troubleshooting steps should the administrator investigate? (Choose three)

An administrator wants to ensure that critical database servers are protected against vulnerability exploits, SQL injections, and buffer overflows. Which security profile must be applied to the relevant Security policy rule to provide this protection?

An administrator configures an external dynamic list (EDL) pointing to a URL hosting a plain-text list of malicious IP addresses. The firewall successfully downloads the EDL, but security rules referencing this EDL fail to block traffic to those IPs. Inspection reveals that the EDL entries are showing as 'parsing error' in the system logs. What is the most likely cause of this issue?

A security administrator is configuring a Palo Alto Networks firewall to protect against network reconnaissance. The administrator wants to detect and block TCP port scans targeting the internal network from external sources. Which feature should the administrator configure to achieve this?

An administrator configures a decryption exclusion based on the 'Pre-defined SSL Decryption Exclusions' list. However, an internal audit reveals that a specific sensitive medical portal is still being intercepted and decrypted. The portal uses certificate pinning and a non-standard port (TCP 8443). How can the administrator ensure this specific traffic is never decrypted?

An administrator configures a dynamic address group (DAG) based on User-ID tags, but security rules referencing this DAG fail to match traffic from users who have successfully authenticated via GlobalProtect. What is the most likely root cause?

A network security team is deploying a Palo Alto Networks firewall in Layer 2 mode between two internal segments. Users report that ARP resolution works but traffic between the segments is silently discarded. Which configuration element most likely explains why the traffic is dropped despite correct Layer 2 forwarding?

A security administrator is configuring a Palo Alto Networks firewall to protect a web server in a DMZ zone. The administrator wants the firewall to inspect the HTTP traffic for known attack patterns and block malicious requests while allowing legitimate web traffic. Which Security Profile type should the administrator apply to the Security policy rule that permits HTTP traffic to the web server?

A network security engineer is configuring a Palo Alto Networks firewall to prevent users from accessing known malicious websites. The engineer wants to ensure that the firewall blocks access based on a dynamically updated list of malicious URLs and IP addresses. Which feature should be configured to achieve this?

A security administrator is configuring a NAT policy on a Palo Alto Networks firewall. Internal users in the 10.1.1.0/24 subnet need to access the internet, but the organization has only a single public IP address, 203.0.113.5, on the untrusted interface. The administrator wants all internal users to share this public IP address when accessing external resources. Which NAT type should the administrator configure?

A security analyst is investigating unusual outbound traffic from an internal server. The analyst suspects the server may be communicating with a command-and-control server. Which Palo Alto Networks firewall feature should the analyst use to identify the application generating the traffic, regardless of the port being used?

An administrator needs to configure a Palo Alto Networks firewall interface to connect to an untrusted ISP router. Which interface type is appropriate for this connection?

A network administrator is documenting the security zones on a Palo Alto Networks firewall. The firewall has an interface connected to the public internet and another connected to a DMZ hosting a web server. Which zone type should be assigned to the interface facing the public internet to apply the strictest default posture?

Which THREE actions are recommended best practices when securing the management plane of a Palo Alto Networks firewall? (Choose three)

A network security engineer is configuring a Palo Alto Networks firewall to protect against SYN flood attacks. The engineer wants to limit the number of half-open connections from a single source IP address to 100 per second. Which feature should be configured to achieve this?

An administrator wants to prevent users from accessing specific URL categories such as 'gambling' and 'adult' while allowing all other business-related sites. Where should this restriction be configured?

A security engineer is tuning a Decryption policy on a Palo Alto Networks firewall. The organization must inspect TLS traffic to a sanctioned SaaS application, but must not break sessions to a banking portal that uses certificate pinning. Which action in the Decryption policy rule should be applied to the banking portal traffic to achieve this?

A security administrator is reviewing traffic logs on a Palo Alto Networks firewall and notices that a large volume of sessions from the internal network is matching a Security policy rule that permits any application on any port. The administrator wants to reduce the attack surface by ensuring that only specific applications are allowed, even when they use non-standard ports. Which feature should the administrator implement to achieve this?

A security administrator is configuring a Palo Alto Networks firewall to protect against brute force attacks on the management interface. The administrator wants to limit the number of failed login attempts and automatically block the source IP after a threshold is reached. Which configuration should be implemented?

A security operations analyst is investigating asymmetric routing through a Palo Alto Networks firewall. Return traffic from an external server arrives on a different interface than the interface that forwarded the original outbound request. Which firewall behavior should the analyst expect to see, and what is the appropriate mitigation?

An administrator wants to configure Zone Protection Profiles to safeguard the internal network against common layer 2 and layer 3 attacks. Which THREE attack mitigation features are available within a Zone Protection Profile? (Choose three)

An administrator configures a QoS profile to prioritize VoIP traffic over bulk data transfers. However, after applying the profile, VoIP packets are still experiencing high latency during peak business hours. Inspection shows that the QoS profile is applied correctly to the security rules, but the packets are not being placed into the correct QoS class. What is missing in the interface configuration?

A security architect is designing a network segmentation strategy using Palo Alto Networks firewalls. The design must limit lateral movement and enforce least privilege between internal tiers. Which TWO practices support this goal? (Choose two.)

