my ace exam

1/20/2015 Empowering People: paloaltonetworks

https://paloaltonetworks.csod.com/Evaluations/EvalLaunch.aspx?loid=7557e2531f91470fa91ca284f048d2c3&evalLvl=5&redirect_url=%2fphnx%2fdriver.as… 1/12

Test Accredited Configuration Engineer (ACE) Exam PANOS 6.0 Version

ACE Exam

Question 1 of 50.

Which of the following statements is NOT True regarding a Decryption Mirror interface?

Supports SSL outbound Supports SSL inbound Can be a member of any VSYS Requires superuser privilege

Mark for follow up

Question 2 of 50.

How do you reduce the amount of information recorded in the URL Content Filtering Logs?

Enable "Log container page only". Disable URL packet captures. Enable URL log caching. Enable DSRI.

Mark for follow up

Question 3 of 50.

Which routing protocol is supported on the Palo Alto Networks platform?

BGP RIPv1 ISIS RSTP

Mark for follow up

Question 4 of 50.

When using remote authentication for users (LDAP, RADIUS, Active Directory, etc.), what must be done to allow a userto authenticate through multiple methods?

Create multiple authentication profiles for the same user. This cannot be done. A single user can only use one authentication type. Create an Authentication Sequence, dictating the order of authentication profiles. This cannot be done. Although multiple authentication methods exist, a firewall must choose a single, globalauthentication typeand all users must use this method.



Mark for follow up

Question 5 of 50.

In a Destination NAT configuration, the Translated Address field may be populated with either an IP address or anAddress Object.True False

Mark for follow up

Question 6 of 50.

Which of the following CANNOT use the source user as a match criterion?

DoS Protection Secuirty Policies QoS Antivirus Profile Policy Based Forwarding

Mark for follow up

Question 7 of 50.

A Config Lock may be removed by which of the following users? (Select all correct answers.)Device administrators

Any administrator

The administrator who set it

Superusers

Mark for follow up

Question 8 of 50.

Taking into account only the information in the screenshot above, answer the following question. An administrator isusing SSH on port 3333 and BitTorrent on port 7777. Which statements are True?

The BitTorrent traffic will be denied.



The SSH traffic will be allowed.

The BitTorrent traffic will be allowed.

The SSH traffic will be denied.

Mark for follow up

Question 9 of 50.

With IKE Phase 1, each device is identified to the other by a Peer ID. In most cases, the Peer ID is just the public IPaddress of the device. In situations where the public IP address is not static, the Peer ID can be a text value.True False

Mark for follow up

Question 10 of 50.

What Security Profile type must be configured to send files to the WildFire cloud, and with what choices for the actionsetting?

A Data Filtering profile with possible actions of “Forward” or “Continue and Forward”. A Vulnerability Protection profile with the possible action of “Forward”. A File Blocking profile with possible actions of “Forward” or “Continue and Forward”. A URL Filtering profile with the possible action of “Forward”.

Mark for follow up

Question 11 of 50.

Both SSL decryption and SSH decryption are disabled by default.True False

Mark for follow up

Question 12 of 50.

Which of the following would be a reason to use the PANOS XML API to communicate with a Palo Alto Networksfirewall?

To permit syslogging of User Identification events. To pull information from other network resources for UserID. To allow the firewall to push UserID information to a Network Access Control (NAC) device.

Mark for follow up

Question 13 of 50.

Without a WildFire subscription, which of the following files can be submitted by the Firewall to the hosted WildFirevirtualized sandbox?

MS Office doc/docx, xls/xlsx, and ppt/pptx files only



PE and Java Applet (jar and class) only PE files only PDF files only

Mark for follow up

Question 14 of 50.

What is the function of the GlobalProtect Portal?

To maintain the list of Global Protect Gateways and specify HIP data that the agent should report. To loadbalance GlobalProtect client connections to GlobalProtect Gateways. To maintain the list of remote GlobalProtect Portals and the list of categories for checking the client machine. To provide redundancy for tunneled connections through the GlobalProtect Gateways.

Mark for follow up

Question 15 of 50.

Which of the following interface types can have an IP address assigned to it? (Select all correct answers.)

Layer 3 Layer 2 Tap Virtual Wire

Mark for follow up

Question 16 of 50.

Which of the following most accurately describes Dynamic IP in a Source NAT configuration?

The next available address in the configured pool is used, and the source port number is changed. A single IP address is used, and the source port number is unchanged. A single IP address is used, and the source port number is changed. The next available IP address in the configured pool is used, but the source port number is unchanged.

Mark for follow up

Question 17 of 50.

WildFire may be used for identifying which of the following types of traffic?

RIPv2 DHCP OSPF Malware



Mark for follow up

Question 18 of 50.

Which link is used by an Active/Passive cluster to synchronize session information?

The Uplink The Control Link The Management Link The Data Link

Mark for follow up

Question 19 of 50.

