PaloAltoACE认证考试题库及答案

ACEExam

Question1of72.

Whichofthefollowingisnotdefinedorassignedaspartofthesecurityrules?

答案：A

匕NATrules

UFileblockingprofile

CSecurityprofiles

CApplications

Markforfollowup

Question2of72.

11ispossibletousedifferentSSLforwardproxycertificatesfordifferentvsysinamulti-vsys

environment.

答案：A

TrueFalse

cc

Markforfollowup

Question3of72.

InActive/ActiveHAenvironments,redundancyfortheHA3interfacecanbeachievedby

答案：C

CConfiguringHA3inaredundantgroup

ConfiguringacorrespondingHA4interface

ConfiguringHA3asanAggregateEthernetbundle

CConfiguringmultipleHA3interfaces

Markforfollowup

Question4of72.

InPANOS4.0orgreater,whichofthefollowingisanaccuratestatementinregardtosupportfor

IPv6?

答案：C

PANOSsupportsContentIDinIPv6,butonlyinLayer3Mode.

UserIDisonlysupportedinIPv6whenthePaloAltoNetworksfirewallisdeployedinVwiremode.

PANOSsupportsdual-stackIP,forIPv4andIPv6.ThisincludesVirtualWireandLayer3deployments.

ThreatPreventioncapabilitiesarenotsupportedinIPv6.

Noneoftheabove

Markforfollowup

Question5of72.

WhatneedstobedonepriortocommittingaconfigurationinPanoramaaftermakingachangevia

theCLIorwebinterfaceonadevice?

答案：D

CRe-importtheconfigurationfromthedeviceintoPanorama

CMakethesamechangeagainviaPanorama

USynchronizetheconfigurationbetweenthedeviceandPanorama

Noadditionalactionsrequired

Noneoftheabove

Markforfollowup

Question6of72.

Ifacustomerhas1forestwith3domainsandwantsaresilientPANAgentdeployment,whatisthe

mostappropriateagentarchitecture?

答案：B

Agentsdeployedontwoseparateserverswithintheforest

TwoAgentsdeployedperdomain,onseparateservers

Twoagentsdeployedonvirtualserversonaserverwithintheforest

Anagentdeployedonaserverwithineachdomain

rMarkforfollowup

Question7of72.

WhichmodewillallowausertochoosehowtheywishtoconnecttotheGlobalProtectNetworkas

theywouldlike?

答案：C

COptionalMode

CAlwaysOnMode

COnDemandMode

CSingleSign-OnMode

Markforfollowup

Question8of72.

Active/ActiveHAcanbeconfiguredtoprovide:

答案：C

CHighersessioncount

CRedundantVirtualRouters

USupportforasymmetricroutingenvironments

CLowerfail-overtimes

Markforfollowup

Question9of72.

WhenforwardingmulticastpacketsinL2mode,wecanconfiguresecuritypolicestomatchon

multicastIPaddresses.

答案：B

TrueFalse

cc

Markforfollowup

Question10of72.

ToproperlyconfigureDOSprotectiontolimitthenumberofsessionsindividuallyfromspecific

sourceIPsyouwouldconfigureaDOSProtectionrulewiththefollowingcharacteristics:

答案：B

CAction:Protect,AggregateProfilewith"ResourcesProtection"configured

„Action:Protect,ClassifiedProfilewith"ResourcesProtection"configured,andClassifiedAddresswith

c"source-ip-only"configured

Action:Deny,AggregateProfilewithHResourcesProtection"configured

Action:Deny,ClassifiedProfilewith"ResourcesProtection"configured,andClassifiedAddresswith

"source-ip-only"configured

Noneoftheabove

Markforfollowup

Question11of72.

ForcorrectroutingtoSSLVPNclientstooccur,thefollowingmustbeconfigured:

答案：B

CAstaticrouteonthenext-hopgatewayoftheSSLVPNclientIPpoolwithadestinationofthePANdevice

Noroutingneedstobeconfigured-thePANdeviceautomaticallyrespondstoARPrequestsfortheSSL

VPNclientIPpool

白NetworkAddressTranslationmustbeenabledfortheSSLVPNclientIPpool

AdynamicroutingprotocolbetweenthePANdeviceandthenext-hopgatewaytoadvertisetheSSLVPN

clientIPpool

Markforfollowup

Question12of72.

