My ACE Exam
May 2, 2017 | Author: vbsalongo-1 | Category: N/A
Short Description
Other...
Description
1/20/2015
Empowering People: paloaltonetworks
Test Accredited Configuration Engineer (ACE) Exam PANOS 6.0 Version ACE Exam
Question 1 of 50. Which of the following statements is NOT True regarding a Decryption Mirror interface? Supports SSL outbound Supports SSL inbound Can be a member of any VSYS Requires superuser privilege Mark for follow up
Question 2 of 50. How do you reduce the amount of information recorded in the URL Content Filtering Logs? Enable "Log container page only". Disable URL packet captures. Enable URL log caching. Enable DSRI. Mark for follow up
Question 3 of 50. Which routing protocol is supported on the Palo Alto Networks platform? BGP RIPv1 ISIS RSTP Mark for follow up
Question 4 of 50. When using remote authentication for users (LDAP, RADIUS, Active Directory, etc.), what must be done to allow a user to authenticate through multiple methods? Create multiple authentication profiles for the same user. This cannot be done. A single user can only use one authentication type. Create an Authentication Sequence, dictating the order of authentication profiles. This cannot be done. Although multiple authentication methods exist, a firewall must choose a single, global authentication typeand all users must use this method. https://paloaltonetworks.csod.com/Evaluations/EvalLaunch.aspx?loid=7557e2531f91470fa91ca284f048d2c3&evalLvl=5&redirect_url=%2fphnx%2fdriver.as…
1/12
1/20/2015
Empowering People: paloaltonetworks
Mark for follow up
Question 5 of 50. In a Destination NAT configuration, the Translated Address field may be populated with either an IP address or an Address Object. True False
Mark for follow up
Question 6 of 50. Which of the following CANNOT use the source user as a match criterion? DoS Protection Secuirty Policies QoS Antivirus Profile Policy Based Forwarding Mark for follow up
Question 7 of 50. A Config Lock may be removed by which of the following users? (Select all correct answers.) Device administrators Any administrator The administrator who set it Superusers Mark for follow up
Question 8 of 50.
Taking into account only the information in the screenshot above, answer the following question. An administrator is using SSH on port 3333 and BitTorrent on port 7777. Which statements are True? The BitTorrent traffic will be denied. https://paloaltonetworks.csod.com/Evaluations/EvalLaunch.aspx?loid=7557e2531f91470fa91ca284f048d2c3&evalLvl=5&redirect_url=%2fphnx%2fdriver.as…
2/12
1/20/2015
Empowering People: paloaltonetworks
The SSH traffic will be allowed. The BitTorrent traffic will be allowed. The SSH traffic will be denied. Mark for follow up
Question 9 of 50. With IKE Phase 1, each device is identified to the other by a Peer ID. In most cases, the Peer ID is just the public IP address of the device. In situations where the public IP address is not static, the Peer ID can be a text value. True False
Mark for follow up
Question 10 of 50. What Security Profile type must be configured to send files to the WildFire cloud, and with what choices for the action setting? A Data Filtering profile with possible actions of “Forward” or “Continue and Forward”. A Vulnerability Protection profile with the possible action of “Forward”. A File Blocking profile with possible actions of “Forward” or “Continue and Forward”. A URL Filtering profile with the possible action of “Forward”. Mark for follow up
Question 11 of 50. Both SSL decryption and SSH decryption are disabled by default. True False
Mark for follow up
Question 12 of 50. Which of the following would be a reason to use the PANOS XML API to communicate with a Palo Alto Networks firewall? To permit syslogging of User Identification events. To pull information from other network resources for UserID. To allow the firewall to push UserID information to a Network Access Control (NAC) device. Mark for follow up
Question 13 of 50. Without a WildFire subscription, which of the following files can be submitted by the Firewall to the hosted WildFire virtualized sandbox? MS Office doc/docx, xls/xlsx, and ppt/pptx files only https://paloaltonetworks.csod.com/Evaluations/EvalLaunch.aspx?loid=7557e2531f91470fa91ca284f048d2c3&evalLvl=5&redirect_url=%2fphnx%2fdriver.as…
