troubleshooting

Which THREE components are required to successfully deploy and use Advanced URL Filtering?

You have a Security Policy rule allowing 'web-browsing' and 'ssl'. A user cannot access a specific site, and the logs show the traffic as 'web-browsing' but failing a specific Security Profile. Which action is most appropriate?

An administrator is troubleshooting a NetSec-Pro firewall where dynamic updates for App-ID and Threat signatures are failing. The firewall has valid internet access, and the management interface has a default route. Which action should be taken next to resolve the issue?

A security administrator is investigating a suspected data exfiltration incident. The administrator needs to identify which user account uploaded a large file to an external cloud storage service. Which log type should the administrator examine to find the username associated with the upload?

You need to ensure that traffic between two internal zones is inspected for threats. What must be configured on the Security Policy?

An administrator is using the Palo Alto Networks Expedition tool to migrate a configuration from a competitor firewall to a Palo Alto Networks firewall. After importing the competitor's configuration, the administrator notices that some rules are not being translated correctly. Which step should the administrator take to improve the translation accuracy?

A network administrator is troubleshooting a Palo Alto Networks firewall and needs to verify which security policy rule is allowing or denying a specific session. The administrator wants to see the rule name and the action taken for a particular flow. Which CLI command should be used?

A network security engineer is configuring a Palo Alto Networks firewall to protect against a specific threat: a malicious PDF file being downloaded from a web server. The engineer wants to block the download and log the event. Which security profile should be configured to detect and block the malicious PDF?

You are troubleshooting a connectivity issue between an SCM-managed firewall and the SCM cloud service. Which log source in the firewall UI provides the most detailed information regarding the management connection?

An administrator is using Strata Cloud Manager to manage a large number of firewalls. They need to generate a report that shows which security policy rules are unused across all managed firewalls over the past 90 days. The report should help identify rules that can be safely removed to improve performance. Which Strata Cloud Manager feature should be used?

When deploying a firewall in a Zero Trust environment, what is the recommended stance for the default interzone policy?

Which TWO settings are configurable within a URL Filtering profile?

A security architect is hardening a PAN-OS firewall that protects a data center. The architect wants to reduce the attack surface exposed by the firewall's own management and control functions. Which TWO measures directly harden the management plane? (Choose two.)

Which command is used to restart the management server process on the firewall without impacting traffic flow?

Which log type should be filtered if you are searching for specific firewall configuration changes made by an administrator?

A network security administrator is configuring a firewall to forward traffic to a sandboxing service for analysis. The administrator wants to ensure that any file determined to be malicious by the sandbox is automatically blocked in real time on subsequent attempts. Which feature should be enabled on the firewall to achieve this?

A security analyst is investigating a series of alerts indicating that an internal host is communicating with a known malicious IP address. The analyst wants to verify whether the traffic was allowed by a specific security policy rule and determine the exact rule name that permitted the session. Which Palo Alto Networks feature should the analyst use to identify the rule that allowed the traffic?

An administrator finds that the 'Threat Prevention' logs are not showing any data, despite having an active subscription. What is the most likely cause?

Where do you navigate in PAN-OS to update the App-ID and Threat signatures to the latest versions?

Which TWO steps are necessary to ensure that 'Threat Prevention' is protecting traffic against known vulnerabilities?

When managing multiple firewalls in Panorama, what is the best practice for handling software image updates?

What is the purpose of a 'Security Profile Group'?

An administrator wants to categorize traffic based on the 'Server' role in the network. Which feature should be used to tag this traffic for policy grouping?

Which THREE of the following are valid Security Profile types?

A security team is deploying a new internal certificate authority for TLS inspection. They want to ensure that compromised private keys can be traced and that certificate issuance is cryptographically bound to a public, append-only log that monitors can audit. Which mechanism should they implement?

Which TWO of the following steps are required to implement a successful Site-to-Site VPN with a third-party vendor?

A NetSec-Pro administrator is configuring a security policy to allow access to a web application. The administrator wants to ensure that the policy enforces least privilege by restricting access to only the necessary users and applications. Which two NetSec-Pro features should be used together to achieve this? (Choose two.)

A network engineer is troubleshooting a Palo Alto Networks firewall where a decryption policy is not decrypting traffic as expected. The policy is configured to decrypt traffic to a specific web server, but the traffic passes through encrypted. Which step should be taken first to diagnose the issue?

A network security engineer is configuring a firewall to protect against brute force attacks on the web server. The engineer wants to limit the number of concurrent connections from a single IP address to the web server to 50. Which feature should be configured?

Which of the following are valid methods for performing an initial configuration of a Palo Alto Networks NGFW? (Choose TWO)

An administrator is configuring a SASE solution with Prisma Access and needs to ensure that all traffic from mobile users is inspected by the NGFW security stack, including traffic to the internet and to private applications. The administrator has already configured the GlobalProtect portal and gateway. Which additional component must be configured to allow mobile users to access private applications hosted in the data center?

A network security engineer is configuring a Security Policy rule to allow access to a specific SaaS application but wants to enforce data loss prevention by blocking the upload of files containing credit card numbers. The engineer also wants to ensure that the application is identified correctly even if it uses non-standard ports. Which two Palo Alto Networks features should be used together to achieve these goals? (Choose two.)

A security engineer is deploying a new Palo Alto Networks firewall pair in an active/passive high availability configuration. The requirement is that if the active device's link to the upstream core switch fails, the passive device must take over immediately, even if the passive device's own link to that same switch is still up. Which HA configuration satisfies this requirement?

