EMT Practice Test

1. Question Content...

---

Question1: Which URL Filtering Security Profile action logs the URL Filtering category to the URL
Filtering log?

Question2: After pushing a security policy from Panorama to a PA-3020 firwall, the firewall administrator notices that traffic logs from the PA-3020 are not appearing in Panorama's traffic logs. What could be the problem?

Question3: A network security engineer is asked to provide a report on bandwidth usage. Which tab in the ACC provides the information needed to create the report?

Question4: An Administrator is configuring an IPSec VPN toa Cisco ASA at the administrator's home and experiencing issues completing the connection. The following is th output from the command:
less mp-log ikemgr.log:

What could be the cause of this problem?

Question5: The company's Panorama server (IP 10.10.10.5) is not able to manage a firewall that was recently deployed. The firewall's dedicated management port is being used to connect to the management network.
Which two commands may be used to troubleshoot this issue from the CLI of the new firewall? (Choose two)

Question6: A host attached to ethernet1/3 cannot access the internet. The default gateway is attached to ethernet1/4. After troubleshooting. It is determined that traffic cannot pass from the ethernet1/3 to ethernet1/4. What can be the cause of the problem?

Question7: An administrator is configuring an IPSec VPN to a Cisco ASA at the administrator's home and experiencing issues completing the connection. the following is the output from the command:

What could be the cause of this problem?

Question8: The web server is configured to listen for HTTP traffic on port 8080. The clients access the web server using the IP address 1.1.1.100 on TCP Port 80. The destination NAT rule is configured to translate both IP address and report to 10.1.1.100 on TCP Port 8080.

Which NAT and security rules must be configured on the firewall? (Choose two)

Question9: Which CLI command displays the current management plan memory utilization?

Question10: The IT department has received complaints abou VoIP call jitter when the sales staff is making or receiving calls. QoS is enabled on all firewall interfaces, but there is no QoS policy written in the rulebase. The IT manager wants to find out what traffic is causing the jitter in real time when a user reports the jitter.
Which feature can be used to identify, in real time, the applications taking up the most bandwidth?

Question11: Click the Exhibit button below,


A firewall has three PBF rules and a default route with a next hop of 172.20.10.1 that is configured in the default VR. A user named Will has a PC with a 192.168.10.10 IP address.
He makes an HTTPS connection to 172.16.10.20.
Which is the next hop IP address for the HTTPS traffic from Will's PC?

Question12: Click the Exhibit button

An administrator has noticed a large increase in bittorrent activity. The administrator wants to determine where the traffic is going on the company.
What would be the administrator's next step?

Question13: A firewall administrator is troubleshooting problems with traffic passing through the Palo
Alto Networks firewall. Which method shows the global counters associated with the traffic after configuring the appropriate packet filters?

Question14: A VPN connection is set up between Site-A and Site-B, but no traffic is passing in the system log of Site-A, there is an event logged as like-nego-p1-fail-psk.
What action will bring the VPN up and allow traffic to start passing between the sites?

Question15: A critical US-CERT notification is published regarding a newly discovered botnet. The malware is very evasive and is not reliably detected by endpoint antivirus software.
Furthermore, SSL is used to tunnel malicious traffic to command-and-control servers on the internet and SSL Forward Proxy Decryption is not enabled.
Which component once enabled on a perirneter firewall will allow the identification of existing infected hosts in an environment?

Question16: Which Panorama feature allows for logs generated by Panorama to be forwarded to an external Security Information and Event Management(SIEM) system?

Question17: Which two logs on the firewall will contain authentication-related information useful for troubleshooting purpose (Choose two)

Question18: A network security engineer has a requirement to allow an external server to access an internal web server. The internal web server must also initiate connections with the external server.
What can be done to simplify the NAT policy?

Question19: Firewall administrators cannot authenticate to a firewall GUI.
Which two logs on that firewall will contain authentication-related information useful in troubleshooting this issue? (Choose two.)

