Test - Accredited Configuration Engineer (ACE) Exam - PAN-OS 6.0 Version

Transcription

1 Tes - Accredied Configuraion Engineer (ACE) Exam - PAN-OS 6.0 Version ACE Exam Quesion 1 of 50. Which of he following saemens is NOT abou Palo Alo Neworks firewalls? Sysem defauls may be resored by performing a facory rese in Mainenance Mode. The Admin accoun may be disabled. The Admin accoun may no be disabled. Iniial configuraion may be accomplished hru he MGT inerface or he Console por. Quesion 2 of 50. Users may be auhenicaed sequenially o muliple auhenicaion servers by configuring: Muliple RADIUS servers sharing a VSA configuraion. An Auhenicaion Sequence. A cusom Adminisraor Profile. An Auhenicaion Profile. Quesion 3 of 50. Palo Alo Neworks firewalls suppor he use of boh Dynamic (buil-in user roles) and Role-Based (cusomized user roles) for Adminisraor Accouns.

2 Quesion 4 of 50. When an inerface is in Tap mode and a Policy s acion is se o block, he inerface will send a TCP rese. Quesion 5 of 50. Which of he following mus be enabled in order for User-ID o funcion? Securiy Policies mus have he User-ID opion enabled. User-ID mus be enabled for he source zone of he raffic ha is o be idenified. Capive Poral mus be enabled. Capive Poral Policies mus be enabled. Quesion 6 of 50. When roubleshooing Phase 1 of an IPsec VPN unnel, which locaion and log will be mos informaive? Iniiaing side, Sysem log Responding side, Traffic log Iniiaing side, Traffic log Responding side, Sysem Log Quesion 7 of 50. Which of he following inerface ypes can have an IP address assigned o i? (Selec all correc answers.)

3 Layer 3 Layer 2 Tap Virual Wire Quesion 8 of 50. Afer he insallaion of a new version of PAN-OS, he firewall mus be rebooed. Quesion 9 of 50. Which saemen abou config locks is? A config lock will expire afer 24 hours, unless i was se by a superuser. A config lock can be removed only by he adminisraor who se i. A config lock can be removed only by a superuser. A config lock can only be removed by he adminisraor who se i or by a superuser. Quesion 10 of 50. Besides selecing he Hearbea Backup opion when creaing an Acive-Passive HA Pair, which of he following also prevens "Spli-Brain"? Configuring a backup HA2 link ha poins o he MGT inerface of he oher device in he pair. Creaing a cusom inerface under Service Roue Configuraion, and assigning his inerface as he backup HA2 link. Under Packe Forwarding, selecing he VR Sync checkbox. Configuring an independen backup HA1 link.

4 Quesion 11 of 50. A "Coninue" acion can be configured on which of he following Securiy Profiles? URL Filering and File Blocking URL Filering only URL Filering, File Blocking, and Daa Filering URL Filering and Ani-virus Quesion 12 of 50. Wha will be he user experience when he safe search opion is NOT enabled for Google search bu he firewall has "Safe Search Enforcemen" Enabled? The user will be redireced o a differen search sie ha is specified by he firewall adminisraor. A ask bar pop-up message will be presened o enable Safe Search. The Firewall will enforce Safe Search if he URL filering license is sill valid. A block page will be presened wih insrucions on how o se he sric Safe Search opion for he Google search. Quesion 13 of 50. When using remoe auhenicaion for users (LDAP, RADIUS, Acive Direcory, ec.), wha mus be done o allow a user o auhenicae hrough muliple mehods? This canno be done. Alhough muliple auhenicaion mehods exis, a firewall mus choose a single, global auhenicaion ype--and all users mus use his mehod. This canno be done. A single user can only use one auhenicaion ype. Creae an Auhenicaion Sequence, dicaing he order of auhenicaion profiles. Creae muliple auhenicaion profiles for he same user.

