ACE Exam 201 - PAN-OS 7.0
April 25, 2017 | Author: janojoms | Category: N/A
Short Description
Descripción: with out answer....
Description
20/12/2015
Realize Your Potential: paloaltonetworks
Test Accredited Configuration Engineer (ACE) Exam PANOS 7.0 Version ACE Exam
Question 1 of 50. When configuring a Security Policy Rule based on FQDN Address Objects, which of the following statements is True? The firewall resolves the FQDN first when the policy is committed, and resolves the FQDN again each time Security Profiles are evaluated. The firewall resolves the FQDN first when the policy is committed, and resolves the FQDN again at DNS TTL expiration. In order to create FQDNbased objects, you need to manually define a list of associated IP addresses. Mark for follow up
Question 2 of 50. Using the API in PANOS 6.1, WildFire subscribers can upload up to how many samples per day? 50 1000 500 10 Mark for follow up
Question 3 of 50. In Palo Alto Networks terms, an application is: A specific program detected within an identified stream that can be detected, monitored, and/or blocked. A combination of port and protocol that can be detected, monitored, and/or blocked. A file installed on a local machine that can be detected, monitored, and/or blocked. Webbased traffic from a specific IP address that can be detected, monitored, and/or blocked. Mark for follow up
Question 4 of 50. What is the default setting for 'Action' in a Decryption Policy's rule? Any NoDecrypt None Decrypt Mark for follow up
Question 5 of 50. When Destination Network Address Translation is being performed, the destination in the corresponding Security Policy Rule should use: The PostNAT destination zone and PreNAT IP addresses. The PostNAT destination zone and PostNAT IP addresses. The PreNAT destination zone and PostNAT IP addresses. The PreNAT destination zone and PreNAT IP addresses. Mark for follow up
Question 6 of 50. All of the interfaces on a Palo Alto Networks device must be of the same interface type. True False
Mark for follow up
Question 7 of 50. When using Config Audit, the color yellow indicates which of the following? A setting has been changed between the two config files A setting has been deleted from a config file. A setting has been added to a config file
https://paloaltonetworks.csod.com/Evaluations/EvalLaunch.aspx?loid=e9d5a4eed00144d48d3a07d77495f928&evalLvl=5&redirect_url=%2fphnx%2fdriver.as…
1/8
20/12/2015
Realize Your Potential: paloaltonetworks
An invalid value has been used in a config file. Mark for follow up
Question 8 of 50. Which of the following is NOT a valid option for builtin CLI Admin roles? read/write superuser deviceadmin devicereader Mark for follow up
Question 9 of 50. Security policy rules specify a source interface and a destination interface. True False
Mark for follow up
Question 10 of 50.
Taking into account only the information in the screenshot above, answer the following question. An administrator is using SSH on port 3333 and BitTorrent on port 7777. Which statements are True? The BitTorrent traffic will be allowed. The SSH traffic will be denied. The BitTorrent traffic will be denied. The SSH traffic will be allowed. Mark for follow up
Question 11 of 50. After the installation of the Threat Prevention license, the firewall must be rebooted. True False
Mark for follow up
Question 12 of 50. Attackers will employ a number of tactics to hide malware. One such tactic is to encode and/or compress the file so as to hide the malware. With PANOS 7.0 the firewall can decode up to four levels. But if an attacker has encoded the file beyond four levels, what can you as an administer do to protect your users? Create a Decryption Profile for multilevel encoded files and apply it to a Decryption Policy. Create a File Blocking Profile for multilevel encoded files and apply it to a Decryption Policy. Create a File Blocking Profile for multilevel encoded files with the action set to block. Create a Decryption Policy for multilevel encoded files and set the action to block. Mark for follow up
Question 13 of 50. Will an exported configuration contain Management Interface settings? Yes No
Mark for follow up
Question 14 of 50. When troubleshooting Phase 1 of an IPsec VPN tunnel, which location and log will be most informative?
