ACE Practice Test

When Destination Network Address Translation is being performed, the destination in the
corresponding Security Policy Rule should use:

A.

The PostNAT destination zone and PostNAT IP address

B.

The PreNAT destination zone and PreNAT IP address.

C.

The PreNAT destination zone and PostNAT IP address.

D.

The PostNAT destination zone and PreNAT IP address.

To properly configure DOS protection to limit the number of sessions individually from
specific source IPs you would configure a DOS Protection rule with the following
characteristics:

A.

Action: Protect, Classified Profile with "Resources Protection" configured, and Classified
Address with "source-ip-only" configured

B.

Action: Deny, Aggregate Profile with "Resources Protection" configured

C.

Action: Protect, Aggregate Profile with "Resources Protection" configured

D.

Action: Deny, Classified Profile with "Resources Protection" configured, and Classified
Address with "source-ip-only" configured

To create a custom signature object for an Application Override Policy, which of the
following fields are mandatory?

A.

Category

B.

Regular Expressions

C.

Ports

D.

Characteristics

The following can be configured as a next hop in a Static Route:

A.

A Policy-Based Forwarding Rule

B.

Virtual System

C.

A Dynamic Routing Protocol

D.

Virtual Router

Which of the following would be a reason to use an XML API to communicate with a Palo
Alto Networks firewall?

A.

So that information can be pulled from other network resources for User-ID

B.

To allow the firewall to push UserID information to a Network Access Control (NAC)
device.

C.

To permit sys logging of User Identification events