troubleshooting

Which THREE components are required to successfully deploy and use Advanced URL Filtering?

You have a Security Policy rule allowing 'web-browsing' and 'ssl'. A user cannot access a specific site, and the logs show the traffic as 'web-browsing' but failing a specific Security Profile. Which action is most appropriate?

An administrator notices high memory utilization. What is the most effective way to identify which processes are consuming the most resources on the control plane?

You need to ensure that traffic between two internal zones is inspected for threats. What must be configured on the Security Policy?

You are troubleshooting a connectivity issue between an SCM-managed firewall and the SCM cloud service. Which log source in the firewall UI provides the most detailed information regarding the management connection?

When deploying a firewall in a Zero Trust environment, what is the recommended stance for the default interzone policy?

Which TWO settings are configurable within a URL Filtering profile?

Which command is used to restart the management server process on the firewall without impacting traffic flow?

Which log type should be filtered if you are searching for specific firewall configuration changes made by an administrator?

Where is the configuration located to enable the 'DNS Security' service on a specific security zone?

An administrator finds that the 'Threat Prevention' logs are not showing any data, despite having an active subscription. What is the most likely cause?

Where do you navigate in PAN-OS to update the App-ID and Threat signatures to the latest versions?

Which TWO steps are necessary to ensure that 'Threat Prevention' is protecting traffic against known vulnerabilities?

When managing multiple firewalls in Panorama, what is the best practice for handling software image updates?

What is the purpose of a 'Security Profile Group'?

An administrator wants to categorize traffic based on the 'Server' role in the network. Which feature should be used to tag this traffic for policy grouping?

Which THREE of the following are valid Security Profile types?

You are migrating existing on-premises Panorama appliances to Strata Cloud Manager (SCM). After establishing connectivity, you notice that your device groups are not appearing in the SCM interface. Which action is required to resolve this?

Which TWO of the following steps are required to implement a successful Site-to-Site VPN with a third-party vendor?

Which THREE criteria must be satisfied for a traffic session to match a specific NAT rule?

Which TWO of the following are valid ways to deploy GlobalProtect?

Which protocol does Panorama use to communicate with managed firewalls for configuration synchronization?

Which of the following are valid methods for performing an initial configuration of a Palo Alto Networks NGFW? (Choose TWO)

A administrator needs to ensure that users are authenticated before accessing a web-based internal application. Which User-ID method provides the most granular control by prompting users via a captive portal?

An administrator needs to enforce a consistent security policy across 50 branch firewalls using SCM. They want to ensure that any changes made at the local firewall level are overridden by SCM. Which setting must be configured?

Which three components must be configured to enable GlobalProtect Clientless VPN? (Choose THREE)

What is the primary function of the 'DNS Sinkhole' feature in a DNS Security profile?

Which TWO of the following are required to successfully implement an App-ID based Security policy?

Which TWO methods can be used to manage administrator access to a Palo Alto Networks firewall?

Which command is used on a Palo Alto Networks firewall to verify current license entitlements from the CLI?

An application is failing to function correctly even though the Security policy allows the traffic. The App-ID is showing as 'incomplete'. What is the most likely cause?

Which TWO criteria are used by the firewall to match a security policy rule?

Which THREE components are involved in configuring an IKE Gateway for a VPN?

Which interface type is used to connect the firewall to a switch for management or routing?

Which command is used to display the current User-ID mapping information on the CLI?

You are configuring a new Security Policy on a PAN-OS firewall. To adhere to the principle of least privilege, which configuration approach should you take for the destination zone and address?

Which TWO actions should an administrator perform to prepare for a large-scale firmware upgrade across an enterprise using Panorama?

Which TWO of the following are features of Content-ID?

You are troubleshooting an issue where a specific Threat Prevention profile is not applying correctly via Panorama. The setting is configured in a Template, but the firewall shows a different value. What should you check?

When migrating from Panorama to SCM, what happens to the existing log data stored on the Panorama appliance?

You are setting up an SSL Decryption policy. If you want to exclude traffic to financial websites to comply with privacy laws, how do you configure it?

Which TWO of the following are benefits of using App-ID over port-based security policies?

Which component of the Palo Alto Networks architecture is responsible for the 'Single Pass' processing engine?

When configuring an interface for DHCP client, where do you set the default gateway?

If a packet matches a Security Policy rule, but the application is not identified yet, what action does the firewall take?

Which THREE components are involved in the Prisma Access architecture for protecting mobile users?

