CCNA Platform Solutions Services And Tools Questions

MCQhard

You are troubleshooting a connectivity issue between an SCM-managed firewall and the SCM cloud service. Which log source in the firewall UI provides the most detailed information regarding the management connection?

A.Configuration logs

B.Threat logs

C.Traffic logs

D.System logs

AnswerD

System logs contain events related to the management service and connectivity to SCM.

Why this answer

The system logs, specifically filtering for 'ssl-vpn' or management service traffic, help identify connection failures.

Practice this question →

MCQmedium

When managing multiple firewalls in Panorama, what is the best practice for handling software image updates?

A.Upload images to Panorama and use the 'Software' tab to push them to devices.

B.Use the 'Auto-Update' feature on firewalls only.

C.Download images directly on each firewall.

D.Use an external TFTP server for all devices.

AnswerA

Centralized upload ensures all firewalls receive the approved software version.

Why this answer

Uploading images to the Panorama server first allows for consistent deployment to all managed firewalls.

Practice this question →

MCQmedium

You are migrating existing on-premises Panorama appliances to Strata Cloud Manager (SCM). After establishing connectivity, you notice that your device groups are not appearing in the SCM interface. Which action is required to resolve this?

A.Manually export and import XML configurations for every device group.

B.Enable Panorama mode on SCM.

C.Re-register all managed firewalls directly to SCM via serial number.

D.Run the SCM migration utility to map Panorama device groups to SCM containers.

AnswerD

The migration tool is necessary to transition the hierarchy to SCM's container-based architecture.

Why this answer

SCM requires the migration of the Panorama hierarchy into the SCM structure using the SCM migration tool which syncs the configuration objects.

Practice this question →

MCQeasy

Which protocol does Panorama use to communicate with managed firewalls for configuration synchronization?

A.SSH

B.HTTP

C.SSL/TLS

D.SNMPv3

AnswerC

Panorama uses a secure SSL/TLS connection to manage firewalls.

Why this answer

Panorama uses a secure, encrypted SSL/TLS tunnel (often referred to as the PAN-DB or management tunnel) for configuration sync.

Practice this question →

MCQhard

An administrator needs to enforce a consistent security policy across 50 branch firewalls using SCM. They want to ensure that any changes made at the local firewall level are overridden by SCM. Which setting must be configured?

A.Enable 'Local Policy Precedence' on all firewalls.

B.Set the 'Device Override' to 'Disabled' in the SCM container settings.

C.Disable 'Management Plane Access' for local admins.

D.Configure 'Auto-Commit' on every firewall.

AnswerB

Disabling device overrides ensures that local changes cannot deviate from the pushed SCM policy.

Why this answer

In SCM, the 'Inheritance' and 'Push' model ensures that central policies are enforced on target devices.

Practice this question →

MCQeasy

Which command is used on a Palo Alto Networks firewall to verify current license entitlements from the CLI?

A.show system license

B.check license-status

C.request license info

D.debug license fetch

AnswerC

This command provides a detailed list of active and expired license entitlements.

Why this answer

'request license info' is the standard command to display the status and expiration of all installed licenses.

Practice this question →

Multi-Selectmedium

Which TWO actions should an administrator perform to prepare for a large-scale firmware upgrade across an enterprise using Panorama?

Select 2 answers

A.Delete all old logs to free up space.

B.Upload the firmware images to Panorama.

C.Verify the 'Compatibility Matrix' for all firewall models.

D.Disable all security policies.

E.Manually SSH into every firewall to check disk space.

AnswersB, C

Images must be local to Panorama for distribution.

Why this answer

Preparation involves verifying hardware compatibility and ensuring the images are pre-loaded on the Panorama server.

Practice this question →

MCQhard

You are troubleshooting an issue where a specific Threat Prevention profile is not applying correctly via Panorama. The setting is configured in a Template, but the firewall shows a different value. What should you check?

A.The local device group lockdown setting.

B.The Panorama log collector status.

C.The firewall's OS version compatibility.

D.The order of the templates within the Template Stack.

