Data Center PSE Professional Practice Test

These questions are part of the practice quiz. Start practicing

• Is traffic directed through security chains always bidirectional?
• In AWS, can a firewall be used when connecting two Virtual Private Clouds (VPCs) through VPC peering?
• How many Network Processing Cards (NPCs) does the PA-7050 support?
• If Panorama loses connectivity with Cisco ACI APIC, how many attempts will it make to reconnect before stopping monitoring?
• What configuration is needed for traffic inspection between two VMs on the same hypervisor using Palo Alto Networks NGFW without NSX?
• In which section of the SLR would you find information to confirm concerns about high bandwidth consumption from YouTube during work hours?
• Can permissions for AWS Managed Policies be changed by users?
• Which identifiers can PBR use to forward traffic to the firewall?
• Which two layers are found in a container?
• If authentication to the EDL fails, what happens to the security policy?
• Which type of Ethernet interfaces are supported by all NGFW models?
• Prisma Cloud Advanced Threat Protection (TATP) is delivered to your installation via which feature?
• A company moving as much of its business as possible into Amazon AWS is trying to minimize which parameter(s)?
• Which edition of Prisma Cloud is a SaaS offering hosted by PANW?
• What is the primary role of Contracts in Cisco ACI?
• How many virtual network interfaces does a VM-Series firewall need when deployed on NSX?
• What criteria must the compute node housing the VM-Series meet in OpenStack? (Select all that apply)
• Which method can easily scale to tens of firewalls to increase uptime?
• Which format do you use for an AWS Cloud Formation Template?
• What is the maximum number of endpoints that Panorama can support with 8GB/16GB?
• What routing protocol is used by the NGFW to peer with border-leaf switches in a North/South ACI deployment?
• What native plugin does Prisma Cloud Compute use with CI/CD tools?
• What is one of the main advantages of using Prisma Cloud over traditional security measures?
• Which HEAT template file defines the environment for the VM-Series firewall?
• What does HA stand for in the context of clustering?
• What must a service definition include for the VM-Series firewalls in an ESXi cluster?
• Which options counts as a single workload in AWS?
• What functionality can the auxiliary SFP+ ports on the PA-5200 series be configured for?
• Which firewall, if any, supports only a single power supply?
• For security reasons, can a firewall only be bootstrapped when it is in factory default state?
• In an ESXi installation, which interface is not used for micro-segmentation?
• According to best practices, what does Palo Alto Networks recommend regarding EDLs?
• How many aggregate groups can a Palo Alto Networks firewall support?
• What is required for traffic load balancing in A/A HA configurations?
• With NSX, which components must Panorama connect to?
• Defender connects to Console via websocket over which port to retrieve policies and send data?
• Which NGFW model supports 100Gbps SQFP28?
• Does traditional high availability incur more costs than resilience on the public cloud, and if so, why?
• How many nodes can each CN-MGMT service/pair secure?
• What product monitors vendor configuration to alert when resource changes occur?
• What service is in charge of telemetry on OpenStack?
• Within the HEAT template, which file defines resources for the VM-Series firewall and Linux server?
• Which Microsoft Azure component is used to support firewall high availability?
• What type of traffic would you configure for Layer 2 interfaces on a firewall?
• Which Microsoft Azure load balancing option resolves the same hostname to different IP addresses?
• What is the purpose of the Defender agent in Prisma Compute?
• Does the APIC support inserting L4 - L7 devices in the data center?
• What governs the interaction of Endpoint Groups in Cisco ACI?
• Which component is responsible for handling auto-scaling policies in OpenStack?
• In the context of NGFW and ACI, how is traffic handled when it matches certain security policies?
• Which statement about containers is correct?
• Does vRealize Network Insight help design security groups and firewall rules for network and security teams?
• What kind of firewall is the NSX Distributed Firewall described as?
• What advantage does using dedicated HA interfaces on the management plane provide?
• What does the '4D Model' address in Prisma Cloud?