WhenNetworkAddressTranslationhasbeenperformedontraffic,DestinationZonesinSecurity

rulesshouldbebasedon:

答案：A

CPost-NATaddresses

CPre-NATaddresses

UthesamezonesusedintheNATrules

CNoneoftheabove

Markforfollowup

Question13of72.

Whenusing802.1Qwithaggregatelinks,whatTAG-IDmustbeconfiguredonthevirtualwirein

orderforLACPonaCiscoswitchtooperateproperly?

答案：A

C0

C1

C2

C3

Markforfollowup

Question14of72.

OnaPA-4050withtapinterfacesconfiguredononecopperportandonefiberport,howmany

virtualwirescanbeconfiguredusingtheremainingports?

答案：B

rio

n11

C12

□o

UNoneoftheabove

Markforfollowup

Question15of72.

Alocal/enterprisePKIsystemisrequiredtodeployoutboundforwardproxySSLdecryption

capabilities.

答案：B

TrueFalse

cc

Markforfollowup

Question16of72.

WhichofthefollowingcanbeconfiguredasanexthopinaPolicy-BasedForwardingRule:

答案：B

CADynamicRoutingProtocol

匕VirtualSystem

CARedistributionProfile

CVirtualRouter

CAlloftheabove

Markforfollowup

Question17of72.

Fornon-Microsoftclients,whatCaptivePortalmethodissupported?

答案：C

CNTLMAuth

UUserAgent

UWebFormCaptivePortal

LocalDatabase

Markforfollowup

Question18of72.

WhichoneoftheoptionsdescribesthesequenceoftheGlobalProtectagentconnectingtoa

Gateway?

答案：A

Theagentconnectstotheportal,obtainsalistoftheGateways,andconnectstotheGatewaywiththe

fastestSSLconnecttime

UTheagentconnectstotheclosestGatewayandsendstheHIPreporttotheportal

Theagentconnectstotheportal,obtainsalistoftheGateways,andconnectstotheGatewaywiththe

fastestPINGresponsetime

CTheagentconnectstotheportalandrandomlyestablishesconnectiontothefirstavailableGateway

Markforfollowup

Question19of72.

AnOutboundSSLdecryptionrulecannotbecreatedusingwhichtypeofzone?

答案：A

巴Tap

CVirtualWire

rL2

□L3

CNoneoftheabove

Markforfollowup

Question20of72.

WhichofthefollowingrepresentspotentialHTTPtrafficeventsthatcanbeusedtoidentifypotential

Botnets?

答案：A

TrafficfromusersthatbrowsetoIPaddressesinsteadoffully-qualifieddomainnames,traffictodomains

L-wi

thathavebeenregisteredinthelast30days,downloadingexecutablefilesfromunknownURL's

TrafficfromusersthatbrowsetoIPaddressesinsteadoffully-qualifieddomainnames,traffictodomains

Cthathavebeenregisteredinthelast60days,downloadingexecutablefilesfromunknownURL's,

IRC-basedCommandandControltraffic

TrafficfromusersthatbrowsetoIPaddressesinsteadoffully-qualifieddomainnames,downloading

CW32.Welchia.WormfromaWindowsshare,traffictodomainsthathavebeenregisteredinthelast30

days,downloadingexecutablefilesfromunknownURL's

CTrafficfromusersthatbrowsetoIPaddressesinsteadoffully-qualifieddomainnames,traffictodomains

thathavebeenregisteredinthelast60days,downloadingexecutablefilesfromunknownURL's

Markforfollowup

Question21of72.

WhatistheCLIcommandthatwillinitiateallIPSecVPNtunnelsonadevice?

答案：B

Usetvpnallup

testvpnipsec-sa

testvpnike-as

requestvpnipsec-astest

Noneoftheabove

Markforfollowup

Question22of72.

You'veinstalledandconfiguredaUserIdentificationAgentonaremotecomputer,butwhenthe

agentuserinterfaceislaunchedthemessage"ConnectionFailed"isshownandnousernamesare

resolved.Whatisthemostlikelycauseofthisproblem?

答案：A

CTheUserIdentificationAgentservicedoesnothavereadpermissiontotheActiveDirectorySecuritylog

CTheUserIdentificationAgenttimeoutvaluesarenotconfiguredcorrectly.

