A company has configured a URL Filtering profile with override action on their firewall. Which two profiles are needed to complete the configuration? (Choose two)

1. A. SSUTLS Service
2. B. HTTP Server
3. C. Decryption
4. D. Interface Management

Correct Answer: AD

An existing NGFW customer requires direct interne! access offload locally at each site and iPSec connectivity to all branches over public internet. One requirement is mat no new SD-WAN hardware be introduced to the environment.
What is the best solution for the customer?

1. A. Configure a remote network on PAN-OS
2. B. Upgrade to a PAN-OS SD-WAN subscription
3. C. Deploy Prisma SD-WAN with Prisma Access
4. D. Configure policy-based forwarding

Correct Answer: B

What are three reasons for excluding a site from SSL decryption? (Choose three.)

1. A. the website is not present in English
2. B. unsupported ciphers
3. C. certificate pinning
4. D. unsupported browser version
5. E. mutual authentication

Correct Answer: BCE
Reasons that sites break decryption technically include pinned certificates, client authentication, incomplete certificate chains, and unsupported ciphers.
https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/decryption/decryption-exclusions/exclude-a-server

A network security administrator has an environment with multiple forms of authentication. There is a network access control system in place that authenticates and restricts access for wireless users, multiple Windows domain controllers, and an MDM solution for company-provided smartphones. All of these devices have their authentication events logged.
Given the information, what is the best choice for deploying User-ID to ensure maximum coverage?

1. A. Syslog listener
2. B. agentless User-ID with redistribution
3. C. standalone User-ID agent
4. D. captive portal

Correct Answer: C

Before an administrator of a VM-500 can enable DoS and zone protection, what actions need to be taken?

1. A. Measure and monitor the CPU consumption of the firewall data plane to ensure that each firewall is properly sized to support DoS and zone protection
2. B. Create a zone protection profile with flood protection configured to defend an entire egress zone against SY
3. C. ICMP ICMPv6, UD
4. D. and other IP flood attacks
5. E. Add a WildFire subscription to activate DoS and zone protection features
6. F. Replace the hardware firewall because DoS and zone protection are not available with VM-Series systems

Correct Answer: A
* 1 https://docs.paloaltonetworks.com/best-practices/8-1/dos-and-zone-protection-best-practices/dos-and-zone-prote
* 2 https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/zone-protection-and-dos-protection/zone-defense/ta
https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/zone-protection-and-dos-protection.html