https://paloaltonetworks.csod.com/Evaluations/EvalLaunch.aspx?loid=e9d5a4eed00144d48d3a07d77495f928&evalLvl=5&redirect_url=%2fphnx%2fdriver.as…
2/8
20/12/2015
Realize Your Potential: paloaltonetworks
Initiating side, System log Initiating side, Traffic log Responding side, System Log Responding side, Traffic log Mark for follow up
Question 15 of 50. Which of the following interface types can have an IP address assigned to it? Layer 3 Layer 2 Tap Virtual Wire Mark for follow up
Question 16 of 50. An interface in tap mode can transmit packets on the wire. True False
Mark for follow up
Question 17 of 50. Select the implicit rules that are applied to traffic that fails to match any administratordefined Security Policies. (Choose all rules that are correct.) Intrazone traffic is allowed Interzone traffic is denied Intrazone traffic is denied Interzone traffic is allowed Mark for follow up
Question 18 of 50. Which statement about config locks is True? A config lock can only be removed by the administrator who set it or by a superuser. A config lock can be removed only by the administrator who set it. A config lock will expire after 24 hours, unless it was set by a superuser. A config lock can be removed only by a superuser. Mark for follow up
Question 19 of 50. When you have created a Security Policy Rule that allows Facebook, what must you do to block all other webbrowsing traffic? Nothing. You can depend on PANOS to block the webbrowsing traffic that is not needed for Facebook use. When creating the policy, ensure that webbrowsing is included in the same rule. Create an additional rule that blocks all other traffic. Ensure that the Service column is defined as "applicationdefault" for this Security policy. Doing this will automatically include the implicit webbrowsing application dependency. Mark for follow up
Question 20 of 50. Without a WildFire subscription, which of the following files can be submitted by the Firewall to the hosted WildFire virtualized sandbox? PE files only MS Office doc/docx, xls/xlsx, and ppt/pptx files only PDF files only PE and Java Applet (jar and class) only Mark for follow up
Question 21 of 50. Users may be authenticated sequentially to multiple authentication servers by configuring: An Authentication Sequence.
https://paloaltonetworks.csod.com/Evaluations/EvalLaunch.aspx?loid=e9d5a4eed00144d48d3a07d77495f928&evalLvl=5&redirect_url=%2fphnx%2fdriver.as…
3/8
20/12/2015
Realize Your Potential: paloaltonetworks
An Authentication Profile. A custom Administrator Profile. Multiple RADIUS servers sharing a VSA configuration. Mark for follow up
Question 22 of 50. WildFire may be used for identifying which of the following types of traffic? Malware RIPv2 DHCP OSPF Mark for follow up
Question 23 of 50. When using remote authentication for users (LDAP, RADIUS, Active Directory, etc.), what must be done to allow a user to authenticate through multiple methods? Create an Authentication Sequence, dictating the order of authentication profiles. This cannot be done. Although multiple authentication methods exist, a firewall must choose a single, global authentication typeand all users must use this method. This cannot be done. A single user can only use one authentication type. Create multiple authentication profiles for the same user. Mark for follow up
Question 24 of 50.
Considering the information in the screenshot above, what is the order of evaluation for this URL Filtering Profile? Allow List, Block List, Custom Categories, URL Categories (BrightCloud or PANDB). URL Categories (BrightCloud or PANDB), Custom Categories, Block List, Allow List. Block List, Allow List, Custom Categories, URL Categories (BrightCloud or PANDB). Block List, Allow List, URL Categories (BrightCloud or PANDB), Custom Categories. Mark for follow up
Question 25 of 50. Which type of license is required to perform Decryption Port Mirroring? A Client Decryption license A subscriptionbased SSL Port license A free PANPADecrypt license A subscriptionbased PANPADecrypt license Mark for follow up
https://paloaltonetworks.csod.com/Evaluations/EvalLaunch.aspx?loid=e9d5a4eed00144d48d3a07d77495f928&evalLvl=5&redirect_url=%2fphnx%2fdriver.as…
4/8
20/12/2015
Realize Your Potential: paloaltonetworks
Question 26 of 50. Can multiple administrator accounts be configured on a single firewall? Yes No
Mark for follow up
Question 27 of 50.