• How many data network interfaces does the low-end model of the NGFW feature?
• Which Microsoft Azure load balancing option supports UDP when the client has a hard-coded IP address for the hostname?
• Does the PAN-AIRDUCT kit increase the rack unit (RU) size from 9U to 14U?
• What is IronSkillet used for in Palo Alto Networks devices?
• Which statement is true regarding an auto scaling Palo Alto Networks NGFW deployment in AWS?
• What is the primary function of Cortex XDR?
• When deploying the Palo Alto Networks NGFW on NSX, what is the order of modules packets go through when coming to an application VM from VMs on different hardware?
• What does the Cisco Application Policy Infrastructure Controller (APIC) provide for managing the network?
• Prisma Cloud workload consumption is measured using a how many days rolling average?
• Cisco ACI can redirect traffic between security zones without making the firewall or load balancer the default gateway. Is this statement true or false?
• Which model is available on ESXi but is not supported for NSX use?
• What is required for centralized security management as per the Palo Alto Networks system?
• What is the purpose of out-of-band tests?
• Is active/active HA supported in all interface modes?
• What is required in NSX deployments to manage the NSX-V Manager and ESXi hosts?
• Which demonstration tool should you use to address a customer's needs with an unusual environment? (Choose the most complete answer.)
• What file format is used for defining the configuration of the VM-Series firewall on OpenStack?
• What primary function does the Azure Load Balancer serve?
• In which scenario would in-band testing NOT be appropriate?
• What must be accepted by the compute node to run the VM-Series firewall effectively?
• Which option enables the lowest possible false positive rates in Prisma Cloud Compute?
• What is your best option regarding the content directory in a bootstrap template for a firewall?
• In what context does Palo Alto Networks work with Cisco ACI?
• If all the virtual machines on an ESXi host belong in the same zone, should you install VM-Series? If so, why?
• What type of analysis does vRealize Network Insight provide in relation to east-west traffic?
• In Cisco ACI, Endpoint Groups can consist of members that are either static or dynamic. Is this statement true or false?
• What type of deployment model does Prisma Cloud Compute Edition utilize?
• After installing the Palo Alto Networks NGFW, which virtual machine in Microsoft Azure will have a public IP address?
• What is a primary benefit of using Auto Scaling in AWS for Palo Alto Networks firewalls?
• What does the Prisma Cloud Intelligence Stream provide?
• Which licensed feature is required for NSX?
• Which component is responsible for networking in OpenStack?
• How does NSX-V Manager update Panorama when a guest is added or modified in the ESXi cluster?
• What is the function of the NSX Distributed Firewall in relation to VM-Series?
• When a stats dump file is attempted to be generated, the firewall by default takes data from the last how many days?
• A hospital has a huge health information management application. Which environment is least likely to be placed on a public cloud?
• Can Palo Alto Networks firewalls monitor security chains for effective traffic processing?
• On each firewall model, what is the maximum number of custom EDLs you can add with unique sources?
• What does the "G" signify in PA-7000 G Network Processing Cards?
• Is Panorama designed to be an orchestrator for Kubernetes cluster deployment and management?
• True or False: The NSX Manager is not required for Panorama to function effectively.
• What port is used for a VM-Series firewall management interface to communicate with Panorama?
• What actions are available when offloading traffic from the NGFW using Arista MSS?
• Which kind of PAYG license does the Palo Alto Networks NGFW support with Azure?
• How do you integrate north/south or east/west traffic into the NGFW in Cisco ACI?
• What type of attack might the Palo Alto Networks security platform be unable to stop?
• Which object type cannot have tags?
• Is the Panorama plugin a required component for NSX-V architecture?
• What type of data does Advanced Threat Protection (TATP) primarily utilize?
• What is the relationship between the northbound and southbound interfaces in NSX-T?
• What is the maximum threat prevention VPN bandwidth supported by a single NGFW?
• What integration is leveraged by Palo Alto Networks with Nutanix?
