ACE Practice Test

When allowing an Application in a Security policy on a PAN-OS 5.0 device, would a
dependency Application need to also be enabled if the application does not employ HTTP,
SSL, MSRPC, RPC, t.120, RTSP, RTMP, and NETBIOS-SS.

A.

Yes

B.

No

As the Palo Alto Networks administrator, you have enabled Application Block pages.
Afterward, some users do not receive web-based feedback for all denied applications. Why
would this be?

A.

Some users are accessing the Palo Alto Networks firewall through a virtual system that
does not have Application Block pages enabled.

B.

Application Block Pages will only be displayed when Captive Portal is configured

C.

Some Application ID's are set with a Session Timeout value that is too low.

D.

Application Block Pages will only be displayed when users attempt to access a denied
web-based application.

Will an exported configuration contain Management Interface settings?

A.

Yes

B.

No

The "Disable Server Return Inspection" option on a security profile:

A.

Can only be configured in Tap Mode

B.

Should only be enabled on security policies allowing traffic to a trusted server.

C.

Does not perform higher-level inspection of traffic from the side that originated the TCP
SYN packet

D.

Only performs inspection of traffic from the side that originated the TCP SYN-ACK
packet

What are the benefits gained when the "Enable Passive DNS Monitoring" checkbox is
chosen on the firewall? (Select all correct answers.)

A.

Improved DNSbased C&C signatures.

B.

Improved PANDB malware detection

C.

Improved BrightCloud malware detection.

D.

Improved malware detection in WildFire