Check the Available PSE-Strata Exam Dumps with 224 QA's UPDATED 2023
Download PSE-Strata Exam Dumps Questions to get 100% Success in Palo Alto Networks
NEW QUESTION # 54
Which CLI command will allow you to view latency, jitter and packet loss on a virtual SD-WAN interface?
A)
B)
C)
D)
- A. Option
- B. Option
- C. Option
- D. Option
Answer: D
Explanation:
https://docs.paloaltonetworks.com/sd-wan/1-0/sd-wan-admin/troubleshooting/use-cli-commands-for-sd-wan-tasks.html
NEW QUESTION # 55
Which three categories are identified as best practices in the Best Practice Assessment tool?
(Choose three.)
- A. expose the visibility and presence of command-and-control sessions
- B. measure the adoption of URL filters, App-ID, User-ID
- C. identify sanctioned and unsanctioned SaaS applications
- D. use of device management access and settings
- E. use of decryption policies
Answer: B,C,E
NEW QUESTION # 56
You have a prospective customer that is looking for a way to provide secure temporary access to contractors for a designated period of time. They currently add contractors to existing user groups and create ad hoc policies to provide network access. They admit that once the contractor no longer needs access to the network, administrators are usually too busy to manually delete policies that provided access to the contractor. This has resulted in over-provisioned access that has allowed unauthorized access to their systems.
They are looking for a solution to automatically remove access for contractors once access is no longer required.
You address their concern by describing which feature in the NGFW?
- A. Dynamic User Groups
- B. External Dynamic Lists
- C. Dynamic Address Groups
- D. Multi-factor Authentication
Answer: A
NEW QUESTION # 57
A customer is designing a private data center to host their new web application along with a separate headquarters for users.
Which cloud-delivered security service (CDSS) would be recommended for the headquarters only?
- A. WildFire
- B. Threat Prevention
- C. DNS Security
- D. Advanced URL Filtering (AURLF)
Answer: B
NEW QUESTION # 58
What three Tabs are available in the Detailed Device Health on Panorama for hardware-based firewalls? (Choose three.)
- A. Errors
- B. Mounts
- C. Throughput
- D. Status
- E. Sessions
- F. Environments
- G. Interfaces
Answer: E,F,G
Explanation:
https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-web-interface-help/panorama-web- interface/panorama-managed-devices-summary/detailed-device-health-in-panorama.html
NEW QUESTION # 59
Which Palo Alto Networks security component should an administrator use to and NGFW policies to remote users?
- A. Threat intelligence Cloud
- B. Cortex XDR
- C. GlobalProtect
- D. Prisma SaaS API
Answer: C
NEW QUESTION # 60
What are two advantages of the DNS Sinkholing feature? (Choose two.)
- A. It can be deployed independently of an Anti-Spyware Profile.
- B. It monitors DNS requests passively for malware domains.
- C. It can work upstream from the internal DNS server.
- D. It forges DNS replies to known malicious domains.
Answer: C,D
Explanation:
https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/threat-prevention/dns-sinkholing
NEW QUESTION # 61
In PAN-OS 10.0 and later, DNS Security allows policy actions to be applied based on which three domains? (Choose three.)
- A. command and control (C2)
- B. government
- C. grayware
- D. benign
- E. malware
Answer: C,D,E
NEW QUESTION # 62
A customer with a fully licensed Palo Alto Networks firewall is concerned about threats based on domain generation algorithms (DGAS).
Which Security profile is used to configure Domain Name Security (DNS) to Identity and block previously unknown DGA-based threats in real time?
- A. Anti-Spyware profile
- B. URL Filtering profile
- C. Vulnerability Protection profile
- D. WildFire Analysis profile
Answer: A
NEW QUESTION # 63
Which three settings must be configured to enable Credential Phishing Prevention? (Choose three.)
- A. validate credential submission detection
- B. define an SSL decryption rulebase
- C. enable User-ID
- D. define URL Filtering Profile
- E. Enable App-ID
Answer: A,C,D
Explanation:
https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/threat-prevention/prevent-credential- phishing.html
NEW QUESTION # 64
Which two configuration items are required when the NGFW needs to act as a decryption broker for multiple transparent bridge security chains? (Choose two.)