5 Quesion 14 of 50. Taking ino accoun only he informaion in he screensho above, answer he following quesion. An adminisraor is using SSH on por 3333 and BiTorren on por Which saemens are? The BiTorren raffic will be denied. The SSH raffic will be denied. The BiTorren raffic will be allowed. The SSH raffic will be allowed. Quesion 15 of 50. Considering he informaion in he screensho above, wha is he order of evaluaion for his URL Filering Profile? URL Caegories (BrighCloud or PAN-DB), Cusom Caegories, Block Lis, Allow Lis. Allow Lis, Block Lis, Cusom Caegories, URL Caegories (BrighCloud or PAN-DB). Block Lis, Allow Lis, Cusom Caegories, URL Caegories (BrighCloud or PAN-DB). Block Lis, Allow Lis, URL Caegories (BrighCloud or PAN-DB), Cusom Caegories. Quesion 16 of 50. Which ype of license is required o perform Decrypion Por Mirroring? A subscripion-based SSL Por license A Clien Decrypion license A free PAN-PA-Decryp license A subscripion-based PAN-PA-Decryp license

6 Quesion 17 of 50. In a Palo Alo Neworks firewall, every inerface in use mus be assigned o a zone in order o process raffic. Quesion 18 of 50. When configuring a Decrypion Policy rule, which opion allows a firewall adminisraor o conrol SSHv2 unneling in policies by specifying he SSH-unnel App-ID? SSH Proxy SSL Forward Proxy SSL Inbound Inspecion SSL Reverse Proxy Quesion 19 of 50. An inerface in ap mode can ransmi packes on he wire. Quesion 20 of 50. Wha are wo sources of informaion for deermining wheher he firewall has been successful in communicaing wih an exernal User-ID Agen? Sysem Logs and an indicaor ligh on he chassis. Sysem Logs and Auhenicaion Logs.

7 Sysem Logs and he indicaor ligh under he User-ID Agen seings in he firewall. Traffic Logs and Auhenicaion Logs. Quesion 21 of 50. WildFire may be used for idenifying which of he following ypes of raffic? OSPF DHCP Malware RIPv2 Quesion 22 of 50. When using Config Audi, he color yellow indicaes which of he following? A seing has been changed beween he wo config files A seing has been deleed from a config file. A seing has been added o a config file An invalid value has been used in a config file. Quesion 23 of 50. You can assign an IP address o an inerface in Virual Wire mode.

8 Quesion 24 of 50. In PAN-OS, he WildFire Subscripion Service allows updaes for malware signaures o be disribued as ofen as Once a week Once an hour Once a day Once every 15 minues Quesion 25 of 50. Which of he following mos accuraely describes Dynamic IP in a Source NAT configuraion? A single IP address is used, and he source por number is changed. A single IP address is used, and he source por number is unchanged. The nex available address in he configured pool is used, and he source por number is changed. The nex available IP address in he configured pool is used, bu he source por number is unchanged. Quesion 26 of 50. Wha is he resul of an Adminisraor submiing a WildFire repor s verdic back o Palo Alo Neworks as? You will receive an updae wihin 15 minues. You will receive an o disable he signaure manually. The signaure will be updaed for posiive and negaive files in he nex Applicaion signaure updae. The signaure will be updaed for posiive and negaive files in he nex AV signaure updae. Quesion 27 of 50.

9 A user complains ha she is no longer able o access a needed work applicaion afer he adminisraor implemened vulnerabiliy and ani-spyware profiles. How bes can he adminisraor resolve his issue so he user will once again have access o he needed applicaion? Creae and enable an Applicaion Override Policy, specifying he por used by his applicaion. Check he Threa Log and locae an even showing he user s applicaion being blocked. Using he source IP address displayed in ha even, creae an IP address-based exempion for he group ha he user is a member of. In he vulnerabiliy and ani-spyware Profiles, creae an applicaion exempion for he group s applicaion. Creae a cusom Securiy Policy for his user so ha she will be able o access he required applicaion. Be sure no o apply he vulnerabiliy and ani-spyware profiles o his policy. Quesion 28 of 50. Which of he following are mehods ha HA clusers use o idenify nework ouages? Link and Session Moniors VR and VSYS Moniors Hearbea and Session Moniors Pah and Link Monioring Quesion 29 of 50. Which rouing proocol is suppored on he Palo Alo Neworks plaform? BGP RIPv1 ISIS RSTP Quesion 30 of 50. When configuring he firewall for User-ID, wha is he maximum number of Domain Conrollers ha can be