CTheUserIdentificationAgentsoftwaredidnotinstallproperly.

CTheUserIdentificationAgentcannotcommunicatetothefirewall

CNoneoftheabove

Markforfollowup

Question23of72,

WhichroutingprotocolissupportedonthePaloAltoNetworksplatform?

答案：B

eRIPVI

□BGP

匕RSTP

□ISIS

UNoneoftheabove

Markforfollowup

Question24of72.

IfyouwanttopreventclientPCsusingSSHport-forwardingtobypassfirewallenforcement,whatis

thebestwayofaccomplishingthis?

答案：A

EnableSSHdecryption,blockSSHtunneltraffic

EnableSSLdecryption,blockSSHtraffic

UEnableSSLdecryption,blockSSHtunneltraffic

白EnableSSHdecryption,blockSSHtraffic

Markforfollowup

Question25of72.

WhensettingupGlobalProtect,whatisthejoboftheGlobalProtectPortal?Selectthebestanswer

答案：C

CToloadbalanceGlobalProtectclientconnectionstoGlobalProtectGateways

CTomaintainthelistofGlobalProtectGatewaysandlistofcategoriesforcheckingtheclientmachine

ToapplyGlobalServerLoadBalancingtoGlobalProtectclientstootherGlobalProtectPortalsor

Gateways.

CTomaintainthelistofremoteGlobalProtectPortalsandlistofcategoriesforcheckingtheclientmachine

Markforfollowup

Question26of72.

ThemaximumnumberofinterfacesthatcanbeconfiguredinasingleVirtualWireobjectis:

答案：B

2

4

8

16

Markforfollowup

Question27of72.

TheMDisableServerReturnInspection1'optiononasecurityprofile:

答案：D

CcanonlybeconfiguredinTapMode

Udoesnotperformhigher-levelinspectionoftrafficfromthesidethatoriginatedtheTCPSYNpacket

Udoesnotperformhigher-levelinspectionoftrafficfromthesidethatoriginatedtheTCPSYNpacket

Cperformshigher-levelinspectionoftrafficfromthesidethatoriginatedtheTCPSYNpacket

F]Noneoftheabove

Markforfollowup

Question28of72.

ThenDrive-ByDownload"protectionfeature,underFileBlockingprofilesinContend-ID,provides:

答案：B

CIncreasedspeedonthedownloadsoftheallowedfiletypes.

Protectionagainstunwanteddownloads,byalertingtheuserwitharesponsepageindicatingthatafileis

goingtobedownloaded.

anadministratortheabilitytoleverageAuthenticationProfilesinordertoprotectagainstunwanted

downloads.

UPassword-protectedaccesstospecificfiledownloads,forauthorizedusers.

Markforfollowup

Question29of72.

ToallowthePANdevicetoresolveinternalandexternalDNShostnamesforreportingandfor

securitypolicy,anadministratorcandothefollowing:

答案：B

InthedevicesettingssetthePrimaryDNSservertoanexternalserverandthesecondarytoaninternal

server.

CreateaDNSProxyObjectwithadefaultDNSServerforexternalresolutionandaDNSserverforinternal

domain.Then,inthedevicesettings,pointtothisproxyobjectforDNSresolution.

CreateaDNSProxyObjectwithadefaultDNSServerforexternalresolutionandaDNSserverforinternal

domain.Then,inthedevicesettings,selecttheproxyobjectasthePrimaryDNSandcreateacustom

securityrulewhichreferencesthatobject.

Inthedevicesettingsdefineinternalhostsviaastaticlist.

Noneoftheabove

Markforfollowup

Question30of72.

WhathappensatthepointofThreatPreventionlicenseexpiration?

答案：A

ThreatPreventionnolongerupdated;existingdatabasestilleffective

ThreatPreventionnolongerused;trafficisallowedorblockedbyconfigurationperSecurityRule

ThreatPreventionnolongerused;applicabletrafficisblocked

ThreatPreventionisnolongerused;applicabletrafficisallowed

Markforfollowup

Question31of72.

Wherecanyouenablethe"DynamicURLFiltering"option?