When using OSPF with a Palo Alto Networks firewall, which area type would you configure to ensure the firewall does not receive external routing information while still maintaining connectivity to the backbone?

A security policy with a 'Log at Session End' setting is missing log entries for long-lived sessions. Why might this happen?

Which three items must be configured to successfully implement a Source NAT rule? (Choose THREE)

When a user connects via GlobalProtect, how does the firewall identify the user if they are not in the AD group?

You are troubleshooting a performance issue in Prisma Access. Users report slow access to SaaS applications. You suspect the issue is related to the path selection. Which tool should you use to analyze the latency between the user's mobile client and the Service Connection?

You are configuring Advanced URL Filtering. Users report that a site is being blocked, but the category is 'Newly Registered Domains'. How can you allow access to this specific site while keeping the policy for other newly registered domains?

Which THREE items are necessary for a properly configured Security Policy rule?

Which three settings are part of a Zone Protection Profile? (Choose THREE)

Which THREE of the following are consequences of enabling 'Log at Session End'?

Which THREE criteria can be used to define a security policy for granular control?

An administrator observes that traffic is being correctly identified by App-ID, but the firewall is not applying the expected security profile. What is the most likely reason?

You need to allow traffic based on user group membership. Which feature must be configured to map users to their group information?

An administrator is unable to push a configuration to a firewall managed by Panorama. The error message indicates a 'Template conflict'. What is the most likely cause?

A company requires that traffic from the VPN zone to the Untrust zone undergoes source NAT using a specific interface IP. Which configuration step is mandatory to ensure this traffic is correctly matched?

Which object type in PAN-OS should be used to group multiple IP addresses for use in a security policy?

What is the primary difference between a 'Pre-rule' and a 'Post-rule' in a Panorama-managed environment?

An administrator needs to ensure that internal users can access a public web server using its public IP address even when they are physically inside the internal network. Which NAT type and configuration approach should be used?

If a packet matches a Security Policy rule, but the application is not explicitly defined in the rule, what happens to the traffic?

Which three actions can be taken when a match occurs in a Security Policy rule? (Choose THREE)

Which TWO methods can be used to monitor the status of a configuration push from Panorama?

You have a policy matching 'web-browsing' but traffic is being denied. What is the most likely cause?

When adding a new Security Policy rule, what is the default position for the rule if you do not specify 'Top' or 'Bottom'?

Which TWO settings are configured within a GlobalProtect Gateway to manage user access?

When managing infrastructure, what is the best practice for handling 'Security Profile Groups'?

Which THREE tasks are performed by the Dataplane during traffic processing?

When troubleshooting a site-to-site VPN that is stuck in 'INIT' status, what is the most likely cause?

Which TWO of the following are required to enable full visibility into threats inside SSL traffic?

You want to block a specific URL category for all users except for the 'HR' department. How should the security policy be structured?

What is the purpose of the 'Pre-Rule' and 'Post-Rule' sections in a Panorama-managed firewall?

What is the first step in the packet processing flow when a packet arrives at the firewall?

When a firewall is managed by Panorama, where is the authoritative configuration stored?

When troubleshooting a BGP peering issue between a Palo Alto Networks firewall and an ISP, which log should be reviewed to see state changes and neighbor messages?

A user is unable to access an application via GlobalProtect. The logs show the user is authenticated, but the session is reset. What should the administrator check first?

An administrator needs to restrict access to a specific website. Which profile should be modified?

Which THREE components are critical to ensure that Panorama can successfully manage a firewall behind a NAT/Firewall?

Which CLI command is most effective for verifying if a specific packet is being blocked by a security policy in real-time?

Which TWO of the following are valid log types available on the Palo Alto Networks firewall?

You are troubleshooting a scenario where internal users cannot access an external server. The traffic log shows the traffic is 'allowed', but the byte count is 0. What is the most likely cause?

You are troubleshooting an application that is being blocked despite having an Allow security policy. You observe in the Traffic Log that the App-ID is identified as 'incomplete'. What is the most likely cause?

Which TWO actions are required to successfully onboard a new firewall to Strata Cloud Manager?

Which feature would you use to verify that a specific interface is properly connected to the upstream ISP?

Which THREE of the following are actions that can be taken when a file is detected by a File Blocking Profile?

A user is blocked by a URL Filtering profile. Where can you find the specific log entry that explains why the block occurred?

Which NGFW feature allows for the inspection of files for malicious content based on signatures and heuristic analysis?

What is the function of 'Application Default' in a service object?

Which feature allows you to monitor traffic patterns and generate security policy recommendations?