• What type of traffic can the HSCI port be used for in HA configurations?
• What is an advantage of using SaaS for an enterprise?
• How can one explain to a customer that their existing firewall may be inadequate?
• Where do you create Dynamic Address Groups when deploying the Palo Alto Networks NGFW on NSX?
• Arista MSS is designed specifically for which type of workloads?
• Before activating the support or feature license on an ESXi deployment, what must be applied?
• How many security chains can a single firewall distribute decrypted sessions among?
• A company moving as much of its business as possible into Microsoft Azure is trying to minimize which parameter(s)?
• What is a key feature of Prisma Compute for serverless deployments?
• When securing an AWS EC2 service directly with Palo Alto Networks NGFW, which component is responsible for address translation?
• Using which two metrics gathered by Celiometer does OpenStack manage VM-Series firewall instances?
• In a Microsoft Azure VNet with the IP network 10.0.0.0/16, what is a valid IP address for the Palo Alto Networks NGFW’s management interface?
• Who provides the security policy for the NGFW when using Cisco ACI?
• What types of IP addresses can be assigned to the management interface during AWS bootstrapping?
• An online retailer uses a hybrid cloud to handle burst capacity. Which part of the application is most likely to be sent to the public cloud during a demand peak?
• Is decryption port mirroring available on VM-Series for public cloud platforms?
• What is the maximum number of TCP/IP sessions per CN-NGFW?
• Which interface modes does HA Clustering support?
• What types of networks are supported with a decryption broker?
• Is it possible to configure backup links for the HA3 link in A/A HA deployments?
• Which devices can use a Dynamic Address Group with Panorama?
• What type of interface is supported in NSX-V?
• Is HA (A/P) supported for the VM-Series firewall on Google Cloud Platform?
• When deploying the Palo Alto Networks NGFW on NSX, do packets from an application VM go through the NSX firewall?
• On the PA-7000 series, how many additional instances of the PAN-OS dataplane does each DPC add?
• Can the Palo Alto Networks NGFW enforce the restriction of executable sharing in a virtual machine configured as a file server?
• What is the limit enforced for the number of IP addresses per list with EDLs?
• Which formats can AWS Cloud Formation Templates be in?
• Which feature of PA firewalls enhances synchronization between HA peers?
• How can you automate a VM-Series deployment on NSX-V?
• What are two reasons for enabling micro-segmentation in the data center? (Choose two.)
• What are the four component directories of a Palo Alto Networks bootstrap container?
• Is it necessary for the management interface to access the S3 bucket during VM-Series bootstrapping on AWS?
• What tool does VMware offer to help enable micro-segmentation in data centers?
• How does Prisma Cloud approach workload protection?
• Where are steering rules applied for NSX?
• Which Cisco ACI concept is analogous to access control lists (ACLs)?
• What are the contexts on Palo Alto Networks firewalls referred to when integrated into Cisco ACI?
• Which two HTTP actions are available with automation on the NGFW? (Choose two.)
• Which type of behavioral model does Prisma Cloud Compute runtime defense use to create alerts?
• What do in-band tests measure in the context of firewalls?
• With Prisma Cloud, billable workloads are calculated on the average number of workloads monitored during which timeframe?
• What deployment mode should be used for an NGFW connected between an existing firewall and a core switch to reduce intrusiveness?
• True or False: The last parameter to the twistcli command can have options listed after the image name.
• Which Palo Alto Networks feature is part of the network security offering in cloud deployments?
• How many hops does the redistribution sequence require to aggregate all User-ID information?
• During deployment, how does IronSkillet benefit Palo Alto Networks devices?
• Can Prisma Cloud scan container images in both public and private repositories?
• What is a workload for Prisma Cloud licensing?
• A customer needs a firewall with forty 1Gbps Ethernet data ports and seven QSFP+ data ports. Which firewall should be recommended?
• Which of the following is a characteristic of the PA-7050 firewall?
• Which network configuration allows multiple servers to connect without needing individual network information?