10 configured? Quesion 31 of 50. Which link is used by an Acive/Passive cluser o synchronize session informaion? The Conrol Link The Uplink The Managemen Link The Daa Link Quesion 32 of 50. A Config Lock may be removed by which of he following users? (Selec all correc answers.) Superusers Device adminisraors Any adminisraor The adminisraor who se i Quesion 33 of 50. Which saemen below is? PAN-OS uses BrighCloud as is defaul URL Filering daabase, bu also suppors PAN-DB. PAN-OS uses PAN-DB for URL Filering, replacing BrighCloud.

11 PAN-OS uses BrighCloud for URL Filering, replacing PAN-DB. PAN-OS uses PAN-DB as he defaul URL Filering daabase, bu also suppors BrighCloud. Quesion 34 of 50. The screensho above shows par of a firewall s configuraion. If ping raffic can raverse his device from e1/2 o e1/1, which of he following saemens mus be abou his firewall s configuraion? (Selec all correc answers.) There mus be appropriae roues in he defaul virual rouer. There mus be a securiy policy from Inerne zone o rus zone ha allows ping. There mus be a Managemen Profile ha allows ping. (Then assign ha Managemen Profile o e1/1 and e1/2.) There mus be a securiy policy from rus zone o Inerne zone ha allows ping. Quesion 35 of 50. Taking ino accoun only he informaion in he screensho above, answer he following quesion: A span por or a swich is conneced o e1/4, bu here are no raffic logs. Which of he following condiions mos likely explains his behavior? The inerface is no assigned an IP address. The inerface is no up. The inerface is no assigned a virual rouer. There is no zone assigned o he inerface. Quesion 36 of 50. In Palo Alo Neworks erms, an applicaion is:

12 A specific program deeced wihin an idenified sream ha can be deeced, moniored, and/or blocked. A combinaion of por and proocol ha can be deeced, moniored, and/or blocked. A file insalled on a local machine ha can be deeced, moniored, and/or blocked. Web-based raffic from a specific IP address ha can be deeced, moniored, and/or blocked. Quesion 37 of 50. Boh SSL decrypion and SSH decrypion are disabled by defaul. Quesion 38 of 50. An enerprise PKI sysem is required o deploy SSL Forward Proxy decrypion capabiliies. Quesion 39 of 50. Which of he following is NOT a valid opion for buil-in CLI Admin roles? devicereader read/wrie deviceadmin superuser Quesion 40 of 50.

13 In PAN-OS 6.0, rule numbers are: Numbers ha specify he order in which securiy policies are evaluaed. Numbers creaed o be unique idenifiers in each firewall s policy daabase. Numbers on a scale of 0 o 99 ha specify prioriies when wo or more rules are in conflic. Numbers creaed o make i easier for users o discuss a complicaed or difficul sequence of rules. Quesion 41 of 50. In PAN-OS 6.0 and laer, which of hese iems may be used as mach crierion in a Policy-Based Forwarding Rule? (Choose 3.) Desinaion Zone Applicaion Source User Source Zone Quesion 42 of 50. Taking ino accoun only he informaion in he screensho above, answer he following quesion. Which applicaions will be allowed on heir sandard pors? (Selec all correc answers.) Gnuella SSH BiTorren Skype Quesion 43 of 50. All of he inerfaces on a Palo Alo Neworks device mus be of he same inerface ype.