3/12
1/20/2015
Empowering People: paloaltonetworks
PE and Java Applet (jar and class) only PE files only PDF files only Mark for follow up
Question 14 of 50. What is the function of the GlobalProtect Portal? To maintain the list of Global Protect Gateways and specify HIP data that the agent should report. To loadbalance GlobalProtect client connections to GlobalProtect Gateways. To maintain the list of remote GlobalProtect Portals and the list of categories for checking the client machine. To provide redundancy for tunneled connections through the GlobalProtect Gateways. Mark for follow up
Question 15 of 50. Which of the following interface types can have an IP address assigned to it? (Select all correct answers.) Layer 3 Layer 2 Tap Virtual Wire Mark for follow up
Question 16 of 50. Which of the following most accurately describes Dynamic IP in a Source NAT configuration? The next available address in the configured pool is used, and the source port number is changed. A single IP address is used, and the source port number is unchanged. A single IP address is used, and the source port number is changed. The next available IP address in the configured pool is used, but the source port number is unchanged. Mark for follow up
Question 17 of 50. WildFire may be used for identifying which of the following types of traffic? RIPv2 DHCP OSPF Malware https://paloaltonetworks.csod.com/Evaluations/EvalLaunch.aspx?loid=7557e2531f91470fa91ca284f048d2c3&evalLvl=5&redirect_url=%2fphnx%2fdriver.as…
4/12
1/20/2015
Empowering People: paloaltonetworks
Mark for follow up
Question 18 of 50. Which link is used by an Active/Passive cluster to synchronize session information? The Uplink The Control Link The Management Link The Data Link Mark for follow up
Question 19 of 50. Users may be authenticated sequentially to multiple authentication servers by configuring: Multiple RADIUS servers sharing a VSA configuration. A custom Administrator Profile. An Authentication Sequence. An Authentication Profile. Mark for follow up
Question 20 of 50. Which statement about config locks is True? A config lock can be removed only by a superuser. A config lock will expire after 24 hours, unless it was set by a superuser. A config lock can only be removed by the administrator who set it or by a superuser. A config lock can be removed only by the administrator who set it. Mark for follow up
Question 21 of 50. Which feature can be configured to block sessions that the firewall cannot decrypt? Decryption Profile in Security Profile Decryption Profile in PBF Decryption Profile in Decryption Policy Decryption Profile in Security Policy Mark for follow up
Question 22 of 50. All of the interfaces on a Palo Alto Networks device must be of the same interface type. https://paloaltonetworks.csod.com/Evaluations/EvalLaunch.aspx?loid=7557e2531f91470fa91ca284f048d2c3&evalLvl=5&redirect_url=%2fphnx%2fdriver.as…
5/12
1/20/2015
True
Empowering People: paloaltonetworks
False
Mark for follow up
Question 23 of 50. As the Palo Alto Networks Administrator you have enabled Application Block pages. Afterwards, not knowing they are attempting to access a blocked webbased application, users call the Help Desk to complain about network connectivity issues. What is the cause of the increased number of help desk calls? Some AppID's are set with a Session Timeout value that is too low. Application Block Pages will only be displayed when Captive Portal is configured. The firewall admin did not create a custom response page to notify potential users that their attempt to access the web based application is being blocked due to policy. The File Blocking Block Page was disabled. Mark for follow up
Question 24 of 50. When configuring a Decryption Policy rule, which option allows a firewall administrator to control SSHv2 tunneling in policies by specifying the SSHtunnel AppID? SSH Proxy SSL Forward Proxy SSL Inbound Inspection SSL Reverse Proxy Mark for follow up
Question 25 of 50. What is the default DNS sinkhole address used by the Palo Alto Networks Firewall to cut off communication? Any layer 3 interface address specified by the firewall administrator. The MGT interface address. The local loopback address. The default gateway of the firewall. Mark for follow up
Question 26 of 50.
