EMT Practice Test

1. Question Content...

---

Question1: Which two actions are required to make Microsoft Active Directory users appear in a firewall traffic log? (Choose two.)

Question2: Refer to exhibit.

An organization has Palo Alto Networks NGFWs that send logs to remote monitoring and security management platforms. The network team has reported excessive traffic on the corporate WAN.
How could the Palo Alto Networks NGFW administrator reduce WAN traffic while maintaining support for all existing monitoring/ security platforms?

Question3: Which option describes the operation of the automatic commit recovery feature?

Question4: What are two benefits of nested device groups in Panorama? (Choose two.)

Question5: Which three rule types are available when defining policies in Panorama? (Choose three.)

Question6: Which two settings can be configured only locally on the firewall and not pushed from a Panorama template or template stack? (Choose two)

Question7: An administrator needs to determine why users on the trust zone cannot reach certain websites. The only information available is shown on the following image. Which configuration change should the administrator make?
A)

B)

C)

D)

E)

Question8: An administrator accidentally closed the commit window/screen before the commit was finished. Which two options could the administrator use to verify the progress or success of that commit task? (Choose two.)

Question9: A company has a policy that denies all applications it classifies as bad and permits only application it classifies as good. The firewall administrator created the following security policy on the company's firewall.

Which interface configuration will accept specific VLAN IDs?
Which two benefits are gained from having both rule 2 and rule 3 presents? (choose two)

Question10: People are having intermittent quality issues during a live meeting via web application.

Question11: Which option enables a Palo Alto Networks NGFW administrator to schedule Application and Threat updates while applying only new content-IDs to traffic?

Question12: Which three settings are defined within the Templates object of Panorama? (Choose three.)

Question13: An administrator is configuring an IPSec VPN to a Cisco ASA at the administrator's home and experiencing issues completing the connection. the following is the output from the command:

What could be the cause of this problem?

Question14: Which virtual router feature determines if a specific destination IP address is reachable?

Question15: Refer to the exhibit.

Which certificates can be used as a Forwarded Trust certificate?

Question16: The certificate information displayed in the following image is for which type of certificate?
Exhibit:

Question17: Refer to the exhibit.

An administrator is using DNAT to map two servers to a single public IP address. Traffic will be steered to the specific server based on the application, where Host A (10.1.1.100) received HTTP traffic and host B(10.1.1.101) receives SSH traffic.
Which two security policy rules will accomplish this configuration? (Choose two)

Question18: Which three function are found on the dataplane of a PA-5050? (Choose three)

Question19: When is it necessary to activate a license when provisioning a new Palo Alto Networks firewall?

Question20: If the firewall is configured for credential phishing prevention using the "Domain Credential Filter" method, which login will be detected as credential theft?

Question21: A company.com wants to enable Application Override. Given the following screenshot:

Which two statements are true if Source and Destination traffic match the Application Override policy? (Choose two)

Question22: An administrator deploys PA-500 NGFWs as an active/passive high availability pair. The devices are not participating in dynamic routing and preemption is disabled.
What must be verified to upgrade the firewalls to the most recent version of PAN-OS software?

Question23: An administrator has left a firewall to use the data of port for all management service which there functions are performed by the data face? (Choose three.)

Question24: A Palo Alto Networks firewall is being targeted by an NTP Amplification attack and is being flooded with tens thousands of bogus UDP connections per second to a single destination IP address and post.
Which option when enabled with the correction threshold would mitigate this attack without dropping legitirnate traffic to other hosts insides the network?

Question25: Which field is optional when creating a new Security Policy rule?

Question26: Which Captive Portal mode must be configured to support MFA authentication?

Question27: Palo Alto Networks maintains a dynamic database of malicious domains.
Which two Security Platform components use this database to prevent threats? (Choose two)

Question28: A web server is hosted in the DMZ and the server is configured to listen for incoming connections on TCP port 443. A Security policies rules allowing access from the Trust zone to the DMZ zone needs to be configured to allow web-browsing access. The web server hosts its contents over HTTP(S). Traffic from Trust to DMZ is being decrypted with a Forward Proxy rule.
Which combination of service and application, and order of Security policy rules, needs to be configured to allow cleartext web- browsing traffic to this server on tcp/443.

