After enabling multiple security profiles such as IPS, antivirus, and URL filtering on an NGFW, users report degraded network performance. Which factor is MOST likely causing the issue?
Correct Answer: B
Deep packet inspection and threat analysis consume significant system resources. Improper tuning or undersized hardware can lead to performance degradation.
Question 77
In an active/active high availability (HA) configuration with two PA-Series firewalls, how do the firewalls use the HA3 interface?
Correct Answer: A
The HA3 interface, a Layer 2 link using MAC-in-MAC encapsulation, enables packet forwarding between active/active firewalls to handle asymmetric routing and ensure proper session setup when traffic arrives at the non-owner peer.
Question 78
Which statement applies to the relationship between Panorama-pushed Security policy and local firewall Security policy?
Correct Answer: B
Local firewall rules are evaluated after Panorama pre-rules (those applied before the firewall's local policies) and before Panorama post-rules (those applied after the firewall's local policies). This ensures that the local firewall rules do not override the central Panorama policy and are only applied in the appropriate order within the policy evaluation sequence.
Question 79
How does a Palo Alto Networks NGFW respond when the preemptive hold time is set to 0 minutes during configuration of route monitoring?
Correct Answer: D
Basic Concept: Static route monitoring removes and reinstalls routes based on monitored path state. Preemptive hold time controls the delay before a recovered primary route is reinstalled. Why D is Correct: A value of 0 causes immediate preemption: as soon as the monitored path comes back up, the firewall reinstalls the static route in the RIB without waiting. Why A is Wrong: It does not accept the configuration. is a routing-related concept, but it is not the PAN-OS routing attribute, prerequisite, or route-selection behavior required by this question. Why B is Wrong: It accepts the configuration but throws a warning message. is a routing-related concept, but it is not the PAN-OS routing attribute, prerequisite, or route-selection behavior required by this question. Why C is Wrong: It removes the static route because 0 is a NULL value. is a routing-related concept, but it is not the PAN-OS routing attribute, prerequisite, or route-selection behavior required by this question.
Question 80
What are the phases of the Palo Alto Networks AI Runtime Security: Network Intercept solution?
Correct Answer: B
The phases of the Palo Alto Networks AI Runtime Security: Network Intercept solution are designed to help identify and protect against potential threats in real time by using AI to detect and prevent malicious activities within the network. Discovery: Identifying applications, services, and behaviors within the network to understand baseline activity. Deployment: Implementing the solution into the network and integrating with existing security measures. Detection: Monitoring traffic and activities to identify abnormal or malicious behavior. Prevention: Taking action to stop threats once detected, such as blocking malicious traffic or stopping exploit attempts.
