Which User-ID mapping method should be used in a high-security environment where all IP address-to-user mappings should always be explicitly known?

1. A. PAN-OS integrated User-ID agent
2. B. GlobalProtect
3. C. Windows-based User-ID agent
4. D. LDAP Server Profile configuration

Correct Answer: B

A network engineer troubleshoots a VPN Phase 2 mismatch and decides that PFS (Perfect Forward Secrecy) needs to be enabled.
What action should the engineer take?

1. A. Add an authentication algorithm in the IPSec Crypto profile.
2. B. Enable PFS under the IPSec Tunnel advanced options.
3. C. Select the appropriate DH Group under the IPSec Crypto profile.
4. D. Enable PFS under the IKE gateway advanced options

Correct Answer: D

In SSL Forward Proxy decryption, which two certificates can be used for certificate signing? (Choose two.)

1. A. wildcard server certificate
2. B. enterprise CA certificate
3. C. client certificate
4. D. server certificate
5. E. self-signed CA certificate

Correct Answer: BE
https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/decryption/configure-ssl-forward-proxy.html

An administrator has configured PAN-OS SD-WAN and has received a request to find out the reason for a session failover for a session that has already ended
Where would you find this in Panorama or firewall logs?

1. A. Traffic Logs
2. B. System Logs
3. C. Session Browser
4. D. You cannot find failover details on closed sessions

Correct Answer: D

An administrator discovers that a file blocked by the WildFire inline ML feature on the firewall is a false-positive action. How can the administrator create an exception for this particular file?

1. A. Add partial hash and filename in the file section of the WildFire inline ML tab of the Antivirus profile.
2. B. Set the WildFire inline ML action to allow for that protocol on the Antivirus profile.
3. C. Add the related Threat ID in the Signature exceptions tab of the Antivirus profile.
4. D. Disable the WildFire profile on the related Security policy.

Correct Answer: A