EMT Practice Test

1. Question Content...

---

Question1: Site-A and Site-B need to use IKEv2 to establish a VPN connection. Site-A connects directly to the internet using a public IP address. Site-B uses a private IP address behind an ISP router to connect to the internet.
How should NAT Traversal be implemented for the VPN connection to be established between Site-A and Site-B?

Question2: What happens when the traffic log shows an internal host attempting to open a session to a properly configured sinkhole address?

Question3: Which Panorama objects restrict administrative access to specific device-groups?

Question4: What is the maximum number of samples that can be submitted to WildFire manually per day?

Question5: An administrator needs to determine why users on the trust zone cannot reach certain websites.
The only information available is shown on the following image.
Which configuration change should the administrator make?

Question6: An enterprise has a large Palo Alto Networks footprint that includes onsite firewalls and Prisma Access for mobile users, which is managed by Panorama. The enterprise already uses GlobalProtect with SAML authentication to obtain IP-to-user mapping information.
However, Information Security wants to use this information in Prisma Access for policy enforcement based on group mapping. Information Security uses on-premises Active Directory (AD) but is uncertain about what is needed for Prisma Access to learn groups from AD.
How can policies based on group mapping be learned and enforced in Prisma Access?

Question7: Which three settings are defined within the Templates object of Panorama? (Choose three.)

Question8: How does Panorama handle incoming logs when it reaches the maximum storage capacity?

Question9: Which of the following are critical features of a Next Generation Firewall that provide Breach prevention? Choose two.

Question10: Which of the following commands would you use to check the total number of the sessions that are currently going through SSL Decryption processing?

Question11: How does Panorama prompt VMWare NSX to quarantine an infected VM?

Question12: An administrator allocates bandwidth to a Prisma Access Remote Networks compute location with three remote networks.
What is the minimum amount of bandwidth the administrator could configure at the compute location?

Question13: Which is not a valid reason for receiving a decrypt-cert-validation error?

Question14: Which option is part of the content inspection process?

Question15: An administrator analyzes the following portion of a VPN system log and notices the following issue "Received local id 10.10.1.4/24 type IPv4 address protocol 0 port 0, received remote id
10.1.10.4/24 type IPv4 address protocol 0 port 0."
What is the cause of the issue?

Question16: An administrator has been asked to create 100 virtual firewalls in a local, on-premise lab environment (not in "the cloud"). Bootstrapping is the most expedient way to perform this task.
Which option describes deployment of a bootstrap package in an on-premise virtual environment?

Question17: Which three are valid configuration options in a WildFire Analysis Profile? (Choose three.)

Question18: When is it necessary to activate a license when provisioning a new Palo Alto Networks firewall?

Question19: A web server is hosted in the DMZ, and the server is configured to listen for incoming connections only on TCP port 8080. A Security policy rule allowing access from the Trust zone to the DMZ zone need to be configured to enable we browsing access to the server.
Which application and service need to be configured to allow only cleartext web-browsing traffic to thins server on tcp/8080.

Question20: A client has a sensitive application server in their data center and is particularly concerned about resource exhaustion because of distributed denial-of-service attacks.
How can the Palo Alto Networks NGFW be configured to specifically protect this server against resource exhaustion originating from multiple IP addresses (DDoS attack)?

Question21: Which GlobalProtect component must be configured to enable Chentless VPN?

Question22: Which type of interface does a firewall use to forward decrypted traffic to a security chain for inspection?

Question23: Which CLI command can be used to export the tcpdump capture?

Question24: Which two statements accurately describe how DoS Protection Profiles and Policies mitigate attacks? (Choose two.)

Question25: Which benefit do policy rule UUIDs provide?

Question26: Which two actions would be part of an automatic solution that would block sites with untrusted certificates without enabling SSL Forward Proxy? (Choose two.)

Question27: An administrator logs in to the Palo Alto Networks NGFW and reports that the WebUI is missing the Policies tab. Which profile is the cause of the missing Policies tab?

Question28: In URL filtering, which component matches URL patterns?

Question29: Palo Alto Networks maintains a dynamic database of malicious domains.
Which two Security Platform components use this database to prevent threats? (Choose two)

Question30: What are the three key components of a successful Three Tab Demo? (Select the three correct answers.)

Question31: Which three authentication factors does PAN-OS@software support for MFA? (Choose three.)

Question32: A speed/duplex negotiation mismatch is between the Palo Alto Networks management port and the switch port which it connects.
How would an administrator configure the interface to 1Gbps?

