2022 ACE Question Bank Free PDF Download Recently Updated Questions [Q39-Q63]

By adminOn June 12, 2022

4/5 - (1 vote)

2022 ACE Question Bank: Free PDF Download Recently Updated Questions

ACE Certification Exam Dumps with 74 Practice Test Questions

NO.39 Traffic going to a public IP address is being translated by your PANW firewall to your web server’s private IP. Which IP
should the Security Policy use as the “Destination IP” in order to allow traffic to the server.

The server’s public IP

The firewall’s gateway IP

The server’s private IP

The firewall’s MGT IP

NO.40 When creating a Security Policy to allow Facebook in PAN-OS 5.0, how can you be sure that no other web-browsing
traffic is permitted?

Ensure that the Service column is defined as “application-default” for this security rule. This will automatically
include the implicit web-browsing application dependency.

Create a subsequent rule which blocks all other traffic

When creating the rule, ensure that web-browsing is added to the same rule. Both applications will be processed
by the Security policy, allowing only Facebook to be accessed. Any other applications can be permitted in subsequent
rules.

No other configuration is required on the part of the administrator, since implicit application dependencies will be
added automaticaly.

NO.41 Aviatrix platform provides rich capabilities around networking, security and operations in public cloud networks. In addition to Aviatrix Transit, it also helps customers overcome limitations of native public cloud constructs. Below, match the Aviatrix platform capability for AWS Transit Gateway (TGW) with the appropriate problem description.

NO.42 Which feature is a dynamic grouping of applications used in Security policy rules?

implicit applications

dependent applications

application group

application filter

NO.43 How do you limit the amount of information recorded in the URL Content Filtering Logs?

Enable DSRI

Disable URL packet captures

Enable URL log caching

Enable Log container page only

NO.44 UserID is enabled in the configuration of:

a Security Profile.

an Interface.

a Security Policy.

a Zone.

NO.45 Choose the two best statements that describe challenges of deploying a NextGen Firewall (NGFW) in public cloud. (Choose 2)

Reduced visibility due to NAT

Firewalls can only be deployed in Active/Standby

Reduced firewall feature availability

Reduced effective throughput of the NGFW

Firewalls can only be deployed in Active/Active

NO.46 Customer has an Aviatrix Controller deployed in AW5 and wants to back up the Aviatrix Controller configuration. Where would the backup file be saved?

An S3 bucket

SFTP Server

On one of the Aviatrix Gateways

FTP Server

NO.47 Color-coded tags can be used on all of the items listed below EXCEPT:

Address Objects

Zones

Service Groups

Vulnerability Profiles

NO.48 When setting up GlobalProtect, what is the job of the GlobalProtect Portal? Select the best answer

To maintain the list of remote GlobalProtect Portals and list of categories for checking the client machine

To maintain the list of GlobalProtect Gateways and list of categories for checking the client machine

To load balance GlobalProtect client connections to GlobalProtect Gateways

None of the above

NO.49 You have decided to implement a Virtual Wire Subinterface. Which options can be used to classify traffic?

Either VLAN tag or IP address, provided that each tag or ID is contained in the same zone.

Subinterface ID and VLAN tag only

By Zone and/or IP Classifier

VLAN tag, or VLAN tag plus IP address (IP address, IP range, or subnet).

NO.50 With IKE, each device is identified to the other by a Peer ID. In most cases, this is just the public IP address of the
device. In situations where the public ID is not static, this value can be replaced with a domain name or other text
value

True

False

NO.51 Operations team has noticed that during the peak working hours, Aviatrix Gateway’s throughput utilization stays around 80% of the current instance size. A decision has been made to scale up the instance size to provide more throughput. Which below statement accurately describes instance sizing of Aviatrix Gateways?

Aviatrix Gateways can scale down but not scale up

Aviatrix Gateways instance size has to be chosen at deployment and can’t change later

Aviatrix Gateways can scale up but not scale down

Aviatrix Gateways can scale up and down both

NO.52 What are three connection methods for the GlobalProtect agent? (Choose three.)

