Palo Alto Networks ACE ACE Questions & Answers

• Question 91:

  What are two benefits of attaching a Decryption Profile to a Decryption policy no-decrypt rule?(Choose two.)

  A. URL category match checking

  B. untrusted certificate checking

  C. acceptable protocol checking

  D. expired certificate checking

  Correct Answer: BD

• Question 92:

  In a destination NAT configuration, which option accurately completes the following sentence? A Security policy rule shouldbe written to match the _______.

  A. post-NAT source and destination addresses, but the pre-NAT destination zone

  B. original pre-NAT source and destination addresses, but the post-NAT destination zone

  C. original pre-NAT source and destination addresses, and the pre-NAT destination zone

  D. post-NAT source and destination addresses, and the post-NAT destination zone

  Correct Answer: B

• Question 93:

  Which two file types can be sent to WildFire for analysis if a firewall has only a standard subscription service? (Choosetwo.)

  A. .jar

  B. .exe

  C. .dll

  D. .pdf

  Correct Answer: AD

• Question 94:

  Which interface type is NOT assigned to a security zone?

  A. VLAN

  B. HA

  C. Virtual Wire

  D. Layer 3

  Correct Answer: B

• Question 95:

  What is a use case for deploying Palo Alto Networks NGFW in the public cloud?

  A. extending the corporate data center into the public cloud

  B. cost savings through one-time purchase of Palo Alto Networks hardware and subscriptions

  C. centralizing your data storage on premise

  D. faster WildFire analysis response time

  Correct Answer: A

• Question 96:

  Which four actions can be applied to traffic matching a URL Filtering Security Profile? (Choosefour.)

  A. Reset Client

  B. Override

  C. Continue

  D. Reset Server

  E. Block

  F. Alert

  Correct Answer: BCEF

• Question 97:

  When SSL traffic passes through the firewall, which component is evaluated first?

  A. Decryption policy

  B. Decryption Profile

  C. Security policy

  D. Decryption exclusions list

  Correct Answer: C

• Question 98:

  Finding URLs matched to the not-resolved URL category in the URL Filtering log file might indicate that you should takewhich action?

  A. Reboot the firewall.

  B. Validate connectivity to the PAN-DB cloud.

  C. Re-download the URL seed database.

  D. Validate your Security policy rules.

  Correct Answer: B

• Question 99:

  Which three interface types can control or shape network traffic? (Choose three.)

  A. Layer 2

  B. Tap

  C. Virtual Wire

  D. Layer 3

  Correct Answer: ABD

• Question 100:

  Which condition must exist before a firewall's in-band interface can process traffic?

  A. The firewall must not be a loopback interface.

  B. The firewall must be assigned to a security zone.

  C. The firewall must be assigned an IP address.

  D. The firewall must be enabled.

  Correct Answer: C