答案：D

InthezoneconfigurationthatincludestheinterfacefortheURLfilteredtraffic

IntheZoneProtectionProfilesettings

UnderDevice/Licenses/URLAltering

IntheURLFilteringsecurityprofileobject

Noneoftheabove

Markforfollowup

Question32of72.

WhichofthefollowingtypesofprotectionareavailableinDoSpolicy?

答案：A

Limit,SYNFlood,UDPRood

CSessionLimit,SYNFlood,HostSwapping,UDPFlood

USessionLimit,SYNFlood,PortScanning,HostSwapping

CSessionLimit,PortScanning,HostSwapping,UDPFlood

Markforfollowup

Question33of72.

AcustomerwouldliketoidentifyanyTCPportscansorUDPportsscanstraversingtheirnetwork

links.Wherecanthistypeofsecuritypolicybeconfigured?

答案：A

CNetwork/NetworkProfiles/ZoneProtection

UPolicies/Profile/ZoneProtection

Objects/ZoneProtection

Interfaces/Interfacenumber/ZoneProtection

Markforfollowup

Question34of72.

ToreducetheamountofURLlogsgeneratedyoucanconfigure:

答案：A

CAURLAlteringProfilewith"Logcontainerpageonly',enabled

CAURLFilteringProfilewith"DynamicURLFiltering"enabled

UAURLFilteringProfilewiththeblocklistsetto"Alert"

CThefollowingCLIcommand:"setsystemurl-log-length256

Markforfollowup

Question35of72.

WhenconfiguringSecurityrulesbasedonFQDNobjects,whichofthefollowingstatementsare

true?

答案：A

ThefirewallresolvestheFQDNfirstwhenthepolicyiscommitted,andisrefreshedatTTLexpiration.

Lu

ThereisnolimitonthenumberofIPaddressesstoredforeachresolvedFQDN.

InordertocreateFQDN-basedobjects,youneedtomanuallydefinealistofassociatedIP.Upto10IP

addressescanbeconfiguredforeachFQDNentry.

ThefirewallresolvestheFQDNfirstwhenthepolicyiscommitted,andisrefreshedeachtimeSecurity

L-^i

rulesareevaluated.

ThefirewallresolvestheFQDNfirstwhenthepolicyiscommitted,andisrefreshedatTTLexpiration.The

resolutionofthisFQDNstoresupto10differentIPaddresses.

Markforfollowup

Question36of72.

WhatisrequiredtoconfiguremultiplePhase2IPSecVPNtunnelstothesamePhase1gateway?

答案：B

UMultipleP2tunnelswithdifferentProxyID'sondifferenttunnelinterfaces

CMultipleP2tunnelswithdifferentProxyID'sonthesametunnelinterface

CMultipletunnelinterfaces

CMultipleP2tunnelswithdifferentPeerID'sonthesametunnelInterfaces

Markforfollowup

Question37of72.

WithSSHdecryptionenabled,theSCPapplicationwillbeidentifiedas:

答案：A

匕ssh

□sftp

escp

Cssh-tunnel

Markforfollowup

Question38of72.

WhichofthefollowinglicensesisnecessaryinordertoprovidemoreaccurateBotnetreporting?

答案：D

GlobalProtectGatewayLicense

ThreatPreventionLicense

UVirtualSystemLicense

CURL-FilteringLicense

CAlloftheabove

Markforfollowup

Question39of72.

WhenauserlogsinviaCaptivePortal,theiruserinformationischeckedagainst:

答案：B

CActiveDirectory

CRadius

CLocaldatabase

CAlloftheabove

Markforfollowup

Question40of72.

WhatoptionshouldbeconfiguredwhenusingUserIdentification?

答案：C

UEnableUserIdentificationperinterface

UEnableUserIdentificationperSecurityRule

UEnableUserIdentificationperZone

Noneoftheabove

Markforfollowup

Question41of72.

WhichofthefollowingarenecessarycomponentsofaGlobalProtectsolution?

答案：D

CGlobalProtectNetConnect,GlobalProtectAgent,GlobalProtectPortal,GlobalProtectServer

GlobalProtectGateway,GlobalProtectNetConnect,GlobalProtectAgent,GlobalProtectPortal,

GlobalProtectServer

UGlobalProtectGateway,GlobalProtectAgent,GlobalProtectServer

UGlobalProtectGateway,GlobalProtectAgent,GlobalProtectPortal

CNoneoftheabove

Markforfollowup

Question42of72.

