Palo Alto Networks Systems Engineer (PSE): Software Firewall Professional PSE-SoftwareFirewall Exam Questions
Page: 1 / 14 Total 65 questions
Want more questions? Get Premium Access. ()
Question 1
Which component allows the flexibility to add network resources but does not require making changes to existing policies and rules?
Answer : C
Dynamic address groups in Palo Alto Networks firewalls provide flexibility by allowing network resources to be added without requiring changes to existing policies and rules:
Dynamic address group: These groups automatically update based on tags and attributes assigned to network objects. When new resources are added with the appropriate tags, they are dynamically included in the address group, and the associated policies automatically apply to them without manual intervention.
Question 2
Which two mechanisms could trigger a high availability (HA) failover event? (Choose two.)
Answer : A, B
Ping monitoring:
This mechanism involves monitoring the reachability of a specified IP address. If the firewall cannot ping the address, it may trigger a failover.
PAN-OS Administrator's Guide - HA
Link monitoring:
Link monitoring checks the status of network links. If a monitored link fails, an HA failover can be triggered.
PAN-OS High Availability Link Monitoring
Question 3
What are two requirements for automating service deployment of a VM-Series firewall from an NSX Manager? (Choose two.)
Answer : A, C
For automating the deployment of VM-Series firewalls from NSX Manager, Panorama must be configured to recognize and communicate with both the NSX Manager and vCenter. This ensures that Panorama can manage the firewall policies and orchestration efficiently.
Palo Alto Networks NSX Integration Guide
VM-Series Firewall Communication with Panorama:
It is crucial that the deployed VM-Series firewall can establish communication with Panorama. This connection allows for the centralized management of the firewalls and ensures that policy updates and configurations can be pushed from Panorama to the VM-Series firewalls.
Palo Alto Networks VM-Series Deployment Guide
Question 4
What are two environments supported by the CN-Series firewall? (Choose two.)
Answer : A, C
OpenShift:
The CN-Series firewall supports deployment in Red Hat OpenShift environments. OpenShift is a Kubernetes-based container platform that provides a comprehensive solution for container orchestration.
Palo Alto Networks CN-Series Deployment Guide
Native K8:
The CN-Series firewall is designed to be deployed in native Kubernetes (K8s) environments, providing security for containerized applications running within the Kubernetes clusters.
Palo Alto Networks CN-Series Deployment Guide
Question 5
Which two deployment modes of VM-Series firewalls are supported across NSX-T? (Choose two.)
Answer : B, C
Service Cluster Mode:
In NSX-T, the Service Cluster mode allows the VM-Series firewalls to be deployed as part of a service cluster, where they can provide security services to workloads.
Palo Alto Networks NSX-T Integration Guide
Host-based Mode:
Host-based mode involves deploying the VM-Series firewalls directly on the host machines within the NSX-T environment. This allows for direct integration and security enforcement on the host level.
Palo Alto Networks NSX-T Integration Guide
Question 6
What can software next-generation firewall (NGFW) credits be used to provision?
Answer : A
Software next-generation firewall (NGFW) credits can be used to enable DNS security on Palo Alto Networks firewalls. These credits allow customers to activate DNS Security service, which provides real-time protection against DNS-based threats by leveraging machine learning and continuous analysis.
Which two design options address split brain when configuring high availability (HA)? (Choose two.)
Answer : B, D
Using the Heartbeat Backup:
The heartbeat backup is a mechanism that helps to prevent split-brain scenarios in a high availability (HA) configuration by providing an additional path for heartbeat communication. This ensures that both firewalls in the HA pair are aware of each other's status.
Palo Alto Networks HA Configuration Guide
Adding a Backup HA1 Interface:
Configuring a backup HA1 interface provides redundancy for the primary HA1 link, ensuring continued communication between HA peers even if the primary link fails. This setup is crucial for maintaining synchronization and preventing split-brain scenarios.
All Official Question Types