Question20: A firewall administrator has completed most of the steps required to provision a standalone
Palo Alto Networks Next-Generation Firewall. As a final step, the administrator wants to test one of the security policies.
Which CLI command syntax will display the rule that matches the test?

Question21: A network design calls for a "router on a stick" implementation with a PA-5060 performing inter-VLAN routing All VLAN-tagged traffic will be forwarded to the PA-5060 through a single dot1q trunk interface
Which interface type and configuration setting will support this design?

Question22: Site-A and Site-B have a site-to-site VPN set up between them. OSPF is configured to dynamically create the routes between the sites. The OSPF configuration in Site-A is configured properly, but the route for the tunner is not being established. The Site-B interfaces in the graphic are using a broadcast Link Type. The administrator has determined that the OSPF configuration in Site-B is using the wrong Link Type for one of its interfaces.

Which Link Type setting will correct the error?

Question23: YouTube videos are consuming too much bandwidth on the network, causing delays in mission-critical traffic. The administrator wants to throttle YouTube traffic. The following interfaces and zones are in use on the firewall:
* ethernet1/1, Zone: Untrust (Internet-facing)
* ethernet1/2, Zone: Trust (client-facing)
A QoS profile has been created, and QoS has been enabled on both interfaces. A QoS rule exists to put the YouTube application into QoS class 6. Interface Ethernet1/1 has a QoS profile called Outbound, and interface Ethernet1/2 has a QoS profile called Inbound.
Which setting for class 6 with throttle YouTube traffic?

Question24: A distributed log collection deployment has dedicated log Collectors. A developer needs a device to send logs to Panorama instead of sending logs to the Collector Group.
What should be done first?

Question25: A company has a policy that denies all applications it classifies as bad and permits only application it classifies as good. The firewall administrator created the following security policy on the company's firewall.

Which interface configuration will accept specific VLAN IDs?
Which two benefits are gained from having both rule 2 and rule 3 presents? (choose two)

Question26: Which three rule types are available when defining policies in Panorama? (Choose three.)

Question27: How is the Forward Untrust Certificate used?

Question28: Which two options are required on an M-100 appliance to configure it as a Log Collector?
(Choose two)

Question29: Which Security Policy Rule configuration option disables antivirus and anti-spyware scanning of server-to-client flows only?

Question30: Site-A and Site-B need to use IKEv2 to establish a VPN connection. Site A connects directly to the internet using a public IP address. Site-B uses a private IP address behind an ISP router to connect to the internet.
How should NAT Traversal be implemented for the VPN connection to be established between Site-A and Site-B?

Question31: Only two Trust to Untrust allow rules have been created in the Security policy
Rule1 allows google-base
Rule2 allows youtube-base
The youtube-base App-ID depends on google-base to function. The google-base App-ID implicitly uses SSL and web-browsing. When user try to accesss https://www.youtube.com in a web browser, they get an error indecating that the server cannot be found.
Which action will allow youtube.com display in the browser correctly?

Question32: What are three valid method of user mapping? (Choose three)

Question33: Which authentication source requires the installation of Palo Alto Networks software, other than PAN-OS 7x, to obtain a username-to-IP-address mapping?

Question34: The GlobalProtect Portal interface and IP address have been configured. Which other value needs to be defined to complete the network settings configuration of GlobalPortect Portal?

Question35: Which two statements are correct for the out-of-box configuration for Palo Alto Networks
NGFWs? (Choose two)

Question36: How does Panorama handle incoming logs when it reaches the maximum storage capacity?

Question37: CORRECT TEXT

Question38: A host attached to Ethernet 1/4 cannot ping the default gateway. The widget on the dashboard shows Ethernet 1/1 and Ethernet 1/4 to be green. The IP address of Ethernet
1/1 is 192.168.1.7 and the IP address of Ethernet 1/4 is 10.1.1.7. The default gateway is attached to Ethernet 1/1. A default route is properly configured.
What can be the cause of this problem?