An administrator is configuring Zone Protection profiles to mitigate potential network attacks. Which TWO flood protection mechanisms are available within a Zone Protection profile? (Choose two)

A network administrator is configuring a Palo Alto Networks firewall to protect an internal web server. The administrator wants to allow only HTTP and HTTPS traffic to the server from the internet while blocking all other inbound traffic. Which type of security policy rule should be created to achieve this?

An administrator is troubleshooting a BGP routing peer connection between the Palo Alto Networks firewall and an external provider router. The BGP session is stuck in the 'Connect' state. Inspection of system logs indicates TCP port 179 packets sent by the firewall are being transmitted, but no SYN-ACK is received. Which troubleshooting step or feature verification should be performed first?

An administrator configures a Security policy rule with an application dependency on 'ssl', but the target application is 'custom-app'. When committing the configuration, the firewall generates a warning or error regarding application dependencies. What is the correct way to handle application dependencies in Palo Alto Networks firewalls?

An administrator wants to view real-time session information, including source/destination ports, translated IPs, and matched security rules, for active traffic flowing through the firewall. Which CLI command should the administrator execute?

A network administrator is configuring a Palo Alto Networks firewall to prevent TCP SYN flood attacks. The administrator wants to limit the number of half-open connections from a single source IP address to a specific destination. Which feature should the administrator configure?

An administrator is configuring security policies on a Palo Alto Networks firewall and wants to ensure best practices for rule organization and management. Which TWO practices are recommended when designing security rules? (Choose two)

A security administrator is reviewing a Palo Alto Networks firewall configuration and notices that a Security policy rule allowing outbound web traffic has no security profiles attached. The administrator wants to ensure that the rule is protected against known vulnerabilities, malware, and command-and-control traffic. Which security profile group should the administrator attach to the rule to provide this protection?

An administrator configures a Security policy rule to block all file-sharing applications. However, users are still able to upload files using an authorized cloud collaboration tool that shares the same parent application family. Which feature should the administrator use to granularly block file uploads while permitting standard document viewing?

A security administrator is troubleshooting an issue where internal users cannot reach a specific external website, and the traffic is being dropped by the firewall. The administrator suspects a Threat Prevention profile is blocking the response as a command-and-control callback. Where should the administrator look to verify the exact threat signature ID and packet capture that triggered the block?

An administrator is troubleshooting a scenario where internal clients cannot resolve external domain names through the firewall configured as a DNS proxy. Which TWO settings should be verified on the firewall? (Choose two)

An administrator configures high availability (HA) active/passive mode between two Palo Alto Networks firewalls. During a failover test, the administrator observes that stateful sessions are dropped, forcing users to re-authenticate and re-establish their TCP connections. What is the most likely configuration error?

An administrator deploys User-ID using Palo Alto Networks User-ID Agent on a Windows Server. Users report that after logging off their workstations, the firewall continues to attribute their web traffic to them for up to 45 minutes. How can the administrator reduce this timeout duration?

An administrator is reviewing the Palo Alto Networks firewall traffic logs and sees a session marked with the application 'unknown-tcp'. What does this application classification typically indicate?

A network engineer has deployed an active/passive HA pair of PA-5220 firewalls. During a routine failover test, the engineer notices that existing TCP sessions are dropped and must be re-established. Which feature should be enabled to prevent session disruption during failover?

An administrator needs to prevent known malware and spyware from entering the network through downloaded files and web traffic. Which security profile type should be attached to the Security policy rule?

A security engineer is configuring a Palo Alto Networks firewall to inspect traffic between two internal zones. The engineer wants to ensure that the firewall can identify applications that use non-standard ports and apply appropriate security policies. Which technology should the engineer rely on to achieve this?

A network administrator is configuring a Palo Alto Networks firewall to allow DNS traffic from the trust zone to the untrust zone. The administrator wants to ensure that only DNS queries to specific external DNS servers are allowed, and that all other DNS traffic is blocked. Which configuration should be used?

An administrator is configuring a complex network environment with multiple virtual routers and needs to ensure proper routing and path selection. Which THREE statements regarding Palo Alto Networks virtual routers are accurate? (Choose three)

An administrator configures a dynamic update schedule for Antivirus and WildFire signatures. The firewall successfully downloads the updates, but fails to install them automatically. Where should the administrator check to verify and configure the installation schedule settings in PAN-OS?

An administrator is configuring a Palo Alto Networks firewall to provide secure remote access for employees. The requirement is to allow employees to connect to the corporate network from home using a client that establishes an encrypted tunnel to the firewall. Which feature should the administrator configure?

An administrator needs to implement authentication for administrative access to the Palo Alto Networks firewall using an external RADIUS server. Which TWO components must be configured on the firewall to achieve this? (Choose two)

An administrator is designing a high-availability network using Panorama and Palo Alto Networks firewalls. Which TWO tasks can be performed directly by Panorama regarding firewall management and deployment? (Choose two)

A network administrator is configuring a Palo Alto Networks firewall to allow outbound access to the internet for internal users. The administrator wants to ensure that users can access any website but must not bypass security controls using proxy sites or anonymizers. Which Security policy configuration should the administrator implement?

An administrator wants to secure outbound web browsing traffic by inspecting HTTP/HTTPS traffic for malicious URLs, malware, and exploits. Which TWO security profiles should be attached to the Security policy rule to achieve comprehensive protection? (Choose two)

An administrator wants to ensure that critical server traffic is always prioritized over standard guest internet traffic during periods of network congestion. Which feature should be configured?