Palo-Alto-Networks ACE Exam Dumps

Palo-Alto-Networks ACE Sample Question Answers

Question # 1

A user complains that they are no longer able to access a needed work application after you have implemented vulnerability and anti-spyware profiles. The user's application uses a unique port. What is the most efficient way to allow the user access to this application? 

A. Utilize an Application Override Rule, referencing the custom port utilzed by this application. Application Override rules bypass all Layer 7 inspection, thereby allowing access to this application. 
B. In the Threat log, locate the event which is blocking access to the user's application and create a IP-based exemption for this user. 
C. In the vulnerability and anti-spyware profiles, create an application exemption for the user's application. 
D. Create a custom Security rule for this user to access the required application. Do not apply vulnerability and anti-spyware profiles to this rule. 

Show Answer

Question # 2

After configuring Captive Portal in Layer 3 mode, users in the Trust Zone are not receiving the Captive Portal authentication page when they launch their web browsers. How can this be corrected?

 A. Ensure that all users in the Trust Zone are using NTLM-capable browsers 
B. Enable "Response Pages" in the Interface Management Profile that is applied to the L3 Interface in the Trust Zone. 
C. Confirm that Captive Portal Timeout value is not set below 2 seconds 
D. Enable "Redirect " as the Mode type in the Captive Portal Settings 

Show Answer

Question # 3

When setting up GlobalProtect, what is the job of the GlobalProtect Portal? Select the best answer 

A. To maintain the list of remote GlobalProtect Portals and list of categories for checking the client machine 
B. To maintain the list of GlobalProtect Gateways and list of categories for checking the client machine 
C. To load balance GlobalProtect client connections to GlobalProtect Gateways 
D. None of the above 

Show Answer

Question # 4

What is the size limitation of files manually uploaded to WildFire 

A. Configuarable up to 10 megabytes 
B. Hard-coded at 10 megabytes 
C. Hard-coded at 2 megabytes 
D. Configuarable up to 20 megabytes 

Show Answer

Question # 5

You can assign an IP address to an interface in Virtual Wire mode. 

A. True 
B. False 

Show Answer

Question # 6

You have decided to implement a Virtual Wire Subinterface. Which options can be used to classify traffic? 

A. Either VLAN tag or IP address, provided that each tag or ID is contained in the same zone. 
B. Subinterface ID and VLAN tag only 
C. By Zone and/or IP Classifier 
D. VLAN tag, or VLAN tag plus IP address (IP address, IP range, or subnet). 

Show Answer

Question # 7

Administrative Alarms can be enabled for which of the following except? 

A. Certificate Expirations
 B. Security Violation Thresholds
 C. Security Policy Tags 
D. Traffic Log capacity

Show Answer

Question # 8

As a Palo Alto Networks firewall administrator, you have made unwanted changes to the Candidate configuration. These changes may be undone by Device > Setup > Operations > Configuration Management>....and then what operation? 

A. Revert to Running Configuration 
B. Revert to last Saved Configuration 
C. Load Configuration Version 
D. Import Named Configuration Snapshot

Show Answer

Question # 9

Using the API in PAN-OS 6.1, WildFire subscribers can upload up to how many samples per day? 

A. 500 
B. 50 
C. 1000 
D. 10 

Show Answer

Question # 10

Can multiple administrator accounts be configured on a single firewall? 

A. Yes
 B. No

Show Answer

Question # 11

What is the default DNS Sinkhole address used by Palo Alto Networks Firewall to cut off communication? 

A. MGT interface address 
B. Loopback interface address 
C. Any one Layer 3 interface address 
D. Localhost address 

Show Answer

Question # 12

Which fields can be altered in the default Vulnerability Protection Profile? 

A. Category 
B. Severity 
C. None 

Show Answer

Question # 13

With IKE, each device is identified to the other by a Peer ID. In most cases, this is just the public IP address of the device. In situations where the public ID is not static, this value can be replaced with a domain name or other text value 

A. True 
B. False 

Show Answer

Question # 14

Which of the following must be configured when deploying User-ID to obtain information from an 802.1x authenticator? 

A. Terminal Server Agent 
B. An Agentless deployment of User-ID, employing only the Palo Alto Networks Firewall
 C. A User-ID agent, with the "Use for NTLM Authentication" option enabled. 
D. XML API for User-ID Agent

Show Answer

Question # 15

What will the user experience when attempting to access a blocked hacking website through a translation service such as Google Translate or Bing Translator? 

A. A “Blocked” page response when the URL filtering policy to block is enforced. 
B. A “Success” page response when the site is successfully translated. 
C. The browser will be redirected to the original website address. 
D. An "HTTP Error 503 Service unavailable" message. 

Show Answer

Question # 16

When a user logs in via Captive Portal, their user information can be checked against:

 A. Terminal Server Agent 
B. Security Logs
 C. XML API 
D. Radius 

Show Answer

Question # 17

Select the implicit rules that are applied to traffic that fails to match any administratordefined Security Policies. (Choose all rules that are correct.)

 A. Intra-zone traffic is allowed 
B. Inter-zone traffic is denied 
C. Intra-zone traffic is denied 
D. Inter-zone traffic is allowed 

Show Answer

Question # 18

Previous to PAN-OS 7.0 the firewall was able to decode up to two levels. With PAN-OS 7.0 the firewall can now decode up to how many levels? 

A. Three 
B. Six 
C. Five
 D. Four 

Show Answer

Question # 19

Configuring a pair of devices into an Active/Active HA pair provides support for: 

A. Higher session count 
B. Redundant Virtual Routers 
C. Asymmetric routing environments 
D. Lower fail-over times 

Show Answer

Question # 20

What are two sources of information for determining if the firewall has been successful in communicating with an external User-ID Agent? 

A. System Logs and the indicator light under the User-ID Agent settings in the firewall 
B. There's only one location - System Logs 
C. There's only one location - Traffic Logs 
D. System Logs and indicator light on the chassis

Show Answer

Question # 21

When configuring a Security Policy Rule based on FQDN Address Objects, which of the following statements is True?

 A. The firewall resolves the FQDN first when the policy is committed, and resolves the FQDN again each time Security Profiles are evaluated. 
B. The firewall resolves the FQDN first when the policy is committed, and resolves the FQDN again at DNS TTL expiration. 
C. In order to create FQDN-based objects, you need to manually define a list of associated IP addresses. 

Show Answer

Question # 22

What is the default setting for 'Action' in a Decryption Policy's rule?

A. No-decrypt 
B. Decrypt 
C. Any 
D. None 

Show Answer