Users may be authenticated sequentially to multiple authentication servers by configuring:

Multiple RADIUS servers sharing a VSA configuration. A custom Administrator Profile. An Authentication Sequence. An Authentication Profile.

Mark for follow up

Question 20 of 50.

Which statement about config locks is True?

A config lock can be removed only by a superuser. A config lock will expire after 24 hours, unless it was set by a superuser. A config lock can only be removed by the administrator who set it or by a superuser. A config lock can be removed only by the administrator who set it.

Mark for follow up

Question 21 of 50.

Which feature can be configured to block sessions that the firewall cannot decrypt?

Decryption Profile in Security Profile Decryption Profile in PBF Decryption Profile in Decryption Policy Decryption Profile in Security Policy

Mark for follow up

Question 22 of 50.

All of the interfaces on a Palo Alto Networks device must be of the same interface type.



True False

Mark for follow up

Question 23 of 50.

As the Palo Alto Networks Administrator you have enabled Application Block pages. Afterwards, not knowing they areattempting to access a blocked webbased application, users call the Help Desk to complain about network connectivityissues. What is the cause of the increased number of help desk calls?

Some AppID's are set with a Session Timeout value that is too low. Application Block Pages will only be displayed when Captive Portal is configured. The firewall admin did not create a custom response page to notify potential users that their attempt to access the webbased application is being blocked due to policy. The File Blocking Block Page was disabled.

Mark for follow up

Question 24 of 50.

When configuring a Decryption Policy rule, which option allows a firewall administrator to control SSHv2 tunneling inpolicies by specifying the SSHtunnel AppID?

SSH Proxy SSL Forward Proxy SSL Inbound Inspection SSL Reverse Proxy

Mark for follow up

Question 25 of 50.

What is the default DNS sinkhole address used by the Palo Alto Networks Firewall to cut off communication?

Any layer 3 interface address specified by the firewall administrator. The MGT interface address. The local loopback address. The default gateway of the firewall.

Mark for follow up

Question 26 of 50.



Considering the information in the screenshot above, what is the order of evaluation for this URL Filtering Profile?

Block List, Allow List, URL Categories (BrightCloud or PANDB), Custom Categories. Allow List, Block List, Custom Categories, URL Categories (BrightCloud or PANDB). Block List, Allow List, Custom Categories, URL Categories (BrightCloud or PANDB). URL Categories (BrightCloud or PANDB), Custom Categories, Block List, Allow List.

Mark for follow up

Question 27 of 50.

Security policies specify a source interface and a destination interface.True False

Mark for follow up

Question 28 of 50.

Enabling "Highlight Unused Rules" in the Security Policy window will:

Highlight all rules that did not match traffic within an administratorspecified time period. Highlight all rules that have not matched traffic since the rule was created or since the last reboot of the firewall. Display rules that caused a validation error to occur at the time a Commit was performed. Temporarily disable rules that have not matched traffic since the rule was created or since the last reboot of the firewall.



Mark for follow up

Question 29 of 50.

When troubleshooting Phase 1 of an IPsec VPN tunnel, which location and log will be most informative?

Responding side, Traffic log Responding side, System Log Initiating side, Traffic log Initiating side, System log

Mark for follow up

Question 30 of 50.

In PANOS 6.0, rule numbers are:

Numbers that specify the order in which security policies are evaluated. Numbers created to be unique identifiers in each firewall’s policy database. Numbers on a scale of 0 to 99 that specify priorities when two or more rules are in conflict. Numbers created to make it easier for users to discuss a complicated or difficult sequence of rules.

Mark for follow up

Question 31 of 50.

When you have created a Security Policy Rule that allows Facebook, what must you do to block all other webbrowsingtraffic?

When creating the policy, ensure that webbrowsing is included in the same rule. Nothing. You can depend on PANOS to block the webbrowsing traffic that is not needed for Facebook use. Ensure that the Service column is defined as "applicationdefault" for this Security policy. Doing this will automaticallyinclude the implicit webbrowsing application dependency. Create an additional rule that blocks all other traffic.

Mark for follow up

Question 32 of 50.

When using Config Audit, the color yellow indicates which of the following?

A setting has been changed between the two config files A setting has been deleted from a config file. A setting has been added to a config file An invalid value has been used in a config file.

Mark for follow up

Question 33 of 50.



Will an exported configuration contain Management Interface settings?Yes No

Mark for follow up

Question 34 of 50.

An interface in tap mode can transmit packets on the wire.True False

Mark for follow up

Question 35 of 50.

Which of the following is a routing protocol supported in a Palo Alto Networks firewall?

EIGRP RIPv2 IGRP ISIS

Mark for follow up

Question 36 of 50.

In Palo Alto Networks terms, an application is:

A specific program detected within an identified stream that can be detected, monitored, and/or blocked. A combination of port and protocol that can be detected, monitored, and/or blocked. A file installed on a local machine that can be detected, monitored, and/or blocked. Webbased traffic from a specific IP address that can be detected, monitored, and/or blocked.