A security engineer is using the Palo Alto Networks Expedition tool to migrate a configuration from a Cisco ASA firewall to a Palo Alto Networks firewall. After importing the ASA configuration, the engineer notices that some access control rules are not being translated correctly. What is the most likely cause?

What is the primary function of the 'DNS Sinkhole' feature in a DNS Security profile?

Which TWO of the following are required to successfully implement an App-ID based Security policy?

A security operations team notices that the firewall's threat logs show many 'url-filtering' entries for a business-critical SaaS application, causing help-desk tickets. The application uses multiple domains and its category changes frequently as new domains are registered. The team wants to stop the false positives without broadly allowing the SaaS category. What is the most precise approach?

Which TWO methods can be used to manage administrator access to a Palo Alto Networks firewall?

An administrator is configuring a File Blocking profile to prevent users from downloading executable files from the internet. The administrator wants the firewall to block the download but still forward the file hash to WildFire for analysis. Which File Blocking action accomplishes this?

A security analyst is reviewing a packet capture and notices that a single TCP session to a web server is being inspected, logged, and policy-checked only once, even though the session carries thousands of packets. Which security architecture principle does this behavior illustrate?

Which THREE components are involved in configuring an IKE Gateway for a VPN?

Which command is used to display the current User-ID mapping information on the CLI?

A network administrator is configuring a firewall to perform decryption of outbound SSL traffic to inspect for threats. The administrator wants to ensure that traffic to certain categories, such as financial services, is not decrypted due to privacy concerns. Which configuration should be used to achieve this?

You are configuring a new Security Policy on a PAN-OS firewall. To adhere to the principle of least privilege, which configuration approach should you take for the destination zone and address?

Which TWO actions should an administrator perform to prepare for a large-scale firmware upgrade across an enterprise using Panorama?

A network security engineer is configuring a Palo Alto Networks firewall to enforce least-privilege access for a group of contractors. The contractors must be able to reach only an internal web application over HTTPS. The engineer wants to avoid creating a new security policy that allows any other application. Which Palo Alto Networks feature should the engineer use to identify and control the HTTPS application?

Which TWO of the following are features of Content-ID?

You are troubleshooting an issue where a specific Threat Prevention profile is not applying correctly via Panorama. The setting is configured in a Template, but the firewall shows a different value. What should you check?

A multinational company uses Prisma Access to secure remote workers. They want to ensure that employees can access only approved SaaS applications and that any attempt to use unsanctioned SaaS is blocked and logged for compliance. They also need to apply different policies based on the user's department. Which Prisma Access feature should they use to enforce application-level access control with department-based granularity?

When migrating from Panorama to SCM, what happens to the existing log data stored on the Panorama appliance?

You are setting up an SSL Decryption policy. If you want to exclude traffic to financial websites to comply with privacy laws, how do you configure it?

Which TWO of the following are benefits of using App-ID over port-based security policies?

When configuring an interface for DHCP client, where do you set the default gateway?

If a packet matches a Security Policy rule, but the application is not identified yet, what action does the firewall take?

Which THREE components are involved in the Prisma Access architecture for protecting mobile users?

A security engineer is using the firewall's REST API to retrieve the current list of all security rules in the 'vsys1' virtual system. The engineer wants to receive the response in JSON format. Which API request should be used?

A security policy with a 'Log at Session End' setting is missing log entries for long-lived sessions. Why might this happen?

An administrator is configuring a SASE solution with Palo Alto Networks Prisma Access. The goal is to ensure that traffic from remote users to SaaS applications is inspected for threats while optimizing performance. Which two components are required to achieve this? (Choose two.)

A security administrator is troubleshooting why a Security policy rule that allows access to a specific SaaS application is not working for some users. The rule uses App-ID and User-ID, and the users are authenticated via GlobalProtect. The administrator notices that the rule matches for some users but not others, even though they are in the same User-ID group. What is the most likely cause?

You are troubleshooting a performance issue in Prisma Access. Users report slow access to SaaS applications. You suspect the issue is related to the path selection. Which tool should you use to analyze the latency between the user's mobile client and the Service Connection?

A security administrator is configuring a Site-to-Site VPN between two Palo Alto Networks firewalls. The administrator wants to ensure that the VPN tunnel is established and that traffic is routed correctly. Which interface type should be used for the tunnel interface to allow dynamic routing protocols to run over the VPN?

You are configuring Advanced URL Filtering. Users report that a site is being blocked, but the category is 'Newly Registered Domains'. How can you allow access to this specific site while keeping the policy for other newly registered domains?

Which THREE items are necessary for a properly configured Security Policy rule?

Which THREE of the following are consequences of enabling 'Log at Session End'?

Which THREE criteria can be used to define a security policy for granular control?

An administrator observes that traffic is being correctly identified by App-ID, but the firewall is not applying the expected security profile. What is the most likely reason?

You need to allow traffic based on user group membership. Which feature must be configured to map users to their group information?

An administrator is unable to push a configuration to a firewall managed by Panorama. The error message indicates a 'Template conflict'. What is the most likely cause?

A network security engineer is configuring a Palo Alto Networks firewall to decrypt outbound HTTPS traffic for inspection. The engineer wants to avoid decrypting traffic to financial institutions and healthcare sites for privacy compliance. Which firewall feature should be used to selectively bypass decryption for these categories?

A NetSec-Pro administrator needs to ensure that the firewall can receive dynamic updates for applications and threats. The administrator has verified that the management interface has internet access. Which service must be configured on the management interface to allow these updates?

A security team is deploying a new internal application that uses a proprietary protocol over TCP port 8443. The team wants the firewall to inspect the application and enforce policy based on the application rather than just the port. Which Palo Alto Networks feature should be used to identify and control this application?