HowmanybytesoftheURLarecapturedintheURLLog?

答案：C

C2047

C255

C511

匚；1023

Markforfollowup

Question43of72.

ThefollowingcanbeconfiguredasanexthopinaStaticRoute:

答案：D

CAPolicy-BasedForwardingRule

CVirtualSystem

CADynamicRoutingProtocol

亡VirtualRouter

F二Noneoftheabove

Markforfollowup

Question44of72.

Whichbestdescribesthefirewallrulestobeappliedtoasession?

答案：B

Ulastmatchapplied

Ufirstmatchapplied

Umostspecificmatchapplied

Callmatchesapplied

Markforfollowup

Question45of72.

ForasecuritypolicytoallowinboundNATedtraffictoawebserverwithaprivateIPaddressinthe

trustzone,theentryintheDestinationAddresscolumnofthesecurityruleshouldbebasedonthe

privateIPaddressofthewebserver.

答案：B

TrueFalse

Markforfollowup

Question46of72.

WhichlocalinterfacecannotbeassignedtoIKEgateway?

答案：D

亡VLAN

CLoopback

rLS

CTunnel

Markforfollowup

Question47of72.

AtrafficlogentrywithanApplicationof"incomplete"means:

答案：A

CTheTCPSYN-ACKresponsepacketwasnotseenbeforethesessiontimedout

CCaptivePortalhasnotbeenconfiguredproperly

UAninvalidSSLcertificateisinuse

CTheApp-IDenginecouldnotfindamatchingapplication

F]Noneoftheabove

Markforfollowup

Question48of72.

Whencreatingacustomvulnerabilityprofileandselecting"BlockIP"astheaction,howlongwill

theIPaddressbeblocked?

答案：D

COneHour

Configurablefromonesecondtotwohours

CTwoHours

Configurablefromonesecondtoonehour

Markforfollowup

Question49of72.

WhichstatementaccuratelyreflectsthefunctionalityofusingregionsasobjectsinSecurity

policies?

答案：D

Theadministratorcansetupcustomregions,includinglatitudeandlongitude,tospecifythegeographic

Cpositionofthatparticularregion.Thesecustomregionscanbeusedinthe"SourceUser"fieldofthe

SecurityPolicies.

Theadministratorcansetupcustomregions,includinglatitudeandlongitude,tospecifythegeographic

Upositionofthatparticularregion.Bothpredefinedregionsandcustomregionscanbeusedinthe"Source

User'1field.

Regionscannotbeusedinthe"SourceUserMfieldoftheSecurityPolicies,unlesstheadministratorhasset

口

upcustomregions.

Predefinedregionsareprovidedforcountries,notbutnotforcities.Theadministratorcansetupcustom

La

regions,includinglatitudeandlongitude,tospecifythegeographicpositionofthatparticularregion.

Markforfollowup

Question50of72.

WithURLfiltering,theorderofcheckingwithinaprofileis1)allowlist;2)blocklist;3)URL

categories.

答案：B

TrueFalse

cc

Markforfollowup

Question51of72.

BotnetDetection,undertheMonitortab,willaccomplishthefollowing:

答案：D

Providetheadministratorwithpacketcapturesthatcanbeusedlatertocreatecustomsignaturesfor

preventingunknownbotnets.

UToblocktheinstallationofBotnetsthroughanadvanceddeep-packetinspectionalgorithm.

UPreventBotnet-infectclientcomputersfromrespondingtoCommandandControldata.

PresentareportofknownBotnets,baseduponconditionsstipulatedbytheadministrator,foundovera

匚,一

periodoftime.

CNoneoftheabove

Markforfollowup

Question52of72.

HApathmonitoringcanbeconfiguredinVirtualWiremode.

答案：A

TrueFalse

cc

Markforfollowup

Question53of72.

A"Continue"actioncanbeconfiguredonwhichofthefollowingSecurityProfiles.

答案：C

URLAltering,FileBlocking,andDataAltering

匕URLAltering

eURLFilteringandFileBlocking

CURLFilteringandAntivirus

CAlloftheabove

Markforfollowup

Question54of72.