• True or False: User-ID data redistribution can be unidirectional or bidirectional.
• When creating custom vulnerability threat signatures, what is the threat-id range?
• What technology does Prisma Cloud Compute leverage to protect against container breakout exploits?
• What is the maximum number of APIC Clusters that Panorama can support?
• What is a bridge domain in Cisco ACI?
• How does Arista MSS determine which traffic should be sent to the NGFW for inspection?
• What is the minimum recommended number of controllers for a Cisco APIC cluster?
• Which type of cloud service can be protected by a firewall controlled by the organization rather than by the cloud provider?
• In ACI, which mode are the NGFW's interfaces always in?
• Which technology does not apply to securing a data center?
• What is one of the main components that Prisma Cloud utilizes for threat intelligence?
• When creating a new tag on the firewall or Panorama, where is the tag automatically created?
• Prisma Cloud software consists of two components: Console and Defender. (True or False)
• What is the maximum App-ID throughput for the PA-7050?
• Which tool do you use to convert a statdump file to an SLR report?
• From a threat prevention perspective, can you define a combination signature for brute force attacks?
• In which stage of the sales process is an Ultimate Test Drive (UTD) useful?
• Which component implements the steering rules when deploying the Palo Alto Networks NGFW on NSX?
• Each object can have up to how many Tags?
• True or False: Panorama can normalize metadata for workloads in public cloud environments using Panorama plugins.
• True or False: Each firewall or Panorama management server can receive user-id data from up to 100 redistribution points.
• How many kernels do 10 containers running on a Linux host require?
• What is essential for maintaining high availability in Azure firewalls?
• What is not an advantage of using Panorama?
• What are two business cases for enabling multi-factor authentication? (Choose two.)
• How are firewalls deployed in ACI?
• Which method allows dynamic service insertion in Cisco ACI?
• What modules are included in the Prisma Cloud Enterprise Edition?
• Can service devices be flexibly placed between physical and virtual workloads in Arista MSS?
• What must be configured for Cisco ACI APIC fabric to enable Panorama to retrieve endpoint IP-address-to-tag-mapping information?
• What is the primary function of a contract in Cisco ACI?
• What three principles does microsegmentation leverage to provide consistent security across data centers and hybrid cloud platforms?
• Can aggregate interfaces be configured as an HA3 link in A/A HA deployments on certain PA firewall series?
• What role does Panorama play in Cisco ACI management?
• Which feature provided by AWS enables Automated Remediation?
• What is the default behavior for traffic load balancing in A/A HA configurations?
• Which of the following is a true statement about the PA-7050's Log Processing Cards?
• Where are steering rules defined for NSX?
• What is the purpose of the NSX Service Composer?
• Do dynamic user groups support auto-tagging from HIP Match logs?
• What are the options for the number of cores used by a Palo Alto Networks NGFW virtual that supports NSX?
• In Prisma Cloud Compute Edition, how is multi-tenancy supported?
• Which feature of OpenStack influences service scaling based on traffic metrics?
• Which kind of pay-as-you-go (PAYG) license does the Palo Alto Networks NGFW support with AWS?
• For communication requirements between an application server, a database VM, and a web server VM, can the Palo Alto Networks NGFW be used to restrict the web server's access to the database VM?
• Which object allows you to apply the same contract EPGs dynamically?
• Which deployment environment is compatible with Palo Alto Networks micro-segmentation?
• What is the function of the Tier-0 Logical Router in NSX-T?
• Which capacity license do you get with a usage-based license on Azure?
• In a Layer 3 interface deployment with active/active HA configuration, when should ARP load-sharing be used?
• How long is a container lifecycle?
• Which component is essential for Prisma Cloud to function effectively in cloud environments?
• Which feature differentiates a Layer 3 firewall from Layer 2 firewalls?
• After NSX-V auto deploys a firewall, what connects the hypervisor to the firewall so it can retrieve traffic?