An administrator is managing a Prisma Access deployment and needs to ensure that remote users can access a specific internal web application hosted on a server with IP address 10.1.1.100. The administrator has configured a service connection and wants to verify that traffic is being routed correctly. Which action should the administrator take to confirm that the service connection is operational?

A company wants to prevent users from resolving domain names for known malicious command-and-control servers. The security team already subscribes to a threat intelligence feed that publishes malicious domains. Which control should be implemented to block DNS resolutions for those domains at the network level?

A NetSec-Pro administrator is configuring a firewall to block known malicious IP addresses. The administrator wants to use a dynamically updated list that is automatically populated from a threat intelligence feed. Which feature should be used?

Which object type in PAN-OS should be used to group multiple IP addresses for use in a security policy?

A security analyst is reviewing logs and notices that a user's traffic to a known malicious domain is being allowed. The analyst checks the URL Filtering profile and sees that the domain is categorized as 'malware' and the action is set to 'alert'. The analyst wants to block this traffic immediately. What should the analyst change in the URL Filtering profile?

What is the primary difference between a 'Pre-rule' and a 'Post-rule' in a Panorama-managed environment?

A security administrator is deploying Prisma Access for mobile users and needs to ensure that traffic from remote users is inspected for threats and sensitive data. The administrator wants to leverage the Prisma Access architecture to apply security policies consistently. Which TWO of the following components are essential for enforcing security policies on mobile user traffic in Prisma Access? (Choose two.)

A network security engineer needs to verify that a newly created security policy in Strata Cloud Manager will not block critical business applications. The engineer wants to simulate the policy against recent traffic logs without enforcing it. Which Strata Cloud Manager feature should be used?

A NetSec-Pro administrator is configuring a SASE solution with Prisma Access and needs to enforce data loss prevention (DLP) policies for remote users accessing SaaS applications. The administrator wants to ensure that sensitive data is not uploaded to unsanctioned SaaS applications. Which configuration should be applied?

A security administrator is troubleshooting why a web server in the DMZ zone cannot be reached by external clients even though the inbound security policy permits the traffic. The administrator confirms that the DMZ interface has an IP address, the external interface has an IP address, and static routes exist in both directions. The web server's default gateway points to the firewall's DMZ interface. Which additional configuration is required for the firewall to translate the public destination address to the web server's private address?

If a packet matches a Security Policy rule, but the application is not explicitly defined in the rule, what happens to the traffic?

A security administrator is deploying a new Palo Alto Networks next-generation firewall in a remote branch office. The branch has limited on-site IT staff and no dedicated management server. The administrator wants to centrally manage this firewall, push security policies, and monitor traffic without deploying Panorama. Which Palo Alto Networks cloud-delivered service should be used?

Which three actions can be taken when a match occurs in a Security Policy rule? (Choose THREE)

A security administrator is deploying Prisma Access for a branch office. The branch office needs to access internal applications hosted in the corporate data center. Which Prisma Access component should be configured to enable this connectivity?

You have a policy matching 'web-browsing' but traffic is being denied. What is the most likely cause?

A NetSec-Pro administrator is configuring a Security Profile to block malicious files. The administrator wants to ensure that files are analyzed for zero-day exploits and that a verdict is returned to the firewall to block malicious files. Which Palo Alto Networks service should be enabled to achieve this?

A NetSec-Pro administrator is configuring a new security policy to allow internal users to access a web server in a DMZ. The administrator wants to ensure that only HTTP and HTTPS traffic is allowed, and that all other traffic is blocked. Which NetSec-Pro feature should be used to identify and control the application?

A network architect must choose an encryption mode for securing site-to-site traffic over an untrusted provider network. The requirement is to provide confidentiality and integrity for each packet independently, allow parallel processing, and avoid the need for sequential block chaining. Which mode should be selected?

When adding a new Security Policy rule, what is the default position for the rule if you do not specify 'Top' or 'Bottom'?

A NetSec-Pro administrator is configuring a security policy to allow inbound access to a web server in the DMZ. The administrator wants to ensure that the policy is as restrictive as possible. Which combination of settings should be used?

Which THREE tasks are performed by the Dataplane during traffic processing?

When troubleshooting a site-to-site VPN that is stuck in 'INIT' status, what is the most likely cause?

Which TWO of the following are required to enable full visibility into threats inside SSL traffic?

An administrator notices that a firewall is not blocking traffic that matches a security profile group configured with anti-spyware and vulnerability protection. The traffic log shows the session is allowed, but no threat logs are generated. What is the most likely cause?

You want to block a specific URL category for all users except for the 'HR' department. How should the security policy be structured?

A NetSec-Pro administrator needs to ensure that the firewall can resolve domain names for its own management services and for DNS sinkholing. Which type of DNS configuration should be set up on the firewall?

What is the first step in the packet processing flow when a packet arrives at the firewall?

When a firewall is managed by Panorama, where is the authoritative configuration stored?

When troubleshooting a BGP peering issue between a Palo Alto Networks firewall and an ISP, which log should be reviewed to see state changes and neighbor messages?

A user is unable to access an application via GlobalProtect. The logs show the user is authenticated, but the session is reset. What should the administrator check first?

An engineer is configuring a SASE solution to provide secure web access for remote users. The organization wants to enforce different security policies based on user group membership. Which component of the SASE solution is responsible for applying security policies to web traffic?

An administrator needs to restrict access to a specific website. Which profile should be modified?

A security engineer is deploying a SASE solution to protect remote users accessing SaaS applications. The engineer needs to ensure that traffic from remote users is inspected for threats and that access to sanctioned SaaS applications is controlled based on user identity. Which SASE component should the engineer configure to achieve these goals?