ThebestpracticetoadvertiseaninterfaceIPviaOSPFwithoutitactingasanOSPFneighborand

withoutitcreatingunnecessaryType5LSA'sis:

答案：C

CConfiguretheinterfaceasaVirtualLink

CConfigurearoutingpolicytoimporttheconnectedsubnetintotheOSPFarea

UConfiguretheinterfaceasapassiveOSPFinterface

UConfigureastaticrouteandconfigurearoutingpolicytoimportthestaticrouteintotheOSPFarea

UNoneoftheabove

Markforfollowup

Question55of72.

WithSSHdecryptionenabled,X-Windowforwardingwillbeidentifiedas:

答案：C

Cssh

xwindow

Ussh-tunnel

Crdp

CNoneoftheabove

Markforfollowup

Question56of72.

Whencreatinganapplicationfilter,whichofthefollowingcharacteristicscannotbeselectedasa

"match"?

答案：C

UExcessivebandwidth

CUsedbymalware

UExcessivesessions

UTransfersfiles

Markforfollowup

Question57of72.

Userscanbeauthenticatedseriallytomultipleauthenticationserversbyconfiguring:

答案：C

CAuthenticationProfile

CAcustomAdministratorProfile

AuthenticationSequence

MultipleRADIUSServerssharingaVSAconfiguration

Markforfollowup

Question58of72.

WhichtwostatementsaretrueabouttheSessionOwnerdeviceinanActive/ActiveHApair?

答案：C

TheSessionOwnerperformsLayer3andLayer4packetprocessing,theActivePrimarydeviceisalways

theSessionOwner

CTheSessionOwnerdoesallLayer7processing,TheActivePrimarydeviceisalwaystheSessionOwner

匹TheSessionOwnerperformsallLayer3andLayer4packetprocessing,theSessionOwnerisresponsible

forgeneratingtrafficlogs

TheSessionOwnerisresponsibleforgeneratingtrafficlogs,theActivePrimarydeviceisalwaysthe

SessionOwner.

Markforfollowup

Question59of72.

You'dliketoscheduleafirewallpolicytoonlyallowacertainapplicationduringaparticulartimeof

day.Wherecanthispolicyoptionbeconfigured?

答案：A

CPolicies/Optionscolumn

CPolicies/Service

CPolicies/Application

CPolicies/Profile

F[Noneoftheabove

Markforfollowup

Question60of72.

WhatisthecorrectpolicytomosteffectivelyblockSkype?

答案；A

AllowSkype-probe,blockSkype

BlockSkype

BlockSkype-probe,blockSkype

AllowSkype,blockSkype-probe

Noneoftheabove

Markforfollowup

Question61of72.

WhatrightstothedomaindoestheTerminalServicesAgentrequireinordertoidentifyusersona

terminalserver?

答案：A

DoesnotneedDomainpermissions

ReadaccesstotheSecuritylogs

DomainUser

DomainAdmin

rMarkforfollowup

Question62of72.

WhichofthefollowingarevalidHAstatesinanActive/ActiveHighAvailabilitydeployment?

答案：A

CActivePrimary.Tentative,Non-functional

UActivePrimary,ActiveTentative,Non-functional

UActivePrimary,ActiveTentative,Tentative

CActiveTentative,Tentative,Non-functional

Markforfollowup

Question63of72.

WhichofthefollowingfieldsisnotavailableinDoSpolicy?

答案：A

CApplication

CSourceZone

UService

UDestinationZone

CNoneoftheabove

Markforfollowup

Question64of72.

WhichofthefollowingareaccuratestatementsdescribingtheHA3linkinanActive-ActiveHA

deployment?

答案：A

CHA3isaLayer2link,HA3isusedtohandleasymmetricrouting

HA3isthecontrollink,HA3isalayer2link

HA3isusedtohandleasymmetricrouting,HA3isthedatalink

HA3isusedforsessionsynchronization,HA3isaLayer2link

Markforfollowup

Question65of72.

InQoS,whichofthefollowingwouldbethehighestprioritytrafficfromtheoptionslistedbelowon

asaturated100Mbpslink?

答案：C

UClass1traffic,settohighandguaranteed1Mbps.

CClass1traffic,settohigh.

CClass8traffic,settorealtime.

UClass8traffic,settorealtimeandguaranteed1Mbps

CNoneoftheabove

Markforfollowup

Questi