PaloAlto ACE认证考试题库及答案

ACE Exam

Question 1 of 72.

Which of the following is not defined or assigned as part of the security rules?

答案：A

NAT rules

File blocking profile

Security profiles

Applications

Mark for follow up

Question 2 of 72.

It is possible to use different SSL forward proxy certificates for different vsys in a multi-vsys environment.

答案：A

True

False

Mark for follow up

Question 3 of 72.

In Active/Active HA environments, redundancy for the HA3 interface can be achieved by

答案：C

Configuring HA3 in a redundant group

Configuring a corresponding HA4 interface

Configuring HA3 as an Aggregate Ethernet bundle

Configuring multiple HA3 interfaces

Mark for follow up

Question 4 of 72.

In PANOS 4.0 or greater, which of the following is an accurate statement in regard to support for IPv6?

答案：C

PANOS supports Content ID in IPv6, but only in Layer 3 Mode.

User ID is only supported in IPv6 when the Palo Alto Networks firewall is deployed in Vwire mode.

PANOS supports dual-stack IP, for IPv4 and IPv6. This includes Virtual Wire and Layer 3 deployments.

Threat Prevention capabilities are not supported in IPv6.

None of the above

Mark for follow up

Question 5 of 72.

What needs to be done prior to committing a configuration in Panorama after making a change via the CLI or web interface on a device?

答案：D

Re-import the configuration from the device into Panorama

Make the same change again via Panorama

Synchronize the configuration between the device and Panorama

No additional actions required

None of the above

Mark for follow up

Question 6 of 72.

If a customer has 1 forest with 3 domains and wants a resilient PAN Agent deployment, what is the most appropriate agent architecture?

答案：B

Agents deployed on two separate servers within the forest

Two Agents deployed per domain, on separate servers

Two agents deployed on virtual servers on a server within the forest

An agent deployed on a server within each domain

Mark for follow up

Question 7 of 72.

Which mode will allow a user to choose how they wish to connect to the GlobalProtect Network as they would like?

答案： C

Optional Mode

Always On Mode

On Demand Mode

Single Sign-On Mode

Mark for follow up

Question 8 of 72.

Active/Active HA can be configured to provide:

答案：C

Higher session count

Redundant Virtual Routers

Support for asymmetric routing environments

Lower fail-over times

Mark for follow up

Question 9 of 72.

When forwarding multicast packets in L2 mode, we can configure security polices to match on multicast IP addresses.

答案：B

True

False

Mark for follow up

Question 10 of 72.

To properly configure DOS protection to limit the number of sessions individually from specific source IPs you would configure a DOS Protection rule with the following characteristics:

答案：B

Action: Protect, Aggregate Profile with \

Action: Protect, Classified Profile with \ \

Action: Deny, Aggregate Profile with \

Action: Deny, Classified Profile with \ \None of the above

Mark for follow up

Question 11 of 72.

For correct routing to SSL VPN clients to occur, the following must be configured:

答案：B

A static route on the next-hop gateway of the SSL VPN client IP pool with a destination of the PAN device No routing needs to be configured - the PAN device automatically responds to ARP requests for the SSL VPN client IP pool

Network Address Translation must be enabled for the SSL VPN client IP pool

A dynamic routing protocol between the PAN device and the next-hop gateway to advertise the SSL VPN client IP pool

Mark for follow up

Question 12 of 72.

When Network Address Translation has been performed on traffic, Destination Zones in Security rules should be based on:

答案：A

Post-NAT addresses

Pre-NAT addresses

the same zones used in the NAT rules

None of the above

Mark for follow up

百度搜索“77cn”或“免费范文网”即可找到本站免费阅读全部范文。收藏本站方便下次阅读，免费范文网，提供经典小说综合文库PaloAlto ACE认证考试题库及答案在线全文阅读。