Pre*Logon

Captcha portal

User*Logon

On*demand

NO.53 Besides selecting the Heartbeat Backup option when creating an ActivePassive
HA Pair, which of the following also prevents “SplitBrain”?

Creating a custom interface under Service Route Configuration, and assigning this interface as the backup HA2 link.

Under “Packet Forwarding”, selecting the VR Sync checkbox.

Configuring an independent backup HA1 link.

Configuring a backup HA2 link that points to the MGT interface of the other device in the pair.

NO.54 In PANOS 6.0, rule numbers are:

Numbers that specify the order in which security policies are evaluated.

Numbers created to be unique identifiers in each firewall’s policy database.

Numbers on a scale of 0 to 99 that specify priorities when two or more rules are in conflict.

Numbers created to make it easier for users to discuss a complicated or difficult sequence of rules.

NO.55 What Security Profile type must be configured to send files to the WildFire cloud, and with what choices for the action
setting?

A File Blocking profile with possible actions of “Forward” or “Continue and Forward”.

A Data Filtering profile with possible actions of “Forward” or “Continue and Forward”.

A Vulnerability Protection profile with the possible action of “Forward”.

A URL Filtering profile with the possible action of “Forward”.

NO.56 What are the benefits gained when the “Enable Passive DNS Monitoring” checkbox is chosen on the firewall?

Improved DNS-based C&C signatures.

Improved PANDB malware detection.

Improved BrightCloud malware detection.

Improved malware detection in WildFire.

NO.57 In PAN-OS 5.0, how is Wildfire enabled?

Via the “Forward” and “Continue and Forward” File-Blocking actions

A custom file blocking action must be enabled for all PDF and PE type files

Wildfire is automatically enabled with a valid URL-Filtering license

Via the URL-Filtering “Continue” Action.

NO.58 Using AWS Terraform provider, a customer created an AWS Transit Gateway with 50 VPCs attached to it. After attaching the VPCs and spinning up some EC2 instances in them, none of the instances can communicate with each other. What should be done to resolve the issue?

There must be security group rules blocking traffic as AWS auto configures VPC routing tables

Configure BGP communities in VPC such that all VPCs that need to communicate with eachother have same community defined

Create routing tables in each VPC, add CIDR for all the other VPCs in the routing table pointing to AWS Transit Gateway

There must be security group rules blocking traffic as BGP in VPC auto configures VPC routing tables

NO.59 When employing the BrightCloud URL filtering database in a Palo Alto Networks firewall, the order of evaluation
within a profile is:

Block list, Custom Categories, Predefined categories, Dynamic URL filtering, Allow list, Cache files.

Block list, Allow list, Custom Categories, Cache files, Local URL DB file.

Block list, Custom Categories, Cache files, Predefined categories, Dynamic URL filtering, Allow list.

Dynamic URL filtering, Block list, Allow list, Cache files, Custom categories, Predefined categories.

NO.60 What is a challenge of using VNet peering for transit in Azure?

Limited bandwidth available over peering connections

Requires BGP to be configured

Doesn’t scale well as its a 1:1 mapping

Limited to a single region

NO.61 Which of the following options may be enabled to reduce system overhead when using Content ID?

STP

VRRP

RSTP

DSRI

NO.62 In PAN-OS 5.0, how is Wildfire enabled?

Via the URL-Filtering “Continue” Action

Wildfire is automatically enabled with a valid URL-Filtering license

A custom file blocking action must be enabled for all PDF and PE type files

Via the “Forward” and “Continue and Forward” File-Blocking actions

NO.63 The following can be configured as a next hop in a Static Route:

A Policy-Based Forwarding Rule

Virtual System

A Dynamic Routing Protocol

Virtual Router

New ACE Exam Dumps with High Passing Rate: https://www.testkingit.com/Aviatrix/latest-ACE-exam-dumps.html

2022 ACE Question Bank Free PDF Download Recently Updated Questions [Q39-Q63]

Leave a Reply Cancel reply