Palo Alto Networks ACE ACE Questions & Answers

• Question 41:

  Using the API in PAN-OS 6.1, WildFire subscribers can upload up to how many samples per day?

  A. 500

  B. 50

  C. 1000

  D. 10

  Correct Answer: C

• Question 42:

  The "Drive-By Download" protection feature, under File Blocking profiles in Content-ID, provides:

  A. Increased speed on downloads of file types that are explicitly enabled.

  B. The ability to use Authentication Profiles, in order to protect against unwanted downloads.

  C. Password-protected access to specific file downloads for authorized users.

  D. Protection against unwanted downloads by showing the user a response page indicating that a file is going to be downloaded.

  Correct Answer: D

• Question 43:

  Which of the following objects cannot use User-ID as a match criteria?

  A. Security Policies

  B. QoS

  C. Policy Based Forwarding

  D. DoS Protection

  E. None of the above

  Correct Answer: E

• Question 44:

  When setting up GlobalProtect, what is the job of the GlobalProtect Portal? Select the best answer

  A. To maintain the list of remote GlobalProtect Portals and list of categories for checking the client machine

  B. To maintain the list of GlobalProtect Gateways and list of categories for checking the client machine

  C. To load balance GlobalProtect client connections to GlobalProtect Gateways

  D. None of the above

  Correct Answer: B

• Question 45:

  Color-coded tags can be used on all of the items listed below EXCEPT:

  A. Address Objects

  B. Zones

  C. Service Groups

  D. Vulnerability Profiles

  Correct Answer: D

• Question 46:

  As ofPAN-OS 8.0, when configuring a Decryption Policy Rule, which of the following is NOT an available

  option as matching criteria in the rule?

  A. Application

  B. Source User

  C. URL Category

  D. Source Zone

  E. Service

  Correct Answer: A

• Question 47:

  As the Palo Alto Networks Administrator responsible for UserID, you need to enable mapping of network users that do not signin using LDAP. Which information source would allow for reliable UserID mapping while requiring the least effort to configure?

  A. Active Directory Security Logs

  B. WMI Query

  C. Captive Portal

  D. Exchange CAS Security logs

  Correct Answer: A

• Question 48:

  When troubleshooting Phase 1 of an IPSec VPN tunnel, what location will have the most informative logs?

  A. Responding side, Traffic Logs

  B. Initiating side, Traffic Logs

  C. Responding side, System Logs

  D. Initiating side, System Logs

  Correct Answer: C

• Question 49:

  When allowing an Application in a Security policy on a PAN-OS 5.0 device, would a dependency Application need to also be enabled if the application does not employ HTTP, SSL, MSRPC, RPC, t.120, RTSP, RTMP, and NETBIOS-SS.

  A. Yes

  B. No

  Correct Answer: A

• Question 50:

  In Active/Active HA environments, redundancy for the HA3 interface can be achieved by

  A. Configuring a corresponding HA4 interface

  B. Configuring HA3 as an Aggregate Ethernet bundle

  C. Configuring multiple HA3 interfaces

  D. Configuring HA3 in a redundant group

  Correct Answer: B