You are configuring an SD-WAN path for a branch office. Which metric does the firewall use to determine the best path when multiple paths are available?

Which TWO steps are involved in the process of replacing a failed firewall that is managed by Panorama?

When configuring SSL Forward Proxy, which step is mandatory for the firewall to successfully inspect encrypted traffic?

Which object type allows you to group multiple IP addresses into a single entity for use in security policies?

Which of the following are examples of Interface Management Profile services? (Choose TWO)

You are configuring App-ID for an application that uses non-standard ports. You have created a custom application object, but the traffic is still being identified as 'incomplete'. What is the most likely reason?

You have a security policy that allows 'any' application. What is the security risk of this configuration?

Which TWO factors contribute to 'Configuration Drift' between a firewall and Panorama?

Which SCM feature allows you to view the health status of your entire global firewall deployment?

Which THREE configuration elements are commonly managed via Panorama Templates?

A company is experiencing high false-positive rates with WildFire for custom proprietary executable files. What is the recommended configuration to minimize these while maintaining security?

Which TWO of the following are types of security policies supported by the NGFW?

Which feature in Strata Cloud Manager allows you to verify that a configuration change complies with security best practices before it is pushed to devices?

An administrator wants to ensure that only 'web-browsing' traffic is allowed on port 80. Which feature allows this enforcement?

Which Content-ID component specifically prevents the exfiltration of sensitive data like credit card numbers?

An administrator needs to create a backup of the current configuration. Which file type is recommended for an off-box manual restore?

Which THREE types of information can be used to create a custom URL category?

An administrator needs to ensure that internal users can reach the internet while hiding their private IP addresses. Which NAT type should be configured on the egress interface?

Which action in a Security Policy rule will cause the firewall to send a TCP Reset to the client and server?

You need to ensure that the firewall logs identify traffic by the actual application name, even if the traffic is running on a non-standard port. Which mechanism makes this possible?

Where do you generate a 'Device Deployment' token for adding a new firewall to Strata Cloud Manager?

What happens when a security policy rule is set to 'Log at Session End'?

When configuring a zone, what is the primary security benefit of selecting 'Enable User Identification'?

What is the result of having two security policies with the same source, destination, and service, but different applications?

When using App-ID, what happens if traffic matches a policy allowing 'web-browsing' but the application is actually 'facebook-base'?

Which action should be taken after performing a firmware upgrade on a Palo Alto Networks firewall to ensure all components are up to date?

Which TWO of the following are valid methods for mapping IP addresses to usernames in a Palo Alto Networks NGFW?

Which three items can be used as match criteria in a Security Policy rule? (Choose THREE)

Which of the following are types of Dynamic Updates? (Choose TWO)

When configuring a virtual wire (VWire) interface, which setting is required to pass traffic between the two physical ports?

In a Prisma Access environment, how does the system ensure that a user always connects to the geographically nearest location?

Which TWO actions should be performed when configuring a new DNS Security profile to protect against DNS-based malware?

Which TWO pieces of information are displayed in the 'WildFire Analysis' log?

Which THREE features are part of the Palo Alto Networks Single Pass Architecture?

You are migrating an existing branch office to Prisma Access. Which component is required to allow the branch to communicate with your on-premises data center?

You are configuring a 'Strict' security profile for a web server. Which profile action is best suited to block known exploit patterns while allowing the traffic?

An administrator is unable to download content updates. The firewall has valid internet access, but the management interface has no route to the update server. What is the best solution?

Which object type is used to group multiple IP addresses or subnets for use in a security policy?

You are using SCM to manage firewall policies. You want to audit who made a specific change to a security policy rule. Which feature should you use?

Which TWO items can be used as match criteria in a Security Policy rule?

An administrator needs to restrict administrative access to the firewall from only one specific subnet. Where should this be configured?

You need to create a global address object that is available to all firewalls managed by Panorama. Where should you define this?

Which THREE types of information are contained in the Panorama 'Device Health' report?

An administrator needs to prevent a specific file type (e.g., .exe) from being downloaded. Which profile is used?

In Prisma Access, what is the role of the 'Compute Location' setting?

What is the primary function of the 'Panorama' context in the Web UI of a managed firewall?

You are managing firewalls across multiple time zones using Panorama. Where do you configure the time zone for the managed firewalls?

Which TWO of the following are types of User-ID mapping methods?

When using User-ID with Active Directory, what is the primary purpose of the User-ID Agent?

Which feature allows the firewall to inspect encrypted traffic for threats?

