Palo Alto Networks ACE ACE Questions & Answers

• Question 141:

  Users may be authenticated sequentially to multiple authentication servers by configuring:

  A. An Authentication Profile.

  B. An Authentication Sequence.

  C. A custom Administrator Profile.

  D. Multiple RADIUS servers sharing a VSA configuration.

  Correct Answer: B

• Question 142:

  In PAN-OS 5.0, how is Wildfire enabled?

  A. Via the URL-Filtering "Continue" Action

  B. Wildfire is automaticaly enabled with a valid URL-Filtering license

  C. A custom file blocking action must be enabled for all PDF and PE type files

  D. Via the "Forward" and "Continue and Forward" File-Blocking actions

  Correct Answer: A

• Question 143:

  Which of the following are necessary components of a GlobalProtect solution?

  A. GlobalProtect Gateway, GlobalProtect Agent, GlobalProtect Portal

  B. GlobalProtect Gateway, GlobalProtect Agent, GlobalProtect Server

  C. GlobalProtect Gateway, GlobalProtect NetConnect, GlobalProtect Agent, GlobalProtect Portal, GlobalProtect Server

  D. GlobalProtect NetConnect, GlobalProtect Agent, GlobalProtect Portal, GlobalProtect Server

  Correct Answer: A

• Question 144:

  Which of the following statements is NOT True about Palo Alto Networks firewalls?

  A. The Admin account may be disabled.

  B. System defaults may be restored by performing a factory reset in Maintenance Mode.

  C. The Admin account may not be disabled.

  D. Initial configuration may be accomplished thru the MGT interface or the Console port.

  Correct Answer: A

• Question 145:

  When configuring the firewall for UserID, what is the maximum number of Domain Controllers that can be configured?

  A. 100

  B. 50

  C. 10

  D. 150

  Correct Answer: A

• Question 146:

  When Network Address Translation has been performed on traffic, Destination Zones in Security rules should be based on:

  A. Post-NAT addresses

  B. The same zones used in the NAT rules

  C. Pre-NAT addresses

  D. None of the above

  Correct Answer: A

• Question 147:

  How do you reduce the amount of information recorded in the URL Content Filtering Logs?

  A. Enable "Log container page only".

  B. Disable URL packet captures.

  C. Enable URL log caching.

  D. Enable DSRI.

  Correct Answer: A

• Question 148:

  As the Palo Alto Networks administrator responsible for User Identification, you are looking for the simplest method of mapping network users that do not sign into LDAP. Which information source would allow reliable User ID mapping for these users, requiring the least amount of configuration?

  A. WMI Query

  B. Exchange CAS Security Logs

  C. Captive Portal

  D. Active Directory Security Logs

  Correct Answer: C

• Question 149:

  The "Drive-By Download" protection feature, under File Blocking profiles in Content-ID, provides:

  A. Password-protected access to specific file downloads, for authorized users increased speed on the downloads of the allowed file types

  B. Protection against unwanted downloads, by alerting the user with a response page indicating that file is going to be downloaded

  C. The Administrator the ability to leverage Authentication Profiles in order to protect against unwanted downloads

  Correct Answer: C

• Question 150:

  Traffic going to a public IP address is being translated by a Palo Alto Networks firewall to an internal server's private IP address. Which IP address should the Security Policy use as the "Destination IP" in order to allow traffic to the server?

  A. The firewall's gateway IP

  B. The server's public IP

  C. The server's private IP

  D. The firewall's MGT IP

  Correct Answer: B