In a Palo Alto Networks environment, GlobalProtect has been enabled using certificate-based
authentication for both users and devices. To ensure proper validation of certificates, one or more
certificate profiles are configured.
What function do certificate profiles serve in this context?
B
Explanation:
In the context of GlobalProtect with certificate-based authentication, certificate profiles are used to
ensure proper validation of the certificates. They perform the following functions:
Define trust anchors, which are the root and intermediate Certificate Authorities (CAs) that the
firewall trusts to authenticate certificates.
Specify revocation checks, such as CRL (Certificate Revocation List) and OCSP (Online Certificate
Status Protocol), to ensure that the certificates being used have not been revoked.
Map certificate attributes, such as the Common Name (CN), which helps in authenticating users and
devices based on their certificates.
How does a Palo Alto Networks NGFW respond when the preemptive hold time is set to 0 minutes
during configuration of route monitoring?
D
Explanation:
When the preemptive hold time is set to 0 minutes in route monitoring, the firewall is configured to
immediately reinstall the route into the Routing Information Base (RIB) as soon as the monitored
path comes up. This essentially means that the firewall will not wait for any predefined hold time
before reestablishing the route once the monitoring condition is met, ensuring a faster recovery of
the route.
After an engineer configures an IPSec tunnel with a Cisco ASA, the Palo Alto Networks firewall
generates system messages reporting the tunnel is failing to establish.
Which of the following actions will resolve this issue?
B
Explanation:
The Proxy IDs (or Traffic Selectors) define the local and remote subnets that are allowed to
communicate over the IPSec tunnel. If the Proxy IDs on the Palo Alto Networks firewall do not match
the configuration on the Cisco ASA, the tunnel will fail to establish because the firewalls won't agree
on which traffic to encrypt. Ensuring that the Proxy IDs match between the Palo Alto Networks
firewall and the Cisco ASA will resolve the issue.
Which configuration in the LACP tab will enable pre-negotiation for an Aggregate Ethernet (AE)
interface on a Palo Alto Networks high availability (HA) active/passive pair?
C
Explanation:
In a High Availability (HA) active/passive pair configuration, when setting up an Aggregate Ethernet
(AE) interface, enabling the "Enable in HA Passive State" option allows the interface to participate in
LACP (Link Aggregation Control Protocol) even when the system is in the passive state. This ensures
that the pre-negotiation of the LACP link occurs, allowing the link aggregation to be ready as soon as
the firewall becomes active.
When integrating Kubernetes with Palo Alto Networks NGFWs, what is used to secure traffic
between microservices?
D
Explanation:
When integrating Kubernetes with Palo Alto Networks NGFWs, the CN-Series firewalls are specifically
designed to secure traffic between microservices in containerized environments. These firewalls
provide advanced security features like Application Identification (App-ID), URL filtering, and Threat
Prevention to secure communication between containers and microservices within a Kubernetes
environment.
When configuring a Zone Protection profile, in which section (protection type) would an NGFW
engineer configure options to protect against activities such as spoofed IP addresses and split
handshake session establishment attempts?
B
Explanation:
In the context of a Zone Protection profile, Protocol Protection is the section used to configure
protections against activities such as spoofed IP addresses and split handshake session establishment
attempts. These types of attacks typically involve manipulating protocol behaviors, such as IP address
spoofing or session hijacking, and are mitigated by the Protocol Protection settings.
For which two purposes is an IP address configured on a tunnel interface? (Choose two.)
A, B
Explanation:
Use of dynamic routing protocols: An IP address is needed on the tunnel interface to participate in
dynamic routing protocols (like OSPF, BGP, etc.) over the tunnel. This allows the firewall to advertise
routes and receive updates over the tunnel.
Tunnel monitoring: The IP address on the tunnel interface can also be used for monitoring the
tunnel's status. Tunnel monitoring (such as IPSec tunnel monitoring) requires an IP address on the
tunnel interface to check the health and availability of the tunnel.
Which PAN-OS method of mapping users to IP addresses is the most reliable?
D
Explanation:
Server monitoring is the most reliable method for mapping users to IP addresses in PAN-OS. This
method allows the firewall to monitor specific servers, such as Microsoft Active Directory (AD) or
LDAP servers, to dynamically retrieve and update user-to-IP mappings. It provides a more accurate
and up-to-date mapping of users to their associated IP addresses, as it directly queries user
databases in real time.
In an active/active high availability (HA) configuration with two PA-Series firewalls, how do the
firewalls use the HA3 interface?
D
Explanation:
In an active/active HA configuration with two PA-Series firewalls, the HA3 interface is used primarily
for the exchange of HA state information between the firewalls. This includes:
Hellos and heartbeats to monitor the status of the HA peer.
Synchronization of management plane data, which includes critical routing and User-ID information.
A PA-Series firewall with all licensable features is being installed. The customer’s Security policy
requires that users do not directly access websites. Instead, a security device must create the
connection, and there must be authentication back to the Active Directory servers for all sessions.
Which action meets the requirements in this scenario?
D
Explanation:
In this scenario, the customer requires that users do not directly access websites and that a security
device (the firewall) manages the connection, while also ensuring that there is authentication back to
the Active Directory (AD) servers for all sessions. The explicit proxy with Kerberos authentication is
the best solution because:
The explicit proxy allows the firewall to intercept user web traffic and manage the connections on
behalf of users.
Kerberos authentication ensures that the user’s identity is validated against the Active Directory
servers before the session is allowed, fulfilling the authentication requirement.