Firewall Fundamentals Day 7

In which order are Security policy rules from Panorama processed relative to local firewall policyrules?

• Local firewall policy rules are processed only during loss of Panorama connectivity.

• All Panorama rules are processed first.

• All local firewall policy rules are processed first.

• Some Panorama rules are processed before the firewall’s local rules, and someare processed after the local rules.

In a Panorama managed environment, which two options show the correct order of policy evaluation? (Choose two.)

• device group pre-rules, shared pre-rules, local firewall rules, intrazone-default, interzone-default

• device group pre-rules, local firewall rules, shared post-rules, device group post-rules, intrazone-default, interzone-default

• device group pre-rules, local firewall rules, device group post-rules, shared post-rules, intrazone-default, interzone-default

• device group pre-rules, local firewall rules, intrazone-default, interzone-default, device group post-rules, shared post-rules

• shared pre-rules, device group pre-rules, local firewall rules, intrazone-default, interzone-default

Some devices managed by Panorama have their external interface on ethernet1/1, some onethernet1/2. However, the zone definitions for the external zone are identical.

What is the recommended solution in this case?

• Create three templates: one for the ethernet1/1 devices, one for the ethernet1/2 devices, and one with the external zone definitions. Use those templates to create two template stacks, one with theethernet1/1 and external zone, another with the ethernet1/2 and external zone. Apply those two template stacks to the appropriate devices.

• Create three templates: one for the ethernet1/1 devices, one for the ethernet1/2 devices, and one with the external zone definitions. Apply the external zone template to all devices, and theethernet1/1 and ethernet1/2 as appropriate (you can apply up to five templates per device).

• Create three template stacks: one for the ethernet1/1 devices, one for the ethernet1/2 devices, and one with the external zone definitions. Apply the external zone template to all devices, and theethernet1/1 and ethernet1/2 as appropriate (you can apply up to five templates per device).

• Create two templates: one for the ethernet1/1 devices, one for the ethernet1/2 devices. Use the same external zone definitions in both. Apply those two templates to the appropriate devices.

The Security policy for all of a customer’s remote offices is the same, but different offices have different firewall models. If the remote offices are managed by Panorama, how might the offices share device groups and templates?

• same device groups, same template stacks

• different device groups, same template stack

• different device groups, different template stacks

• same device groups, different template stacks

A Panorama template stack contains two templates, and one configuration setting has a different value in each template. When Panorama pushes the template stack to the managed firewalls, which setting value will the firewalls receive?

• value from the top template of the stack

• value from the bottom template in the stack

• value from the template designated as the parent

• value an administrator selects from the two available values

Which two firewall settings are stored in Panorama templates? (Choose two.)

• custom Application-ID signatures

• Server Profile for an external LDAP server

• services definitions

• DoS Protection profiles

• data-plane interface configurations

Where in Panorama do you enter Security policy rules to ensure that your new rules will take precedence over locally entered rules?

• Security policy rules with a targeted firewall

• default rules section of Security policy rules

• pre-rules section of Security policy rules

• post-rules section of Security policy rules

In Panorama, how should you make changes to a Security policy rule for a specific firewall?

• Log in to Panorama, clone the rule, modify the clone, and add a target firewall to the new rule.

• Select the rule, click the override button, and enter the changes.

• Create a new locally defined Security policy rule that is placed higher in the rule list than the rule to be overridden.

• Log in to Panorama and modify the original rule.

Which three firewall settings are stored in Panorama device groups? (Choose three.)

• custom Application-ID signatures

• services definitions

• DoS Protection profiles

• data-plane interface configurations

• Zone Protection profiles

Which two Panorama objects can display current HA state information about a managed firewall? (Choose two.)

• firewall listings in Monitor > HA Status

• firewall-specific information in Managed Devices > Health

• firewall listings in Managed Devices > Summary

• firewall HA Status widget in Dashboard > Widgets

• firewall HA status in Panorama > High Availability