- A. a unique Decryption policy rule is required per security chain
- B. a single pair of decryption forwarding interfaces
- C. a unique Transparent Bridge Decryption Forwarding Profile to a single Decryption policy rule
- D. dedicated pair of decryption forwarding interfaces required per security chain
Answer: A,C
NEW QUESTION # 65
The ability to prevent users from resolving internet protocol (IP) addresses to malicious, grayware, or newly registered domains is provided by which Security service?
- A. WildFire
- B. Threat Prevention
- C. DNS Security
- D. loT Security
Answer: C
NEW QUESTION # 66
When log sizing is factored for the Cortex Data Lake on the NGFW, what is the average log size used in calculation?
- A. 8MB
- B. 18 bytes
- C. depends on the Cortex Data Lake tier purchased
- D. 1500 bytes
Answer: D
NEW QUESTION # 67
Which two products are included in the Prisma Brand? (Choose two.)
- A. Panorama
- B. Prisma Cloud Enterprise
- C. NGFW
- D. Prisma Cloud Compute
Answer: B,D
Explanation:
https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin- compute/welcome/pcee_vs_pcce.html
NEW QUESTION # 68
Which methods are used to check for Corporate Credential Submissions? (Choose three.)
- A. IP User Mapping
- B. Domain Credential Filter
- C. Group Mapping
- D. User ID Credential Check
- E. LDAP query
Answer: A,B,C
Explanation:
https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/threat-prevention/prevent-credential- phishing/methods-to-check-for-corporate-credential-submissions.html#id29eff481-13de-45b9- b73c-83e2e932ba20
NEW QUESTION # 69
A customer is concerned about malicious activity occurring directly on their endpoints and not visible to their firewalls.
Which three actions does Traps execute during a security event beyond ensuring the prevention of this activity? (Choose three.)
- A. Remediates the event by deleting the malicious file
- B. Collects forensic information about the event
- C. Communicates the status of the endpoint to the ESM
- D. Informs WildFire and sends up a signature to the Cloud
- E. Notifies the user about the event
Answer: B,C,E
Explanation:
https://investors.paloaltonetworks.com/node/11156/html
NEW QUESTION # 70
A customer is concerned about malicious activity occurring directly on their endpoints and will not be visible to their firewalls.
Which three actions does the Traps agent execute during a security event, beyond ensuring the prevention of this activity? (Choose three.)
- A. Remediates the event by deleting the malicious file
- B. Collects forensic information about the event
- C. Communicates the status of the endpoint to the ESM
- D. Informs WildFire and sends up a signature to the Cloud
- E. Notifies the user about the event
Answer: B,C,E
NEW QUESTION # 71
What is the correct behavior when a Palo Alto Networks next-generation firewall (NGFW) is unable to retrieve a DNS verdict from DNS service cloud in the configured lookup time?
- A. NGFW discard a response from the DNS server.
- B. NGFW permit a response from the DNS server.
- C. NGFW resend a verdict challenge to DNS service cloud.
- D. NGFW temporarily disable DNS Security function.
Answer: B
Explanation:
https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/threat-prevention/dns- security/enable-dns-security
NEW QUESTION # 72
The Palo Ao Networks Cloud Identity Engino (CIE) includes which service that supports identity Providers (ldP)?
- A. Directory Sync and Cloud Authentication Service that support IdP using SAML 2.0 and OAuth2
- B. Cloud Authentication Service that supports IdP using SAML 2.0 and OAuth2
- C. Directory Sync that supports IdP using SAML 2.0
- D. Directory Sync and Cloud Authentication Service that support IdP using SAML 2.0
Answer: D
Explanation:
The Cloud Identity Engine consists of two components: Directory Sync, which provides user information, and the Cloud Authentication Service, which authenticates users. For a more comprehensive identity solution, Palo Alto Networks recommends using both components, but you can configure the components independently.
NEW QUESTION # 73
Which two methods will help avoid Split Brain when running HA in Active/Active mode? (Choose two.)