Question39: What must be used in Security Policy Rule that contain addresses where NAT policy applies?

Question40: A network engineer has revived a report of problems reaching 98.139.183.24 through vr1 on the firewall. The routing table on this firewall is extensive and complex.
Which CLI command will help identify the issue?

Question41: Which interface configuration will accept specific VLAN IDs?

Question42: A Network Administrator wants to deploy a Large Scale VPN solution. The Network
Administrator has chosen a GlobalProtect Satellite solution. This configuration needs to be deployed to multiple remote offices and the Network Administrator decides to use
Panorama to deploy the configurations.
How should this be accomplished?

Question43: Which two interface types can be used when configuring GlobalProtect Portal?(Choose two)

Question44: A logging infrastructure may need to handle more than 10,000 logs per second.
Which two options support a dedicated log collector function? (Choose two)

Question45: Given the following table.

Which configuration change on the firewall would cause it to use 10.66.24.88 as the next hop for the 192.168.93.0/30 network?

Question46: In an enterprise deployment, a network security engineer wants to assign to a group of administrators without creating local administrator accounts on the firewall.
Which authentication method must be used?

Question47: Which Palo Alto Networks VM-Series firewall is supported for VMware NSX?

Question48: A company hosts a publicly accessible web server behind a Palo Alto Networks next- generation firewall with the following configuration information:
* Users outside the company are in the "Untrust-L3" zone.
* The web server physically resides in the "Trust-L3" zone.
* Web server public IP address: 23.54.6.10
* Web server private IP address: 192.168.1.10
Which two items must the NAT policy contain to allow users in the Untrust-L3 zone to access the web server? (Choose two.)

Question49: A network design change requires an existing firewall to start accessing Palo Alto Updates from a data plane interface address instead of the management interface.
Which configuration setting needs to be modified?

Question50: A client is deploying a pair of PA-5000 series firewalls using High Availability (HA) in
Active/Passive mode. Which statement is true about this deployment?

Question51: People are having intermittent quality issues during a live meeting via web application.

Question52: What can missing SSL packets when performing a packet capture on dataplane interfaces?

Question53: When a malware-infected host attempts to resolve a known command-and-control server, the traffic matches a security policy with DNS sinhole enabled, generating a traffic log.
What will be the destination IP Address in that log entry?

Question54: How can a Palo Alto Networks firewall be configured to send syslog messages in a format compatible with non-standard syslog servers?

Question55: Which CLI command displays the current management plane memory utilization?

Question56: Which URL Filtering Security Profile action togs the URL Filtering category to the URL
Filtering log?

Question57: A company has a pair of Palo Alto Networks firewalls configured as an Acitve/Passive High Availability (HA) pair.
What allows the firewall administrator to determine the last date a failover event occurred?

Question58: A network administrator uses Panorama to push security polices to managed firewalls at branch offices. Which policy type should be configured on Panorama if the administrators at the branch office sites to override these products?

Question59: Which two logs on the firewall will contain authentication-related information useful for troubleshooting purpose (Choose two)

Question60: A Palo Alto Networks firewall is being targeted by an NTP Amplification attack and is being flooded with tens thousands of bogus UDP connections per second to a single destination IP address and post.
Which option when enabled with the correction threshold would mitigate this attack without dropping legitirnate traffic to other hosts insides the network?

Question61: How are IPV6 DNS queries configured to user interface ethernet1/3?

Question62: A company hosts a publically accessible web server behind a Palo Alto Networks next generation firewall with the following configuration information.
*
Users outside the company are in the "Untrust-L3" zone
*
The web server physically resides in the "Trust-L3" zone.
*
Web server public IP address: 23.54.6.10
*
Web server private IP address: 192.168.1.10
Which two items must be NAT policy contain to allow users in the untrust-L3 zone to access the web server? (Choose two)

Question63: Which three function are found on the dataplane of a PA-5050? (Choose three)

Question64: Several offices are connected with VPNs using static IPv4 routes.
An administrator has been tasked with implementing OSPF to replace static routing.
Which step is required to accomplish this goal?

