Palo Alto Networks Strata Associate PSE-STRATA-ASSOCIATE Questions & Answers

• Question 21:

  Which two Cloud-Delivered Security Services (CDSS) would be appropriate for an organization that wants to secure internet traffic on a perimeter firewall? (Choose two.) Select 2 Correct Responses

  A. WildFire

  B. Advanced URL Filtering (AURLF)

  C. Autonomous Digital Experience Management (ADEM)

  D. SD-WAN

  Correct Answer: AB

• Question 22:

  Which three key functions are processed as part of the Palo Alto Networks single-pass architecture (SPA)?

  (Choose three.)

  Select 3 Correct Responses

  A. User-ID

  B. Content-ID

  C. Intruder-ID

  D. Device-ID

  E. Virus-ID

  Correct Answer: ABD

• Question 23:

  When deploying an Eval Next-Generation Firewall (NGFW) within a customer environment for the purpose of generating a Security Lifecycle Review (SLR) report, creation of which interface will not impact production traffic?

  A. Layer 3 interface

  B. SLR interface

  C. virtual wire interface

  D. TAP interface

  Correct Answer: D

• Question 24:

  Which of the following statements applies to WildFire Public Cloud verdicts?

  A. They are unique to the affected Next-Generation Firewall (NGFW).

  B. They are shared globally with all WildFire customers.

  C. They must be manually downloaded from the WildFire portal.

  D. They are automatically shared with third-party firewall vendors.

  Correct Answer: B

• Question 25:

  Which two of the following are ways that Palo Alto Networks CloudDelivered Security Services (CDSS) use confidential information collected from users? (Choose two.)

  Select 2 Correct Responses

  A. legal compliance

  B. attack retaliation attribution

  C. verification of entitlements

  D. verification of applicant statements

  Correct Answer: AD

• Question 26:

  How does Cloud Identity Engine (CIE) simplify deployment of cloudbased services to provide user authentication?

  A. It allows configuration of an authentication source once instead of for eachauthentication method.

  B. It expands the capability to filter and forward decrypted and non-decrypted Transport Layer Security (TLS) traffic.

  C. It ensures that a compromised master key does not compromise the configuration encryption for an entire deployment.

  D. It authenticates users via a cloud-based service and refers to the hub for mappings for group identification.

  Correct Answer: D

• Question 27:

  Which architecture is unique to Palo Alto Networks and results in no additional performance overhead when enabling additional features?

  A. multi-pass

  B. multiple-core threaded

  C. single-pass

  D. no-pass

  Correct Answer: C

• Question 28:

  Which of the following is an appropriate first step for a customer interested in moving to Zero Trust?

  A. Ask administrators to switch on the Zero Trust options and features of their current products.

  B. Secure the funding required to incorporate the new architecture into their existing networks.

  C. Set priorities by identifying the most valuable and critical assets and data on their networks.

  D. Request a statement ofcompliance from their IT vendors against the Zero Trust standard.

  Correct Answer: D

• Question 29:

  Which architecture allows a Palo Alto Networks Next-Generation Firewall (NGFW) to achieve high performance with all security features enabled?

  A. single-pass parallel processing

  B. dual-pass processing

  C. multi-core processing

  D. parallel-pass single processing

  Correct Answer: A

• Question 30:

  Which traffic will be blocked when application-default service is set on a Security policy?

  A. SSH traffic on TCP/22

  B. HTTPS traffic on TCP/443

  C. HTTP traffic on TCP/81

  D. DNS traffic on UDP/53

  Correct Answer: C