Q68. You are tasked with analyzing the long-term resource usage trends of a Palo Alto Networks firewall to justify a hardware upgrade. You need to gather specific metrics over the past year, including average and peak session counts, CPU utilization (data plane and management plane), and throughput. Which of the following methods provides the MOST comprehensive and historical data for this purpose, assuming the firewall is managed by Panorama?

Q69. A critical application experiences intermittent connectivity issues. The Network Security Analyst suspects a misconfigured security policy on the Palo Alto Networks firewall. The analyst navigates to the Log Viewer and performs a filter for ‘deny’ actions on the application’s destination IP and port, observing several such logs. What are the NEXT logical steps to effectively remediate this issue using the Incidents and Alerts page and Log Viewer data?

Q70. Consider the following XML configuration snippet for a DoS Protection Policy on a Palo Alto Networks firewall:

Assuming this policy is applied to the inbound zone for web traffic, what is the intended behavior and potential limitation of the ‘group- by’ setting in this specific configuration?

Q71. A security analyst is investigating a compromised internal host using Strata Cloud Manager (SCM) to gather evidence. The playbook requires fetching recent logs for specific source and destination IPs, identifying the exact security policy rule that allowed the initial communication, and then temporarily disabling that rule for immediate containment. Which SCM API endpoints and query parameters would be most relevant for accomplishing these tasks efficiently?

Q72. An organization is migrating its cloud applications from a public internet connection to a dedicated AWS Direct Connect link through a Palo Alto Networks firewall. To achieve this, all traffic to AWS public IP ranges (e.g., EC2, S3) from the internal network must be forwarded over the Direct Connect interface (ethernet1/3) with a specific next-hop router. Other internet-bound traffic should continue using the primary internet uplink (ethernet1/1 ). Which of the following PBF actions are critical to ensure that if the Direct Connect link fails, the AWS-bound traffic automatically fails over to the primary internet uplink without manual intervention?

Q73. A large financial institution uses Panorama to manage their firewall estate. They are implementing a strict change management process where all policy modifications, object creations, or deletions must be reviewed and approved before being committed and pushed. They want to ensure that only approved changes are present in the ‘candidate config’ before a commit, and that deviations are easily identifiable. Which Panorama feature, when combined with a robust operational process, helps enforce this requirement and identify discrepancies?

Q74. A Palo Alto Networks firewall is configured to protect a DMZ segment hosting multiple web servers. The security team wants to implement a ‘positive security model’ for application control and threat prevention. This means explicitly allowing only known good applications and blocking everything else, coupled with comprehensive threat inspection for allowed traffic. They also need to ensure that any attempt to use deprecated or high-risk applications (even if ‘allowed’ by a broader rule earlier) is blocked. How do you structure the Security Policy Rules and Security Profiles to achieve this stringent positive security posture?

Q75. An administrator is troubleshooting intermittent decryption failures for a specific set of websites. The logs show ‘SSL Protocol Error’ or ‘Unsupported Protocol Version’ frequently. The current decryption profile uses default settings for protocol versions. Upon investigation, it’s discovered these websites are still using TLS 1.0 or TLS 1.1 , while the firewall is configured to prefer TLS 1.2 and above by default. Which of the following actions, or combination of actions, could resolve this issue while minimizing security compromises?

Q76. A Security Architect is designing a new firewall policy for a cloud environment where applications communicate using REST APIs over HTTP/S. They need to ensure that API traffic is strictly controlled and protected. Specifically, they want to: 1 . Allow only specific API methods (e.g., GET, POST, PUT) and block others (e.g., DELETE, TRACE) unless explicitly authorized. 2. Inspect API payloads for XML/JSON injection attacks and enforce schema validation. 3. Prevent file uploads larger than IOMB to API endpoints. 4. Log all successful API calls and block/log all denied calls. Which combination of Security Profiles and features should be used, and how are they applied to achieve this?

Q77. A network security analyst needs to investigate a series of successful brute-force attacks detected against a critical web server. The attacks spanned several hours and originated from various public IP addresses. Using Strata Logging Service, what specific search query and visualization approach would be most effective to quickly identify the source IPs, target users, and timestamps of these events?

Q78. A Security Administrator reports that users are unable to access certain web applications after a recent Panorama template push. The applications use non-standard ports, and the security policy explicitly allows traffic on these ports. Traffic logs show sessions being dropped with the reason ‘application-default’. Which of the following is the most probable cause of this misconfiguration?