Mark for follow up

Question 37 of 50.

Reconnaissance Protection is a feature used to protect the Palo Alto Networks firewall from port scans. To enable thisfeature within the GUI go to…

Network > Network Profiles > Zone Protection Objects > Zone Protection Interfaces > Interface Number > Zone Protection Policies > Profile > Zone Protection

Mark for follow up

Question 38 of 50.

Which of the following is NOT a valid option for builtin CLI Admin roles?


https://paloaltonetworks.csod.com/Evaluations/EvalLaunch.aspx?loid=7557e2531f91470fa91ca284f048d2c3&evalLvl=5&redirect_url=%2fphnx%2fdriver.a… 10/12

deviceadmin

superuser read/write devicereader

Mark for follow up

Question 39 of 50.

In which of the following can UserID be used to provide a match condition? (Select all correct answers.)

Security Policies NAT Policies Zone Protection Policies Threat Profiles

Mark for follow up

Question 40 of 50.

A user complains that she is no longer able to access a needed work application after the administrator implementedvulnerability and antispyware profiles. How best can the administrator resolve this issue so the user will once againhave access to the needed application?

In the vulnerability and antispyware Profiles, create an application exemption for the group’s application. Check the Threat Log and locate an event showing the user’s application being blocked. Using the source IP addressdisplayed in that event, create an IP addressbased exemption for the group that the user is a member of. Create a custom Security Policy for this user so that she will be able to access the required application. Be sure not toapply the vulnerability and antispyware profiles to this policy. Create and enable an Application Override Policy, specifying the port used by this application.

Mark for follow up

Question 41 of 50.

An enterprise PKI system is required to deploy SSL Forward Proxy decryption capabilities.True False

Mark for follow up

Question 42 of 50.

UserID is enabled in the configuration of …

A Security Policy. An Interface. A Zone. A Security Profile.



Mark for follow up

Question 43 of 50.

What are the benefits gained when the "Enable Passive DNS Monitoring" checkbox is chosen on the firewall? (Select allcorrect answers.)

Improved malware detection in WildFire.

Improved DNSbased C&C signatures.

Improved PANDB malware detection.

Improved BrightCloud malware detection.

Mark for follow up

Question 44 of 50.

Which of the following platforms supports the Decryption Port Mirror function?

PA3000 VMSeries 100 PA2000 PA4000

Mark for follow up

Question 45 of 50.

“What is the result of an Administrator submitting a WildFire report’s verdict back to Palo Alto Networks as “Incorrect”?

You will receive an update within 15 minutes. The signature will be updated for False positive and False negative files in the next AV signature update. The signature will be updated for False positive and False negative files in the next Application signature update. You will receive an email to disable the signature manually.

Mark for follow up

Question 46 of 50.

Which of the following facts about dynamic updates is correct?

Threat and URL Filtering updates are released daily. Application and Antivirus updates are released weekly. Antivirus updates are released daily. Application and Threat updates are released weekly. Application and Antivirus updates are released weekly. Threat and “Threat and URL Filtering” updates are releasedweekly. Application and Threat updates are released daily. Antivirus and URL Filtering updates are released weekly.

Mark for follow up

Question 47 of 50.



When configuring a Security Policy Rule based on FQDN Address Objects, which of the following statements is True?

The firewall resolves the FQDN first when the policy is committed, and resolves the FQDN again at DNS TTL expiration. The firewall resolves the FQDN first when the policy is committed, and resolves the FQDN again each time SecurityProfiles are evaluated. In order to create FQDNbased objects, you need to manually define a list of associated IP addresses.

Mark for follow up

Question 48 of 50.

What general practice best describes how Palo Alto Networks firewall policies are applied to a session?

The rule with the highest rule number is applied. First match applied. Last match applied. Most specific match applied.

Mark for follow up

Question 49 of 50.

Which of the following statements is NOT True about Palo Alto Networks firewalls?

System defaults may be restored by performing a factory reset in Maintenance Mode. The Admin account may be disabled. Initial configuration may be accomplished thru the MGT interface or the Console port. The Admin account may not be disabled.

Mark for follow up

Question 50 of 50.

When configuring UserID on a Palo Alto Networks firewall, what is the proper procedure to limit User mappings to aparticular DHCP scope?

In the zone in which User Identification is enabled, select the "Restrict Allocated IP" checkbox. In the zone in which User Identification is enabled, create a User Identification ACL Include List using the same IPranges as those allocated in the DHCP scope. Under the User Identification settings, under the User Mapping tab, select the "Restrict Users to Allocated IP" checkbox. In the DHCP settings on the Palo Alto Networks firewall, point the DHCP Relay to the IP address of the UserID agent.

Mark for follow up

Save / Return Later Summary

my ace exam

Documents

versionacee empoweringpeople