Question29: Which processing order will be enabled when a Panorama administrator selects the setting "Objects defined in ancestors will take higher precedence?"

Question30: Where can an administrator see both the management plane and data plane CPU utilization in the WebUI?

Question31: How can a candidate or running configuration be copied to a host external from Panorama?

Question32: An administrator has been asked to create 100 virtual firewalls in a local, on-premise lab environment (not in "the cloud"). Bootstrapping is the most expedient way to perform this task.
Which option describes deployment of a bootstrap package in an on-premise virtual environment?

Question33: The company's Panorama server (IP 10.10.10.5) is not able to manage a firewall that was recently deployed. The firewall's dedicated management port is being used to connect to the management network.
Which two commands may be used to troubleshoot this issue from the CLI of the new firewall? (Choose two)

Question34: How are IPV6 DNS queries configured to user interface ethernet1/3?

Question35: The administrator has enabled BGP on a virtual router on the Palo Alto Networks NGFW, but new routes do not seem to be populating the virtual router.
Which two options would help the administrator troubleshoot this issue? (Choose two.)

Question36: Based on the image, what caused the commit warning?

Question37: An administrator wants to upgrade an NGFW from PAN-OS® 8.0.2 to PAN-OS® 9.0. The firewall is not a part of an HA pair. What needs to be updated first?

Question38: A network security engineer is asked to provide a report on bandwidth usage. Which tab in the ACC provides the information needed to create the report?

Question39: Which is not a valid reason for receiving a decrypt-cert-validation error?

Question40: A file sharing application is being permitted and no one knows what this application is used for.
How should this application be blocked?

Question41: If an administrator does not possess a website's certificate, which SSL decryption mode will allow the Palo Alto networks NGFW to inspect when users browse to HTTP(S) websites?

Question42: Which Zone Pair and Rule Type will allow a successful connection for a user on the internet zone to a web server hosted in the DMZ zone? The web server is reachable using a destination Nat policy in the Palo Alto Networks firewall.

Question43: Which three fields can be included in a pcap filter? (Choose three)

Question44: Which two interface types can be used when configuring GlobalProtect Portal?(Choose two)

Question45: A critical US-CERT notification is published regarding a newly discovered botnet. The malware is very evasive and is not reliably detected by endpoint antivirus software. Furthermore, SSL is used to tunnel malicious traffic to command-and-control servers on the internet and SSL Forward Proxy Decryption is not enabled.
Which component once enabled on a perirneter firewall will allow the identification of existing infected hosts in an environment?

Question46: A distributed log collection deployment has dedicated log Collectors. A developer needs a device to send logs to Panorama instead of sending logs to the Collector Group.
What should be done first?

Question47: Which authentication source requires the installation of Palo Alto Networks software, other than PAN-OS 7x, to obtain a username-to-IP-address mapping?

Question48: Which User-ID method maps IP addresses to usernames for users connecting through an 802.1x-enabled wireless network device that has no native integration with PAN-OS® software?

Question49: When is the content inspection performed in the packet flow process?

Question50: An administrator has configured the Palo Alto Networks NGFW's management interface to connect to the internet through a dedicated path that does not traverse back through the NGFW itself.
Which configuration setting or step will allow the firewall to get automatic application signature updates?

Question51: A network administrator uses Panorama to push security polices to managed firewalls at branch offices. Which policy type should be configured on Panorama if the administrators at the branch office sites to override these products?

Question52: Which two benefits come from assigning a Decryption Profile to a Decryption policy rule with a "No Decrypt" action? (Choose two.)

Question53: During the packet flow process, which two processes are performed in application identification? (Choose two.)

Question54: Which event will happen if an administrator uses an Application Override Policy?

Question55: Which client software can be used to connect remote Linux client into a Palo Alto Networks Infrastructure without sacrificing the ability to scan traffic and protect against threats?

Question56: Panorama provides which two SD_WAN functions? (Choose two.)

Question57: Which Security policy rule will allow an admin to block facebook chat but allow Facebook in general?

Question58: A global corporate office has a large-scale network with only one User-ID agent, which creates a bottleneck near the User-ID agent server.
Which solution in PAN-OS® software would help in this case?

