Give PSE Strata Exam Questions A Try To Prepare For PSE Strata Exam Well

Eleanor2023-01-09T07:54:02+00:00

If you are preparing for the Palo Alto Networks System Engineer Professional – Strata exam, our PSE Strata exam questions are a valuable study resource that can help you succeed. These exam questions cover all the topics included in the PSE Strata exam, so you can be confident that you are studying all the relevant material. If you want to increase your chances of success on the Palo Alto Networks System Engineer Professional – Strata PSE Strata exam, we highly recommend giving ITPrepare’s PSE Strata exam questions a try.

Also, you can read PSE Strata free demo questions first:

Page 1 of 5

1. Which three actions should be taken before deploying a firewall evaluation unt in a customer environment? (Choose three.)

Request that the customer make part 3978 available to allow the evaluation unit to communicate with Panorama

Inform the customer that a SPAN port must be provided for the evaluation unit, assuming a TAP mode deployment.

Upgrade the evaluation unit to the most current recommended firmware, unless a demo of the upgrade process is planned.

Set expectations for information being presented in the Security Lifecycle Review (SLR) because personal user information will be made visible

Reset the evaluation unit to factory default to ensure that data from any previous customer evaluation is removed

2. A customer worried about unknown attacks is hesitant to enable SSL decryption due to privacy and regulatory issues .

How does the platform address the customer’s concern?

It overcomes reservations about SSL decrypt by offloading to a higher-capacity firewall to help with the decrypt throughput

It shows how AutoFocus can provide visibility into targeted attacks at the industry sector

It allows a list of websites or URL categories to be defined for exclusion from decryption

It bypasses the need to decrypt SSL traffic by analyzing the file while still encrypted

3. A prospective customer currently uses a firewall that provides only Layer 4 inspection and protections. The customer sees traffic going to an external destination, port 53, but cannot determine what Layer 7 application traffic is going over that port.

Which capability of PAN-OS would address the customer's lack of visibility?

Device ID, because it will give visibility into which devices are communicating with external destinations over port 53

single pass architecture (SPA), because it will improve the performance of the Palo Alto Networks Layer 7 inspection

User-ID, because it will allow the customer to see which users are sending traffic to external destinations over port 53

App-ID, because it will give visibility into what exact applications are being run over that port and allow the customer to block unsanctioned applications using port 53

4. What is an advantage of having WildFire machine learning (ML) capability Inline on the firewall?

It eliminates of the necessity for dynamic analysis in the cloud

It enables the firewall to block unknown malicious files in real time and prevent patient zero without disrupting business productivity

It is always able to give more accurate verdicts than the cloud ML analysis reducing false positives and false negatives

It improves the CPU performance of content inspection

5. What are two ways to manually add and remove members of dynamic user groups (DUGs)? (Choose two)

Add the user to an external dynamic list (EDL).

Tag the user using Panorama or the Web Ul of the firewall.

Tag the user through the firewalls XML AP

Tag the user through Active Directory

6. Which two features are key in preventing unknown targeted attacks? (Choose two)

nighty botnet report

App-ID with the Zero Trust model

WildFire Cloud threat analysis

Single Pass Parallel Processing (SP3)

7. What will best enhance security of a production online system while minimizing the impact for the existing network?

Layer 2 interfaces

active / active high availability (HA)

Virtual wire

virtual systems

8. Which three of the following actions must be taken to enable Credential Phishing Prevention? (Choose three.)

Enable User Credential Detection

Enable User-ID

Define a Secure Sockets Layer (SSL) decryption rule base

Enable App-ID

Define a uniform resource locator (URL) Filtering profile

9. When HTTP header logging is enabled on a URL Filtering profile, which attribute-value can be logged?

X-Forwarded-For

HTTP method

HTTP response status code

Content type

10. Which component is needed for a large-scale deployment of NGFWs with multiple Panorama Management Servers?

M-600 appliance

Panorama Interconnect plugin

Panorama Large Scale VPN (LSVPN) plugin

Palo Alto Networks Cluster license

Page 2 of 5

11. In Panorama, which three reports or logs will help identify the inclusion of a host source in a command-and-control (C2) incident? (Choose three.)

