Infrastructure Management And CDSS

Which THREE components are required to successfully deploy and use Advanced URL Filtering?

A network security administrator is configuring a firewall to forward traffic to a sandboxing service for analysis. The administrator wants to ensure that any file determined to be malicious by the sandbox is automatically blocked in real time on subsequent attempts. Which feature should be enabled on the firewall to achieve this?

An administrator finds that the 'Threat Prevention' logs are not showing any data, despite having an active subscription. What is the most likely cause?

Which TWO steps are necessary to ensure that 'Threat Prevention' is protecting traffic against known vulnerabilities?

What is the purpose of a 'Security Profile Group'?

A network security engineer is configuring a firewall to protect against brute force attacks on the web server. The engineer wants to limit the number of concurrent connections from a single IP address to the web server to 50. Which feature should be configured?

A security engineer is deploying a new Palo Alto Networks firewall pair in an active/passive high availability configuration. The requirement is that if the active device's link to the upstream core switch fails, the passive device must take over immediately, even if the passive device's own link to that same switch is still up. Which HA configuration satisfies this requirement?

What is the primary function of the 'DNS Sinkhole' feature in a DNS Security profile?

A security operations team notices that the firewall's threat logs show many 'url-filtering' entries for a business-critical SaaS application, causing help-desk tickets. The application uses multiple domains and its category changes frequently as new domains are registered. The team wants to stop the false positives without broadly allowing the SaaS category. What is the most precise approach?

An administrator is configuring a File Blocking profile to prevent users from downloading executable files from the internet. The administrator wants the firewall to block the download but still forward the file hash to WildFire for analysis. Which File Blocking action accomplishes this?

A network administrator is configuring a firewall to perform decryption of outbound SSL traffic to inspect for threats. The administrator wants to ensure that traffic to certain categories, such as financial services, is not decrypted due to privacy concerns. Which configuration should be used to achieve this?

You are configuring Advanced URL Filtering. Users report that a site is being blocked, but the category is 'Newly Registered Domains'. How can you allow access to this specific site while keeping the policy for other newly registered domains?

A NetSec-Pro administrator needs to ensure that the firewall can receive dynamic updates for applications and threats. The administrator has verified that the management interface has internet access. Which service must be configured on the management interface to allow these updates?

A NetSec-Pro administrator is configuring a firewall to block known malicious IP addresses. The administrator wants to use a dynamically updated list that is automatically populated from a threat intelligence feed. Which feature should be used?

A NetSec-Pro administrator needs to ensure that the firewall can resolve domain names for its own management services and for DNS sinkholing. Which type of DNS configuration should be set up on the firewall?

A security administrator is configuring a Palo Alto Networks firewall to block malicious files. The administrator wants to ensure that files are scanned for threats and that known malicious files are blocked. Which security profile should be used to scan files for viruses and other malware?

A user is blocked by a URL Filtering profile. Where can you find the specific log entry that explains why the block occurred?

A NetSec-Pro administrator is configuring a firewall to inspect traffic between an internal trusted zone and an external untrusted zone. The security policy allows the traffic, and a security profile group is applied. However, the administrator notices that SSL decryption is not occurring, and encrypted threats are passing uninspected. Which configuration step is required to enable SSL forward proxy decryption?

A security operations team is investigating a series of alerts indicating that the firewall is not blocking known malicious files. They have a WildFire license and a File Blocking profile attached to a security policy. However, users are still able to download and execute malicious executables. Which configuration issue is most likely causing this failure?

A company is experiencing high false-positive rates with WildFire for custom proprietary executable files. What is the recommended configuration to minimize these while maintaining security?

A NetSec-Pro administrator is configuring a security policy to allow access to a critical internal application. The application uses a custom TCP port 8443 and requires that the firewall perform threat inspection. The administrator creates a rule allowing the application and attaches a Vulnerability Protection profile. However, users report that the application is not working. After checking the traffic logs, the administrator sees that the sessions are being denied by the 'intrazone-default' rule. What is the most likely cause?

You need to ensure that the firewall logs identify traffic by the actual application name, even if the traffic is running on a non-standard port. Which mechanism makes this possible?

A network administrator is configuring a Palo Alto Networks firewall and wants to ensure that security policy rules are evaluated in the correct order. They have created several rules with different source and destination zones. Which factor determines the order in which security policy rules are evaluated?

A security administrator is configuring a Palo Alto Networks firewall to decrypt outbound SSL traffic for inspection. They have enabled SSL Forward Proxy decryption on a security policy rule. However, users report that they are unable to access certain banking websites, and the firewall logs show decryption errors. Which action should the administrator take to resolve this issue while maintaining security?

Which TWO actions should be performed when configuring a new DNS Security profile to protect against DNS-based malware?

Which TWO pieces of information are displayed in the 'WildFire Analysis' log?

A security operations team wants to receive alerts when the firewall detects a critical vulnerability exploit attempt. Which component should be configured to generate these alerts?

A network security administrator is configuring a firewall to integrate with a cloud-based threat intelligence service. The administrator wants to automatically block traffic to known malicious IP addresses and domains. Which two actions are required to achieve this? (Choose two.)

What is the impact of selecting 'Action: Reset-Both' in a Threat Prevention profile for a detected vulnerability?

Which feature allows you to block traffic based on a specific geographic region?

You are deploying Advanced URL Filtering. How does the 'Credential Phishing' prevention feature operate?

How does the 'Advanced URL Filtering' subscription improve upon standard URL Filtering?

A NetSec-Pro administrator is deploying a new branch office firewall. The security team requires that all traffic from the branch to the internet be inspected for threats, but they do not want to decrypt traffic due to privacy concerns. Which type of security profile should be applied to the outbound security policy to detect threats in unencrypted traffic without performing SSL decryption?

A network security administrator is configuring a Palo Alto Networks firewall to integrate with a directory service for user identification. They want to ensure that security policies can enforce rules based on user and group information. Which component must be configured to map IP addresses to user identities?

An administrator needs to enable Threat Prevention to protect against a specific zero-day exploit. How are the signatures for these new threats delivered to the firewall?