AnswerD

Templates at the top of the stack override those at the bottom.

Why this answer

Template Stacks can have multiple templates, and the order dictates which takes precedence for shared objects.

Practice this question →

MCQhard

When migrating from Panorama to SCM, what happens to the existing log data stored on the Panorama appliance?

A.It is automatically moved to SCM storage.

B.It is purged immediately upon successful migration.

C.It is exported as a CSV file to the administrator's desktop.

D.It remains on the Panorama appliance and must be archived manually.

AnswerD

Panorama logs stay local; migration tools typically migrate configuration, not data.

Why this answer

Log data is not migrated to SCM automatically; it remains on the Panorama appliance until purged by local retention policies.

Practice this question →

MCQmedium

An administrator is unable to push a configuration to a firewall managed by Panorama. The error message indicates a 'Template conflict'. What is the most likely cause?

A.The Panorama license has expired.

B.The Template Stack order is incorrectly configured, causing overlapping values.

C.The firewall is in maintenance mode.

D.The device group is locked by another administrator.

AnswerB

Template stacks apply settings in order; conflicts occur when multiple templates in the stack define the same parameter.

Why this answer

A template conflict usually occurs when a setting is defined in both the Device-level configuration and the Panorama Template stack without proper stack ordering.

Practice this question →

Multi-Selectmedium

Which TWO methods can be used to monitor the status of a configuration push from Panorama?

Select 2 answers

A.Check the firewall's local 'Traffic' log.

B.System log export

C.Use the CLI 'show system state' command.

D.Panorama Tasks menu

E.Commit Status window

AnswersD, E

The Tasks window is the primary place to view progress.

Why this answer

The Tasks interface and the 'Commit Status' window provide real-time updates on push operations.

Practice this question →

MCQeasy

When a firewall is managed by Panorama, where is the authoritative configuration stored?

A.On the local firewall only.

B.In the cloud-based license portal.

C.On the Panorama appliance.

D.On each firewall's local storage independently.

AnswerC

Panorama maintains the master configuration for all managed firewalls.

Why this answer

Panorama serves as the central management point, making its configuration the 'source of truth' for managed devices.

Practice this question →

Multi-Selecthard

Which THREE components are critical to ensure that Panorama can successfully manage a firewall behind a NAT/Firewall?

Select 3 answers

A.A valid auth key/token for the device.

B.TCP port 3978 (PAN-DB/Management) open from the firewall to Panorama.

C.A static public IP for the firewall.

D.Correct Panorama IP address configured on the firewall.

E.SNMP community string configured.

AnswersA, B, D

The token ensures secure authentication between the devices.

Why this answer

Connectivity requires a valid management connection, appropriate port access, and correct authentication credentials.

Practice this question →

Multi-Selectmedium

Which TWO actions are required to successfully onboard a new firewall to Strata Cloud Manager?

Select 2 answers

A.Configure a static route to the SCM cloud URL.

B.Create a local admin user with full permissions.

C.Register the device serial number in the SCM inventory.

D.Install a local management certificate on the firewall.

E.Enable Panorama mode on the firewall.

AnswersC, D

Registration allows SCM to recognize the device.

Why this answer

Onboarding requires both the registration of the device serial number and the establishment of the management connection (auth key).

Practice this question →

Multi-Selectmedium

Which TWO steps are involved in the process of replacing a failed firewall that is managed by Panorama?

Select 2 answers

A.Push the configuration to the new device using the existing Device Group.

B.Re-license every feature manually.

C.Create a new Device Group for the replacement.

D.Remove the old serial number from Panorama and add the new one.

E.Reset the firewall to factory defaults.

AnswersA, D

Once the serial number is updated, the existing config is pushed to the new device.

Why this answer

Replacing a hardware unit requires adopting the existing configuration and assigning the new serial number to the existing device entry.

Practice this question →

Multi-Selecthard

Which TWO factors contribute to 'Configuration Drift' between a firewall and Panorama?

Select 2 answers

A.Local administrators making changes directly on the firewall CLI.

B.The firewall is in 'Read-Only' mode.