https://paloaltonetworks.csod.com/Evaluations/EvalLaunch.aspx?loid=7557e2531f91470fa91ca284f048d2c3&evalLvl=5&redirect_url=%2fphnx%2fdriver.as…
6/12
1/20/2015
Empowering People: paloaltonetworks
Considering the information in the screenshot above, what is the order of evaluation for this URL Filtering Profile? Block List, Allow List, URL Categories (BrightCloud or PANDB), Custom Categories. Allow List, Block List, Custom Categories, URL Categories (BrightCloud or PANDB). Block List, Allow List, Custom Categories, URL Categories (BrightCloud or PANDB). URL Categories (BrightCloud or PANDB), Custom Categories, Block List, Allow List. Mark for follow up
Question 27 of 50. Security policies specify a source interface and a destination interface. True False
Mark for follow up
Question 28 of 50. Enabling "Highlight Unused Rules" in the Security Policy window will: Highlight all rules that did not match traffic within an administratorspecified time period. Highlight all rules that have not matched traffic since the rule was created or since the last reboot of the firewall. Display rules that caused a validation error to occur at the time a Commit was performed. Temporarily disable rules that have not matched traffic since the rule was created or since the last reboot of the firewall. https://paloaltonetworks.csod.com/Evaluations/EvalLaunch.aspx?loid=7557e2531f91470fa91ca284f048d2c3&evalLvl=5&redirect_url=%2fphnx%2fdriver.as…
7/12
1/20/2015
Empowering People: paloaltonetworks
Mark for follow up
Question 29 of 50. When troubleshooting Phase 1 of an IPsec VPN tunnel, which location and log will be most informative? Responding side, Traffic log Responding side, System Log Initiating side, Traffic log Initiating side, System log Mark for follow up
Question 30 of 50. In PANOS 6.0, rule numbers are: Numbers that specify the order in which security policies are evaluated. Numbers created to be unique identifiers in each firewall’s policy database. Numbers on a scale of 0 to 99 that specify priorities when two or more rules are in conflict. Numbers created to make it easier for users to discuss a complicated or difficult sequence of rules. Mark for follow up
Question 31 of 50. When you have created a Security Policy Rule that allows Facebook, what must you do to block all other webbrowsing traffic? When creating the policy, ensure that webbrowsing is included in the same rule. Nothing. You can depend on PANOS to block the webbrowsing traffic that is not needed for Facebook use. Ensure that the Service column is defined as "applicationdefault" for this Security policy. Doing this will automatically include the implicit webbrowsing application dependency. Create an additional rule that blocks all other traffic. Mark for follow up
Question 32 of 50. When using Config Audit, the color yellow indicates which of the following? A setting has been changed between the two config files A setting has been deleted from a config file. A setting has been added to a config file An invalid value has been used in a config file. Mark for follow up
Question 33 of 50. https://paloaltonetworks.csod.com/Evaluations/EvalLaunch.aspx?loid=7557e2531f91470fa91ca284f048d2c3&evalLvl=5&redirect_url=%2fphnx%2fdriver.as…
8/12
1/20/2015
Empowering People: paloaltonetworks
Will an exported configuration contain Management Interface settings? Yes No
Mark for follow up
Question 34 of 50. An interface in tap mode can transmit packets on the wire. True False
Mark for follow up
Question 35 of 50. Which of the following is a routing protocol supported in a Palo Alto Networks firewall? EIGRP RIPv2 IGRP ISIS Mark for follow up
Question 36 of 50. In Palo Alto Networks terms, an application is: A specific program detected within an identified stream that can be detected, monitored, and/or blocked. A combination of port and protocol that can be detected, monitored, and/or blocked. A file installed on a local machine that can be detected, monitored, and/or blocked. Webbased traffic from a specific IP address that can be detected, monitored, and/or blocked. Mark for follow up
Question 37 of 50. Reconnaissance Protection is a feature used to protect the Palo Alto Networks firewall from port scans. To enable this feature within the GUI go to… Network > Network Profiles > Zone Protection Objects > Zone Protection Interfaces > Interface Number > Zone Protection Policies > Profile > Zone Protection Mark for follow up
Question 38 of 50. Which of the following is NOT a valid option for builtin CLI Admin roles? https://paloaltonetworks.csod.com/Evaluations/EvalLaunch.aspx?loid=7557e2531f91470fa91ca284f048d2c3&evalLvl=5&redirect_url=%2fphnx%2fdriver.as…
9/12
1/20/2015
Empowering People: paloaltonetworks
deviceadmin superuser read/write devicereader Mark for follow up
Question 39 of 50. In which of the following can UserID be used to provide a match condition? (Select all correct answers.) Security Policies NAT Policies Zone Protection Policies Threat Profiles Mark for follow up
Question 40 of 50. A user complains that she is no longer able to access a needed work application after the administrator implemented vulnerability and antispyware profiles. How best can the administrator resolve this issue so the user will once again have access to the needed application? In the vulnerability and antispyware Profiles, create an application exemption for the group’s application. Check the Threat Log and locate an event showing the user’s application being blocked. Using the source IP address displayed in that event, create an IP addressbased exemption for the group that the user is a member of. Create a custom Security Policy for this user so that she will be able to access the required application. Be sure not to apply the vulnerability and antispyware profiles to this policy. Create and enable an Application Override Policy, specifying the port used by this application. Mark for follow up
Question 41 of 50. An enterprise PKI system is required to deploy SSL Forward Proxy decryption capabilities. True False
Mark for follow up
Question 42 of 50. UserID is enabled in the configuration of … A Security Policy. An Interface. A Zone. A Security Profile.