Question33: You need to allow users to access the office-suite applications of their choice.
How should you configure the firewall to allow access to any office-suite application?

Question34: Which logs enable a firewall administrator to determine whether a session was decrypted?

Question35: A distributed log collection deployment has dedicated Log Collectors. A developer needs a device to send logs to Panorama instead of sending logs to the Collector Group.
What should be done first?

Question36: A host attached to ethernet1/3 cannot access the internet. The default gateway is attached to ethernet1/4. After troubleshooting. It is determined that traffic cannot pass from the ethernet1/3 to ethernet1/4. What can be the cause of the problem?

Question37: Which DoS protection mechanism detects and prevents session exhaustion attacks?

Question38: A company needs to preconfigure firewalls to be sent to remote sites with the least amount of reconfiguration. Once deployed, each firewall must establish secure tunnels back to multiple regional data centers to include the future regional data centers.
Which VPN configuration would adapt to changes when deployed to the future site?

Question39: An administrator encountered problems with inbound decryption. Which option should the administrator investigate as part of triage?

Question40: A company.com wants to enable Application Override. Given the following screenshot:
Which two statements are true if Source and Destination traffic match the Application Override policy? (Choose two)

Question41: Which tool provides an administrator the ability to see trends in traffic over periods of time, such as threats detected in the last 30 days?

Question42: An administrator wants to upgrade a firewall HA pair to PAN-OS 10.1. The firewalls are currently running PAN-OS 8.1.17.
Which upgrade path maintains synchronization of the HA session (and prevents network outage)?

Question43: An administrator wants to upgrade an NGFW from PAN-OS 7.1.2 to PAN-OS 8.0.2. The firewall is not a part of an HA pair.
What needs to be updated first?

Question44: Based on the following image, what is the correct path of root, intermediate, and end-user certificate?

Question45: When overriding a template configuration locally on a firewall, what should you consider?

Question46: An administrator has enabled OSPF on a virtual router on the NGFW. OSPF is not adding new routes to the virtual router.
Which two options enable the administrator to troubleshoot this issue? (Choose two.)

Question47: What will be the egress interface if the traffic's ingress interface is ethernet1/6 sourcing from
192.168.111.3 and to the destination 10.46.41.113 during the time shown in the image?

Question48: A network security engineer is asked to provide a report on bandwidth usage. Which tab in the ACC provides the information needed to create the report?

Question49: Where can an administrator see both the management plane and data plane CPU utilization in the WebUI?

Question50: After Migrating from an ASA firewall to a Palo Alto Networks Firewall, the VPN connection between a remote network and the Palo Alto Networks Firewall is not establishing correctly.
The following entry is appearing in the logs:
Pfs group mismatched: my:0 peer:2
Which setting should be changed on the Palo Alto Networks Firewall to resolve this error message?

Question51: An Administrator is configuring an IPSec VPN toa Cisco ASA at the administrator's home and experiencing issues completing the connection. The following is th output from the command:

What could be the cause of this problem?

Question52: In High Availability, which information is transferred via the HA data link?

Question53: Which protection feature is available only in a Zone Protection Profile?

Question54: A remote administrator needs access to the firewall on an untrust interface. Which three options would you configure on an Interface Management profile to secure management access?
(Choose three.)

Question55: What can missing SSL packets when performing a packet capture on dataplane interfaces?

Question56: When deploying PAN-OS SD-WAN, which routing protocol can you use to build a routing overlay?

Question57: In an enterprise deployment, a network security engineer wants to assign rights to a group of administrators without creating local administrator accounts on the firewall.
Which authentication method must be used?

Question58: Which client software can be used to connect remote Linux client into a Palo Alto Networks Infrastructure without sacrificing the ability to scan traffic and protect against threats?

Question59: A network design calls for a "router on a stick" implementation with a PA-5060 performing inter- VLAN routing. All VLAN-tagged traffic will be forwarded to the PA-5060 through a single dot1q trunk interface.
Which interface type and configuration setting will support this design?

Question60: For which two reasons would a firewall discard a packet as part of the packet flow sequence?
(Choose two.)

Question61: What best describes the HA Promotion Hold Time?

Question62: The firewall identifies a popular application as an unknown-tcp.
Which two options are available to identify the application? (Choose two.)

