Which solution is best for securing an EKS environment?

CN-Series high availability (HA) pair

Which two statements apply to the VM-Series plugin? (Choose two.)

It can be upgraded independently of PAN-OS.

It enables management of cloud-specific interactions between VM-Series firewalls and supported public cloud platforms.

It can manage capabilities common to both VM-Series firewalls and hardware firewalls.

It can be upgraded independently of PAN-OS.

It enables management of cloud-specific interactions between VM-Series firewalls and supported public cloud platforms.

It can manage Panorama plugins.

What can software next-generation firewall (NGFW) credits be used to provision?

Migrating NGFWs from hardware to VMs

How is traffic directed to a Palo Alto Networks firewall integrated with Cisco ACI?

Through a policy-based redirect

By using contracts between endpoint groups that send traffic to the firewall using a shared policy

Through a virtual machine (VM) monitor domain

Through a policy-based redirect

Which two elements of the Palo Alto Networks platform architecture enable security orchestration in a software-defined network (SDN)? (Choose two.)

Full set of APIs enabling programmatic control of policy and configuration

Dynamic Address Groups to adapt Security policies dynamically

Full set of APIs enabling programmatic control of policy and configuration

VXLAN support for network-layer abstraction

Dynamic Address Groups to adapt Security policies dynamically

NVGRE support for advanced VLAN integration

A customer in a VMware ESXi environment wants to add a VM-Series firewall and partition an existing group of virtual machines (VMs) in the same subnet into two groups. One group requires no additional security, but the second group requires substantially more security.How can this partition be accomplished without editing the IP addresses or the default gateways of any of the guest VMs?

Create a new virtual switch and use the VM-Series firewall to separate virtual switches using virtual wire mode. Then move the guests that require more security into the new virtual switch.

Edit the IP address of all of the affected VMs. www*

Create a new virtual switch and use the VM-Series firewall to separate virtual switches using virtual wire mode. Then move the guests that require more security into the new virtual switch.

Create a Layer 3 interface in the same subnet as the VMs and then configure proxy Address Resolution Protocol (ARP).

Send the VLAN out of the virtual environment into a hardware Palo Alto Networks firewall in Layer 3 mode. Use the same IP address as the old default gateway, then delete it.

How must a Palo Alto Networks Next-Generation Firewall (NGFW) be configured in order to secure traffic in a Cisco ACI environment?

It must use a Layer 3 underlay network

It must be deployed as a member of a device cluster

It must use a Layer 3 underlay network

It must receive all forwarding lookups from the network controller

It must be identified as a default gateway

Which two factors lead to improved return on investment for prospects interested in Palo Alto Networks virtualized next-generation firewalls (NGFWs)? (Choose two.)

Decreased likelihood of data breach

Reduced operational expenditures

What do tags allow a VM-Series firewall to do in a virtual environment?

Adapt Security policy rules dynamically.

Integrate with security information and event management (SIEM) solutions.

Which two methods of Zero Trust implementation can benefit an organization? (Choose two.)

Security automation is seamlessly integrated.

Which two actions can be performed for VM-Series firewall licensing by an orchestration system?(Choose two.)

Registering an authorization code

Why are VM-Series firewalls and hardware firewalls that are external to the Kubernetes cluster problematic for protecting containerized workloads?

They are located outside the cluster and have no visibility into application-level cluster traffic.

They do not scale independently of the Kubernetes cluster.

They are managed by another entity when located inside the cluster.

They function differently based on whether they are located inside or outside of the cluster.

What is a benefit of network runtime security?

It identifies unknown vulnerabilities that cannot be identified by known Common Vulnerability and Exposure (CVE) lists.

It more narrowly focuses on one security area and requires careful customization integration and maintenance

It removes vulnerabilities that have been baked into containers.

It is siloed to enhance workload security.

It identifies unknown vulnerabilities that cannot be identified by known Common Vulnerability and Exposure (CVE) lists.

What is a design consideration for a prospect who wants to deploy VM-Series firewalls in an Amazon Web Services (AWS) environment?

Only active-passive high availability (HA) is supported.

Special AWS plugins are needed for load balancing.

Resources are shared within the cluster.

Only active-passive high availability (HA) is supported.

High availability (HA) clusters are limited to fewer than 8 virtual appliances.

Which three NSX features can be pushed from Panorama in PAN-OS? (Choose three.)

Security group assignment of virtual machines (VMs)

Which two design options address split brain when configuring high availability (HA)? (Choose two.)

Bundling multiple interfaces in an aggregated interface group and assigning HA2

Sending heartbeats across the HA2 interfaces

Which offering can gain visibility and prevent an attack by a malicious actor attempting to exploit a known web server vulnerability using encrypted communication?

Secure Sockets Layer (SSL) Inbound Inspection

Palo Alto Networks PCSFE Practice Test 1 - Free Online Exam Prep & Questions

Question 1 / 40

Which two subscriptions should be recommended to a customer who is deploying VM-Series firewalls to a private data center but is concerned about protecting data-center resources from malware and lateral movement? (Choose two.)

Intelligent Traffic Offload

Threat Prevention

WildFire

SD-WAN

Comment (0)

Palo Alto Networks PCSFE Practice Test 1

Question

Palo Alto Networks PCSFE Practice Tests

Practice Tests