What are three considerations when deploying User-ID? (Choose three.)

Specify included and excluded networks when configuring User-ID

Only enable User-ID on trusted zones

Use a dedicated service account for User-ID services with the minimal permissions necessary

Specify included and excluded networks when configuring User-ID

Only enable User-ID on trusted zones

Use a dedicated service account for User-ID services with the minimal permissions necessary

User-ID can support a maximum of 15 hops

Enable WMI probing in high security networks

Which three considerations should be made prior to installing a decryption policy on the NGFW?(Choose three.)

Include all traffic types in decryption policy

Exclude certain types of traffic in decryption policy

Include all traffic types in decryption policy

Exclude certain types of traffic in decryption policy

Deploy decryption setting all at one time

Ensure throughput is not an issue

When having a customer pre-sales call, which aspects of the NGFW should be covered?

Palo Alto Networks URL Filtering allows you to monitor and control the sites users can access, to prevent phishing attacks by controlling the sites to which users can submit valid corporate credentials, and to enforce safe search for search engines like Google and Bing

The NGFW simplifies your operations through analytics and automation while giving you consistent protection through exceptional visibility and control across the data center, perimeter, branch, mobile and cloud networks

The Palo Alto Networks-developed URL filtering database, PAN-DB provides high-performance local caching for maximum inline performance on URL lookups, and offers coverage against malicious URLs and IP addresses. As WildFire identifies unknown malware, zero-day exploits, and advanced persistent threats (APTs), the PAN-DB database is updated with information on malicious URLs so that you can block malware downloads and disable Command and Control (C2) communications to protect your network from cyberthreats. URL categories that identify confirmed malicious content — malware, phishing, and C2 are updated every five minutes — to ensure that you can manage access to these sites within minutes of categorization

The NGFW creates tunnels that allow users/systems to connect securely over a public network, as if they were connecting over a local area network (LAN). To set up a VPN tunnel you need a pair of devices that can authenticate each other and encrypt the flow of information between them The devices can be a pair of Palo Alto Networks firewalls, or a Palo Alto Networks firewall along with a VPN-capable device from another vendor

Palo Alto Networks URL Filtering allows you to monitor and control the sites users can access, to prevent phishing attacks by controlling the sites to which users can submit valid corporate credentials, and to enforce safe search for search engines like Google and Bing

What action would address the sub-optimal traffic path shown in the figure?Key:RN - Remote NetworkSC - Service ConnectionMU GW - Mobile User Gateway

Onboard a Service Connection in the APAC region

Onboard a Service Connection in the Americas region

Remove the Service Connection in the EMEA region

Onboard a Service Connection in the APAC region

Onboard a Remote Network location in the EMEA region

Access to a business site is blocked by URL Filtering inline machine learning (ML) and considered as a false-positive.How should the site be made available?

Create a custom URL category and add it on exception of the inline ML profile

Disable URL Filtering inline ML

Create a custom URL category and add it to the Security policy

Create a custom URL category and add it on exception of the inline ML profile

Change the action of real-time detection category on URL filtering profile

Which two features can be enabled to support asymmetric routing with redundancy on a Palo Alto networks next-generation firewall (NGFW)? (Choose two.)

Active / active high availability (HA)

Which three of the following actions must be taken to enable Credential Phishing Prevention?(Choose three.)

Enable User Credential Detection

Define a uniform resource locator (URL) Filtering profile

Enable User Credential Detection

Define a Secure Sockets Layer (SSL) decryption rule base

Define a uniform resource locator (URL) Filtering profile

Which two configuration elements can be used to prevent abuse of stolen credentials? (Choose two.)

Multi-factor authentication (MFA)

What are two benefits of the sinkhole Internet Protocol (IP) address that DNS Security sends to the client in place of malicious IP addresses? (Choose two.)

The client communicates with it instead of the malicious IP address

In situations where the internal DNS server is between the client and the firewall, it gives the firewall the ability to identify the clients who originated the query to the malicious domain

The client communicates with it instead of the malicious IP address

It represents the remediation server that the client should visit for patching

It will take over as the new DNS resolver for that client and prevent further DNS requests from occurring in the meantime

In situations where the internal DNS server is between the client and the firewall, it gives the firewall the ability to identify the clients who originated the query to the malicious domain

A customer worried about unknown attacks is hesitant to enable SSL decryption due to privacy and regulatory issues. How does the platform address the customer’s concern?