SaaS reports

data filtering logs

WildFire analysis reports

threat logs

botnet reports

12. A customer requires an analytics tool with the following attributes:

- Uses the logs on the firewall to detect actionable events on the network

- Automatically processes a series of related threat events that, when combines, indicate a likely comprised host on the network

- Pinpoints the area of risk and allows for assessment of the risk to action can be taken to prevent exploitation of network resources

Which feature of PAN-OS will address these requirements?

WildFire with application program interface (API) calls for automation

Third-party security information and event management (SIEM) which can ingest next-generation firewall (NGFW) logs

Automated correlation engine (ACE)

Cortex XDR and Cortex Data Lake

13. A customer requires protections and verdicts for portable executable (PE) and executable and linkable format (ELF), as well as the ability to integrate with existing security tools.

Which Cloud-Delivered Security Service (CDSS) does Palo Alto Networks provide that will address this requirement?

Dynamic Unpacking

WildFire

DNS Security

File Blocking profile

14. 1. A customer with a fully licensed Palo Alto Networks firewall is concerned about threats based on domain generation algorithms (DGAS).

Which Security profile is used to configure Domain Name Security (DNS) to Identity and block previously unknown DGA-based threats in real time?

URL Filtering profile

WildFire Analysis profile

Vulnerability Protection profile

Anti-Spyware profile

15. Which CLI command allows visibility into SD-WAN events such as path Selection and path quality measurements?

>show sdwan path-monitor stats vif

>show sdwan session distribution policy-name

>show sdwan connection all

>show sdwan event

16. Which statement best describes the business value of Palo Alto Networks Zero Touch Provisioning (ZTP)?

It is designed to simplify and automate the onboarding of new firewalls to the Panorama management server.

When it is in place, it removes the need for an onsite firewall

When the service is purchased, Palo Alto Networks sends an engineer to physically deploy the firewall to the customer environment

It allows a firewall to be automatically connected to the local network wirelessly

17. Which statement applies to Palo Alto Networks Single Pass Parallel Processing (SP3)?

It processes each feature in a separate single pass with additional performance impact for each enabled feature.

Its processing applies only to security features and does not include any networking features.

It processes all traffic in a single pass with no additional performance impact for each enabled feature.

It splits the traffic and processes all security features in a single pass and all network features in a separate pass

18. Which two of the following does decryption broker provide on a NGFW? (Choose two.)

Decryption broker allows you to offload SSL decryption to the Palo Alto Networks next-generation firewall and decrypt traffic only once

Eliminates the need for a third party SSL decryption option which allows you to reduce the total number of third party devices performing analysis and enforcement

Provides a third party SSL decryption option which allows you to increase the total number of third party devices performing analysis and enforcement

Decryption broker allows you to offload SSL decryption to the Palo Alto Networks next-generation firewall and decrypt traffic multiple times

19. Which solution informs a customer concerned about zero-day targeted attacks whether an attack is specifically targeted at its property?

AutoFocus

Panorama Correlation Report

Cortex XSOAR Community edition

Cortex XDR Prevent

20. What is the default behavior in PAN-OS when a 12 MB portable executable (PE) fe is forwarded to the WildFire cloud service?

PE File is not forwarded.

Flash file is not forwarded.

PE File is forwarded

Flash file is forwarded

Page 3 of 5

21. In PAN-OS 10.0 and later, DNS Security allows policy actions to be applied based on which three domains? (Choose three.)

grayware

command and control (C2)

benign

government

malware

22. Which three mechanisms are valid for enabling user mapping? (Choose three.)

Captive Portal

Domain server monitoring

Reverse DNS lookup

User behaviour recognition

Client probing

23. A WildFire subscription is required for which two of the following activities? (Choose two)

Filter uniform resource locator (URL) sites by category.