Which CLI command is most effective for verifying if a specific packet is being blocked by a security policy in real-time?

Which TWO of the following are valid log types available on the Palo Alto Networks firewall?

An administrator is troubleshooting a Prisma Access remote network deployment where branch users are unable to access the internet through Prisma Access. The remote network firewall shows the IPsec tunnel to Prisma Access is up, and the service connection to the data center is also up. Branch users can access internal resources at the data center but not the internet. Which configuration issue is most likely causing this problem?

A security administrator is configuring a Palo Alto Networks firewall to block malicious files. The administrator wants to ensure that files are scanned for threats and that known malicious files are blocked. Which security profile should be used to scan files for viruses and other malware?

You are troubleshooting an application that is being blocked despite having an Allow security policy. You observe in the Traffic Log that the App-ID is identified as 'incomplete'. What is the most likely cause?

Which feature would you use to verify that a specific interface is properly connected to the upstream ISP?

Which THREE of the following are actions that can be taken when a file is detected by a File Blocking Profile?

A user is blocked by a URL Filtering profile. Where can you find the specific log entry that explains why the block occurred?

Which NGFW feature allows for the inspection of files for malicious content based on signatures and heuristic analysis?

A network security administrator is implementing a defense-in-depth strategy and needs to select controls that operate at the network layer to protect against IP spoofing and to segment traffic between VLANs. Which two controls should the administrator implement? (Choose two.)

A network security administrator is using the Palo Alto Networks Best Practice Assessment (BPA) tool to evaluate the security posture of a firewall. The BPA report shows a low score in the 'Security Policy' category due to overly permissive rules. Which action should the administrator take to improve the score while maintaining necessary access?

What is the function of 'Application Default' in a service object?

A security administrator is configuring a Security Policy rule to allow access to a sanctioned SaaS application. The administrator wants to ensure that the rule only allows the specific SaaS application and not other applications that might use the same underlying protocol. Which App-ID characteristic should be used to achieve this?

You are configuring an SD-WAN path for a branch office. Which metric does the firewall use to determine the best path when multiple paths are available?

A NetSec-Pro administrator is configuring a firewall to inspect traffic between an internal trusted zone and an external untrusted zone. The security policy allows the traffic, and a security profile group is applied. However, the administrator notices that SSL decryption is not occurring, and encrypted threats are passing uninspected. Which configuration step is required to enable SSL forward proxy decryption?

A network security engineer is configuring a Security Policy rule on a Palo Alto Networks NGFW. The engineer wants to allow traffic but generate an alert in the logs for auditing purposes. Which action should be selected in the Security Policy rule?

Which TWO steps are involved in the process of replacing a failed firewall that is managed by Panorama?

When configuring SSL Forward Proxy, which step is mandatory for the firewall to successfully inspect encrypted traffic?

A network administrator is configuring a Security Policy rule to block traffic from a specific IP address. The administrator wants to ensure that the rule is evaluated before other rules that might allow the traffic. What should be configured to achieve this?

Which object type allows you to group multiple IP addresses into a single entity for use in security policies?

A NetSec-Pro administrator is troubleshooting a SASE deployment where remote users report slow access to SaaS applications. The administrator suspects that traffic is being backhauled to the data center instead of going directly to the internet. The organization uses a SASE solution with a cloud secure web gateway (SWG) and SD-WAN. Which action should the administrator take to ensure that SaaS traffic is routed directly to the internet while still being inspected by the SWG?

You are configuring App-ID for an application that uses non-standard ports. You have created a custom application object, but the traffic is still being identified as 'incomplete'. What is the most likely reason?

A security operations team is investigating a series of alerts indicating that the firewall is not blocking known malicious files. They have a WildFire license and a File Blocking profile attached to a security policy. However, users are still able to download and execute malicious executables. Which configuration issue is most likely causing this failure?

You have a security policy that allows 'any' application. What is the security risk of this configuration?

Which TWO factors contribute to 'Configuration Drift' between a firewall and Panorama?

Which SCM feature allows you to view the health status of your entire global firewall deployment?

Which THREE configuration elements are commonly managed via Panorama Templates?

A company is experiencing high false-positive rates with WildFire for custom proprietary executable files. What is the recommended configuration to minimize these while maintaining security?

A network engineer is designing a zero-trust micro-segmentation architecture for an east-west data center. The requirement is to enforce security policy between workloads on the same VLAN without routing traffic through a physical firewall appliance. Which technology should the engineer implement?

A NetSec-Pro administrator is configuring a security policy to allow access to a critical internal application. The application uses a custom TCP port 8443 and requires that the firewall perform threat inspection. The administrator creates a rule allowing the application and attaches a Vulnerability Protection profile. However, users report that the application is not working. After checking the traffic logs, the administrator sees that the sessions are being denied by the 'intrazone-default' rule. What is the most likely cause?

A security administrator is configuring a Security Policy rule to allow web traffic but wants to ensure that users cannot download executable files. The administrator decides to attach a File Blocking profile to the rule. Which action should be set in the File Blocking profile to prevent the download of executable files while still allowing other file types?

Which feature in Strata Cloud Manager allows you to verify that a configuration change complies with security best practices before it is pushed to devices?

An administrator wants to ensure that only 'web-browsing' traffic is allowed on port 80. Which feature allows this enforcement?

A security administrator is deploying Prisma Access for mobile users. The administrator wants to ensure that traffic from mobile users is inspected for threats and that access to certain applications is controlled based on user identity. Which component of Prisma Access is responsible for enforcing security policies and inspecting traffic?

