Given the screenshot, how did the firewall handle the traffic?

1. A. Traffic was allowed by profile but denied by policy as a threat
2. B. Traffic was allowed by policy but denied by profile as..
3. C. Traffic was allowed by policy but denied by profile as ..
4. D. Traffic was allowed by policy but denied by profile as a..

Correct Answer: D

Cortex XDR notifies an administrator about grayware on the endpoints. There are no entries about grayware in any of the logs of the corresponding firewall. Which setting can the administrator configure on the firewall to log grayware verdicts?

1. A. within the log forwarding profile attached to the Security policy rule
2. B. within the log settings option in the Device tab
3. C. in WildFire General Settings, select "Report Grayware Files"
4. D. in Threat General Settings, select "Report Grayware Files"

Correct Answer: C

A company wants to install a PA-3060 firewall between two core switches on a VLAN trunk link. They need to assign each VLAN to its own zone and to assign untagged (native) traffic to its own zone which options differentiates multiple VLAN into separate zones?

1. A. Create V-Wire objects with two V-Wire interfaces and define a range of "0-4096 in the "Tag Allowed" field of the V-Wire object.
2. B. Create V-Wire objects with two V-Wire subinterfaces and assign only a single VLAN ID to the Tag Allowed" field of the V-Wire objec
3. C. Repeat for every additional VLAN and use a VLAN ID of 0 for untagged traffi
4. D. Assign each interface/sub interface to a unique zone.
5. E. Create Layer 3 subinterfaces that are each assigned to a single VLAN ID and a common virtual router.The physical Layer 3 interface would handle untagged traffi
6. F. Assign each interface/subinterface t
7. G. unique zon
8. H. Do not assign any interface an IP address.
9. I. Create VLAN objects for each VLAN and assign VLAN interfaces matching each VLAN I
10. J. Repeat for every additional VLAN and use a VLAN ID of 0 for untagged traffi
11. K. Assign each interface/sub interface to a unique zone.

Correct Answer: B
https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/networking/configure-interfaces/virtual-wire-interfa Virtual wire interfaces by default allow all untagged traffic. You can, however, use a virtual wire to connect two interfaces and configure either interface to block or allow traffic based on the virtual LAN (VLAN) tags. VLAN tag 0 indicates untagged traffic.You can also create multiple subinterfaces, add them into different zones, and then classify traffic according to a VLAN tag or a combination of a VLAN tag with IP classifiers (address, range, or subnet) to apply granular policy control for specific VLAN tags or for VLAN tags from a specific source IP address, range, or subnet.

An engineer is tasked with configuring a Zone Protection profile on the untrust zone. Which three settings can be configured on a Zone Protection profile? (Choose three.)

1. A. Ethernet SGT Protection
2. B. Protocol Protection
3. C. DoS Protection
4. D. Reconnaissance Protection
5. E. Resource Protection

Correct Answer: BCD
* B. Protocol Protection: Protocol protection is used to limit or block traffic that uses certain protocols or application functions. For example, a Zone Protection profile can be configured to block traffic that uses non-standard protocols, such as IP-in-IP, or to limit the number of concurrent sessions for certain protocols, such as SIP.
* C. DoS Protection: DoS protection is used to protect against various types of denial-of-service (DoS) attacks, such as SYN floods, UDP floods, ICMP floods, and others. A Zone Protection profile can be configured to limit the rate of traffic for certain protocols or to drop traffic that matches specific patterns, such as malformed packets or packets with invalid headers.
* D. Reconnaissance Protection: Reconnaissance protection is used to prevent attackers from gathering information about the network, such as by using port scans or other techniques. A Zone Protection profile can be configured to limit the rate of traffic for certain types of reconnaissance, such as port scans or OS fingerprinting, or to drop traffic that matches specific patterns, such as packets with invalid flags or payloads.

Refer to the exhibit.

Based on the screenshots above what is the correct order in which the various rules are deployed to firewalls inside the DATACENTER_DG device group?

1. A. shared pre-rules DATACENTER DG pre rulesrules configured locally on the firewall shared post-rules DATACENTER_DG post-rules DATACENTER.DG default rules
2. B. shared pre-rulesDATACENTER_DG pre-rulesrules configured locally on the firewall shared post-rulesDATACENTER.DG post-rules shared default rules
3. C. shared pre-rules DATACENTER_DG pre-rulesrules configured locally on the firewall DATACENTER_DG post-rules shared post-rulesshared default rules
4. D. shared pre-rules DATACENTER_DG pre-rulesrules configured locally on the firewall DATACENTER_DG post-rules shared post-rules DATACENTER_DG default rules

Correct Answer: A