• Can a Palo Alto Networks NGFW, when deployed on ESXi without NSX, function as a Layer 2 (Ethernet) firewall?
• What can CloudWatch do to improve traffic management?
• Which component defines steering rules when deploying the Palo Alto Networks NGFW on NSX?
• Which two partners provide part of the environment for the NGFW running on OpenStack?
• Dynamic Address Groups in a Palo Alto Networks NGFW deployment on NSX utilize tags created on which system?
• To ensure that traffic from the guests is steered to the VM-Series firewall, what must be installed on each guest?
• Which two reasons could prevent vNet peering in Azure?
• The AWS deployment you have designed requires a VM-Series firewall of a minimal size. Which option can you use?
• What is the current support limitation of Prisma Cloud Labs compliance checks for serverless functions?
• Is it true that deploying the VM-Series firewall through service chaining is not supported on OpenStack Queens?
• What is the service called for the VM-Series on NSX-V Manager?
• Is it true that no limits are placed on the number of EDLs?
• Which Cisco ACI concept allows the integration of Layer 4 - Layer 7 devices into the traffic flow without the device being the default gateway for servers?
• Which components directly address the inner interface in the Prisma Cloud Enterprise edition?
• Does traditional HA (A/P) support exist when deploying the firewall with Amazon Elastic Load Balancing (ELB)?
• In an Azure deployment, which Palo Alto Networks firewall feature is an enabler of micro-segmentation?
• Which operating system do you select to use for a Palo Alto Networks NGFW running in Microsoft Azure?
• Which interface mode do you use to generate the statdump file that can be converted into an SLR for unobtrusive evaluation?
• What is the function of ARP load-sharing in active/active HA configurations?
• For a cluster of 120 nodes in the CN-Series, how many CN-MGMT pods are required?
• Which network configuration is needed in the firewall at the exit to the internet?
• What is responsible for orchestration in OpenStack?
• Which of the following is not a UTD provided by Palo Alto Networks?
• Which defines the firewall device cluster that you insert into the traffic flow between EPGs in Cisco ACI?
• What does VMware NSX-T logical switching enable?
• What parameter is essential for the compute flavor in OpenStack while deploying the VM-Series?
• Is an IP set, such as an IP range or subnet, considered as a single registered IP address?
• What is the maximum number of sessions that a PA-7000 20G Network Processing Card can support?
• What type of firewall function does the term 'stateful' refer to?
• Can you use a port filter firewall to implement a setup where one VM accesses a DNS server and another VM is prevented from accessing the web server?
• With EDLS, what does the firewall do if the web server is unreachable?
• Which model is not supported for ESXi use?
• What is the hosting environment of the Prisma Cloud Compute Edition?
• What do Panorama and NSX-V Manager use for registering the Palo Alto Networks NGFW service?
• How can you connect a Virtual Private Cloud (VPC) to your internal network while keeping your data secure in AWS?
• In the twistcli command, the last parameter should be which of the following?
• How many Log Processing Cards (LPCs) can you install on a PA-7050 and PA-7080?
• Can dynamic address groups include statically defined address objects?
• Each registered IP address can have up to how many tags?
• What interface is referred to as the inner management interface in Prisma Cloud Enterprise Edition?
• Which Palo Alto Networks product directly protects corporate laptops when used from home?
• What is the maximum IPsec VPN bandwidth supported by a single NGFW?
• Does bootstrapping a firewall require entering it in a specific state for initial configuration?
• What version of PAN-OS is the starting point for VM-Series firewall pricing based on the number of vCPUs and other factors?
• In Cisco ACI, a single firewall or two firewalls deployed as an HA pair are configured as a ________.
• What are key features of the NSX-V Manager?
• What type of traffic does a bridge domain in Cisco ACI primarily manage?
• When bootstrapping a firewall, is it necessary to include the VM Auth Key in the basic configuration file if Panorama is to manage the firewalls?
• What specifies the connectivity policy between vSphere and the ACI fabric?
• How many weeks in advance should you schedule a UTD in the system?