- A. Create a loopback IP address and use that as a Source Interface
- B. Place your management interface in an Aggregate Interface Group configuration
- C. Configure a Backup HA1 Interface
- D. Configure a Heartbeat Backup
Answer: C,D
Explanation:
https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/high-availability/set-up-activeactive-ha/configure-activeactive-ha.html
NEW QUESTION # 74
What are the two group options for database when creating a custom report? (Choose two)
- A. SQL
- B. Detailed Logs
- C. Oracle
- D. Summary Databases
Answer: B,D
NEW QUESTION # 75
Which statement is true about Deviating Devices and metrics?
- A. Deviating Device Tab is only available for hardware-based firewalls
- B. Deviating Device Tab is only available with a SD-WAN Subscription
- C. A metric health baseline is determined by averaging the health performance for a given metric over seven days plus the standard deviation
- D. An Administrator can set the metric health baseline along with a valid standard deviation
Answer: C
Explanation:
https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-web-interface-help/panorama-web-interface/panorama-managed-devices-summary/panorama-managed-devices-health.html
NEW QUESTION # 76
Select the BOM for the Prisma Access, to provide access for 5500 mobile users and 10 remote locations (100Mbps each) for one year, including Base Support and minimal logging. The customer already has 4x PA5220r 8x PA3220,1x Panorama VM for 25 devices.
- A. 5500x PAN-GPCS-USER-C-BAS-1YR, 1000x PAN-GPCS-NET-B-BAS-1YR, 1x PAN-LGS-1TB-
1YR - B. 1x PAN-GPCS-USER-C-BAS-1YR, 1x PAN-GPCS-NET-B-BAS-1YR, 1x PAN-LGS-1TB-1YR
- C. 5500x PAN-GPCS-USER-C-BAS-1YR, 1000x PAN-GPCS-NET-B-BAS-1YRr 1x PAN-LGS-1TB-
1YR, 1x PAN-PRA-25, 1x PAN-SVC-BAS-PRA-25 - D. 5500x PAN-GPCS-USER-C-BAS-1YR, 1000x PAN-GPCS-NET-B-BAS-1YR, 1x PAN-SVC-BAS- PRA-25. 1x PAN-PRA-25
Answer: C
NEW QUESTION # 77
A network covers three geographical areas: Americas, Europe (EMEA), and Asia (APAC). The APAC segment of the network consists of nine HA pairs of PA-3060 firewalls, generating a combined log output of 25 K logs per second. Only 14 days of traffic log retention is required.
Which management and logging solution will be effective and cost-efficient for this segment of the network?
- A. Two M-500s in HA management at the global level, and one log collector-mode M-500 with 8 TB of storage for APAC
- B. Two M-500s in HA management at the global level, with one M-100 with 4 TB of storage for APAC
- C. Two Dual-mode M-500s in HA for both global management and storage. Each M-500 has 8 TB of storage
- D. Two M-500s in HA management at the global level, and two log collector-mode M-500s in a log collector group with 16 TB of storage for APAC
Answer: D
NEW QUESTION # 78
What are three purposes for the Eval Systems, Security Lifecycle Reviews and Prevention Posture Assessment tools? (Choose three.)
- A. when client's want to see the power of the platform
- B. when you're delivering a security strategy
- C. help streamline the deployment and migration of NGFWs
- D. provide users visibility into the applications currently allowed on the network
- E. assess the state of NGFW feature adoption
Answer: A,D,E
NEW QUESTION # 79
......
Palo Alto Networks PSE-Strata Exam is an essential certification for professionals who want to demonstrate their knowledge and skills in network security and become a Palo Alto Networks System Engineer Professional. Palo Alto Networks System Engineer Professional - Strata Exam certification exam covers a wide range of topics related to network security, including network security concepts, network security technologies, next-generation firewall architecture, and Palo Alto Networks security solutions. By passing this certification exam, professionals can prove their expertise in network security and gain a competitive edge in the job market.
Best Value Available! 2023 Realistic Verified Free PSE-Strata Exam Questions: https://www.practicevce.com/Palo-Alto-Networks/PSE-Strata-practice-exam-dumps.html
100% Accurate Answers! PSE-Strata Actual Real Exam Questions: https://drive.google.com/open?id=1cLhsY2OyaDzVYsxvkDgkLXZ2XJG3Fo8B