501-540_在线真题试卷与模拟练习_501-540

更新时间：试题数量：购买人数：提供作者：

有效期：个月

章节介绍：共有个章节

我的练习

我的错题
(0道)

我的收藏
(0道)

我的斩题
(0道)

我的笔记
(0道)

专项练习

顺序练习 0 / 0

随机练习 自定义设置练习量

题型乱序 按导入顺序练习

模拟考试 仿真模拟

题型练习 按题型分类练习

易错题 精选高频易错题

学习资料 考试学习相关信息

搜索

题库预览

A firewall engineer creates a destination static NAT rule to allow traffic from the internet to a webserver hosted behind the edge firewall. The pre-NAT IP address of the server is 153.6.12.10, and the post-NAT IP address is 192.168.10.10. Refer to the routing and interfaces information below.

（含图）

What should the NAT rule destination zone be set to?

Which source is the most reliable for collecting User-ID user mapping?

Which type of zone will allow different virtual systems to communicate with each other?

An organization is interested in migrating from their existing web proxy architecture to the Web Proxy feature of their PAN-OS 11.0 firewalls. Currently, HTTP and SSL requests contain the destination IP address of the web server and the client browser is redirected to the proxy.

Which PAN-OS proxy method should be configured to maintain this type of traffic flow?

An engineer discovers the management interface is not routable to the User-ID agent.

What configuration is needed to allow the firewall to communicate to the User-ID agent?

An engineer receives reports from users that applications are not working and that websites are only partially loading in an asymmetric environment. After investigating, the engineer observes the flow_tcp_non_syn_drop counter increasing in the show counters global output.

Which troubleshooting command should the engineer use to work around this issue?

Where is Palo Alto Networks Device Telemetry data stored on a firewall with a device certificate installed?

Which GlobalProtect gateway setting is required to enable split-tunneling by access route, destination domain, and application?

A superuser is tasked with creating administrator accounts for three contractors. For compliance purposes, all three contractors will be working with different device-groups in their hierarchy to deploy policies and objects.

Which type of role-based access is most appropriate for this project?

An administrator connects four new remote offices to the corporate data center. The administrator decides to use the Large Scale VPN (LSVPN) feature on the Palo Alto Networks next-generation firewall.

What should the administrator configure in order to connect the sites?

A customer wants to set up a site-to-site VPN using tunnel interfaces.

What format is the correct naming convention for tunnel interfaces?

An engineer notices that the tunnel monitoring has been failing for a day and the VPN should have failed over to a backup path.

What part of the network profile configuration should the engineer verify?

What is the PAN-OS NPTv6 feature based on RFC 6296 used for?

A network security administrator wants to inspect HTTPS traffic from users as it egresses through a firewall to the Internet/Untrust zone from trusted network zones. The security admin wishes to ensure that if users are presented with invalid or untrusted security certificates, the user will see an untrusted certificate warning.

What is the best choice for an SSL Forward Untrust certificate?

After implementing a new NGFW, a firewall engineer sees a VoIP traffic issue going through the firewall. After troubleshooting, the engineer finds that the firewall performs NAT on the voice packets payload and opens dynamic pinholes for media ports.

What can the engineer do to solve the VoIP traffic issue?

After importing a pre-configured firewall configuration to Panorama, what step is required to ensure a commit/push is successful without duplicating local configurations?

Which new PAN-OS 11.0 feature supports IPv6 traffic?

If a URL is in multiple custom URL categories with different actions, which action will take priority?

An engineer is reviewing the following high availability (HA) settings to understand a recent HA failover event.

（含图）

Which timer determines the frequency between packets sent to verify that the HA functionality on the other HA firewall is operational?

An engineer is configuring a firewall with three interfaces:

• MGT connects to a switch with internet access.

• Ethernet1/1 connects to an edge router.

• Ethernet1/2 connects to a virtualization network.

The engineer needs to configure dynamic updates to use a dataplane interface for internet traffic.

What should be configured in Setup > Services > Service Route Con?guration to allow this traffic?

1 2