Question65: Which command can be used to validate a Captive Portal policy?

Question66: Which two methods can be used to mitigate resource exhaustion of an application server?
(Choose two)

Question67: DRAG DROP
When using the predefined default profile, the policy will inspect for viruses on the decoders. Match each decoder with its default action.
Answer options may be used more than once or not at all.

Question68: A network Administrator needs to view the default action for a specific spyware signature.
The administrator follows the tabs and menus through Objects> Security Profiles> Anti-
Spyware and select default profile.
What should be done next?

Question69: What are two prerequisites for configuring a pair of Palo Alto Networks firewalls in an active/passive High Availability (HA) pair? (Choose two.)

Question70: Which field is optional when creating a new Security Policy rule?

Question71: Which setting allow a DOS protection profile to limit the maximum concurrent sessions from a source IP address?

Question72: Company.com has an in-house application that the Palo Alto Networks device doesn't identify correctly. A Threat Management Team member has mentioned that this in-house application is very sensitive and all traffic being identified needs to be inspected by the
Content-ID engine.
Which method should company.com use to immediately address this traffic on a Palo Alto
Networks device?

Question73: Which two virtualized environments support Active/Active High Availability (HA) in PAN-OS 7.0? (Choose two.)

Question74: A company.com wants to enable Application Override. Given the following screenshot:

Which two statements are true if Source and Destination traffic match the Application
Override policy? (Choose two)

Question75: Which Device Group option is assigned by default in Panorama whenever a new device group is created to manage a Firewall?

Question76: Support for which authentication method was added in PAN-OS 7.0?

Question77: A company has a web server behind a Palo Alto Networks next-generation firewall that it wants to make accessible to the public at 1.1.1.1. The company has decided to configure a destination NAT Policy rule.
Given the following zone information:
*DMZ zone: DMZ-L3
*Public zone: Untrust-L3
*Guest zone: Guest-L3
*Web server zone: Trust-L3
*Public IP address (Untrust-L3): 1.1.1.1
*Private IP address (Trust-L3): 192.168.1.50
What should be configured as the destination zone on the Original Packet tab of NAT
Policy rule?

Question78: A network security engineer needs to configure a virtual router using IPv6 addresses.
Which two routing options support these addresses? (Choose two)

Question79: Which three fields can be included in a pcap filter? (Choose three)

Question80: Which client software can be used to connect remote Linux client into a Palo Alto Networks
Infrastructure without sacrificing the ability to scan traffic and protect against threats?

Question81: Several offices are connected with VPNs using static IPV4 routes. An administrator has been tasked with implementing OSPF to replace static routing.
Which step is required to accoumplish this goal?

Question82: A file sharing application is being permitted and no one knows what this application is used for.
How should this application be blocked?

Question83:
What will be the source address in the ICMP packet?

Question84: Palo Alto Networks maintains a dynamic database of malicious domains.
Which two Security Platform components use this database to prevent threats? (Choose two)

Question85: Which option is an IPv6 routing protocol?

Question86: A network security engineer is asked to perform a Return Merchandise Authorization
(RMA) on a firewall
Which part of files needs to be imported back into the replacement firewall that is using
Panorama?

Question87: After pushing a security policy from Panorama to a PA-3020 firwall, the firewall administrator notices that traffic logs from the PA-3020 are not appearing in Panorama's traffic logs. What could be the problem?

Question88: When is it necessary to activate a license when provisioning a new Palo Alto Networks firewall?

Question89: Which three options does the WF-500 appliance support for local analysis? (Choose three)

Question90: Which two mechanisms help prevent a spilt brain scenario an Active/Passive High
Availability (HA) pair? (Choose two)