QUESTION 47
You are a Network Security Analyst managing a Palo Alto Networks firewall. A critical internal application, ‘Project-Zeus’, connects to an external SaaS provider over TCP/443. This SaaS service uses a highly customized TLS implementation that consistently causes App- ID to identify the traffic as ‘ssl-unknown’ or ‘unknown-tcp’, even though the service is legitimate and approved. The security team wants to ensure ‘Project-Zeus’ traffic is explicitly identified as ‘project-zeus-app’ (a pre-defined custom application) to apply a specific set of security profiles, including advanced threat prevention and decryption, that are tailored to its known behavior. The SaaS provider’s IP range is dynamic but always resides within a specific FQDN object (saas.example.com) that resolves to multiple IPs.
Which combination of configuration elements will reliably achieve this goal?

QUESTION 48
An internal web application, ‘AppX’, uses SSL with client certificates for mutual authentication. Users are complaining that they cannot access ‘APPX’ when SSL Inbound Inspection is enabled on the Palo Alto Networks firewall. The firewall logs indicate ‘decryption-failure’ with reason ‘client-certificate-required’. Which specific configuration adjustment to the SSL Inbound Inspection profile applied to ‘APPX’ would resolve this issue without compromising the mutual authentication requirement?

QUESTION 49
Which administrator receives a global notification for a new malware that infects hosts. The infection will result in the infected host attempting to contact and command-and-control (C2) server.
Which security profile components will detect and prevent this threat after the firewall`s signature database has been updated?

QUESTION 50
Which security profile should be used to classify malicious web content?

QUESTION 51
Given the scenario, which two statements are correct regarding multiple static default routes? (Choose two.)

QUESTION 52
How are service routes used in PAN-OS?

QUESTION 53
A leading game development studio hosts its massively multiplayer online (MMO) game servers behind a Palo Alto Networks firewall. The game protocol utilizes custom UDP packets on port 7777 for real-time communication. During major game updates or events, they face unique DoS challenges: 1. Volumetric UDP floods on port 7777 from botnets, requiring quick mitigation. 2. ‘Login server exhaustion’ attacks, where attackers rapidly open and close TCP connections to the login service (port 443), consuming server resources despite individual connections appearing benign. 3. Legitimate players often connect from behind NATs, appearing to be single source IPs with high concurrent connections. Which of the following multiple DoS protection profiles and policy configurations, when used together, would provide the most effective and resilient defense against these specific, concurrent threats?

QUESTION 54
An enterprise is facing a unique challenge with its SD-WAN deployment. They have a custom, latency-critical, stateful application (App-ID: proprietary-app) that requires all its traffic (initial connection and subsequent data) to be pinned to a single, consistent WAN path for the entire session duration to avoid session resets. This application must prefer a specific MPLS link (Link A) if its latency is below 30ms and packet loss is below 0.01 If Link A degrades, the application should failover to a dedicated Internet VPN tunnel (Tunnel B) if Tunnel B’s latency is below 50ms and packet loss below 0.1%. If both links fail their respective SLAs, the traffic should be dropped. Furthermore, if a session is established on Tunnel B, it should not flap back to Link A even if Link A recovers, to maintain session consistency. Which configuration elements are crucial to implement this requirement?

QUESTION 55
Which update option is not available to administrators?

QUESTION 56
When is an event displayed under threat logs?

QUESTION 57
Which Security policy action will message a user’s browser that their web session has been terminated?

QUESTION 58
Which type of administrative role must you assign to a firewall administrator account, if the account must include a custom set of firewall permissions?

QUESTION 59
A security analyst is investigating a compromised internal host using Strata Cloud Manager (SCM) to gather evidence. The playbook requires fetching recent logs for specific source and destination IPs, identifying the exact security policy rule that allowed the initial communication, and then temporarily disabling that rule for immediate containment. Which SCM API endpoints and query parameters would be most relevant for accomplishing these tasks efficiently?

QUESTION 60
A network administrator is troubleshooting an intermittent application connectivity issue that only affects a specific subnet, but only when traffic traverses a particular firewall managed by Panoram a. The administrator suspects a recent policy change. How can Panorama’s features be leveraged to efficiently diagnose and potentially revert problematic policy changes for this specific firewall, minimizing impact to other devices?

QUESTION 61
You are debugging a connectivity issue where an internal application server, running a custom SSH service on port 2222, cannot establish connections to an external cloud logging service. The firewall logs show ‘deny’ actions with application ‘ssh’ and service ‘application-default’, even though a specific policy rule allows ‘custom_ssh_app’ (a custom App-ID for port 2222) to the logging service. What is the most likely cause and solution?

QUESTION 62
A cybersecurity firm manages multiple tenants on a single Palo Alto Networks firewall using Virtual Systems (vSys). Each vSys has its own PBF policies. A new requirement dictates that all outbound web traffic (TCP/80, 443) from a specific subnet (172.16.0.0/24) in ‘vSys_A’ must first be directed to an external web proxy (192.0.2.254) before being sent to the internet. This proxy is located in a different vSys, ‘vSys_B’, which has a dedicated interface (ethernet1/10) for this proxy integration. All other traffic from 172.16.0.0/24 in ‘vSys A’ should follow its regular internet path. Which PBF configuration is appropriate, and what critical inter-vSys element is needed?

QUESTION 63
Which two DNS policy actions in the anti-spyware security profile can prevent hacking attacks through DNS queries to malicious domains? (Choose two.)

QUESTION 64
A Palo Alto Networks firewall is configured for SSL Forward Proxy decryption. An internal application relies on certificate pinning for security. When users attempt to access this application, they receive certificate warnings, and the application fails to connect. The security team wants to maintain decryption for other traffic but specifically bypass decryption for this application. Which configuration change is the most precise and least impactful to the overall security posture?

QUESTION 65
A large-scale SD-WAN deployment uses BGP for dynamic route exchange between hub and spoke firewalls. The network team has defined an SD-WAN profile with multiple SD-WAN policy rules. They observe that some traffic flows, which should be matched by an SD-WAN policy rule, are instead being routed according to the standard BGP routing table. This occurs even when the SD-WAN preferred path is technically ‘up’ and healthy according to Path Monitoring. What could be the complex underlying reasons for this behavior, considering the interaction between SD-WAN and dynamic routing?

QUESTION 66
What is a recommended consideration when deploying content updates to the firewall from Panorama?

QUESTION 67
Which rule type is appropriate for matching traffic both within and between the source and destination zones?