Forward advanced file types from the firewall for analysis.

Use the WildFire Application Programming Interface (API) to submit website links for analysis

Enforce policy based on Host Information Profile (HIP)

Decrypt Secure Sockets Layer (SSL)

24. The ability to prevent users from resolving internet protocol (IP) addresses to malicious, grayware, or newly registered domains is provided by which Security service?

WildFire

DNS Security

Threat Prevention

loT Security

25. Which three script types can be analyzed in WildFire? (Choose three)

PythonScript

MonoSenpt

JScript

PowerShell Script

VBScript

26. What is the recommended way to ensure that firewalls have the most current set of signatures for up-to-date protection?

Run a Perl script to regularly check for updates and alert when one is released

Monitor update announcements and manually push updates to Crewall

Store updates on an intermediary server and point all the firewalls to it

Use dynamic updates with the most aggressive schedule required by business needs

27. Access to a business site is blocked by URL Filtering inline machine learning (ML) and considered as a false-positive.

How should the site be made available?

Disable URL Filtering inline ML

Create a custom URL category and add it to the Security policy

Create a custom URL category and add it on exception of the inline ML profile

Change the action of real-time detection category on URL filtering profile

28. WildFire machine learning (ML) for portable executable (PE) files is enabled in the antivirus profile and added to the appropriate firewall rules in the profile. In the Palo Alto Networks WildFire test av file, an attempt to download the test file is allowed through.

Which command returns a valid result to verify the ML is working from the command line.

show wfml cloud-status

show mlav cloud-status

show ml cloud-status

show av cloud-status

29. What are three key benefits of the Palo Alto Networks platform approach to security? (Choose three)

operational efficiencies due to reduction in manual incident review and decrease in mean time to resolution (MTTR)

improved revenue due to more efficient network traffic throughput

Increased security due to scalable cloud delivered security Services (CDSS)

Cost savings due to reduction in IT management effort and device

30. How frequently do WildFire signatures move into the antivirus database?

every 24 hours

every 12 hours

once a week

every 1 hour

Page 4 of 5

31. in which step of the Palo Alto Networks Five-Step Zero Trust Methodology would an organization's critical data, applications, assets, and services (DAAS) be identified?

Step 4. Create the Zero Trust policy.

Step 2: Map the transaction flows.

Step 3. Architect a Zero Trust network.

Step 1: Define the protect surface

32. A customer is designing a private data center to host their new web application along with a separate headquarters for users.

Which cloud-delivered security service (CDSS) would be recommended for the headquarters only?

Threat Prevention

DNS Security

WildFire

Advanced URL Filtering (AURLF)

33. Which Security profile on the Next-Generation Firewall (NGFW) includes Signatures to protect against brute force attacks?

Vulnerability Protection profile

Antivirus profile

URL Filtering profile

Anti-Spyware profile

34. A packet that is already associated with a current session arrives at the firewall.

What is the flow of the packet after the firewall determines that it is matched with an existing session?

it is sent through the fast path because session establishment is not required. If subject to content inspection, it will pass through a single stream-based content inspection engine before egress.

It is sent through the slow path for further inspection. If subject to content inspection, it will pass through a single stream-based content inspection engines before egress

It is sent through the fast path because session establishment is not required. If subject to content inspection, it will pass through multiple content inspection engines before egress

It is sent through the slow path for further inspection. If subject to content inspection, it will pass through multiple content inspection engines before egress

35. The Palo Ao Networks Cloud Identity Engino (CIE) includes which service that supports identity Providers (ldP)?

Directory Sync and Cloud Authentication Service that support IdP ung SAML 2.0 and OAuth2

Cloud Authentication Service that supports IdP using SAML 2.0 and OAuth2

Directory Sync and Cloud Authentication Service that support IdP ng SAML 2.0

Directory Sync that supports IdP using SAML 2.0

36. Which filtering criterion is used to determine users to be included as members of a dynamic user group (DUG)?

Security policy rule

Tag

IP address

37. Within the Five-Step Methodology of Zero Trust, in which step would application access and user access be defined?

Step 3: Architect a Zero Trust Network

Step 5. Monitor and Maintain the Network

Step 4: Create the Zero Trust Policy

Step 1: Define the Protect Surface

Step 2 Map the Protect Surface Transaction Flows

38. Which proprietary technology solutions will allow a customer to identify and control traffic sources regardless of internet protocol (IP) address or network segment?