Q79. A Palo Alto Networks firewall has a Log Forwarding Profile configured to send all logs to a syslog server. The security team needs to monitor ‘wildfire’ verdicts in real-time. To facilitate this, they request that the forwarded ‘wildfire’ logs include additional custom fields that are not part of the default syslog format. Specifically, they need the ‘file-hash’ and ‘file-type’ from WildFire logs to be explicitly included. How can this be achieved within the Log Forwarding Profile configuration?

Q80. A Palo Alto Networks Network Security Analyst is tasked with optimizing security posture by decommissioning legacy, unused firewall rules. The challenge is identifying rules that genuinely have no active sessions or hit counts over an extended period (e.g., 6 months), distinguishing them from rules that might be critical but rarely triggered (e.g., a failover rule). Additionally, the analyst needs to propose a phased deprecation process to minimize risk. Which approach, integrating Command Center, Activity Insights, and Policy Optimizer, is most robust?

Q81. An organization is deploying a new application that uses a custom TCP-based protocol over a non-standard port (e.g., TCP/8000). Despite creating a custom application signature, defining a service object for TCP/8000, and allowing it in a security policy, the application fails to establish connections. Packet captures on the client side show SYN packets being sent, but no SYN-ACKs are received. Debugging on the Palo Alto Networks firewall (debug flow basic and debug flow session) indicates the initial SYN packet is received by the firewall and matched to the correct security policy, but no session is established or forwarded. The firewall is in virtual wire mode between two internal segments. What advanced, context-specific misconfiguration or state is the most likely culprit?

Q82. A company is implementing a new BYOD policy and needs to ensure that mobile devices accessing internal resources are protected from known and unknown malware. They have deployed a Palo Alto Networks firewall with WildFire subscriptions. Which configuration steps are essential to leverage WildFire for comprehensive malware analysis and prevention specifically for BYOD traffic, assuming a security policy rule already exists for BYOD access?

Q83. A Palo Alto Networks firewall is configured with an External Dynamic List (EDL) sourced from an internal web server. The web server is located in a different security zone. Which of the following security policy rules must be in place to allow the firewall to successfully fetch updates for this EDL?

Q84. A global financial institution is implementing Strata Logging Service for their extensive Palo Alto Networks firewall deployment. They face stringent regulatory requirements for data residency and auditability, necessitating that certain log types (e.g., authentication, sensitive data filtering) remain within specific geographic regions while others (e.g., general traffic, threat) can be stored globally Furthermore, auditors require immutable log records for a minimum of 7 years. How can this complex requirement be met using Strata Logging Service and related Palo Alto Networks capabilities?

Q85. An enterprise is deploying a new containerized application infrastructure, using Kubernetes, exposed via a dedicated load balancer that sits behind a Palo Alto Networks firewall. The security team anticipates a very high, burstable volume of legitimate traffic, but also expects sophisticated HTTP/2-based DoS attacks that exploit the protocol’s multiplexing capabilities and header compression. The firewall needs to detect and mitigate these without impacting legitimate, high-concurrency connections. Given that standard HTTP/I .1 flood protection might be insufficient, what advanced DoS profile configurations should be prioritized for the Palo Alto Networks firewall to protect this environment, assuming HTTP/2 inspection is enabled?

Q86. You are deploying a new application on a Palo Alto Networks firewall and need to create a custom Application (App-ID) for it. The application communicates over TCP port 8443, uses TLS, and sends a specific HTTP header ‘X-App-ID: MyWebApp’ in all its requests. The application also uses a unique URI path structure, To ensure the most accurate and robust App-ID, which custom application signature configuration would be most appropriate?

Q87. Consider a large-scale network migration where an organization is transitioning thousands of physical Palo Alto Networks firewalls to a mix of physical and virtual firewalls, all to be managed by Strata Cloud Manager (SCM). The migration plan involves frequent, scheduled policy updates across different device groups. How can an administrator programmatically automate the policy update process and verify successful deployment for multiple device groups using SCM’s API?

Q88. You are debugging a complex application issue where a server behind a Palo Alto Networks firewall is unable to establish outbound HTTPS connections to specific external APIs, despite a broad security policy allowing HTTPS. Packet captures on the firewall show SYN packets leaving the server’s interface, but no SYN-ACKs are returned from the external API server. The firewall’s session browser shows the session in a ‘PREINIT state for an extended period before eventually aging out. There are no ‘deny’ logs for this traffic. Which of the following is the MOST ADVANCED troubleshooting step to determine where the packets are being dropped or what is delaying the session establishment?

Q89. Consider the following XML configuration snippet for a Palo Alto Networks decryption profile:
yes yes yes block yes
If this ‘CustomDecryptionProfile’ is applied to a security policy, and an internal user attempts to access a legitimate external website whose certificate chain includes an intermediate CA that is not present in the firewall’s trusted CA store, what will be the likely outcome for that connection?