An administrator has configured SSL Forward Proxy decryption for outbound internet traffic on a Palo Alto Networks NGFW They want to exclude a specific application internal-app') running on HTTPS (port 443) from decryption because it uses client-side certificates. The 'internal-app' is hosted externally but accessed by internal users. There is a general 'Decrypt all outbound HTTPS' rule lower in the policy. Which configuration steps are necessary to create the exclusion rule?

• A. Edit the 'Decrypt all outbound HTTPS' rule and add the 'internal-app' to its exclusion list within the rule options.
• B. Remove the 'SSI' service from the 'Decrypt all outbound HTTPS' rule and create a separate rule for 'internal-app' with no decryption.
• C. Create a Security policy rule with Action 'No Decrypt', Source Zone 'internal', Destination Zone 'external', Application 'internal-app', and place this rule above the 'Decrypt all outbound HTTPS' rule.
• D. Create a custom URL Category for the 'internal-app' domain and add this URL Category to the Decryption Profile used by the 'Decrypt all outbound HTTPS' rule.
• E. Create a Decryption policy rule with Action 'No Decrypt', Source Zone 'internal', Destination Zone 'external', Application 'internal-app', and place this rule above the 'Decrypt all outbound HTTPS' rule.

Explanation: Only visible for Actual4dump members. You can sign-up / login (it's free).

When configuring Security Policy rules in Prisma Access for remote users, what are some key advantages of using User-ID (mapped to Active Directory groups) and App-ID compared to traditional firewall policies based solely on IP addresses, ports, and security zones?

• A. Granular control based on user identity (e.g., allow Finance users to access Finance app) and application identity (e.g., allow only specific collaboration tools), independent of IP addresses or ports.
• B. Consistent policy enforcement for users regardless of their changing IP address (e.g., when moving between locations or getting a new DHCP lease).
• C. Improved performance by allowing the firewall to bypass deep packet inspection for trusted users and applications.
• D. Enhanced security posture by allowing policies to be defined based on 'who is doing what', rather than just 'where the traffic is going'.
• E. Reduced administrative overhead by eliminating the need for security zones or NAT policies.

Explanation: Only visible for Actual4dump members. You can sign-up / login (it's free).

An alert is triggered in Cortex XDR indicating that PowerShell is being used to execute commands remotely. The analyst investigates and confirms that the activity is expected administrator behavior. What type of alert classification is this?
Response:

• A. Benign Positive
• B. True Positive
• C. False Positive
• D. False Negative

A company uses GlobalProtect on a self-managed PA-Series firewall to provide remote access. They have internal network segments defined by VLANs (e.g., Production Servers VLAN 10, Development Servers VLAN 20, User VLAN 30). Users connecting via GlobalProtect are assigned IP addresses from a dedicated VPN pool (e.g., 172.16.1.0/24). The security policy needs to restrict remote users' access to specific applications on specific server VLANs based on their user group and device compliance. How are Security Zones used to implement this segmentation and access control for remote user traffic interacting with internal resources? (Select all that apply)

• A. Traffic between remote users (within the VPN IP pool) is implicitly allowed by the intra-zone-default rule because they are in the same 'VPN-Zone'.
• B. Define a dedicated Security Zone for the GlobalProtect VPN user pool (e.g., 'VPN-Zone').
• C. Ensure the GlobalProtect tunnel interface or subinterface that receives user traffic is assigned to the 'VPN-Zone'.
• D. Create Security Policy rules with the Source Zone as 'VPN-Zone' and Destination Zone(s) as the respective internal server zones ('Prod-Zone', 'Dev-Zone').
• E. Define distinct Security Zones for each internal VLAN (e.g., 'Prod-Zone', 'Dev-Zone').

Explanation: Only visible for Actual4dump members. You can sign-up / login (it's free).

A security team manages a large fleet of Palo Alto Networks firewalls using Panoram a. They have enabled AIOps for NGFW to improve operational efficiency and security posture. They receive an AIOps alert about high session setup rates on a specific firewall, potentially indicating a performance bottleneck or a network anomaly (like a connection flood). Which of the following are valid actions the team can take or insights they can gain by leveraging the integration between AIOps and Panorama/Cortex Data Lake to investigate and address this alert? (Select all that apply)

• A. Automatically apply QOS policies via AIOps to mitigate the impact of high session setup on critical traffic.
• B. View historical trends and analyze the rate of new sessions on the affected firewall over time within the AIOps dashboard to determine if the current rate is an anomaly or a consistent pattern.
• C. Identify if the high session setup rate correlates with any specific configuration changes made to the firewall using AIOps' change correlation capabilities.
• D. Receive recommendations from AIOps on potential causes for the high session setup rate, such as short-lived connections or specific application traffic patterns.
• E. Drill down from the AIOps alert into the detailed Traffic logs for the affected firewall (stored in Cortex Data Lake/Panorama Log Collector) to identify the source IPs, destinations, and applications contributing to the high session setup rate.

Explanation: Only visible for Actual4dump members. You can sign-up / login (it's free).