NEW QUESTION 10
Refer to the diagram. Users at an internal system want to ssh to the SSH server. The server is configured to respond only to the ssh requests coming from IP 172.16.16.1.
In order to reach the SSH server only from the Trust zone, which Security rule and NAT rule must be configured on the firewall?

NEW QUESTION 11
An administrator is defining protection settings on the Palo Alto Networks NGFW to guard against resource exhaustion. When platform utilization is considered, which steps must the administrator take to configure and apply packet buffer protection?

NEW QUESTION 12
Refer to exhibit.

An organization has Palo Alto Networks NGFWs that send logs to remote monitoring and security management platforms. The network team has reported excessive traffic on the corporate WAN.
How could the Palo Alto Networks NGFW administrator reduce WAN traffic while maintaining support for all existing monitoring/ security platforms?

NEW QUESTION 13
During the implementation of SSL Forward Proxy decryption, an administrator imports the company’s Enterprise Root CA and Intermediate CA certificates onto the firewall. The company’s Root and Intermediate CA certificates are also distributed to trusted devices using Group Policy and GlobalProtect. Additional device certificates and/or Subordinate certificates requiring an Enterprise CA chain of trust are signed by the company’s Intermediate CA.
Which method should the administrator use when creating Forward Trust and Forward Untrust certificates on the firewall for use with decryption?

NEW QUESTION 14
Which three user authentication services can be modified to provide the Palo Alto Networks NGFW with both usernames and role names? (Choose three.)

NEW QUESTION 15
An administrator analyzes the following portion of a VPN system log and notices the following issue
“Received local id 10 10 1 4/24 type IPv4 address protocol 0 port 0, received remote id 10.1.10.4/24 type IPv4 address protocol 0 port 0.” What is the cause of the issue?

NEW QUESTION 16
Below are the steps in the workflow for creating a Best Practice Assessment in a firewall and Panorama configuration Place the steps in order.

NEW QUESTION 17
Which PAN-OS® policy must you configure to force a user to provide additional credentials before he is
allowed to access an internal application that contains highly-sensitive business data?

NEW QUESTION 18
Which User-ID method maps IP addresses to usernames for users connecting through an
802.1x-enabled wireless network device that has no native integration with PAN-OS software?

NEW QUESTION 19
A user at an external system with the IP address 65.124 57 5 quenes the DNS server at 4 2 2 2 for the IP address of the web server www xyz com The DNS server returns an address of 172 16 151 In order to reach the web server, which Security rule and NAT rule must be configured on the firewall?

A)

B)

C)

D)

NEW QUESTION 20
Refer to the exhibit.

Which certificates can be used as a Forwarded Trust certificate?

NEW QUESTION 21
An administrator is using Panorama and multiple Palo Alto Networks NGFWs. After upgrading all devices to the latest PAN-OS software, the administrator enables log forwarding from the firewalls to PanoramA.
Pre-existing logs from the firewalls are not appearing in PanoramA.
Which action would enable the firewalls to send their pre-existing logs to Panorama?

NEW QUESTION 22
To connect the Palo Alto Networks firewall to AutoFocus, which setting must be enabled?

NEW QUESTION 23
A firewall administrator is configuring an IPSec tunnel between Site A and Site B. The Site A firewall uses a DHCP assigned address on the outside interface of the firewall, and the Site B firewall uses a static IP address assigned to the outside interface of the firewall. However, the use of dynamic peering is not working.
Refer to the two sets of configuration settings provided. Which two changes will allow the configurations to work? (Choose two.) Site A configuration:

Site B configuration:

NEW QUESTION 24
Which User-ID method should be configured to map IP addresses to usernames for users connected through a terminal server?

NEW QUESTION 25
A session in the Traffic log is reporting the application as “incomplete.” What does “incomplete” mean?

NEW QUESTION 26
A firewall administrator has been asked to configure a Palo Alto Networks NGFW to prevent against compromised hosts trying to phone-home or beacon out to external command-and-control (C2) servers.
Which security Profile type will prevent these behaviors?

NEW QUESTION 27
An administrator using an enterprise PKI needs to establish a unique chain of trust to ensure mutual authentication between Panorama and the managed firewalls and Log Collectors.
How would the administrator establish the chain of trust?

NEW QUESTION 28
Which two profiles should be configured when sharing tags from threat logs with a remote User-ID agent? (Choose two.)

NEW QUESTION 29
An administrator has been asked to configure a Palo Alto Networks NGFW to provide protection against external hosts attempting to exploit a flaw in an operating system on an internal system.
Which Security Profile type will prevent this attack?

NEW QUESTION 30
When overriding a template configuration locally on a firewall, what should you consider?

NEW QUESTION 31
VPN traffic intended for an administrator’s Palo Alto Networks NGFW is being maliciously intercepted and retransmitted by the interceptor. When creating a VPN tunnel, which protection profile can be enabled to prevent this malicious behavior?

NEW QUESTION 32
A user’s traffic traversing a Palo Alto Networks NGFW sometimes can reach http://www.company.com. At
other times the session times out. The NGFW has been configured with a PBF rule that the user’s traffic
matches when it goes to http://www.company.com.
How can the firewall be configured automatically disable the PBF rule if the next hop goes down?

NEW QUESTION 33
Which feature must you configure to prevent users form accidentally submitting their corporate credentials to a phishing website?