Which action in a Security Profile allows you to permit traffic but generate an alert in the logs?

You want to perform a configuration backup and store it on an external server using SCP. Which menu path contains the configuration for scheduled exports?

What is the impact of selecting 'Action: Reset-Both' in a Threat Prevention profile for a detected vulnerability?

An administrator notices intermittent packet loss in a GlobalProtect deployment where users connect via IPv6. Which configuration change is likely to resolve the issue if MTU fragmentation is suspected?

Which feature allows you to block traffic based on a specific geographic region?

Which tool in the Palo Alto Networks ecosystem is best suited for centralized visibility and reporting across an entire enterprise?

An administrator wants to use DHCP to assign IP addresses to GlobalProtect clients. Where is this setting configured?

Which THREE of the following are settings that can be configured in a URL Filtering profile?

What is the effect of setting a Security Policy rule action to 'Drop' versus 'Reset-Both'?

An administrator wants to block a specific file type from being uploaded. Which profile is required?

An administrator is implementing PBF (Policy Based Forwarding). What is a requirement for PBF to function correctly?

Which of the following is an example of a Security Profile?

Which THREE features are provided by the Strata Cloud Manager 'Subscription Management' interface?

What is the benefit of using an 'Aggregate Interface'?

When managing WildFire, how can you ensure that you are receiving the latest threat signatures as soon as they are generated?

You are deploying Advanced URL Filtering. How does the 'Credential Phishing' prevention feature operate?

Which TWO locations in the PAN-OS web interface are used to check the status of CDSS subscriptions?

Which TWO of the following are valid components of a PAN-OS Security Policy?

Which THREE items must be verified when troubleshooting traffic that is not being correctly identified as the intended application?

Where do you configure a URL Filtering profile?

When using Panorama, an administrator wants to push policies to specific firewalls based on their geographical location. Which feature should be used?

Which type of VPN tunnel configuration is required for a Palo Alto Networks firewall to act as a client connecting to a third-party VPN gateway?

Which type of interface is used to connect to a switch in a Layer 2 configuration where the firewall acts as a transparent bridge?

An administrator needs to restrict access to a specific internal server to only one remote VPN user. What is the most secure method?

You are troubleshooting a connection that is being blocked despite a matching policy. Which tool is best for determining which specific rule is hitting the traffic?

Which feature allows an administrator to prevent unauthorized users from using a stolen credential by requiring a second form of authentication?

Which THREE are types of security policies that can be configured on a Palo Alto Networks firewall?

Which TWO logs are essential when troubleshooting a user who cannot connect to the internet?

How does the 'Advanced URL Filtering' subscription improve upon standard URL Filtering?

You are configuring 'Log Forwarding' from Panorama to an external SIEM. Which object must you define in Panorama to facilitate this?

Which THREE of the following are considered 'App-ID' identification techniques?

You are using the 'Policy Optimizer' in Panorama to identify unused rules. After identifying a rule, what is the safest way to remove it?

An administrator observes that dynamic updates for App-ID and Threat signatures are failing. Which troubleshooting step should be performed first?

Which TWO methods can be used to ensure the firewall has the latest threat intelligence for blocking malicious traffic?

An administrator notices that the 'Commit' progress on Panorama hangs at 99%. What is the most effective way to troubleshoot this?

Which THREE items are included in a Panorama configuration 'Export'?

Which TWO of the following are benefits of using Strata Cloud Manager over traditional on-premises Panorama?

Why should you use an App-ID 'Group' in a security policy?

What is the purpose of the 'Zone Protection Profile'?

An administrator needs to enable Threat Prevention to protect against a specific zero-day exploit. How are the signatures for these new threats delivered to the firewall?

An administrator wants to use User-ID. What is the primary benefit of mapping IP addresses to usernames?

Which action is required to ensure that WildFire analysis results are applied to traffic as quickly as possible?

Which plane on a Palo Alto Networks firewall is responsible for the web interface and CLI?

Which action should be taken if you want to log traffic matching a specific policy?

What does the 'Zone Protection Profile' protect against?

Which THREE of the following items are required to successfully deploy a Prisma Access Service Connection?

An administrator is configuring a Site-to-Site VPN and needs to ensure that the tunnel interface is included in the routing table. What must be done to ensure traffic can be routed across the tunnel?

You have configured a custom application object for a proprietary internal tool. When you attempt to use this object in a Security Policy, traffic is still being denied. What is a common configuration error?

Which three types of logs can be generated by a PAN-OS firewall? (Choose THREE)