A network security administrator is configuring a Security Policy rule to allow access to a web application. The rule includes the application 'web-browsing' and 'ssl'. Users report that they cannot access the application, and the traffic logs show the application as 'incomplete'. What is the most likely cause?

Which Content-ID component specifically prevents the exfiltration of sensitive data like credit card numbers?

A security team wants to detect command-and-control traffic that uses domain generation algorithms (DGAs) and DNS tunnelling. The firewall already performs DNS sinkholing for known malicious domains. Which two additional capabilities should the team enable to improve detection of these DNS-based threats? (Choose two.)

An engineer is deploying a new Palo Alto Networks firewall and needs to enable DNS sinkholing for malware command-and-control domains. The firewall must respond to internal clients with a sinkhole IP address when they query known malicious domains. Which configuration step is required to make the firewall perform DNS sinkholing?

A security engineer at a financial services company is designing segmentation for a new data center. The requirement is that the web tier (VLAN 20) must never initiate connections to the database tier (VLAN 30), but the database tier must be able to initiate connections to the web tier for replication. Which security policy configuration on a Palo Alto Networks firewall best enforces this requirement?

A security administrator is troubleshooting why a user's GlobalProtect connection is failing. The user can authenticate successfully, but the GlobalProtect client shows 'Connected' yet cannot access internal resources. The administrator checks the GlobalProtect Gateway configuration and sees that the tunnel interface is configured with an IP address and the client IP pool is set. What is the most likely cause of the issue?

An administrator needs to create a backup of the current configuration. Which file type is recommended for an off-box manual restore?

A junior administrator is reviewing how a PAN-OS firewall handles a brand-new TCP session between a client in the Trust zone and a web server in the Untrust zone. They want to confirm which component performs the actual security policy lookup for that first packet before any session entry exists. Which component is responsible?

An administrator needs to ensure that internal users can reach the internet while hiding their private IP addresses. Which NAT type should be configured on the egress interface?

Which action in a Security Policy rule will cause the firewall to send a TCP Reset to the client and server?

You need to ensure that the firewall logs identify traffic by the actual application name, even if the traffic is running on a non-standard port. Which mechanism makes this possible?

A network administrator is troubleshooting a Prisma Access deployment where remote users are unable to access internal applications. The administrator suspects that the issue is related to the service connection configuration. Which component is responsible for routing traffic between Prisma Access and the corporate network?

Where do you generate a 'Device Deployment' token for adding a new firewall to Strata Cloud Manager?

A NetSec-Pro administrator is configuring a Palo Alto Networks NGFW for a SASE deployment. Remote users connect through Prisma Access, and the security team wants to enforce consistent security policies that inspect traffic based on application identity rather than just port and protocol. The administrator needs to ensure that the firewall can identify applications even when they use non-standard ports or encryption. Which Palo Alto Networks technology should the administrator rely on to achieve this?

A network security administrator is hardening a new layer 2 switching infrastructure against common attacks. Which two measures should be implemented to prevent MAC flooding and DHCP spoofing attacks? (Choose two.)

A security architect is reviewing a design where a Palo Alto Networks firewall will inspect traffic between two internal segments that are both connected to the same firewall. The architect wants to ensure that traffic between the segments is subject to security policy and threat inspection rather than being allowed implicitly. The two segments are currently assigned to different subnets but the same security zone. Which change is required to ensure interzone policy enforcement between the segments?

What happens when a security policy rule is set to 'Log at Session End'?

When configuring a zone, what is the primary security benefit of selecting 'Enable User Identification'?

A network security engineer is troubleshooting why a user cannot access a web application. The engineer checks the traffic logs and sees that the session is being denied by a security policy. The engineer suspects that the application is being identified incorrectly. Which tool should the engineer use to verify how the firewall is classifying the application in real time?

A network administrator is configuring a Palo Alto Networks firewall and wants to ensure that security policy rules are evaluated in the correct order. They have created several rules with different source and destination zones. Which factor determines the order in which security policy rules are evaluated?

What is the result of having two security policies with the same source, destination, and service, but different applications?

When using App-ID, what happens if traffic matches a policy allowing 'web-browsing' but the application is actually 'facebook-base'?

A network security engineer is configuring a Palo Alto Networks firewall to inspect traffic between two internal zones. The engineer wants to ensure that the firewall performs application identification and applies security profiles to the traffic. The traffic is currently being allowed by a security policy, but no security profiles are being applied. What is the most likely cause?

A network security engineer is troubleshooting an intermittent issue where some users lose access to an internal application after a firewall policy change. Logs show the traffic is being dropped with a session end reason indicating the application was not identified. The rule in question uses App-ID with a specific application, and the service is application-default. Which condition most likely explains the drop?

Which action should be taken after performing a firmware upgrade on a Palo Alto Networks firewall to ensure all components are up to date?

Which TWO of the following are valid methods for mapping IP addresses to usernames in a Palo Alto Networks NGFW?

A security operations team is using Strata Cloud Manager to monitor firewall health. They want to receive alerts when a managed firewall's CPU utilization exceeds 80% for more than 10 minutes. Which Strata Cloud Manager capability should they configure?

Which of the following are types of Dynamic Updates? (Choose TWO)

A security administrator is configuring a Palo Alto Networks firewall to decrypt outbound SSL traffic for inspection. They have enabled SSL Forward Proxy decryption on a security policy rule. However, users report that they are unable to access certain banking websites, and the firewall logs show decryption errors. Which action should the administrator take to resolve this issue while maintaining security?

