A network administrator is configuring path monitoring for a primary static route to ensure immediate failback from a backup route. The administrator wants the primary route to become active again without any delay as soon as its path is restored. Which preemptive hold time value should the administrator configure to achieve this immediate failback?
Correct Answer: B
A preemptive hold time of 0 causes the firewall to immediately fail back to the primary static route as soon as path monitoring detects that the primary path is restored, with no delay before traffic is switched back.
Question 52
When deploying Palo Alto Networks NGFWs in a cloud service provider (CSP) environment, which method ensures high availability (HA) across multiple availability zones?
Correct Answer: C
To ensure high availability (HA) across multiple availability zones (AZs) in a cloud service provider (CSP) environment, using a load balancer with health probes is a recommended method. This setup ensures that traffic can be directed to the healthy NGFW instances across multiple availability zones. If one NGFW instance or availability zone goes down, the load balancer can redirect traffic to the available instance(s) in other zones, providing redundancy and maintaining service availability.
Question 53
How does a Palo Alto Networks firewall choose the best route when it receives routes for the same destination from different routing protocols?
Correct Answer: D
Basic Concept: When routes to the same destination are learned from different routing protocols, PAN-OS compares administrative distance before metrics from the same protocol. Why D is Correct: The lowest administrative distance wins because it represents the most preferred route source; higher values are less trusted. Why A is Wrong: The route that was received first will be entered into the forwarding table, and all subsequent routes will be rejected. is a routing-related concept, but it is not the PAN-OS routing attribute, prerequisite, or route-selection behavior required by this question. Why B is Wrong: It will attempt to load balance the traffic across all routes. is a routing-related concept, but it is not the PAN-OS routing attribute, prerequisite, or route-selection behavior required by this question. Why C is Wrong: It compares the administrative distance and chooses the one with the highest value. is a routing-related concept, but it is not the PAN-OS routing attribute, prerequisite, or route-selection behavior required by this question.
Question 54
Which configuration in the LACP tab will enable pre-negotiation for an Aggregate Ethernet (AE) interface on a Palo Alto Networks high availability (HA) active/passive pair?
Correct Answer: C
In a High Availability (HA) active/passive pair configuration, when setting up an Aggregate Ethernet (AE) interface, enabling the "Enable in HA Passive State" option allows the interface to participate in LACP (Link Aggregation Control Protocol) even when the system is in the passive state. This ensures that the pre-negotiation of the LACP link occurs, allowing the link aggregation to be ready as soon as the firewall becomes active.
Question 55
A large enterprise wants to implement certificate-based authentication for both users and devices, using an on- premises Microsoft Active Directory Certificate Services (AD CS) hierarchy as the primary certificate authority (CA). The enterprise also requires Online Certificate Status Protocol (OCSP) checks to ensure efficient revocation status updates and reduce the overhead on its NGFWs. The environment includes multiple Active Directory forests, Panorama management for several geographically dispersed firewalls, GlobalProtect portals and gateways needing distinct certificate profiles for users and devices, and strict Security policies demanding frequent revocation checks with minimal latency. Which approach best addresses these requirements while maintaining consistent policy enforcement?
Correct Answer: B
This approach best addresses the enterprise's requirements for certificate-based authentication, OCSP checks, and consistent policy enforcement: Distributing the root and intermediate CA certificates via Panorama ensures that all firewalls in the enterprise are consistent in their trust chain and can validate certificates properly. Configuring OCSP responder profiles on each firewall offloads the revocation checks to an internal OCSP server, which reduces the overhead on the firewalls and ensures fast, real-time certificate status checks. Using CRL checks as a fallback ensures reliability in case the OCSP responder is unavailable. Separate certificate profiles for users and devices ensure that the firewall can enforce different security policies based on the type of certificate (user vs. device). Automated certificate enrollment methods such as Group Policy or SCEP streamline certificate distribution to endpoints, ensuring efficient management of certificates across geographically dispersed firewalls.
