A Security Profile can block or allow traffic at which point?

1. A. after it is matched to a Security policy rule that allows traffic
2. B. on either the data plane or the management plane
3. C. after it is matched to a Security policy rule that allows or blocks traffic
4. D. before it is matched to a Security policy rule

Correct Answer: A

You must configure which firewall feature to enable a data-plane interface to submit DNS queries on behalf of the control plane?

1. A. Admin Role profile
2. B. virtual router
3. C. DNS proxy
4. D. service route

Correct Answer: A

Given the image, which two options are true about the Security policy rules. (Choose two.)

1. A. The Allow Office Programs rule is using an Application Filter
2. B. In the Allow FTP to web server rule, FTP is allowed using App-ID
3. C. The Allow Office Programs rule is using an Application Group
4. D. In the Allow Social Networking rule, allows all of Facebook’s functions

Correct Answer: AD
In the Allow FTP to web server rule, FTP is allowed using port based rule and not APP-ID.

Which data-plane processor layer of the graphic shown provides uniform matching for spyware and vulnerability exploits on a Palo Alto Networks Firewall?

1. A. Signature Matching
2. B. Network Processing
3. C. Security Processing
4. D. Security Matching

Correct Answer: A

What must be considered with regards to content updates deployed from Panorama?

1. A. Content update schedulers need to be configured separately per device group.
2. B. Panorama can only install up to five content versions of the same type for potential rollback scenarios.
3. C. A PAN-OS upgrade resets all scheduler configurations for content updates.
4. D. Panorama can only download one content update at a time for content updates of the same type.

Correct Answer: D

Reference:https://docs.paloaltonetworks.com/panorama/9-1/panorama-admin/manage-licenses-and-updates/deploy-updates-to-firewalls-log-collectors-and-wildfire-appliances-using-panorama/schedule-a-content-update-using-panorama.html