Palo Alto Networks Palo Alto Networks Certifications PSE-STRATA Questions & Answers

• Question 101:

  A customer requests that a known spyware threat signature be triggered based on a rate of occurrence, for example, 10 hits in 5 seconds.

  How is this goal accomplished?

  A. Create a custom spyware signature matching the known signature with the time attribute

  B. Add a correlation object that tracks the occurrences and triggers above the desired threshold

  C. Submit a request to Palo Alto Networks to change the behavior at the next update

  D. Configure the Anti-Spyware profile with the number of rule counts to match the occurrence frequency

  Correct Answer: A

• Question 102:

  A packet that is already associated with a current session arrives at the firewall.

  What is the flow of the packet after the firewall determines that it is matched with an existing session?

  A. it is sent through the fast path because session establishment is not required. If subject to content inspection, it will pass through a single stream-based content inspection engine before egress.

  B. It is sent through the slow path for further inspection. If subject to content inspection, it will pass through a single stream-based content inspection engines before egress

  C. It is sent through the fast path because session establishment is not required. If subject to content inspection, it will pass through multiple content inspection engines before egress

  D. It is sent through the slow path for further inspection. If subject to content inspection, it will pass through multiple content inspection engines before egress

  Correct Answer: A

• Question 103:

  What are two ways to manually add and remove members of dynamic user groups (DUGs)? (Choose two)

  A. Add the user to an external dynamic list (EDL).

  B. Tag the user using Panorama or the Web Ul of the firewall.

  C. Tag the user through the firewalls XML API.

  D. Tag the user through Active Directory

  Correct Answer: BC

• Question 104:

  In an HA pair running Active/Passive mode, over which interface do the dataplanes communicate?

  A. HA3

  B. HA1

  C. HA2

  D. HA4

  Correct Answer: C

• Question 105:

  A customer is looking for an analytics tool that uses the logs on the firewall to detect actionable events on the network. They require something to automatically process a series of related threat events that, when combined, indicate a likely compromised host on their network or some other higher level conclusion. They need to pinpoint the area of risk, such as compromised hosts on the network, allows you to assess the risk and take action to prevent exploitation of network resources.

  Which feature of PAN-OS can you talk about to address their requirement to optimize their business outcomes?

  A. The Automated Correlation Engine

  B. Cortex XDR and Cortex Data Lake

  C. WildFire with API calls for automation

  D. 3rd Party SIEM which can ingest NGFW logs and perform event correlation

  Correct Answer: A

  Reference: https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/monitoring/use-the-automated-correlation-engine.html

• Question 106:

  A client chooses to not block uncategorized websites. Which two additions should be made to help provide some protection? (Choose two.)

  A. A URL filtering profile with the action set to continue for unknown URL categories to security policy rules that allow web access

  B. A data filtering profile with a custom data pattern to security policy rules that deny uncategorized websites

  C. A file blocking profile attached to security policy rules that allow uncategorized websites to help reduce the risk of drive by downloads

  D. A security policy rule using only known URL categories with the action set to allow

  Correct Answer: AB

• Question 107:

  In which two ways can PAN-OS software consume MineMeld outputs? (Choose two.)

  A. TXT

  B. API

  C. CSV

  D. EDL

  Correct Answer: AD

• Question 108:

  Which are the three mandatory components needed to run Cortex XDR? (Choose three.)

  A. Panorama

  B. NGFW with PANOS 8 0.5 or later

  C. Cortex Data Lake

  D. Traps

  E. Pathfinder

  F. Directory Syn Service

  Correct Answer: BCF

  https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-prevent-admin/cortex-xdr-prevent-overview/cortex-xdr-prevent-architecture

• Question 109:

  Which statement best describes the business value of Palo Alto Networks Zero Touch Provisioning (ZTP)?

  A. It is designed to simplify and automate the onboarding of new firewalls to the Panorama management server.

  B. When it is in place, it removes the need for an onsite firewall

  C. When the service is purchased, Palo Alto Networks sends an engineer to physically deploy the firewall to the customer environment

  D. It allows a firewall to be automatically connected to the local network wirelessly

  Correct Answer: A

• Question 110:

  Which three mechanisms are valid for enabling user mapping? (Choose three.)

  A. Captive Portal

  B. Domain server monitoring

  C. Reverse DNS lookup

  D. User behaviour recognition

  E. Client probing

  Correct Answer: ABE