User ID and Device-ID

Source-D and Network.ID

Source ID and Device-ID

User-ID and Source-ID

39. What will a Palo Alto Networks next-generation firewall (NGFW) do when it is unable to retrieve a DNS verdict from the DNS cloud service in the configured lookup time?

allow the request and all subsequent responses

temporarily disable the DNS Security function

block the query

discard the request and all subsequent responses

40. Which two configuration elements can be used to prevent abuse of stolen credentials? (Choose two.)

WildFire analysis

Dynamic user groups (DUGs)

Multi-factor authentication (MFA)

URL Filtering Profiles

Page 5 of 5

41. Which built-in feature of PAN-OS allows the NGFW administrator to create a policy that provides auto remediation for anomalous user behavior and malicious activity while maintaining user visibility?

Dynamic user groups (DUGS)

tagging groups

remote device User-ID groups

dynamic address groups (DAGs)

42. WildFire can discover zero-day malware in which three types of traffic? (Choose three)

SMTP

HTTPS

FTP

DNS

TFTP

43. A customer is starting to understand their Zero Trust protect surface using the Palo Alto Networks Zero Trust reference architecture.

What are two steps in this process? (Choose two.)

Validate user identities through authentication

Gain visibility of and control over applications and functionality in the traffic flow using a port and protocol firewall

Categorize data and applications by levels of sensitivity

Prioritize securing the endpoints of privileged users because if non-privileged user endpoints are exploited, the impact will be minimal due to perimeter controls

44. A Fortune 500 customer has expressed interest in purchasing WildFire; however, they do not want to send discovered malware outside of their network.

Which version of WildFire will meet this customer’s requirements?

WildFire Private Cloud

WildFire Government Cloud

WildFire Secure Cloud

WildFire Public Cloud

45. Which two methods are used to check for Corporate Credential Submissions? (Choose two.)

doman credentialiter

User-ID credential check

LDAP query

IP user mapping

46. Which two features can be enabled to support asymmetric routing with redundancy on a Palo Alto networks next-generation firewall (NGFW)? (Choose two.)

Active / active high availability (HA)

Multiple virtual systems

non-SYN first packet

Asymmetric routing profile

47. What are two benefits of the sinkhole Internet Protocol (IP) address that DNS Security sends to the client in place of malicious IP addresses? (Choose two.)

The client communicates with it instead of the malicious IP address

It represents the remediation server that the client should visit for patching

It will take over as the new DNS resolver for that client and prevent further DNS requests from occurring in the meantime

In situations where the internal DNS server is between the client and the firewall, it gives the firewall the ability to identify the clients who originated the query to the malicious domain

48. What helps avoid split brain in active / passive high availability (HA) pair deployment?

Enable preemption on both firewalls in the HA pair.

Use a standard traffic interface as the HA3 link.

Use the management interface as the HA1 backup link

Use a standard traffic interface as the HA2 backup

49. Which of the following statements is valid with regard to Domain Name System (DNS) sinkholing?

it requires the Vulnerability Protection profile to be enabled

DNS sinkholing signatures are packaged and delivered through Vulnerability Protection updates

infected hosts connecting to the Sinkhole Internet Protocol (IP) address can be identified in the traffic logs

It requires a Sinkhole license in order to activate

50. Which Palo Alto Networks security component should an administrator use to and NGFW policies to remote users?

Prisma SaaS API

Threat intelligence Cloud

GlobalProtect

Cortex XDR

Give PSE Strata Exam Questions A Try To Prepare For PSE Strata Exam Well