Topic 1 Question 540 to 560

An engineer creates a set of rules in a Device Group (Panorama) to permit traffic to various services for a specific LDAP user group.

What needs to be configured to ensure Panorama can retrieve user and group information for use in these rules?

• A service route to the LDAP server

• A User-ID agent on the LDAP server

• A Master Device

• Authentication Portal

Review the information below. A firewall engineer creates a U-NAT rule to allow users in the trust zone access to a server in the same zone by using an external, public NAT IP for that server.

Given the rule below, what change should be made to make sure the NAT works as expected?

• Change destination NAT zone to Trust_L3.

• Change destination translation to Dynamic IP (with session distribution) using firewall eth1/2 address.

• Change Source NAT zone to Untrust_L3.

• Add source Translation to translate original source IP to the firewall eth1/2 interface translation.

An engineer is configuring a template in Panorama which will contain settings that need to be applied to all firewalls in production.

Which three parts of a template an engineer can configure? (Choose three.)

• Service Route Configuration

• Dynamic Address Groups

• NTP Server Address

• Antivirus Profile

• Authentication Profile

A firewall engineer reviews the PAN-OS GlobalProtect application and sees that it implicitly uses web-browsing and depends on SSL.

When creating a new rule, what is needed to allow the application to resolve dependencies?

• Add SSL application to the same rule

• SSL and web-browsing must both be explicitly allowed.

• Add SSL and web-browsing applications to the same rule

• Add web-browsing application to the same rule

In a security-first network, what is the recommended threshold value for apps and threats to be dynamically updated?

• 1 to 4 hours

• 6 to 12 hours

• 24 hours

• 36 hours

An engineer configures a specific service route in an environment with multiple virtual systems instead of using the inherited global service route configuration.

What type of service route can be used for this configuration?

• Destination-Based Service Route

• Inherit Global Setting

• IPv6 Source or Destination Address

• IPv4 Source Interface

An administrator is receiving complaints about application performance degradation. After checking the ACC, the administrator observes that there is an excessive amount of VoIP traffic.

Which three elements should the administrator configure to address this issue? (Choose three.)

• A QoS policy for each application

• An Application Override policy for the SIP traffic

• A QoS profile defining traffic classes

• QoS on the ingress interface for the traffic flows

• QoS on the egress interface for the traffic flows

What are three tasks that cannot be configured from Panorama by using a template stack? (Choose three.)

• Rename a vsys on a multi-vsys firewall

• Change the firewall management IP address

• Enable operational modes such as normal mode, multi-vsys mode, or FIPS-CC mode

• Add administrator accounts

• Configure a device block list

Based on the screenshots above, what is the correct order in which the various rules are deployed to firewalls inside the DATACENTER_DG device group?

• 
  

• .

  shared pre-rules
  
  DATACENTER_DG pre-rules -
  rules configured locally on the firewall
  
  DATACENTER_DG post-rules -
  shared post-rules
  shared default rules

• shared pre-rules
  
  DATACENTER_DG pre-rules -
  rules configured locally on the firewall
  shared post-rules
  
  DATACENTER_DG post-rules -
  DATACENTER_DG default rules

• shared pre-rules
  
  DATACENTER_DG pre-rules -
  rules configured locally on the firewall
  shared post-rules
  
  DATACENTER_DG post-rules -
  shared default rules

• shared pre-rules
  
  DATACENTER_DG pre-rules -
  rules configured locally on the firewall
  
  DATACENTER_DG post-rules -
  shared post-rules
  DATACENTER_DG default rules

A company wants to implement threat prevention to take action without redesigning the network routing.

What are two best practice deployment modes for the firewall? (Choose two.)

• Virtual Wire

• Layer 2

• Layer 3

• TAP