Taking into account only the information in the screenshot above, answer the following question: A span port or a switch is connected to e1/4, but there are no traffic logs. Which of the following conditions most likely explains this behavior? The interface is not assigned an IP address. The interface is not up. There is no zone assigned to the interface. The interface is not assigned a virtual router. Mark for follow up
Question 28 of 50. Which predefined Admin Role has all rights except the rights to create administrative accounts and virtual systems? Superuser vsysadmin Device Administrator A custom admin role must be created for this specific combination of rights. Mark for follow up
Question 29 of 50.
The screenshot above shows part of a firewall’s configuration. If ping traffic can traverse this device from e1/2 to e1/1, which of the following statements must be True about this firewall’s configuration? (Select all correct answers.) There must be appropriate routes in the default virtual router. There must be a security policy rule from Internet zone to trust zone that allows ping. There must be a security policy rule from trust zone to Internet zone that allows ping. There must be a Management Profile that allows ping. (Then assign that Management Profile to e1/1 and e1/2.) Mark for follow up
Question 30 of 50. Which of the following is a routing protocol supported in a Palo Alto Networks firewall?
https://paloaltonetworks.csod.com/Evaluations/EvalLaunch.aspx?loid=e9d5a4eed00144d48d3a07d77495f928&evalLvl=5&redirect_url=%2fphnx%2fdriver.as…
5/8
20/12/2015
Realize Your Potential: paloaltonetworks
RIPv2 IGRP EIGRP ISIS Mark for follow up
Question 31 of 50. WildFire analyzes files to determine whether or not they are malicious. When doing so, WildFire will classify the file with an official verdict. This verdict is known as the WildFire Analysis verdict. Choose the three correct classifications as a result of this analysis and classification? Benign Spyware Safeware Adware Grayware Malware detection Mark for follow up
Question 32 of 50. When employing the BrightCloud URL filtering database in a Palo Alto Networks firewall, the order of evaluation within a profile is: Block list, Allow list, Custom Categories, Cache files, Local URL DB file. Dynamic URL filtering, Block list, Allow list, Cache files, Custom categories, Predefined categories. Block list, Custom Categories, Predefined categories, Dynamic URL filtering, Allow list, Cache files. Block list, Custom Categories, Cache files, Predefined categories, Dynamic URL filtering, Allow list. Mark for follow up
Question 33 of 50. In PANOS 7.0 which of the available choices serves as an alert warning by defining patterns of suspicious traffic and network anomalies that may indicate a host has been compromised? Correlation Objects AppID Signatures Command & Control Signatures Custom Signatures Correlation Events Mark for follow up
Question 34 of 50. True or False: The WildFire Analysis Profile can only be configured to send unknown files to the WildFire Public Cloud only. True False
Mark for follow up
Question 35 of 50. Which of the following most accurately describes Dynamic IP in a Source NAT configuration? The next available IP address in the configured pool is used, but the source port number is unchanged. A single IP address is used, and the source port number is changed. The next available address in the configured pool is used, and the source port number is changed. A single IP address is used, and the source port number is unchanged. Mark for follow up
Question 36 of 50. What will be the user experience when the safe search option is NOT enabled for Google search but the firewall has "Safe Search Enforcement" Enabled? A block page will be presented with instructions on how to set the strict Safe Search option for the Google search. The user will be redirected to a different search site that is specified by the firewall administrator. A task bar popup message will be presented to enable Safe Search. The Firewall will enforce Safe Search if the URL filtering license is still valid. Mark for follow up