It allows a list of websites or URL categories to be defined for exclusion from decryption

It overcomes reservations about SSL decrypt by offloading to a higher-capacity firewall to help with the decrypt throughput

It shows how AutoFocus can provide visibility into targeted attacks at the industry sector

It allows a list of websites or URL categories to be defined for exclusion from decryption

It bypasses the need to decrypt SSL traffic by analyzing the file while still encrypted

A customer is starting to understand their Zero Trust protect surface using the Palo Alto Networks Zero Trust reference architecture.What are two steps in this process? (Choose two.)

Validate user identities through authentication

Categorize data and applications by levels of sensitivity

Validate user identities through authentication

Gain visibility of and control over applications and functionality in the traffic flow using a port and protocol firewall

Categorize data and applications by levels of sensitivity

Prioritize securing the endpoints of privileged users because if non-privileged user endpoints are exploited, the impact will be minimal due to perimeter controls

Which statement applies to Palo Alto Networks Single Pass Parallel Processing (SP3)?

It processes all traffic in a single pass with no additional performance impact for each enabled feature.

It processes each feature in a separate single pass with additional performance impact for each enabled feature.

Its processing applies only to security features and does not include any networking features.

It processes all traffic in a single pass with no additional performance impact for each enabled feature.

It splits the traffic and processes all security features in a single pass and all network features in a separate pass

What is the recommended way to ensure that firewalls have the most current set of signatures for up-to-date protection?

Use dynamic updates with the most aggressive schedule required by business needs

Run a Perl script to regularly check for updates and alert when one is released

Monitor update announcements and manually push updates to Crewall

Store updates on an intermediary server and point all the firewalls to it

Use dynamic updates with the most aggressive schedule required by business needs

Which of the following statements is valid with regard to Domain Name System (DNS) sinkholing?

infected hosts connecting to the Sinkhole Internet Protocol (IP) address can be identified in the traffic logs

it requires the Vulnerability Protection profile to be enabled

DNS sinkholing signatures are packaged and delivered through Vulnerability Protection updates

infected hosts connecting to the Sinkhole Internet Protocol (IP) address can be identified in the traffic logs

It requires a Sinkhole license in order to activate

A customer with a fully licensed Palo Alto Networks firewall is concerned about threats based on domain generation algorithms (DGAS).Which Security profile is used to configure Domain Name Security (DNS) to Identity and block previously unknown DGA-based threats in real time?

Vulnerability Protection profile

Which three actions should be taken before deploying a firewall evaluation unt in a customer environment? (Choose three.)

Inform the customer that a SPAN port must be provided for the evaluation unit, assuming a TAP mode deployment.

Upgrade the evaluation unit to the most current recommended firmware, unless a demo of the upgrade process is planned.

Reset the evaluation unit to factory default to ensure that data from any previous customer evaluation is removed

Request that the customer make part 3978 available to allow the evaluation unit to communicate with Panorama

Inform the customer that a SPAN port must be provided for the evaluation unit, assuming a TAP mode deployment.

Upgrade the evaluation unit to the most current recommended firmware, unless a demo of the upgrade process is planned.

Set expectations for information being presented in the Security Lifecycle Review (SLR) because personal user information will be made visible

Reset the evaluation unit to factory default to ensure that data from any previous customer evaluation is removed

Which statement best describes the business value of Palo Alto Networks Zero Touch Provisioning(ZTP)?

It is designed to simplify and automate the onboarding of new firewalls to the Panorama management server.

When it is in place, it removes the need for an onsite firewall

When the service is purchased, Palo Alto Networks sends an engineer to physically deploy the firewall to the customer environment

It allows a firewall to be automatically connected to the local network wirelessly

What will best enhance security of a production online system while minimizing the impact for the existing network?

active / active high availability (HA)

Which Security profile on the Next-Generation Firewall (NGFW) includes Signatures to protect against brute force attacks?

Vulnerability Protection profile

A prospective customer currently uses a firewall that provides only Layer 4 inspection and protections. The customer sees traffic going to an external destination, port 53, but cannot determine what Layer 7 application traffic is going over that port Which capability of PAN-OS would address the customer's lack of visibility?

App-ID, because it will give visibility into what exact applications are being run over that port and allow the customer to block unsanctioned applications using port 53

Device ID, because it will give visibility into which devices are communicating with external destinations over port 53

single pass architecture (SPA), because it will improve the performance of the Palo Alto Networks Layer 7 inspection

User-ID, because it will allow the customer to see which users are sending traffic to external destinations over port 53

App-ID, because it will give visibility into what exact applications are being run over that port and allow the customer to block unsanctioned applications using port 53