Question63: Company.com has an in-house application that the Palo Alto Networks device doesn't identify correctly. A Threat Management Team member has mentioned that this in-house application is very sensitive and all traffic being identified needs to be inspected by the Content-ID engine.
Which method should company.com use to immediately address this traffic on a Palo Alto Networks device?

Question64: Ethernet1/1 has been configured with the following subinterfaces:

The following security policy rule is applied:

The Interface Management Profile permits the following:

A customer is trying to ping 10.10.10.1 from VLAN 799 IP 10.10.10.2/24.
What will be the result of this ping?

Question65: Refer to the diagram. An administrator needs to create an address object that will be useable by the NYC. MA, CA and WA device groups.
Where will the object need to be created within the device-group hierarchy?

Question66: When you import the configuration of an HA pair into Panorama, how do you prevent the import from affecting ongoing traffic?

Question67: A logging infrastructure may need to handle more than 10,000 logs per second.
Which two options support a dedicated log collector function? (Choose two)

Question68: PAN-OS 7.0 introduced an automated correlation engine that analyzes log patterns and generates correlation events visible in the new Application Command Center (ACC).
Which license must the firewall have to obtain new correlation objectives?

Question69: The Network Security Administrator discovers that the company's NAT-aware SIP phone system is not working properly through the Palo Alto Networks firewall, even though SIP traffic is being allowed by policy.
Which configuration change can resolve this issue?

Question70: A global corporate office has a large-scale network with only one User-ID agent, which creates a bottleneck near the User-ID agent server. Which solution in PAN-OS software would help in this case?

Question71: The IT department has received complaints abou VoIP call jitter when the sales staff is making or receiving calls. QoS is enabled on all firewall interfaces, but there is no QoS policy written in the rulebase. The IT manager wants to find out what traffic is causing the jitter in real time when a user reports the jitter.
Which feature can be used to identify, in real time, the applications taking up the most bandwidth?

Question72: Which statement is correct given the following message from the PanGPA log on the GlobalProtect app?
Failed to connect to server at port:4767

Question73: An administrator creates a custom application containing Layer 7 signatures. The latest application and threat dynamic update is downloaded to the same NGFW. The update contains an application that matches the same traffic signatures as the custom application.
Which application should be used to identify traffic traversing the NGFW?

Question74: When setting up a security profile which three items can you use? (Choose three )

Question75: When a malware-infected host attempts to resolve a known command-and-control server, the traffic matches a security policy with DNS sinkhole enabled, generating a traffic log.
What will be the destination IP address in that log entry?

Question76: SD-WAN is designed to support which two network topology types? (Choose two.)

Question77: Which action disables Zero Touch Provisioning (ZTP) functionality on a ZTP firewall during the onboarding process?

Question78: A network security engineer needs to configure a virtual router using IPv6 addresses.
Which two routing options support these addresses? (Choose two.)

Question79: What is a key step in implementing WildFire best practices?

Question80: A customer is replacing their legacy remote access VPN solution. The current solution is in place to secure only internet egress for the connected clients.
Prisma Access has been selected to replace the current remote access VPN solution.
During onboarding the following options and licenses were selected and enabled:
- Prisma Access for Remote Networks 300Mbps
- Prisma Access for Mobile Users 1500 Users
- Cortex Data Lake 2TB
- Trusted Zones trust
- Untrusted Zones untrust
- Parent Device Group shared
How can you configure Prisma Access to provide the same level of access as the current VPN solution?

Question81: Which CLI command is used to simulate traffic going through the firewall and determine which Security policy rule, NAT translation, static route, or PBF rule will be triggered by the traffic?

Question82: Which method will dynamically register tags on the Palo Alto Networks NGFW?

Question83: How can packet buffer protection be configured?

Question84: Use the image below If the firewall has the displayed link monitoring configuration what will cause a failover?

Question85: What are two common reasons to use a "No Decrypt" action to exclude traffic from SSL decryption? (Choose two.)

Question86: What are the differences between using a service versus using an application for Security Policy match?

Question87: Which statement regarding HA timer settings is true?

Question88: An administrator has configured the Palo Alto Networks NGFW's management interface to connect to the internet through a dedicated path that does not traverse back through the NGFW itself.
Which configuration setting or step will allow the firewall to get automatic application signature updates?

Question89: Given the following diagram:

A VPN connection has been created to allow traffic from the Trust-L3 zone of Site A to reach the Trust-L3 zone of Site B.
Each site is using tunnel.1 in the Untrust-L3 zone for the VPN connection.
A static route needs to be added to the default virtual router in the Site A firewall to enable traffic from Site A to reach all workstations in Site B.
Which static route configuration will satisfy the requirement?