14 Quesion 44 of 50. Taking ino accoun only he informaion in he screensho above, answer he following quesion. An adminisraor is pinging and fails o receive a response. Wha is he mos likely reason for he lack of response? There is no roue back o he machine originaing he ping. The inerface is down. There is no Managemen Profile. There is a Securiy Policy ha prevens ping. Quesion 45 of 50. Wha is he funcion of he GlobalProec Poral? To mainain he lis of Global Proec Gaeways and specify HIP daa ha he agen should repor. To load-balance GlobalProec clien connecions o GlobalProec Gaeways. To mainain he lis of remoe GlobalProec Porals and he lis of caegories for checking he clien machine. To provide redundancy for unneled connecions hrough he GlobalProec Gaeways. Quesion 46 of 50. Traffic going o a public IP address is being ranslaed by a Palo Alo Neworks firewall o an inernal server s privae IP address. Which IP address should he Securiy Policy use as he "Desinaion IP" in order o allow raffic o he server? The server s privae IP The server s public IP

15 The firewall s gaeway IP The firewall s MGT IP Quesion 47 of 50. In an Ani-virus profile, seing he acion o "Block" for IMAP and POP3 decoders will resul in which of he following acions? The firewall wih his Ani-virus profile will behave as if an "Aler" is he specified acion, and he server sending he will aemp o re-send i. The firewall will send an HTTP 404 error message back o he server ha is aemping o send he . All messages sen using he IMAP or POP3 proocols will be dropped by he firewall, even if hey are no infeced wih a virus. I s no possible o se an Ani-virus profile acion o Block IMAP and POP3 raffic. Quesion 48 of 50. Which of he following plaforms suppors he Decrypion Por Mirror funcion? PA-3000 VM-Series 100 PA-2000 PA-4000 Quesion 49 of 50. When you have creaed a Securiy Policy Rule ha allows Facebook, wha mus you do o block all oher web-browsing raffic? When creaing he policy, ensure ha web-browsing is included in he same rule. Nohing. You can depend on PAN-OS o block he web-browsing raffic ha is no needed for Facebook use. Ensure ha he Service column is defined as "applicaion-defaul" for his Securiy policy. Doing his will auomaically include he implici web-browsing applicaion dependency.

16 Creae an addiional rule ha blocks all oher raffic. Quesion 50 of 50. An inerface in Virual Wire mode mus be assigned an IP address. Save / Reurn Laer Summary Answers: A "Coninue" acion can be configured on which of he following Securiy Profiles? A user complains ha she is no longer able o access a needed work applicaion afer he adminisraor implemened vulnerabiliy and ani-spyware profiles. How bes can he adminisraor resolve his issue so he user will once again have access o he needed applicaion? An enerprise PKI sysem is required o deploy SSL Forward Proxy decrypion capabiliies Besides selecing he Hearbea Backup opion when creaing an Acive-Passive HA Pair, which of he following also prevens "Spli-Brain"?

17 809 7 Considering he informaion in he screensho above, wha is he order of evaluaion for his URL Filering Profile? In an Ani-virus profile, seing he acion o "Block" for IMAP and POP3 decoders will resul in which of he following acions? In Palo Alo Neworks erms, an applicaion is: In PAN-OS, he WildFire Subscripion Service allows updaes for malware signaures o be disribued as ofen as Taking ino accoun only he informaion in he screensho above, answer he following quesion. An adminisraor is using SSH on por 3333 and BiTorren on por Which saemens are? Taking ino accoun only he informaion in he screensho above, answer he following quesion: A span por or a swich is conneced o e1/4, bu here are no raffic logs. Which of he following condiions mos likely explains his behavior? The screensho above shows par of a firewall s configuraion. If ping raffic can raverse his device from e1/2 o e1/1, which of he following saemens mus be abou his firewall s configuraion? (Selec all correc answers.) Users may be auhenicaed sequenially o muliple auhenicaion servers by configuring: When configuring a Decrypion Policy rule, which opion allows a firewall adminisraor o conrol SSHv2 unneling in policies by specifying he SSH-unnel App-ID? When using Config Audi, he color yellow indicaes which of he following? When using remoe auhenicaion for users (LDAP, RADIUS, Acive Direcory, ec.), wha mus be done o allow a user o auhenicae hrough muliple mehods? When you have creaed a Securiy Policy Rule ha allows Facebook, wha mus you do o block all oher web-browsing raffic?

18 853 1 Which of he following inerface ypes can have an IP address assigned o i? (Selec all correc answers.) Which of he following mus be enabled in order for User-ID o funcion? Which of he following saemens is NOT abou Palo Alo Neworks firewalls?