A network architect is designing segmentation for a data centre that hosts web, application, and database tiers. The requirement is to enforce policy based on workload identity that can move between hypervisors and physical hosts, without relying on IP addresses that change during live migration. Which segmentation approach best meets this requirement?

When configuring a virtual wire (VWire) interface, which setting is required to pass traffic between the two physical ports?

A security operations team is using the NetSec-Pro 'Policy Optimizer' to review rule usage. They notice that a rule allowing 'any' application on port 80 has a high session count but no application identification. They want to safely transition this rule to a more secure, application-based rule. Which action should they take first according to best practices?

Which TWO actions should be performed when configuring a new DNS Security profile to protect against DNS-based malware?

An administrator managing 200 Palo Alto Networks firewalls with Strata Cloud Manager needs to rapidly deploy a new decryption policy only to firewalls in the European branch offices, which are identified by the region tag 'EU'. The administrator wants to avoid manual per-firewall configuration and ensure the policy is applied consistently. Which SCM feature should the administrator use?

Which TWO pieces of information are displayed in the 'WildFire Analysis' log?

Which THREE features are part of the Palo Alto Networks Single Pass Architecture?

A network security engineer is troubleshooting a Security policy rule that is supposed to block traffic to a known malicious IP address. The rule is configured with the action 'deny' and is placed at the top of the rulebase. However, traffic to that IP is still being allowed. What is the most likely cause?

You are configuring a 'Strict' security profile for a web server. Which profile action is best suited to block known exploit patterns while allowing the traffic?

A NetSec-Pro administrator needs to verify that a newly configured security policy on a Palo Alto Networks firewall is correctly logging traffic to an external syslog server. The administrator has already configured the Log Forwarding profile and syslog server. Which tool in the firewall's web interface should the administrator use to view real-time logs and confirm that they are being forwarded?

A security administrator is configuring a Site-to-Site VPN with a partner organization. The partner uses a policy-based VPN, while your organization uses a route-based VPN with a tunnel interface. The tunnel is up, but traffic is not passing. The administrator confirms that the proxy IDs match on both sides. What is the most likely cause of the issue?

An administrator is unable to download content updates. The firewall has valid internet access, but the management interface has no route to the update server. What is the best solution?

A NetSec-Pro administrator is configuring a Security Policy rule to allow HTTP traffic from the Trust zone to the Untrust zone. The administrator wants to ensure that the firewall identifies the application as web-browsing regardless of the port used. Which Security Policy rule component should be used to achieve this requirement?

An administrator needs to configure a Palo Alto Networks firewall to perform dynamic updates for applications and threats. The firewall has a valid support license and internet connectivity on the management interface. However, the administrator wants to schedule the updates to occur automatically at a specific time. Which configuration tab in the web interface should the administrator use to set up the update schedule?

Which object type is used to group multiple IP addresses or subnets for use in a security policy?

A security operations team wants to receive alerts when the firewall detects a critical vulnerability exploit attempt. Which component should be configured to generate these alerts?

A network security administrator is configuring a Security Policy rule to allow access to a specific SaaS application, but wants to block file uploads to that application. Which Palo Alto Networks feature should the administrator use to achieve this granular control?

A network engineer is setting up a new Security Zone on a Palo Alto Networks firewall. The engineer wants to ensure that traffic entering this zone from any other zone is denied by default. Which action should be taken?

A network security engineer is deploying Prisma Access to secure remote workers. The engineer needs to ensure that traffic from remote users is inspected for threats and that access to SaaS applications is controlled based on user identity and device posture. Which two components are required to achieve these goals? (Choose two.)

A security engineer is configuring a Security Policy rule on a Palo Alto Networks NGFW to block traffic and send a TCP reset to both the client and server. Which action should be selected?

A security team is deploying Prisma Access for remote users and wants to ensure that traffic to sanctioned SaaS applications is inspected for data loss while traffic to unsanctioned SaaS is blocked. They also need to apply different inspection profiles based on user group. Which combination of Prisma Access and NGFW features should they use to meet these requirements?

You are using SCM to manage firewall policies. You want to audit who made a specific change to a security policy rule. Which feature should you use?

Which TWO items can be used as match criteria in a Security Policy rule?

A network administrator is configuring a Site-to-Site VPN between two Palo Alto Networks firewalls. The administrator notices that the VPN tunnel is up, but traffic is not passing through it. The administrator checks the routing table and sees that the route to the remote network is pointing to the tunnel interface. What is the most likely reason for the traffic not passing?

An administrator needs to restrict administrative access to the firewall from only one specific subnet. Where should this be configured?

A security administrator is configuring a Security Profile to protect against unknown threats. The administrator wants to ensure that files downloaded from the internet are analyzed for malicious behavior and that zero-day exploits are detected. Which Security Profile component should be configured?

You need to create a global address object that is available to all firewalls managed by Panorama. Where should you define this?

A security engineer is configuring GlobalProtect on a Palo Alto Networks firewall. The engineer wants to ensure that users are authenticated before they can access internal resources. The engineer has configured the GlobalProtect portal and gateway, but users are able to connect without providing credentials. What is the most likely cause?

Which THREE types of information are contained in the Panorama 'Device Health' report?

A security operations team notices that outbound sessions from internal hosts are being allowed to an external server on TCP port 443, but the firewall's threat logs show no inspection of the application data inside those sessions. The team confirms the traffic is not using a protocol that the firewall cannot decrypt. Which action should the team take to gain visibility into the content of these sessions?

An administrator needs to prevent a specific file type (e.g., .exe) from being downloaded. Which profile is used?

A network security administrator is configuring a firewall to integrate with a cloud-based threat intelligence service. The administrator wants to automatically block traffic to known malicious IP addresses and domains. Which two actions are required to achieve this? (Choose two.)

