Palo Alto Networks System Engineer Professional - Strata v1.0
Question 1
Which three activities can the botnet report track? (Choose three.)
- A. Accessing domains registered in the last 30 days
- B. Visiting a malicious URL
- C. Launching a P2P application
- D. Detecting malware within a one-hour period
- E. Initiating API calls to other applications
- F. Using dynamic DNS domain providers
Answer : ACF
Reference:
https://media.paloaltonetworks.com/documents/Controlling-Botnets.pdf
Question 2
A customer requires protections and verdicts for PE (portable executable) and ELF (executable and linkable format) as well as integration with products and services can also access the immediate verdicts to coordinate enforcement to prevent successful attacks.
What competitive feature does Palo Alto Networks provide that will address this requirement?
- A. File Blocking Profile
- B. Dynamic Unpacking
- C. WildFire
- D. DNS Security
Answer : C
Reference:
https://docs.paloaltonetworks.com/wildfire/u-v/wildfire-whats-new/latest-wildfire-cloud-features/real-time-wildfire-verdicts-and-signatures-for-pe-and-elf- files.html
Question 3
Which statement is true about Deviating Devices and metrics?
- A. A metric health baseline is determined by averaging the health performance for a given metric over seven days plus the standard deviation
- B. Deviating Device Tab is only available with a SD-WAN Subscription
- C. An Administrator can set the metric health baseline along with a valid standard deviation
- D. Deviating Device Tab is only available for hardware-based firewalls
Answer : A
Reference:
https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-web-interface-help/panorama-web-interface/panorama-managed-devices-summary/panorama- managed-devices-health.html
Question 4
DRAG DROP -
Match the WildFire Inline Machine Learning Model to the correct description for that model.
Select and Place:
Answer : 
Reference:
https://docs.paloaltonetworks.com/wildfire/u-v/wildfire-whats-new/wildfire-features-in-panos-100/configure-wildfire-inline-ml.html
Question 5
Palo Alto Networks publishes updated Command-and-Control signatures.
How frequently should the related signatures schedule be set?
- A. Once an hour
- B. Once a day
- C. Once a week
- D. Once every minute
Answer : C
Question 6
Which two methods will help avoid Split Brain when running HA in Active/Active mode? (Choose two.)
- A. Configure a Backup HA1 Interface
- B. Configure a Heartbeat Backup
- C. Create a loopback IP address and use that as a Source Interface
- D. Place your management interface in an Aggregate Interface Group configuration
Answer : AB
Reference:
https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/high-availability/set-up-activeactive-ha/configure-activeactive-ha.html
Question 7
Which three script types can be analyzed in WildFire? (Choose three.)
- A. JScript
- B. PythonScript
- C. PowerShell Script
- D. VBScript
- E. MonoScript
Answer : ABD
Reference:
https://docs.paloaltonetworks.com/wildfire/u-v/wildfire-whats-new/wildfire-features-in-panos-90/wildfire-appliance-script-support.html
Question 8
What helps avoid split brain in active/passive HA pair deployment?
- A. Use a standard traffic interface as the HA2 backup
- B. Enable preemption on both firewalls in the HA pair
- C. Use the management interface as the HA1 backup link
- D. Use a standard traffic interface as the HA3 link
Answer : C
Reference:
https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/high-availability/set-up-activepassive-ha/configure-activepassive-ha.html
Question 9
DRAG DROP -
Match the functions to the appropriate processing engine within the dataplane.
Select and Place:
Answer : 
Question 10
What are three considerations when deploying User-ID? (Choose three.)
- A. Specify included and excluded networks when configuring User-ID
- B. Only enable User-ID on trusted zones
- C. Use a dedicated service account for User-ID services with the minimal permissions necessary
- D. User-ID can support a maximum of 15 hops
- E. Enable WMI probing in high security networks
Answer : ABC
Reference:
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVPCA0
Question 11
Which three considerations should be made prior to installing a decryption policy on the NGFW? (Choose three.)
- A. Include all traffic types in decryption policy
- B. Inability to access websites
- C. Exclude certain types of traffic in decryption policy
- D. Deploy decryption setting all at one time
- E. Ensure throughput is not an issue
Answer : ABC
Question 12
Which three components are specific to the Query Builder found in the Custom Report creation dialog of the firewall? (Choose three.)
- A. Connector
- B. Database
- C. Recipient
- D. Operator
- E. Attribute
- F. Schedule
Answer : ADE
Reference:
https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/monitoring/view-and-manage-reports/generate-custom-reports
Question 13
Which CLI commands allows you to view SD-WAN events such as path selection and path quality measurements?
- A. >show sdwan connection all
- B. >show sdwan event
- C. >show sdwan path-monitor stats vif
- D. >show sdwan session distribution policy-name
Answer : B
Reference:
https://docs.paloaltonetworks.com/sd-wan/1-0/sd-wan-admin/troubleshooting/use-cli-commands-for-sd-wan-tasks.html
Question 14
Which three steps in the cyberattack lifecycle does Palo Alto Networks Security Operating Platform prevent? (Choose three.)
- A. recon the target
- B. deliver the malware
- C. exfiltrate data
- D. weaponize vulnerabilities
- E. lateral movement
Answer : BCE
Reference:
https://www.exclusive-networks.com/ch-fr/praevention-cyber-attack-lifecycle-palo-alto/
Question 15
Which profile or policy should be applied to protect against port scans from the internet?
- A. An App-ID security policy rule to block traffic sourcing from the untrust zone
- B. Zone protection profile on the zone of the ingress interface
- C. Security profiles to security policy rules for traffic sourcing from the untrust zone
- D. Interface management profile on the zone of the ingress interface
Answer : B
Reference:
https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-web-interface-help/network/network-network-profiles-zone-protection/reconnaissance- protection.html