What is the correct sequence of evaluation for Security policy rulebases?
Correct Answer: A
Security policy rules are evaluated in a strict top-down order starting with Panorama Pre-Rules, followed by the local firewall rulebase, and finally Panorama Post-Rules, ensuring centrally enforced policies are applied before and after locally defined rules.
Question 47
A large enterprise wants to implement certificate-based authentication for both users and devices, using an on- premises Microsoft Active Directory Certificate Services (AD CS) hierarchy as the primary certificate authority (CA). The enterprise also requires Online Certificate Status Protocol (OCSP) checks to ensure efficient revocation status updates and reduce the overhead on its NGFWs. The environment includes multiple Active Directory forests, Panorama management for several geographically dispersed firewalls, GlobalProtect portals and gateways needing distinct certificate profiles for users and devices, and strict Security policies demanding frequent revocation checks with minimal latency. Which approach best addresses these requirements while maintaining consistent policy enforcement?
Correct Answer: B
Basic Concept: Enterprise certificate authentication requires a consistent trust chain, revocation checking, and scalable certificate enrollment. Panorama templates/shared objects help maintain consistency across many firewalls. Why B is Correct: The correct approach distributes trusted CAs consistently, uses OCSP for efficient revocation, keeps CRL fallback, separates user and device certificate profiles, and automates endpoint enrollment. Why A is Wrong: Deploy self-signed certificates at each site to simplify local certificate validation and reduce dependencies on a centralized CTurn off certificate revocation checks for lower overhead, rely on IP-based rules for GlobalProtect authentication, and use a single certificate profile for both users and devices. is associated with authentication, PKI, or TLS configuration, but it is not the object or step that enforces the certificate validation or service identity requirement being tested. Why C is Wrong: Configure each firewall independently to trust the root and intermediate CA certificates. Rely only on manual CRL checks for certificate revocation, and import both user and device certificates directly into each firewall's local certificate store for authentication. is associated with authentication, PKI, or TLS configuration, but it is not the object or step that enforces the certificate validation or service identity requirement being tested. Why D is Wrong: Obtain wildcard certificates from a public CA for both user and device authentication, and configure firewalls to perform CRL polling at the default update interval. Manually install user certificates on endpoints and synchronize firewall certificate stores through frequent manual SSH updates to maintain consistency. is associated with authentication, PKI, or TLS configuration, but it is not the object or step that enforces the certificate validation or service identity requirement being tested.
Question 48
Which two actions in the IKE Gateways will allow implementation of post-quantum cryptography when building VPNs between multiple Palo Alto Networks NGFWs? (Choose two.)
Correct Answer: C,D
To implement post-quantum cryptography (PQC) in VPNs between Palo Alto Networks NGFWs, you would enable the PQ KEM (Post-Quantum Key Encapsulation Mechanism) in the IKE gateway configuration. This enables the firewall to use quantum-resistant encryption for key exchange, which is an essential part of securing communications against the potential future threats posed by quantum computing. By selecting IKE v2 Preferred and enabling the PQ KEM option under Advanced Options, you can add specific Rounds for the post-quantum cryptography process, which will help in implementing quantum-resistant key exchange methods. This option similarly selects IKE v2 and enables PQ KEM while also creating a dedicated IKE Crypto Profile with the necessary Rounds configured for post-quantum cryptography.
Question 49
An administrator configures a GlobalProtect gateway with split tunneling for network traffic based on an access route. Users report that public web browsing works, but they cannot resolve the names of internal servers. The administrator determines that all DNS queries are being sent to the public DNS servers configured on the users' endpoints. Which GlobalProtect portal setting should be configured to resolve this issue?
Correct Answer: A
Basic Concept: Split tunnel access routes do not automatically control DNS resolution. Split DNS must specify which domains use VPN-assigned DNS servers. Why A is Correct: Configuring split DNS with internal corporate domains sends those queries to corporate DNS while leaving public browsing DNS local. Why B is Wrong: DNS Proxy feature on the firewall to point clients to the gateway IP for DNS relates to VPN configuration, but it does not address the specific PAN-OS requirement for selectors, tunnel interface functions, routing, or Security policy in this scenario. Why C is Wrong: "DNS Forwarding" option on the gateway's tunnel interface relates to VPN configuration, but it does not address the specific PAN-OS requirement for selectors, tunnel interface functions, routing, or Security policy in this scenario. Why D is Wrong: NAT rule to allow DNS traffic from the GlobalProtect clients to the internal DNS servers relates to VPN configuration, but it does not address the specific PAN-OS requirement for selectors, tunnel interface functions, routing, or Security policy in this scenario.
Question 50
A network administrator is configuring path monitoring for a primary static route to ensure immediate failback from a backup route. The administrator wants the primary route to become active again without any delay as soon as its path is restored. Which preemptive hold time value should the administrator configure to achieve this immediate failback?
Correct Answer: B
Basic Concept: Immediate failback for monitored static routes is controlled by preemptive hold time. Zero means do not wait after recovery. Why B is Correct: A value of 0 makes the primary route active again as soon as the path monitor succeeds. Why A is Wrong: -1 is a routing-related concept, but it is not the PAN-OS routing attribute, prerequisite, or route-selection behavior required by this question. Why C is Wrong: 1 is a routing-related concept, but it is not the PAN-OS routing attribute, prerequisite, or route-selection behavior required by this question. Why D is Wrong: 2 is a routing-related concept, but it is not the PAN-OS routing attribute, prerequisite, or route-selection behavior required by this question.
