Which two tools should a systems engineer use to showcase the benefit of an evaluation that a customer has just concluded?

Security Lifecycle Review (SLR)

A company with a large Active Directory (AD) of over 20,000 groups has user roles based on group membership in the directory. Up to 1,000 groups may be used in Security policies. The company has limited operations personnel and wants to reduce the administrative overhead of managing the synchronization of the groups with their firewalls.What is the recommended architecture to synchronize the company's AD with Palo Alto Networks firewalls?

Configure a group mapping profile with an include group list.

Configure a group mapping profile with custom filters for LDAP attributes that are mapped to the user roles.

Configure a group mapping profile, without a filter, to synchronize all groups.

Configure a group mapping profile with an include group list.

Configure NGFWs to synchronize with the AD after deploying the Cloud Identity Engine (CIE) and agents.

Which two actions should a systems engineer take when a customer is concerned about how to remain aligned to Zero Trust principles as they adopt additional security features over time? (Choose two)

Apply decryption where possible to inspect and log all new and existing traffic flows.

Use the Best Practice Assessment (BPA) tool to measure progress toward Zero Trust principles.

Turn on all licensed Cloud-Delivered Security Services (CDSS) subscriptions in blocking mode for all policies.

Apply decryption where possible to inspect and log all new and existing traffic flows.

Use the Best Practice Assessment (BPA) tool to measure progress toward Zero Trust principles.

Use the Policy Optimizer tool to understand security rules allowing users to bypass decryption.

Which three tools can a prospective customer use to evaluate Palo Alto Networks products to assess where they will fit in the existing architecture? (Choose three)

Security Lifecycle Review (SLR)

Which two compliance frameworks are included with the Premium version of Strata Cloud Manager (SCM)? (Choose two)

Center for Internet Security (CIS)

National Institute of Standards and Technology (NIST)

Center for Internet Security (CIS)

Health Insurance Portability and Accountability Act (HIPAA)

Which use case is valid for Palo Alto Networks Next-Generation Firewalls (NGFWs)?

IT/OT segmentation firewalls allow operational technology resources in plant networks to securely interface with IT resources in the corporate network.

Code-embedded NGFWs provide enhanced internet of things (IoT) security by allowing PAN-OS code to be run on devices that do not support embedded virtual machine (VM) images.

Serverless NGFW code security provides public cloud security for code-only deployments that do not leverage virtual machine (VM) instances or containerized services.

IT/OT segmentation firewalls allow operational technology resources in plant networks to securely interface with IT resources in the corporate network.

PAN-OS GlobalProtect gateways allow companies to run malware and exploit prevention modules on their endpoints without installing endpoint agents.

What would make a customer choose an on-premises solution over a cloud-based SASE solution for their network?

Most employees and applications in close physical proximity in a geographic region.

High growth phase with existing and planned mergers, and with acquisitions being integrated.

Most employees and applications in close physical proximity in a geographic region.

Hybrid work and cloud adoption at various locations that have different requirements per site.

The need to enable business to securely expand its geographical footprint.

A systems engineer (SE) has joined a team to work with a managed security services provider (MSSP) that is evaluating PAN-OS for edge connections to their customer base. The MSSP is concerned about how to efficiently handle routing with all of its customers, especially how to handle BGP peering, because it has created a standard set of rules and settings that it wants to apply to each customer, as well as to maintain and update them. The solution requires logically separated BGP peering setups for each customer. What should the SE do to increase the probability of Palo Alto Networks being awarded the deal?

Work with the MSSP to plan for the enabling of logical routers in the PAN-OS Advanced Routing Engine to allow sharing of routing profiles across the logical routers.

Collaborate with the MSSP to create an API call with a standard set of routing filters, maps, and related actions, then the MSSP can call the API whenever they bring on a new customer.

Confirm to the MSSP that the existing virtual routers will allow them to have logically separated BGP peering setups, but that there is no method to handle the standard criteria across all of the routers.

Establish with the MSSP the use of vsys as the better way to segregate their environment so that customer data does not intermingle.

What are the first two steps a customer should perform as they begin to understand and adopt Zero Trust principles? (Choose two)

Understand which users, devices, infrastructure, applications, data, and services are part of the network or have access to it.

Map the transactions between users, applications, and data, then verify and inspect those transactions.

