What is a result of enabling split tunneling in the GlobalProtect portal configuration with the "Both Network Traffic and DNS" option?
Correct Answer: D
When split tunneling is enabled with the "Both Network Traffic and DNS" option in the GlobalProtect portal configuration, it allows the firewall to control which traffic is sent over the VPN tunnel and which is not. Specifically, it determines which domains are resolved by the VPN-assigned DNS servers (for domains requiring VPN access) and which are resolved by local DNS servers (for domains that can be accessed without the VPN tunnel).
Question 97
A network security engineer at a 24/7 online retailer is upgrading an active/passive high availability (HA) cluster of PAN-OS firewalls. The primary goal is to perform the upgrade with no service interruption to online transactions. The engineer has already downloaded the new software to both devices. Which sequence of actions will meet this requirement?
Correct Answer: B
Upgrading the passive firewall first ensures there is no impact to live traffic. After the passive device is upgraded and operational, a controlled failover is performed so traffic moves to the upgraded firewall, and then the remaining firewall can be upgraded, achieving a zero-downtime upgrade process for an active/passive HA pair.
Question 98
How does a Palo Alto Networks NGFW respond when the preemptive hold time is set to 0 minutes during configuration of route monitoring?
Correct Answer: D
Basic Concept: Static route monitoring removes and reinstalls routes based on monitored path state. Preemptive hold time controls the delay before a recovered primary route is reinstalled. Why D is Correct: A value of 0 causes immediate preemption: as soon as the monitored path comes back up, the firewall reinstalls the static route in the RIB without waiting. Why A is Wrong: It does not accept the configuration. is a routing-related concept, but it is not the PAN-OS routing attribute, prerequisite, or route-selection behavior required by this question. Why B is Wrong: It accepts the configuration but throws a warning message. is a routing-related concept, but it is not the PAN-OS routing attribute, prerequisite, or route-selection behavior required by this question. Why C is Wrong: It removes the static route because 0 is a NULL value. is a routing-related concept, but it is not the PAN-OS routing attribute, prerequisite, or route-selection behavior required by this question.
Question 99
An engineer configures a PA-440 firewall to act as a switch by creating several Layer 2 interfaces and assigning them all to VLAN 20. A file server is connected to interface ethernet1/1, and client workstations are connected to interfaces ethernet1/2 and ethemet1/3. All devices are in VLAN 20. The clients are unable to access the file server. Which configuration step to allow this communication by default is missing?
Correct Answer: B
Basic Concept: Layer 2 interfaces in the same VLAN still depend on zone assignment and intrazone/interzone policy. Same-zone traffic is allowed by intrazone-default unless changed. Why B is Correct: Placing all three Layer 2 interfaces in the same Layer 2 zone allows same-VLAN communication by default. Why A is Wrong: Create an Aggregate Ethernet (AE) group that includes all three interfaces. is a valid Palo Alto Networks or networking concept in another context, but it does not implement the exact configuration outcome required by this question. Why C is Wrong: Create an "allow" Security policy with the source and destination VLAN set to "VLAN 20". is a valid Palo Alto Networks or networking concept in another context, but it does not implement the exact configuration outcome required by this question. Why D is Wrong: Create a Layer 3 subinterface for VLAN 20 to enable routing. is a valid Palo Alto Networks or networking concept in another context, but it does not implement the exact configuration outcome required by this question.
Question 100
An organization runs multiple Kubernetes clusters both on-premises and in public clouds (AWS, Azure, GCP). They want to deploy the Palo Alto Networks CN-Series NGFW to secure east-west traffic within each cluster, maintain consistent Security policies across all environments, and dynamically scale as containerized workloads spin up or down. They also plan to use a centralized Panorama instance for policy management and visibility. Which approach meets these requirements?
Correct Answer: C
Basic Concept: CN-Series is deployed natively into Kubernetes clusters and managed by Panorama to enforce consistent policy across container environments. Why C is Correct: Using Kubernetes tools such as Helm to deploy CN-Series in each cluster and managing all instances through Panorama satisfies east-west inspection, scaling, and policy consistency. Why A is Wrong: Install standalone CN-Series instances in each cluster with local configuration only. Export daily policy configuration snapshots to Panorama for recordkeeping, but do not unify policy enforcement. is a cloud deployment or routing approach, but it does not match the required managed insertion model, resilience pattern, or Panorama-controlled policy design in this scenario. Why B is Wrong: Configure the CN-Series only in public cloud clusters, and rely on Kubernetes Network Policies for on-premises cluster security. Synchronize partial policy information into Panorama manually as needed. is a cloud deployment or routing approach, but it does not match the required managed insertion model, resilience pattern, or Panorama-controlled policy design in this scenario. Why D is Wrong: Deploy a single CN-Series firewall in the on-premises data center to process traffic for all clusters, connecting remote clusters via VPN or peering. Manage this single instance through Panorama. is a cloud deployment or routing approach, but it does not match the required managed insertion model, resilience pattern, or Panorama-controlled policy design in this scenario.
