NEW QUESTION 1
Click the Exhibit button below,


A firewall has three PBF rules and a default route with a next hop of 172.20.10.1 that is configured in the default VR. A user named Will has a PC with a 192.168.10.10 IP address. He makes an HTTPS connection to 172.16.10.20.
Which is the next hop IP address for the HTTPS traffic from Will's PC?

• A. 172.20.30.1
• B. 172.20.40.1
• C. 172.20.20.1
• D. 172.20.10.1

Answer: C

NEW QUESTION 2
Which CLI command can be used to export the tcpdump capture?

• A. scp export tcpdump from mgmt.pcap to <username@host:path>
• B. scp extract mgmt-pcap from mgmt.pcap to <username@host:path>
• C. scp export mgmt-pcap from mgmt.pcap to <username@host:path>
• D. download mgmt.-pcap

Answer: C

NEW QUESTION 3
A VPN connection is set up between Site-A and Site-B, but no traffic is passing in the system log of Site-A, there is an event logged as like-nego-p1-fail-psk.
What action will bring the VPN up and allow traffic to start passing between the sites?

• A. Change the Site-B IKE Gateway profile version to match Site-A,
• B. Change the Site-A IKE Gateway profile exchange mode to aggressive mode.
• C. Enable NAT Traversal on the Site-A IKE Gateway profile.
• D. Change the pre-shared key of Site-B to match the pre-shared key of Site-A

Answer: D

NEW QUESTION 4
PAN-OS 7.0 introduced an automated correlation engine that analyzes log patterns and generates correlation events visible in the new Application Command Center (ACC).
Which license must the firewall have to obtain new correlation objectives?

• A. Application Center
• B. URL Filtering
• C. GlobalProtect
• D. Threat Prevention

Answer: D

NEW QUESTION 5
A company has a policy that denies all applications it classifies as bad and permits only application it classifies as good. The firewall administrator created the following security policy on the company's firewall.

Which interface configuration will accept specific VLAN IDs?
Which two benefits are gained from having both rule 2 and rule 3 presents? (choose two)

• A. A report can be created that identifies unclassified traffic on the network.
• B. Different security profiles can be applied to traffic matching rules 2 and 3.
• C. Rule 2 and 3 apply to traffic on different ports.
• D. Separate Log Forwarding profiles can be applied to rules 2 and 3.

Answer: BD

NEW QUESTION 6
Which three fields can be included in a pcap filter? (Choose three)

• A. Egress interface
• B. Source IP
• C. Rule number
• D. Destination IP
• E. Ingress interface

Answer: BCD

Explanation: (https://live.paloaltonetworks.com/t5/Featured-Articles/Getting-Started-Packet-Capture/ta- p/72069)

NEW QUESTION 7
An administrator logs in to the Palo Alto Networks NGFW and reports that the WebUI is missing the Policies tab. Which profile is the cause of the missing Policies tab?

• A. Admin Role
• B. WebUI
• C. Authentication
• D. Authorization

Answer: A

NEW QUESTION 8
Which interface configuration will accept specific VLAN IDs?

• A. Tab Mode
• B. Subinterface
• C. Access Interface
• D. Trunk Interface

Answer: B

NEW QUESTION 9
A network security engineer for a large company has just installed a PA-5060 Firewall to isolate the company’s PCI environment from its production network. The company’s engineers made configuration changes to the switches on both network segments, and connected them to the new firewall.
Soon after the cutover, however, users began to complain about latency and some servicers stopped communicating. There are no security policies that deny traffic between the two networks segments. You suspect that there is an interface misconfiguration on Ethernet 1/1.
Which two commands should be used to troubleshoot the issue? (Choose two)

• A. show interface hardware
• B. show interface management
• C. show interface ethernet1/1
• D. show interface logical

Answer: CD

NEW QUESTION 10
Which two virtualization platforms officially support the deployment of Palo Alto Networks VM-Series firewalls? (Choose two.)

• A. Red Hat Enterprise Virtualization (RHEV)
• B. Kernel Virtualization Module (KVM)
• C. Boot Strap Virtualization Module (BSVM)
• D. Microsoft Hyper-V

Answer: BD

NEW QUESTION 11
Several offices are connected with VPNs using static IPV4 routes. An administrator has been tasked with implementing OSPF to replace static routing.
Which step is required to accoumplish this goal?

• A. Assign an IP address on each tunnel interface at each site
• B. Enable OSPFv3 on each tunnel interface and use Area ID 0.0.0.0
• C. Assign OSPF Area ID 0.0.0.0 to all Ethernet and tunnel interfaces
• D. Create new VPN zones at each site to terminate each VPN connection

Answer: C

NEW QUESTION 12
A file sharing application is being permitted and no one knows what this application is used for.
How should this application be blocked?

• A. Block all unauthorized applications using a security policy
• B. Block all known internal custom applications
• C. Create a WildFire Analysis Profile that blocks Layer 4 and Layer 7 attacks
• D. Create a File blocking profile that blocks Layer 4 and Layer 7 attacks

Answer: D

NEW QUESTION 13
An administrator needs to optimize traffic to prefer business-critical applications over non- critical applications.
QoS natively integrates with which feature to provide service quality?

• A. Port Inspection
• B. Certificate revocation
• C. Content-ID
• D. App-ID

Answer: D

NEW QUESTION 14
A Network Administrator wants to deploy a Large Scale VPN solution. The Network Administrator has chosen a GlobalProtect Satellite solution. This configuration needs to be deployed to multiple remote offices and the Network Administrator decides to use Panorama to deploy the configurations.
How should this be accomplished?

• A. Create a Template with the appropriate IKE Gateway settings
• B. Create a Template with the appropriate IPSec tunnel settings
• C. Create a Device Group with the appropriate IKE Gateway settings
• D. Create a Device Group with the appropriate IPSec tunnel settings

Answer: B

NEW QUESTION 15
What are three valid method of user mapping? (Choose three)

• A. Syslog
• B. XML API
• C. 802.1X
• D. WildFire
• E. Server Monitoring

Answer: ABE

NEW QUESTION 16
A company hosts a publicly accessible web server behind a Palo Alto Networks next- generation firewall with the following configuration information:
* Users outside the company are in the "Untrust-L3" zone.
* The web server physically resides in the "Trust-L3" zone.
* Web server public IP address: 23.54.6.10
* Web server private IP address: 192.168.1.10
Which two items must the NAT policy contain to allow users in the Untrust-L3 zone to access the web server? (Choose two.)

• A. Destination IPof 23.54.6.10
• B. UntrustL3 for both Source and Destination Zone
• C. Destination IP of 192.168.1.10
• D. UntrustL3 for Source Zone and Trust-L3 for Destination Zone

Answer: AB