Question90: A network security engineer for a large company has just installed a PA-5060 Firewall to isolate the company's PCI environment from its production network. The company's engineers made configuration changes to the switches on both network segments, and connected them to the new firewall.
Soon after the cutover, however, users began to complain about latency and some servicers stopped communicating. There are no security policies that deny traffic between the two networks segments. You suspect that there is an interface misconfiguration on Ethernet 1/1.
Which two commands should be used to troubleshoot the issue? (Choose two)

Question91: At which stage of the cyber-attack lifecycle would the attacker attach an infected PDF file to an email?

Question92: A network administrator uses Panorama to push security polices to managed firewalls at branch offices. Which policy type should be configured on Panorama if the administrators at the branch office sites to override these products?

Question93: Which event will happen if an administrator uses an Application Override Policy?

Question94: What are three valid qualifiers for a Decryption Policy Rule match? (Choose three )

Question95: How can a candidate or running configuration be copied to a host external from Panorama?

Question96: Which three firewall states are valid? (Choose three.)

Question97: A network security engineer must implement Quality of Service policies to ensure specific levels of delivery guarantees for various applications in the environment.
]They want to ensure that they know as much as they can about QoS before deploying.
Which statement about the QoS feature is correct?

Question98: An administrator needs to upgrade a Palo Alto Networks NGFW to the most current version of PAN-OS software. The firewall has internet connectivity through an Ethernet interface, but no internet connectivity from the management interface. The Security policy has the default security rules and a rule that allows all web-browsing traffic from any to any zone.
What must the administrator configure so that the PAN-OS software can be upgraded?

Question99: An administrator needs to gather information about the CPU utilization on both the management plane and the data plane.
Where does the administrator view the desired data?

Question100: An administrator needs firewall access on a trusted interface. Which two components are required to configure certificate based, secure authentication to the web Ul? (Choose two )

Question101: The firewall is not downloading IP addresses from MineMeld. Based, on the image, what most likely is wrong?

Question102: A standalone firewall with local objects and policies needs to be migrated into Panoram

Question103: To support a new compliance requirement, your company requires positive username attribution of every IP address used by wireless devices. You must collect IP address-to-username mappings as soon as possible with minimal downtime and minimal configuration changes to the wireless devices themselves. The wireless devices are from various manufacturers.
Given the scenario, choose the option for sending IP address-to-username mappings to the firewall

Question104: A company needs to preconfigure firewalls to be sent to remote sites with the least amount of preconfiguration.
Once deployed each firewall must establish secure tunnels back to multiple regional data centers to include the future regional data centers.
Which VPN preconfigured configuration would adapt to changes when deployed to the future site?

Question105: A Palo Alto Networks NGFW just submitted a file to WildFire for analysis. Assume a 5- minute window for analysis. The firewall is configured to check for verdicts every 5 minutes.
How quickly will the firewall receive back a verdict?

Question106: To connect the Palo Alto Networks firewall to AutoFocus, which setting must be enabled?

Question107: In SSL Forward Proxy decryption, which two certificates can be used for certificate signing?
(Choose two.)

Question108: Which Public Key infrastructure component is used to authenticate users for GlobalProtect when the Connect Method is set to pre-logon?

Question109: While troubleshooting an SSL Forward Proxy decryption issue, which PAN-OS CLI command would you use to check the details of the end entity certificate that is signed by the Forward Trust Certificate or Forward Untrust Certificate?

Question110: An organization is building a Bootstrap Package to deploy Palo Alto Networks VM-Series firewalls into their AWS tenant.
Which two statements are correct regarding the bootstrap package contents? (Choose two )

Question111: Which setting allow a DOS protection profile to limit the maximum concurrent sessions from a source IP address?

Question112: Click the Exhibit button. An administrator has noticed a large increase in bittorrent activity.
The administrator wants to determine where the traffic is going on the company.

What would be the administrator's next step?

Question113: Which prerequisite must be satisfied before creating an SSH proxy Decryption policy?

Question114: Which option would an administrator choose to define the certificate and protocol that Panorama and its managed devices use for SSL/TLS services?

Question115: As a best practice, which URL category should you target first for SSL decryption?

Question116: What are two valid deployment options for Decryption Broker? (Choose two)

Question117: People are having intermittent quality issues during a live meeting via web application.