https://paloaltonetworks.csod.com/Evaluations/EvalLaunch.aspx?loid=7557e2531f91470fa91ca284f048d2c3&evalLvl=5&redirect_url=%2fphnx%2fdriver.a…
10/12
1/20/2015
Empowering People: paloaltonetworks
Mark for follow up
Question 43 of 50. What are the benefits gained when the "Enable Passive DNS Monitoring" checkbox is chosen on the firewall? (Select all correct answers.) Improved malware detection in WildFire. Improved DNSbased C&C signatures. Improved PANDB malware detection. Improved BrightCloud malware detection. Mark for follow up
Question 44 of 50. Which of the following platforms supports the Decryption Port Mirror function? PA3000 VMSeries 100 PA2000 PA4000 Mark for follow up
Question 45 of 50. “What is the result of an Administrator submitting a WildFire report’s verdict back to Palo Alto Networks as “Incorrect”? You will receive an update within 15 minutes. The signature will be updated for False positive and False negative files in the next AV signature update. The signature will be updated for False positive and False negative files in the next Application signature update. You will receive an email to disable the signature manually. Mark for follow up
Question 46 of 50. Which of the following facts about dynamic updates is correct? Threat and URL Filtering updates are released daily. Application and Antivirus updates are released weekly. Antivirus updates are released daily. Application and Threat updates are released weekly. Application and Antivirus updates are released weekly. Threat and “Threat and URL Filtering” updates are released weekly. Application and Threat updates are released daily. Antivirus and URL Filtering updates are released weekly. Mark for follow up
Question 47 of 50. https://paloaltonetworks.csod.com/Evaluations/EvalLaunch.aspx?loid=7557e2531f91470fa91ca284f048d2c3&evalLvl=5&redirect_url=%2fphnx%2fdriver.a…
11/12
1/20/2015
Empowering People: paloaltonetworks
When configuring a Security Policy Rule based on FQDN Address Objects, which of the following statements is True? The firewall resolves the FQDN first when the policy is committed, and resolves the FQDN again at DNS TTL expiration. The firewall resolves the FQDN first when the policy is committed, and resolves the FQDN again each time Security Profiles are evaluated. In order to create FQDNbased objects, you need to manually define a list of associated IP addresses. Mark for follow up
Question 48 of 50. What general practice best describes how Palo Alto Networks firewall policies are applied to a session? The rule with the highest rule number is applied. First match applied. Last match applied. Most specific match applied. Mark for follow up
Question 49 of 50. Which of the following statements is NOT True about Palo Alto Networks firewalls? System defaults may be restored by performing a factory reset in Maintenance Mode. The Admin account may be disabled. Initial configuration may be accomplished thru the MGT interface or the Console port. The Admin account may not be disabled. Mark for follow up
Question 50 of 50. When configuring UserID on a Palo Alto Networks firewall, what is the proper procedure to limit User mappings to a particular DHCP scope? In the zone in which User Identification is enabled, select the "Restrict Allocated IP" checkbox. In the zone in which User Identification is enabled, create a User Identification ACL Include List using the same IP ranges as those allocated in the DHCP scope. Under the User Identification settings, under the User Mapping tab, select the "Restrict Users to Allocated IP" checkbox. In the DHCP settings on the Palo Alto Networks firewall, point the DHCP Relay to the IP address of the UserID agent. Mark for follow up
Save / Return Later
Summary
https://paloaltonetworks.csod.com/Evaluations/EvalLaunch.aspx?loid=7557e2531f91470fa91ca284f048d2c3&evalLvl=5&redirect_url=%2fphnx%2fdriver.a…
12/12
View more...
Comments
