Palo Alto Networks Palo Alto Networks Certifications PCCET Questions & Answers

• Question 71:

  A native hypervisor runs:

  A. with extreme demands on network throughput

  B. only on certain platforms

  C. within an operating system's environment

  D. directly on the host computer's hardware

  Correct Answer: D

  Type 1 (native or bare metal). Runs directly on the host computer's hardware Type 2 (hosted). Runs within an operating system environment

• Question 72:

  Which option is an example of a North-South traffic flow?

  A. Lateral movement within a cloud or data center

  B. An internal three-tier application

  C. Client-server interactions that cross the edge perimeter

  D. Traffic between an internal server and internal user

  Correct Answer: C

  North-south refers to data packets that move in and out of the virtualized environment from the host network or a corresponding traditional data center. North-south traffic is secured by one or more physical form factor perimeter edge firewalls.

• Question 73:

  When signature-based antivirus software detects malware, what three things does it do to provide protection? (Choose three.)

  A. decrypt the infected file using base64

  B. alert system administrators

  C. quarantine the infected file

  D. delete the infected file

  E. remove the infected file's extension

  Correct Answer: CDE

• Question 74:

  On an endpoint, which method is used to protect proprietary data stored on a laptop that has been stolen?

  A. operating system patches

  B. full-disk encryption

  C. periodic data backups

  D. endpoint-based firewall

  Correct Answer: B

• Question 75:

  What are three benefits of SD-WAN infrastructure? (Choose three.)

  A. Improving performance of SaaS applications by requiring all traffic to be back-hauled through the corporate headquarters network

  B. Promoting simplicity through the utilization of a centralized management structure

  C. Utilizing zero-touch provisioning for automated deployments

  D. Leveraging remote site routing technical support by relying on MPLS

  E. Improving performance by allowing efficient access to cloud-based resources without requiring back- haul traffic to a centralized location

  Correct Answer: BCE

  Simplicity: Because each device is centrally managed, with routing based on application policies, WAN managers can create and update security rules in real time as network requirements change. Also, when SD-WAN is combined with zero-touch provisioning, a feature that helps automate the deployment and configuration processes, organizations can further reduce the complexity, resources, and operating expenses required to spin up new sites. Improved performance: By allowing efficient access to cloud- based resources without the need to backhaul traffic to centralized locations, organizations can provide a better user experience.

• Question 76:

  In a traditional data center what is one result of sequential traffic analysis?

  A. simplifies security policy management

  B. reduces network latency

  C. causes security policies to be complex

  D. improves security policy application ID enforcement

  Correct Answer: C

  Multiple policies, no policy reconciliation tools: Sequential traffic analysis (stateful inspection, application control, intrusion prevention system (IPS), anti-malware, etc.) in traditional data center security solutions requires a corresponding security policy or profile, often using multiple management tools. The result is that your security policies become convoluted as you build and manage a firewall policy with source, destination, user, port, and action; an application control policy with similar rules; and any other threat prevention rules required. Multiple security policies that mix positive (firewall) and negative (application control, IPS, and anti-malware) control models can cause security holes by missing traffic and/or not identifying

• Question 77:

  A user is provided access over the internet to an application running on a cloud infrastructure. The servers, databases, and code of that application are hosted and maintained by the vendor.

  Which NIST cloud service model is this?

  A. IaaS

  B. SaaS

  C. PaaS

  D. CaaS

  Correct Answer: B

  SaaS - User responsible for only the data, vendor responsible for rest

• Question 78:

  Which network firewall operates up to Layer 4 (Transport layer) of the OSI model and maintains information about the communication sessions which have been established between hosts on trusted and untrusted networks?

  A. Group policy

  B. Stateless

  C. Stateful

  D. Static packet-filter

  Correct Answer: C

  Stateful packet inspection firewalls Second-generation stateful packet inspection (also known as dynamic packet filtering) firewalls have the following characteristics: They operate up to Layer 4 (Transport layer) of the OSI model and maintain state information about the communication sessions that have been established between hosts on the trusted and untrusted networks. They inspect individual packet headers to determine source and destination IP address, protocol (TCP, UDP, and ICMP), and port number (during session establishment only) to determine whether the session should be allowed, blocked, or dropped based on configured firewall rules. After a permitted connection is established between two hosts, the firewall creates and deletes firewall rules for individual connections as needed, thus effectively creating a tunnel that allows traffic to flow between the two hosts without further inspection of individual packets during the session. This type of firewall is very fast, but it is port-based and it is highly dependent on the trustworthiness of the two hosts because individual packets aren't inspected after the connection is established.

• Question 79:

  Anthem server breaches disclosed Personally Identifiable Information (PII) from a number of its servers. The infiltration by hackers was attributed to which type of vulnerability?

  A. an intranet-accessed contractor's system that was compromised

  B. exploitation of an unpatched security vulnerability

  C. access by using a third-party vendor's password

  D. a phishing scheme that captured a database administrator's password

  Correct Answer: D

• Question 80:

  What does SIEM stand for?

  A. Security Infosec and Event Management

  B. Security Information and Event Management

  C. Standard Installation and Event Media

  D. Secure Infrastructure and Event Monitoring

  Correct Answer: B

  Originally designed as a tool to assist organizations with compliance and industry-specific regulations, security information and event management (SIEM) is a technology that has been around for almost two decades