https://paloaltonetworks.csod.com/Evaluations/EvalLaunch.aspx?loid=e9d5a4eed00144d48d3a07d77495f928&evalLvl=5&redirect_url=%2fphnx%2fdriver.as…
6/8
20/12/2015
Realize Your Potential: paloaltonetworks
Question 37 of 50. In PANOS 6.0 and later, which of these items may be used as match criterion in a PolicyBased Forwarding Rule? (Choose 3.) Destination Application Source Zone Source User Destination Zone Mark for follow up
Question 38 of 50. A "Continue" action can be configured on which of the following Security Profiles? URL Filtering and File Blocking URL Filtering only URL Filtering, File Blocking, and Data Filtering URL Filtering and Antivirus Mark for follow up
Question 39 of 50. Palo Alto Networks firewalls support the use of both Dynamic (builtin user roles) and RoleBased (customized user roles) for Administrator Accounts. True False
Mark for follow up
Question 40 of 50. Which of the following facts about dynamic updates is correct? Antivirus updates are released daily. Application and Threat updates are released weekly. Application and Threat updates are released daily. Antivirus and URL Filtering updates are released weekly. Application and Antivirus updates are released weekly. Threat and “Threat and URL Filtering” updates are released weekly. Threat and URL Filtering updates are released daily. Application and Antivirus updates are released weekly. Mark for follow up
Question 41 of 50. Previous to PANOS 7.0 the firewall was able to decode up to two levels. With PANOS 7.0 the firewall can now decode up to how many levels? Four Three Five Six Mark for follow up
Question 42 of 50. Which of the following would be a reason to use the PANOS XML API to communicate with a Palo Alto Networks firewall? To pull information from other network resources for UserID. To permit syslogging of User Identification events. To allow the firewall to push UserID information to a Network Access Control (NAC) device. Mark for follow up
Question 43 of 50. PANOS 7.0 introduced a new Security Profile type. What is the name of this new security profile type? Threat Analysis WildFire Analysis Malware Analysis File Analysis Mark for follow up
Question 44 of 50.
https://paloaltonetworks.csod.com/Evaluations/EvalLaunch.aspx?loid=e9d5a4eed00144d48d3a07d77495f928&evalLvl=5&redirect_url=%2fphnx%2fdriver.as…
7/8
20/12/2015
Realize Your Potential: paloaltonetworks
You can assign an IP address to an interface in Virtual Wire mode. True False
Mark for follow up
Question 45 of 50. Which of the following are methods that HA clusters use to identify network outages? Link and Session Monitors Path and Link Monitoring Heartbeat and Session Monitors VR and VSYS Monitors Mark for follow up
Question 46 of 50. When an interface is in Tap mode and a Policy’s action is set to “block”, the interface will send a TCP reset. True False
Mark for follow up
Question 47 of 50. How do you reduce the amount of information recorded in the URL Content Filtering Logs? Enable "Log container page only". Disable URL packet captures. Enable URL log caching. Enable DSRI. Mark for follow up
Question 48 of 50. What will the user experience when attempting to access a blocked hacking website through a translation service such as Google Translate or Bing Translator? A “Blocked” page response when the URL filtering policy to block is enforced. A “Success” page response when the site is successfully translated. The browser will be redirected to the original website address. An "HTTP Error 503 Service unavailable" message. Mark for follow up
Question 49 of 50. True or False: The PANDB URL Filtering Service is offered as both a Private Cloud solution and a Public Cloud solution. True False
Mark for follow up
Question 50 of 50. With IKE Phase 1, each device is identified to the other by a Peer ID. In most cases, the Peer ID is just the public IP address of the device. In situations where the public IP address is not static, the Peer ID can be a text value. True False
Mark for follow up
Save / Return Later
Summary
https://paloaltonetworks.csod.com/Evaluations/EvalLaunch.aspx?loid=e9d5a4eed00144d48d3a07d77495f928&evalLvl=5&redirect_url=%2fphnx%2fdriver.as…
8/8
View more...
Comments