C.Panorama is offline during a policy push.

D.Templates not having the 'Override' setting correctly configured for specific parameters.

E.Using different versions of Pan-OS on Panorama and the firewall.

AnswersA, D

Direct local changes circumvent the central management plane.

Why this answer

Drift occurs when local changes are made to a managed device, or when policies are pushed that fail to overwrite existing local settings.

Practice this question →

MCQeasy

Which SCM feature allows you to view the health status of your entire global firewall deployment?

A.Report Generator

B.Device Inventory

C.Dashboard

D.Policy Monitor

AnswerC

The dashboard is designed for global visibility and health status.

Why this answer

The SCM 'Dashboard' provides a high-level overview, including device health and connectivity status.

Practice this question →

Multi-Selectmedium

Which THREE configuration elements are commonly managed via Panorama Templates?

Select 3 answers

A.NTP server settings

B.Address objects

C.Network interfaces

D.Security policy rules

E.DNS settings

AnswersA, C, E

System-wide settings like NTP are part of the template configuration.

Why this answer

Templates manage network and device-level settings like interface configurations, DNS, and NTP settings.

Practice this question →

MCQmedium

Which feature in Strata Cloud Manager allows you to verify that a configuration change complies with security best practices before it is pushed to devices?

A.Policy Optimizer

B.Commit Validation

C.App-ID Dependency Check

D.Configuration Audit

AnswerB

This tool checks the configuration against rules and best practices.

Why this answer

The 'Commit Validation' or 'Pre-check' feature in SCM identifies potential issues before they are deployed.

Practice this question →

MCQeasy

Where do you generate a 'Device Deployment' token for adding a new firewall to Strata Cloud Manager?

A.Customer Support Portal

B.Local Firewall CLI

C.SCM Inventory/Device Management

D.Panorama Settings

AnswerC

Deployment tokens are generated within the device management section of SCM.

Why this answer

The SCM dashboard provides the 'Add Device' or 'Deployment' section to generate tokens for secure device registration.

Practice this question →

MCQmedium

You are using SCM to manage firewall policies. You want to audit who made a specific change to a security policy rule. Which feature should you use?

A.System Logs

B.Audit Logs / Configuration Logs

C.Threat Logs

D.Device Health Logs

AnswerB

These logs show the history of configuration modifications.

Why this answer

The 'Audit Log' or 'Configuration Log' in SCM tracks all changes, including the timestamp and the administrator who performed the action.

Practice this question →

MCQmedium

You need to create a global address object that is available to all firewalls managed by Panorama. Where should you define this?

A.In the 'Shared' device group.

B.In the local firewall's Address tab.

C.In the root Template stack.

D.In the Policy Optimizer.

AnswerA

Objects defined in 'Shared' are available to all child device groups.

Why this answer

Shared objects are defined in the 'Shared' device group to make them available across all devices.

Practice this question →

Multi-Selecthard

Which THREE types of information are contained in the Panorama 'Device Health' report?

Select 3 answers

A.CPU utilization

B.Disk space utilization

C.Memory usage

D.Security policy hit counts

E.Active user count

AnswersA, B, C

System performance metrics are standard in health reports.

Why this answer

Device health reports track resource utilization and system status, essential for enterprise monitoring.

Practice this question →

MCQeasy

What is the primary function of the 'Panorama' context in the Web UI of a managed firewall?

A.To configure local security policies.

B.To change the Panorama server IP address.

C.To initiate a direct sync request to Panorama.

D.To view read-only policies and objects pushed from Panorama.

AnswerD

This context allows the local admin to see what Panorama has enforced.

Why this answer

When a firewall is managed by Panorama, the 'Panorama' menu context allows you to view pushed policies and configuration objects.

Practice this question →

MCQhard

You are managing firewalls across multiple time zones using Panorama. Where do you configure the time zone for the managed firewalls?

A.In a Panorama Template.

B.In the global system settings of Panorama.

C.In the Device Group settings.

D.In the log forwarding profile.

AnswerA

Time, DNS, and NTP are set within Templates assigned to devices.