Understand which users, devices, infrastructure, applications, data, and services are part of the network or have access to it.

Enable relevant Cloud-Delivered Security Services (CDSS) subscriptions to automatically protect the customer's environment from both internal and external threats.

Map the transactions between users, applications, and data, then verify and inspect those transactions.

Implement VM-Series NGFWs in the customer's public and private clouds to protect east-west traffic.

Which action can help alleviate a prospective customer's concerns about transitioning from a legacy firewall with port-based policies to a Palo Alto Networks NGFW with application-based policies?

Discuss the PAN-OS Policy Optimizer feature as a means to safely migrate port-based rules to application-based rules.

Assure the customer that the migration wizard will automatically convert port-based rules to application-based rules upon installation of the new NGFW.

Recommend deploying a new NGFW firewall alongside the customer's existing port-based firewall until they are comfortable removing the port-based firewall.

Reassure the customer that the NGFW supports the continued use of port-based rules, as PAN-OS automatically translates these policies into application-based policies.

Which two statements correctly describe best practices for sizing a firewall deployment with decryption enabled? (Choose two.)

SSL decryption traffic amounts vary from network to network.

Perfect Forward Secrecy (PFS) ephemeral key exchange algorithms such as Diffie-Hellman Ephemeral (DHE) and Elliptic-Curve Diffie-Hellman Exchange (ECDHE) consume more processing resources than Rivest-Shamir-Adleman (RSA) algorithms.

SSL decryption traffic amounts vary from network to network.

Large average transaction sizes consume more processing power to decrypt.

Perfect Forward Secrecy (PFS) ephemeral key exchange algorithms such as Diffie-Hellman Ephemeral (DHE) and Elliptic-Curve Diffie-Hellman Exchange (ECDHE) consume more processing resources than Rivest-Shamir-Adleman (RSA) algorithms.

Rivest-Shamir-Adleman (RSA) certificate authentication method (not the RSA key exchange algorithm) consumes more resources than Elliptic Curve Digital Signature Algorithm (ECDSA), but ECDSA is more secure.

A prospective customer is interested in Palo Alto Networks NGFWs and wants to evaluate the ability to segregate its internal network into unique BGP environments.Which statement describes the ability of NGFWs to address this need?

It can be addressed by creating multiple eBGP autonomous systems.

It cannot be addressed because PAN-OS does not support it.

It can be addressed by creating multiple eBGP autonomous systems.

It can be addressed with BGP confederations.

It cannot be addressed because BGP must be fully meshed internally to work.

In addition to Advanced DNS Security, which three Cloud-Delivered Security Services (CDSS) subscriptions utilize inline machine learning (ML)? (Choose three)

IoT Security IoT Security is focused on discovering and managing IoT devices connected to the network. While this service uses machine learning for device behavior profiling and anomaly detection, it does not leverage inline machine learning for real-time traffic inspection. Instead, it operates at a more general level by providing visibility and identifying device risks. Key Takeaways: Enterprise DLP, Advanced URL Filtering, and Advanced Threat Prevention all rely on inline machine learning to provide real-time protection. Advanced WildFire uses ML but not inline; its analysis is performed in the cloud. IoT Security applies ML for device management rather than inline threat detection.

Palo Alto Networks PSE-Strata-Pro-24 Practice Test 2 - Free Online Exam Prep & Questions

Spam

Selling illegal goods, money scams etc.

Hate Speech

Serious attack on a group.

Harassment and bullying

Harassing an individual (including doxing)

Harmful activities

Threatening or glorifying violence or serious harm, including self-harm

Adult content (Consensual)

Nudity/Sexual content

Sexual exploitation and abuse (child safety)

Sexually explicit or suggestive imagery or writing involving minors

Sexual exploitation and abuse (adults and animals)

Sexually explicit or suggestive imagery or writing involving non-consenting adults or non-humans

Plagiarism

Reusing content without attribution (link and blockquotes)

Poorly written

Not in English or has very bad formatting, grammar, and spelling

Inappropriate credential

Author's credential is offensive, spam, or impersonation

Other

Ex. Illegal content, incomplete question...

Palo Alto Networks PSE-Strata-Pro-24 Practice Test 2

Question

Palo Alto Networks PSE-Strata-Pro-24 Practice Tests

Practice Tests