NEW QUESTION 61
A network administrator is hardening a new Palo Alto Networks firewall and wants to ensure that all firewall- generated management traffic, such as calls to Strata Logging Service, uses a dedicated in-band data port instead of the out-of-band management port.
Which configuration setting should the administrator modify to reroute this type of traffic?

NEW QUESTION 62
Which statement describes the role of Terraform in deploying Palo Alto Networks NGFWs?

NEW QUESTION 63
In regard to the Advanced Routing Engine (ARE), what must be enabled first when configuring a logical router on a PAN-OS firewall?

NEW QUESTION 64
An engineer is configuring a GlobalProtect portal and wants to enable split tunneling. The requirement is to route DNS queries for “https://www.google.com/search?q=corp.internal.com” to the DNS servers assigned by the VPN, while allowing all other DNS queries to be resolved by the client’s locally configured DNS.
What is the effect of configuring this split DNS policy?

NEW QUESTION 65
A network administrator is establishing a site-to-site VPN between a Palo Alto Networks firewall and a partner’s Check Point Security Gateway. The partner has provided a specific list of local and remote IP address subnets that are permitted through the tunnel. The initial tunnel configuration on the PAN-OS firewall fails during the IKE Phase 2 exchange.
Which configuration step is essential to ensure compatibility with the policy-based Check Point gateway?

NEW QUESTION 66
An NGFW policy allows general web browsing but blocks access to known malicious or high-risk websites.
Which NGFW security function is MOST directly responsible for this behavior?

NEW QUESTION 67
A security team wants to block peer-to-peer file sharing applications even when those applications attempt to evade detection by using non-standard ports.
Which NGFW capability enables this control?

NEW QUESTION 68
Which protocol and port number are used by default for IKE Phase 1 negotiations in an IPSec VPN?

NEW QUESTION 69
An organization is deploying VM-Series firewalls in Microsoft Azure to secure its VNets. A key requirement is that the security infrastructure must be resilient to the failure of an entire Azure Availability Zone.
What is the recommended method to achieve this goal?

NEW QUESTION 70
A network administrator needs to replace the default self-signed certificate on a firewall with one signed by the company’s internal certificate authority (CA).
Which two firewall features would require this new certificate to be assigned via an SSL/TLS service profile? (Choose two.)

NEW QUESTION 71
An organization runs multiple Kubernetes clusters both on-premises and in public clouds (AWS, Azure, GCP). They want to deploy the Palo Alto Networks CN-Series NGFW to secure east-west traffic within each cluster, maintain consistent Security policies across all environments, and dynamically scale as containerized workloads spin up or down. They also plan to use a centralized Panorama instance for policy management and visibility.
Which approach meets these requirements?

NEW QUESTION 72
Which configuration step is required when implementing a new self-signed root certificate authority (CA) certificate for SSL decryption on a Palo Alto Networks firewall?

NEW QUESTION 73
When considering the various methods for User-ID to learn user-to-IP address mappings, which source is considered the most accurate due to the mapping being explicitly created through an authentication event directly with the firewall?

NEW QUESTION 74
A security administrator is creating a new custom report to get a consolidated view of network events and needs to select a database to query for the report data.
Which valid set of databases is available for the task?

NEW QUESTION 75
An engineer at a managed services provider is updating an application that allows its customers to request firewall changes to also manage SD-WAN. The application will be able to make any approved changes directly to devices via API.
What is a requirement for the application to create SD-WAN interfaces?

NEW QUESTION 76
Palo Alto Networks NGFWs use SSL/TLS profiles to secure which two types of connections? (Choose two.)

NEW QUESTION 77
Which two zone types are valid when configuring a new security zone? (Choose two.)

NEW QUESTION 78
An engineer is creating an automation workflow. The first step is to deploy a new VM-Series firewall into a VMware vSphere environment, including its virtual machine (VM) configuration and network interfaces. The second step is to connect to the firewall and configure a complex set of Security policies and objects. The team uses both Terraform and Ansible.
For which part of this workflow would Terraform typically be used?

NEW QUESTION 79
An organization uses Cloud Identity Engine (CIE) to gather user information from its on-premises Active Directory (AD) for employees and a separate Azure AD for external partners. Due to compliance regulations, the firewalls protecting the internal network must not have any identity information about external partners. Conversely, firewalls in the partner-facing DMZ should only be aware of partner identities.
Which CIE feature is designed to solve this data partitioning requirement?

NEW QUESTION 80
When creating a Log Forwarding profile on a PAN-OS firewall to direct logs to various external and internal systems, which set of methods is available?

NEW QUESTION 81
A network administrator is configuring path monitoring for a primary static route to ensure immediate failback from a backup route. The administrator wants the primary route to become active again without any delay as soon as its path is restored.
Which preemptive hold time value should the administrator configure to achieve this immediate failback?

NEW QUESTION 82
After an engineer configures an IPSec tunnel with a Cisco ASA, the Palo Alto Networks firewall generates system messages reporting the tunnel is failing to establish.
Which of the following actions will resolve this issue?