Question59: A company needs to preconfigure firewalls to be sent to remote sites with the least amount of reconfiguration. Once deployed, each firewall must establish secure tunnels back to multiple regional data centers to include the future regional data centers.
Which VPN configuration would adapt to changes when deployed to the future site?

Question60: When configuring a GlobalProtect Portal, what is the purpose of specifying an Authentication Profile?

Question61: VPN traffic intended for an administrator's Palo Alto Networks NGFW is being maliciously intercepted and retransmitted by the interceptor. When creating a VPN tunnel, which protection profile can be enabled to prevent this malicious behavior?

Question62: A network engineer has revived a report of problems reaching 98.139.183.24 through vr1 on the firewall. The routing table on this firewall is extensive and complex.
Which CLI command will help identify the issue?

Question63: How can a Palo Alto Networks firewall be configured to send syslog messages in a format compatible with non-standard syslog servers?

Question64: In High Availability, which information is transferred via the HA data link?

Question65: Exhibit:

What will be the egress interface if the traffic's ingress interface is ethernet1/6 sourcing from 192.168.111.3 and to the destination 10.46.41.113 during the time shown in the image?

Question66: If an administrator wants to decrypt SMTP traffic and possesses the server's certificate, which SSL decryption mode will allow the Palo Alto Networks NGFW to inspect traffic to the server?

Question67: A logging infrastructure may need to handle more than 10,000 logs per second.
Which two options support a dedicated log collector function? (Choose two)

Question68: A network security engineer is asked to perform a Return Merchandise Authorization (RMA) on a firewall Which part of files needs to be imported back into the replacement firewall that is using Panorama?

Question69: A user's traffic traversing a Palo Alto Networks NGFW sometimes can reach http://www.company.com. At other times the session times out. The NGFW has been configured with a PBF rule that the user's traffic matches when it goes to http://www.company.com.
How can the firewall be configured automatically disable the PBF rule if the next hop goes down?

Question70:

Question71: Which log file can be used to identify SSL decryption failures?

Question72: In a virtual router, which object contains all potential routes?

Question73: Site-A and Site-B have a site-to-site VPN set up between them. OSPF is configured to dynamically create the routes between the sites. The OSPF configuration in Site-A is configured properly, but the route for the tunner is not being established. The Site-B interfaces in the graphic are using a broadcast Link Type. The administrator has determined that the OSPF configuration in Site-B is using the wrong Link Type for one of its interfaces.

Which Link Type setting will correct the error?

Question74: If a template stack is assigned to a device and the stack includes three templates with overlapping settings, which settings are published to the device when the template stack is pushed?

Question75: An administrator has been asked to configure a Palo Alto Networks NGFW to provide protection against worms and trojans. Which Security Profile type will protect against worms and trojans?

Question76: Which setting allow a DOS protection profile to limit the maximum concurrent sessions from a source IP address?

Question77: Which operation will impact performance of the management plane?

Question78: A customer has an application that is being identified as unknown-top for one of their custom PostgreSQL database connections. Which two configuration options can be used to correctly categorize their custom database application? (Choose two.)

Question79: What can missing SSL packets when performing a packet capture on dataplane interfaces?

Question80: How would an administrator monitor/capture traffic on the management interface of the Palo Alto Networks NGFW?

Question81: Which protection feature is available only in a Zone Protection Profile?

Question82: Starting with PAN-OS version 9.1, Global logging information is now recoded in which firewall log?

Question83: Which command can be used to validate a Captive Portal policy?

Question84: A session in the Traffic log is reporting the application as "incomplete." What does "incomplete" mean?

Question85: Which method will dynamically register tags on the Palo Alto Networks NGFW?

Question86: Decrypted packets from the website https://www.microsoft.com will appear as which application and service within the Traffic log?

Question87: Which two features does PAN-OS® software use to identify applications? (Choose two)

Question88: An administrator needs to implement an NGFW between their DMZ and Core network. EIGRP Routing between the two environments is required. Which interface type would support this business requirement?

Question89: An administrator needs to upgrade a Palo Alto Networks NGFW to the most current version of PAN-OS® software. The firewall has internet connectivity through an Ethernet interface, but no internet connectivity from the management interface. The Security policy has the default security rules and a rule that allows all web-browsing traffic from any to any zone. What must the administrator configure so that the PAN-OS® software can be upgraded?