In Prisma Access, what is the role of the 'Compute Location' setting?

A network security administrator needs to ensure that the Palo Alto Networks firewall can resolve domain names for security policy enforcement. Which service should be configured on the firewall?

What is the primary function of the 'Panorama' context in the Web UI of a managed firewall?

A NetSec-Pro administrator is using the Strata Cloud Manager to manage security policies across multiple tenants. The administrator wants to create a policy rule that applies to all tenants but with the ability to override it in a specific tenant if needed. Which Strata Cloud Manager feature should the administrator use to achieve this?

An analyst is investigating why a server in the DMZ zone can reach an external update site on TCP 443 even though no security rule explicitly permits that server's traffic. The firewall uses a security rule with the application set to 'ssl' and the service set to 'application-default'. Which behaviour explains the observed connectivity?

You are managing firewalls across multiple time zones using Panorama. Where do you configure the time zone for the managed firewalls?

When using User-ID with Active Directory, what is the primary purpose of the User-ID Agent?

Which feature allows the firewall to inspect encrypted traffic for threats?

A network security team is designing segmentation for a new data center. They want to ensure that east-west traffic between application tiers is inspected and that any compromised host cannot freely reach other tiers. They plan to use security zones and security policies on their Palo Alto Networks firewalls. Which TWO design elements are required to enforce least-privilege east-west segmentation? (Choose two.)

Which action in a Security Profile allows you to permit traffic but generate an alert in the logs?

You want to perform a configuration backup and store it on an external server using SCP. Which menu path contains the configuration for scheduled exports?

What is the impact of selecting 'Action: Reset-Both' in a Threat Prevention profile for a detected vulnerability?

An administrator manages a Palo Alto Networks firewall and needs to ensure that the firewall can resolve domain names for its own services, such as for updating dynamic content and resolving FQDN objects in security policies. The administrator has configured DNS servers on the management interface. However, FQDN objects in security policies are not being resolved correctly. What is the most likely cause?

An administrator notices intermittent packet loss in a GlobalProtect deployment where users connect via IPv6. Which configuration change is likely to resolve the issue if MTU fragmentation is suspected?

Which feature allows you to block traffic based on a specific geographic region?

Which tool in the Palo Alto Networks ecosystem is best suited for centralized visibility and reporting across an entire enterprise?

A firewall administrator needs to allow a specific set of external partners to reach a web application while blocking all other internet sources. The partners' addresses change periodically, and the administrator wants to update the permitted list from a central management platform without editing the security rule each time. Which object type should the administrator use?

An administrator wants to use DHCP to assign IP addresses to GlobalProtect clients. Where is this setting configured?

Which THREE of the following are settings that can be configured in a URL Filtering profile?

What is the effect of setting a Security Policy rule action to 'Drop' versus 'Reset-Both'?

An administrator wants to block a specific file type from being uploaded. Which profile is required?

An administrator is implementing PBF (Policy Based Forwarding). What is a requirement for PBF to function correctly?

Which of the following is an example of a Security Profile?

What is the benefit of using an 'Aggregate Interface'?

You are deploying Advanced URL Filtering. How does the 'Credential Phishing' prevention feature operate?

Which TWO of the following are valid components of a PAN-OS Security Policy?

A security team is evaluating controls to detect and prevent IP spoofing at the network edge. Which TWO mechanisms are designed to validate the source address of packets and reduce spoofing? (Choose two.)

Which THREE items must be verified when troubleshooting traffic that is not being correctly identified as the intended application?

A NetSec-Pro administrator needs to configure a new security policy rule on a next-generation firewall to allow HTTP traffic from the trust zone to the untrust zone. The administrator wants to ensure that the rule is placed at the top of the rulebase so that it is evaluated before any other rules. Which action should the administrator take when creating the rule?

Where do you configure a URL Filtering profile?

When using Panorama, an administrator wants to push policies to specific firewalls based on their geographical location. Which feature should be used?

A security analyst is reviewing a packet capture and observes that a single TCP SYN packet sent to a closed port on an internal server elicits a TCP RST response, while the same SYN sent to a filtered port receives no response at all. Which statement best describes what the analyst is observing?

An administrator is configuring a SASE deployment with Prisma Access and needs to ensure that remote users' traffic to sanctioned SaaS applications is inspected by the NGFW security stack while traffic to unsanctioned applications is blocked. The administrator has already configured the Prisma Access mobile users globalprotect infrastructure and added the SaaS applications to the SaaS application list. Which component must be configured next to enforce this policy for remote users?

An administrator needs to restrict access to a specific internal server to only one remote VPN user. What is the most secure method?

You are troubleshooting a connection that is being blocked despite a matching policy. Which tool is best for determining which specific rule is hitting the traffic?

A security administrator needs to allow the NetSec-Pro management plane to authenticate firewall administrators against the corporate Microsoft Active Directory. The AD servers are reachable only on the internal network. Which server profile type should the administrator configure on the firewall to meet this requirement?

Which feature allows an administrator to prevent unauthorized users from using a stolen credential by requiring a second form of authentication?

Which TWO logs are essential when troubleshooting a user who cannot connect to the internet?

How does the 'Advanced URL Filtering' subscription improve upon standard URL Filtering?

You are configuring 'Log Forwarding' from Panorama to an external SIEM. Which object must you define in Panorama to facilitate this?

An administrator is configuring a NetSec-Pro firewall to prevent users from downloading executable files (.exe) from the internet. Which profile should be applied to the Security Policy rule to block this file type?