Question118: People are having intermittent quality issues during a live meeting via a web application.
How can the performance of this application be improved?

Question119: An administrator has purchased WildFire subscriptions for 90 firewalls globally.
What should the administrator consider with regards to the WildFire infrastructure?

Question120: A firewall administrator is troubleshooting problems with traffic passing through the Palo Alto Networks firewall. Which method shows the global counters associated with the traffic after configuring the appropriate packet filters?

Question121: What are two benefits of nested device groups in Panorama? (Choose two.)

Question122: Which Palo Alto Networks VM-Series firewall is valid?

Question123: An administrator is using Panorama and multiple Palo Alto Networks NGFWs. After upgrading all devices to the latest PAN-OS?software, the administrator enables log forwarding from the firewalls to Panorama. Pre-existing logs from the firewalls are not appearing in Panorama.
Which action would enable the firewalls to send their pre-existing logs to Panorama?

Question124: A client is deploying a pair of PA-5000 series firewalls using High Availability (HA) in Active/Passive mode. Which statement is true about this deployment?

Question125: A bootstrap USB flash drive has been prepared using a Windows workstation to load the initial configuration of a Palo Alto Networks firewall that was previously being used in a lab. The USB flash drive was formatted using file system FAT32 and the initial configuration is stored in a file named init-cfg.txt. The firewall is currently running PAN-OS 10.0 and using a lab config. The contents of init-cfg.txt in the USB flash drive are as follows:

The USB flash drive has been inserted in the firewalls USB port, and the firewall has been restarted using command: > request restart system Upon restart, the firewall fails to begin the bootstrapping process. The failure is caused because:

Question126: An administrator with 84 firewalls and Panorama does not see any WildFire logs in Panorama. All
84 firewalls have an active WildFire subscription. On each firewall, WildFire logs are available.
This issue is occurring because forwarding of which type of logs from the firewalls to Panorama is missing?

Question127: Which two firewall components enable you to configure SYN flood protection thresholds?
(Choose two)

Question128: Which three rule types are available when defining policies in Panorama? (Choose three.)

Question129: Which three rule types are available when defining polices in Panorama? (Choose three.)

Question130: Which Security Policy Rule configuration option disables antivirus and anti-spyware scanning of server-to-client flows only?

Question131: Which two options prevent the firewall from capturing traffic passing through it? (Choose two.)

Question132: If a template stack is assigned to a device and the stack includes three templates with overlapping settings, which settings are published to the device when the template stack is pushed?

Question133: An administrator needs to assign a specific DNS server to one firewall within a device group.
Where would the administrator go to edit a template variable at the device level?

Question134: In the following image from Panorama, why are some values shown in red?

Question135: The GlobalProtect Portal interface and IP address have been configured. Which other value needs to be defined to complete the network settings configuration of GlobalPortect Portal?

Question136: An administrator sees several inbound sessions identified as unknown-tcp in the Traffic logs. The administrator determines that these sessions are form external users accessing the company's proprietary accounting application. The administrator wants to reliably identify this traffic as their accounting application and to scan this traffic for threats.
Which option would achieve this result?

Question137: Which authentication source requires the installation of Palo Alto Networks software, other than PAN-OS 7x, to obtain a username-to-IP-address mapping?

Question138: Starting with PAN-OS version 9.1, application dependency information is now reported in which new locations? (Choose two.)

Question139: In order to route traffic between layer 3 interfaces on the PAN firewall you need:

Question140: Which two virtualization platforms officially support the deployment of Palo Alto Networks VM- Series firewalls? (Choose two.)

Question141: An engineer wants to implement the Palo Alto Networks firewall in VWire mode on the internet gateway and wants to be sure of the functions that are supported on the vwire interface. What are three supported functions on the VWire interface? (Choose three )

Question142: During the packet flow process, which two processes are performed in application identification?
(Choose two.)

Question143: An administrator needs to troubleshoot a User-ID deployment. The administrator believes that there is an issue related to LDAP authentication. The administrator wants to create a packet capture on the management plane.
Which CLI command should the administrator use to obtain the packet capture for validating the configuration?

Question144: When you navigate to Network: > GlobalProtect > Portals > Method section, which three options are available? (Choose three )

Question145: Wildfire may be used for identifying which of the following types of traffic?

Question146: An administrator has been asked to configure active/active HA for a pair of Palo Alto Networks NGFWs. The firewall use Layer 3 interfaces to send traffic to a single gateway IP for the pair.
Which configuration will enable this HA scenario?