Palo Alto Networks ACE ACE Questions & Answers

• Question 211:

  

  Considering the information in the screenshot above, what is the order of evaluation for this URL Filtering Profile?

  A. URL Categories (BrightCloud or PANDB),

  B. Custom Categories, Block List, Allow List.

  C. Block List, Allow List, URL Categories (BrightCloud or PANDB), Custom Categories.

  D. Block List, Allow List, Custom Categories, URL Categories (BrightCloud or PANDB).

  E. Allow List, Block List, Custom Categories, URL Categories (BrightCloud or PANDB).

  Correct Answer: B

• Question 212:

  Which of the following platforms supports the Decryption Port Mirror function?

  A. PA3000

  B. VMSeries 100

  C. PA2000

  D. PA4000

  Correct Answer: A

• Question 213:

  Which of the following options may be enabled to reduce system overhead when using Content ID?

  A. STP

  B. VRRP

  C. RSTP

  D. DSRI

  Correct Answer: D

• Question 214:

  If the Forward Proxy Ready shows "no" when running the command show system setting ssl-decrypt setting, what is most likely the cause?

  A. SSL forward proxy certificate is not generated

  B. Web interface certificate is not generated

  C. Forward proxy license is not enabled on the box n

  D. SSL decryption rule is not created

  Correct Answer: D

• Question 215:

  Will an exported configuration contain Management Interface settings?

  A. Yes

  B. No

  Correct Answer: A

• Question 216:

  For correct routing to SSL VPN clients to occur, the following must be configured:

  A. Network Address Translation must be enabled for the SSL VPN client IP pool

  B. A dynamic routing protocol between the Palo Alto Networks device and the next-hop gateway to advertise the SSL VPN client IP pool

  C. A static route on the next-hop gateway of the SSL VPN client IP pool with a destination of the Palo Alto Networks device

  D. No routing needs to be configured - the PAN device automatically responds to ARP requests for the SSL VPN client IP pool

  Correct Answer: A

• Question 217:

  After the installation of the Threat Prevention license, the firewall must be rebooted.

  A. True

  B. False

  Correct Answer: B

• Question 218:

  In which of the following can UserID be used to provide a match condition? (Select all correct answers.)

  A. Security Policies

  B. NAT Policies

  C. Zone Protection Policies

  D. Threat Profiles

  Correct Answer: A

• Question 219:

  Select the implicit rules that are applied to traffic that fails to match any administrator-defined Security Policies. (Choose all rules that are correct.)

  A. Intra-zone traffic is allowed

  B. Inter-zone traffic is denied

  C. Intra-zone traffic is denied

  D. Inter-zone traffic is allowed

  Correct Answer: AB

• Question 220:

  To properly configure DOS protection to limit the number of sessions individually from specific source IPs you would configure a DOS Protection rule with the following characteristics:

  A. Action: Protect, Classified Profile with "Resources Protection" configured, and Classified Address with "source-ip-only" configured

  B. Action: Deny, Aggregate Profile with "Resources Protection" configured

  C. Action: Protect, Aggregate Profile with "Resources Protection" configured

  D. Action: Deny, Classified Profile with "Resources Protection" configured, and Classified Address with "source-ip-only" configured

  Correct Answer: A