Why this answer

Time zone settings are part of the Device configuration, which is managed via Panorama Templates.

Practice this question →

MCQeasy

Which tool in the Palo Alto Networks ecosystem is best suited for centralized visibility and reporting across an entire enterprise?

A.Cortex XDR

B.Panorama

C.Threat Vault

D.Customer Support Portal

AnswerB

Panorama provides centralized visibility and reporting for multiple firewalls.

Why this answer

Panorama is the primary tool for centralized management, visibility, and logging (when used with Panorama Logging).

Practice this question →

Multi-Selecthard

Which THREE features are provided by the Strata Cloud Manager 'Subscription Management' interface?

Select 3 answers

A.View expiration dates for security subscriptions.

B.Automate the deployment of licenses to firewalls.

C.Generate license renewal quotes.

D.Configure threat signature update frequency.

E.View current subscription status for all managed devices.

AnswersA, B, E

SCM tracks expiration dates across the global deployment.

Why this answer

SCM provides centralized visibility into license status, expiration, and automated renewal/deployment workflows.

Practice this question →

MCQmedium

When using Panorama, an administrator wants to push policies to specific firewalls based on their geographical location. Which feature should be used?

A.Device Groups

B.Panorama Templates

C.Address Groups

D.Policy Groups

AnswerA

Device Groups are the primary mechanism for grouping firewalls for shared configuration.

Why this answer

Device Groups allow for hierarchical organization of firewalls, enabling targeted policy application.

Practice this question →

MCQmedium

You are configuring 'Log Forwarding' from Panorama to an external SIEM. Which object must you define in Panorama to facilitate this?

A.Log Collector Profile

B.Reporting Profile

C.External Service Profile

D.Log Forwarding Profile

AnswerD

This profile defines the destination server for external log forwarding.

Why this answer

A Log Forwarding Profile must be created and applied to policies to define where logs are sent.

Practice this question →

MCQmedium

You are using the 'Policy Optimizer' in Panorama to identify unused rules. After identifying a rule, what is the safest way to remove it?

A.Disable the rule and monitor for issues, then delete after a set period.

B.Export the policy to CSV and re-import.

C.Immediately delete the rule.

D.Rename the rule to 'Old_Rule' and leave it.

AnswerA

Disabling the rule allows for a quick rollback if production traffic is affected.

Why this answer

Policy Optimizer allows for safe rule removal by tracking 'hits' over time, ensuring the rule is truly redundant.

Practice this question →

MCQhard

An administrator notices that the 'Commit' progress on Panorama hangs at 99%. What is the most effective way to troubleshoot this?

A.Check the 'Tasks' menu in Panorama for detailed error logs on the specific job.

B.Reboot the Panorama appliance.

C.Clear the configuration cache on the firewall.

D.Increase the timeout value in Management Settings.

AnswerA

The Tasks menu provides granular logs for why a commit is failing or hanging.

Why this answer

The task manager in Panorama shows the status of ongoing jobs, and clicking on the job ID reveals detailed logs of the push process.

Practice this question →

Multi-Selecthard

Which THREE items are included in a Panorama configuration 'Export'?

Select 3 answers

A.Security policy rules

B.Template network configurations

C.Log data files

D.Historical threat reports

E.Address and Service objects

AnswersA, B, E

All policy rules are included in the configuration export.

Why this answer

A Panorama configuration export typically includes the full XML policy set, device group structure, and object definitions.

Practice this question →

Multi-Selectmedium

Which TWO of the following are benefits of using Strata Cloud Manager over traditional on-premises Panorama?

Select 2 answers

A.Automatic updates and feature availability.

B.Direct root access to the management server.

C.Support for legacy PAN-OS versions 6.0 and below.

D.Ability to host custom local scripts.

E.Elimination of on-premises hardware maintenance for the management plane.

AnswersA, E

As a SaaS solution, SCM receives updates without manual appliance patching.

Why this answer

SCM provides cloud-native benefits such as reduced infrastructure overhead and automated updates.

Practice this question →