一番質高い SecOps-Generalist 試験問題集

In a PAN-OS SD-WAN deployment, how does the firewall primarily leverage App-ID information when making real-time path selection decisions for application traffic?

• A. App-ID directs traffic to the management plane for detailed processing and path selection.
• B. App-ID is only used for security policy enforcement (allow/deny), not for path selection.
• C. App-ID identifies the application, and the Path Selection policy uses this application identity as a matching criterion to apply specific routing rules or performance requirements.
• D. App-ID is used to encrypt traffic before it is sent over the selected WAN link.
• E. App-ID dynamically changes the port and protocol of the application to match the capabilities of the best available WAN link.

An administrator is configuring SSL Inbound Inspection on a Palo Alto Networks NGFW to decrypt incoming HTTPS traffic destined for an internal web server. Which type of certificate, specifically the private key component, must be imported onto the firewall to enable successful decryption of traffic destined for that specific server?

• A. A wildcard certificate trusted by internal clients.
• B. The firewall's self-signed intermediate CA certificate for forward proxy.
• C. The public certificate of the external client connecting to the server.
• D. The server certificate of the internal web server, including its private key.
• E. The firewall's self-signed root CA certificate.

An administrator is troubleshooting a scenario where a newly released threat is not being detected by the Antivirus profile on a Palo Alto Networks NGFW. The firewall has a valid support license and is managed by Panoram a. Which of the following are potential reasons for the firewall not having the latest Antivirus signatures? (Select all that apply)

• A. The connection from the firewall or Panorama to the Palo Alto Networks update servers is blocked by a firewall rule or network issue.
• B. The WildFire Analysis profile is not attached to the relevant Security Policy rule.
• C. The Antivirus dynamic update version currently installed on the firewall is outdated.
• D. The Antivirus dynamic update download schedule in Panorama or the firewall's update schedule is not configured or has failed.
• E. The Antivirus profile attached to the Security Policy rule is set to 'alert' instead of 'block' for the relevant signature severity.

Consider a scenario where an internal application uses certificate pinning and client-side certificates for authentication over HTTPS. Due to these technical requirements, the application breaks when subjected to SSL Forward Proxy decryption. To maintain application functionality while still applying general security policy (like App-ID based access control and basic URL filtering based on hostname), the administrator decides to exclude this application's traffic from decryption. Which of the following configuration steps is the MOST appropriate method to achieve this?

• A. Define a custom URL Category for the application's domain(s) and add this category to the 'No Decrypt' list within a Decryption Profile.
• B. Import the application server's private key into the firewall and configure SSL Inbound Inspection for the traffic.
• C. Configure the application to use a different, unencrypted port instead of HTTPS.
• D. Create a Decryption Policy rule matching the source (users/zones), destination (application server IP/zone/URL category), and application (HTTPS if identified) and set the 'Action' of this rule to 'No Decrypt', ensuring it's placed higher than broader decrypt rules.
• E. Create a Security Policy rule for this application's traffic and set the 'Action' to 'No Decrypt'.

When reviewing logs and monitoring data in the Prisma SD-WAN Cloud Management Console, what is the significance of the 'Application Health Score' metric?

• A. It shows the percentage of users accessing the application from a specific branch.
• B. It is a metric based on the application's performance relative to its defined SLA thresholds or expected quality characteristics (latency, jitter, loss).
• C. It represents the number of active sessions for a specific application.
• D. It measures the total bandwidth consumed by the application over a given period.
• E. It indicates the security risk level associated with the application, based on detected threats.