Which THREE of the following are considered 'App-ID' identification techniques?

A security operations analyst notices that a workstation in the trust zone is repeatedly attempting connections to an external IP address on TCP port 4444, a port commonly associated with remote access trojans. The security policy currently allows the workstation to reach any external destination on any port because of a legacy any-any outbound rule. The analyst wants to block this specific behavior without disrupting legitimate business traffic. Which action should the analyst take first?

Which TWO methods can be used to ensure the firewall has the latest threat intelligence for blocking malicious traffic?

A NetSec-Pro administrator is deploying a new branch office firewall. The security team requires that all traffic from the branch to the internet be inspected for threats, but they do not want to decrypt traffic due to privacy concerns. Which type of security profile should be applied to the outbound security policy to detect threats in unencrypted traffic without performing SSL decryption?

A network security engineer is configuring a Palo Alto Networks firewall to integrate with a SASE solution using GlobalProtect. The requirement is to ensure that traffic from remote users is inspected by the firewall's security profiles before being forwarded to the internet. The engineer has configured a GlobalProtect portal and gateway, and users can connect. However, traffic from remote users is not being inspected by security profiles. What is the most likely missing configuration?

A network security administrator is configuring a Palo Alto Networks firewall to integrate with a directory service for user identification. They want to ensure that security policies can enforce rules based on user and group information. Which component must be configured to map IP addresses to user identities?

An administrator notices that the 'Commit' progress on Panorama hangs at 99%. What is the most effective way to troubleshoot this?

A network administrator is reviewing the TCP/IP model layers while troubleshooting a connectivity issue. The administrator needs to identify which layer is responsible for logical addressing and routing of packets across multiple networks. Which layer of the TCP/IP model performs this function?

An administrator needs to enable NetSec-Pro Clientless VPN for remote users. The portal is configured with a valid certificate and authentication profile. Users report that the portal loads, but no internal web applications are accessible. Which additional component must be configured to allow access to internal web applications?

Which THREE items are included in a Panorama configuration 'Export'?

Which TWO of the following are benefits of using Strata Cloud Manager over traditional on-premises Panorama?

A company is deploying Prisma Access for remote users. The security team wants to ensure that all traffic from remote users is inspected by the full security stack, including threat prevention and URL filtering, while also providing optimal performance for SaaS applications. Which two components are required to achieve this? (Choose two.)

Why should you use an App-ID 'Group' in a security policy?

An administrator is configuring a Palo Alto Networks firewall to integrate with a SASE solution using Prisma Access. They need to ensure that traffic from branch offices is securely forwarded to Prisma Access for inspection. Which component should be configured on the branch office firewall to achieve this?

An administrator is using the Strata Cloud Manager API to programmatically create a security rule. The API request fails with a 400 Bad Request error. The administrator has verified that the authentication token is valid and the endpoint URL is correct. Which of the following is the most likely cause of the error?

A security engineer is configuring a NetSec-Pro appliance to forward logs to an external SIEM using syslog. The SIEM requires that logs be sent over TCP with TLS encryption for compliance. The engineer configures a syslog server profile with the SIEM's IP address and port 6514, and selects 'SSL' as the transport. However, the SIEM is not receiving any logs. Which of the following is the most likely cause of the failure?

A security administrator needs to configure a Palo Alto Networks firewall to send logs to an external syslog server. The logs should include traffic, threat, and URL filtering data. Which type of profile should be configured to forward these logs?

What is the purpose of the 'Zone Protection Profile'?

A network security administrator is configuring a firewall to forward logs to an external syslog server. The syslog server uses a non-standard port and requires TCP for reliability. Which log forwarding destination configuration should the administrator use?

A NetSec-Pro administrator is using the Strata Cloud Manager API to automate the retrieval of security policy rule hit counts across multiple tenants. The API calls are failing with HTTP 403 errors. The administrator has verified that the API key is valid and has not expired. Which of the following is the most likely cause of the 403 errors?

A NetSec-Pro administrator is troubleshooting why a user cannot access a specific SaaS application. The security policy allows the application, but traffic is being denied. The administrator suspects that the application is being identified incorrectly. Which NetSec-Pro feature can be used to verify the application identification and take corrective action?

An administrator needs to enable Threat Prevention to protect against a specific zero-day exploit. How are the signatures for these new threats delivered to the firewall?

An administrator wants to use User-ID. What is the primary benefit of mapping IP addresses to usernames?

A network administrator is deploying a new Palo Alto Networks firewall in a data center. The security policy requires that all traffic to the DMZ be inspected for threats, but the administrator wants to ensure that SSL encrypted traffic is decrypted and inspected without breaking applications that use certificate pinning. Which feature should the administrator configure to selectively decrypt traffic based on the destination URL category?

Which plane on a Palo Alto Networks firewall is responsible for the web interface and CLI?

Which action should be taken if you want to log traffic matching a specific policy?

What does the 'Zone Protection Profile' protect against?

Which THREE of the following items are required to successfully deploy a Prisma Access Service Connection?

An administrator is configuring a Site-to-Site VPN and needs to ensure that the tunnel interface is included in the routing table. What must be done to ensure traffic can be routed across the tunnel?

A network administrator is configuring a NetSec-Pro firewall to send alerts to an external email server when a critical threat is detected. They navigate to the 'Log Settings' under the 'Device' tab and configure the email server profile. Which additional step is required to ensure that threat logs trigger email notifications?

You have configured a custom application object for a proprietary internal tool. When you attempt to use this object in a Security Policy, traffic is still being denied. What is a common configuration error?

Which three types of logs can be generated by a PAN-OS firewall? (Choose THREE)