Try Palo Alto Networks : SecOps-Generalist practice torrent pass for sure

An organization wants to protect its users from accessing known malicious websites and command-and-control (C2) infrastructure by preventing the resolution of malicious domain names. They have a Palo Alto Networks NGFW with an Advanced DNS Security subscription. Which key capability provided by Advanced DNS Security enables this protection at the DNS layer?

• A. Blocking DNS traffic based on the source IP address of the querying host.
• B. Encrypting all DNS queries to prevent eavesdropping.
• C. Analyzing DNS query and response patterns using machine learning to identify malicious domains in real-time.
• D. Comparing DNS query domain names against a static blacklist configured manually on the firewall.
• E. Serving as a local DNS resolver for all internal clients.

An administrator is configuring SSL Inbound Inspection on a Palo Alto Networks NGFW to decrypt incoming HTTPS traffic destined for an internal web server. Which type of certificate, specifically the private key component, must be imported onto the firewall to enable successful decryption of traffic destined for that specific server?

• A. The public certificate of the external client connecting to the server.
• B. The firewall's self-signed root CA certificate.
• C. The server certificate of the internal web server, including its private key.
• D. A wildcard certificate trusted by internal clients.
• E. The firewall's self-signed intermediate CA certificate for forward proxy.

An administrator is troubleshooting why a Security Policy rule intended to allow only specific applications for the 'IT-Admins' user group is not being matched by their traffic. The rule is placed correctly in the policy order, the source zone is correct, and the destination is correct. Traffic logs show the administrator's traffic hitting a broader 'allow' rule lower in the policy list, and the 'Source User' column for that session shows 'unknown'. What is the MOST likely configuration issue causing the desired rule to be skipped and User-ID to show as 'unknown'?

• A. The Security Policy rule is configured with 'Service: any', overriding the specific applications listed in the rule.
• B. The administrator's traffic is being decrypted, and the decryption is introducing errors that prevent policy matching.
• C. User-ID is not successfully mapping the administrator's source IP address to their username and the 'IT-Admins' group.
• D. The 'IT-Admins' user group is defined incorrectly in the firewall's local user database.
• E. App-ID is failing to identify the specific applications listed in the rule, causing the rule match to fail.

An organization is using Palo Alto Networks IoT Security integrated with their NGFW. A new vulnerability is announced for a specific model of 'IoT Camera' device deployed in the company. The IoT Security platform identifies that several devices are affected and flags them as high risk. The security team wants to immediately implement a temporary policy to restrict all communication from these specifically vulnerable cameras until they can be patched. Which of the following policy configurations and considerations are most relevant to achieving this rapid, targeted restriction using the IoT Security integration? (Select all that apply)

• A. Create a Security Policy rule with the Source Zone matching the IoT segment and the Source Address referencing the dynamic 'Vulnerable IoT Cameras' device group.
• B. Configure the IoT Security platform to automatically push configuration changes to the vulnerable devices themselves to disable network connectivity.
• C. Ensure this new 'deny' rule for vulnerable cameras is placed above any existing 'allow' rules that might permit communication from the general IoT segment.
• D. Leverage the dynamic device group automatically created or updated by the IoT Security platform for 'Vulnerable IoT Cameras'.
• E. Set the Action of the Security Policy rule matching the vulnerable cameras to 'deny' or 'drop' for all applications and destinations.

Consider a scenario where an internal application uses certificate pinning and client-side certificates for authentication over HTTPS. Due to these technical requirements, the application breaks when subjected to SSL Forward Proxy decryption. To maintain application functionality while still applying general security policy (like App-ID based access control and basic URL filtering based on hostname), the administrator decides to exclude this application's traffic from decryption. Which of the following configuration steps is the MOST appropriate method to achieve this?

• A. Configure the application to use a different, unencrypted port instead of HTTPS.
• B. Import the application server's private key into the firewall and configure SSL Inbound Inspection for the traffic.
• C. Define a custom URL Category for the application's domain(s) and add this category to the 'No Decrypt' list within a Decryption Profile.
• D. Create a Decryption Policy rule matching the source (users/zones), destination (application server IP/zone/URL category), and application (HTTPS if identified) and set the 'Action' of this rule to 'No Decrypt', ensuring it's placed higher than broader decrypt rules.
• E. Create a Security Policy rule for this application's traffic and set the 'Action' to 'No Decrypt'.