Pass PSE-PrismaCloud Exam Latest Practice Questions Updated on Feb 12, 2024 [Q19-Q41] – IT Certification Exam Questions & Answers

Rate this post

Pass PSE-PrismaCloud Exam Latest Practice Questions Updated on Feb 12, 2024

Palo Alto Networks PSE-PrismaCloud Study Guide Archives

QUESTION 19
When an on-premises NGFW (customer gateway) is used to connect to the Virtual Gateway, which two IKE profiles cannot be used? (Choose two.)

Group2 / SHA-1 / AES-128-CBC / IKE-V1

Group2 / SHA-1 / AES-128-GCM / IKE-V1

Group14 / SHA-256 / AES-256-GCM / IKE-V1

Group2 / SHA-1 / AES-128-CBC

Group14 / SHA-256 / AES-256-CBC / IKE-V1

QUESTION 20
A customer has deployed a VM-Series NGFW on Amazon Web Services using a PAYG license. What is the sequence required by the customer to switch to a BYOL license?

QUESTION 21
Which three features are not supported by VM-Series NGFWs on Azure Stack? (Choose three.)

Azure Application Insight

Resource Group

Azure Security Center

Bootstrapping

ARM Template

QUESTION 22
What configuration on AWS is required in order for VM-Series to forward traffic between its network interfaces?

Both Source and Destination Checks are disabled

Both Source and Destination Checks are enabled

Source Check is disabled and Destination Check is enabled

Source Check is enabled and Destination Check is disabled

Explanation
https://docs.paloaltonetworks.com/vm-series/9-0/vm-series-deployment/set-up-the-vm-series-firewall-on-aws/us

QUESTION 23
Which RQL string monitors all traffic from the Internet and Suspicious IPs destined for your Amazon Web Services databases?

network where source.publicnetwork IN (‘Suspicious IPs’) and dest.resource IN (resource where role IN (‘AWS RDS’, ‘Database’))

network where source.publicnetwork IN (‘Suspicious IPs’, ‘Internet IPs’) and dest.resource IN (resource where role IN (‘LDAP’))

network where dest.resource IN (resource where role = ‘Database’}

network where source.publicnetwork IN (‘Suspicious IPs’, ‘Internet IPs’) and dest resource IN (resource where role IN (‘AWS RDS’. ‘Database’))

QUESTION 24
Which cloud provider supports iLB-as-next-hop?

Microsoft Azure

Alibaba Cloud

Oracle Cloud

Amazon Web Services

QUESTION 25
A client has a sensitive internet-facing application server in Microsoft Azure and is concerned about resource exhaustion because of distributed denial-of-service attacks What can be configured on the VM-Series firewall to specifically protect this server against this type of attack?

Custom threat signature

Zone Protection Profile

QoS Profile to limit incoming requests

DoS Protection Profile with specific session counts

QUESTION 26
Amazon Web Services WAF can be enabled on which two resources?(Choose two.)

AWS CDN

AWS NAT Gateway

AWS ALB

AWS NLB

QUESTION 27
How can you use Prisma Public Cloud to identify Amazon EC2 instances that have been tagged as “Private?

Create an RQL config query to identify resources with the tag “Private.”

Create an RQL network query to identify traffic from resources tagged “Private.”

Open the Asset Dashboard, filter on tags: and choose “Private.”

Generate a CIS compliance report and review the “Asset Summary.”

QUESTION 28
Which Amazon Web Services security service can provide host vulnerability information to Prisma Public Cloud?

Shield

Inspector

GuardDuty

Amazon Web Services WAF

Explanation
http://www.paloguard.com/datasheets/prisma-cloud-on-aws.pdf

QUESTION 29
Which three services can Google Cloud Security Scanner assess? (Choose three.)

Google Kubernetes Engine

BigQuery

Compute Engine

App Engine

Google Virtual Private Cloud

QUESTION 30
What are two ways to enable interface swap when deploying a VM-Series NGFW in Google Cloud Platform?
(Choose two.)

run the PAN-OS CLI command: set system mgmt-interface-swap enable yes

run the PAN-OS CLI command: set system mgmt-interface-swap setting enable yes

create a bootstrap file that includes the mgmt-interface-swap command

in the Google Cloud Console Metadata Field, enter a key-value pair where mgmt-interface-swap is the key and enable is the value

Explanation
https://docs.paloaltonetworks.com/vm-series/8-1/vm-series-deployment/set-up-the-vm-series-firewall-on-google

QUESTION 31
Which two items are required when a VM-100 BYOL instance is upgraded to a VM-300 BYOL instance?
(Choose two.)

UUID

new Auth Code

CPU ID

API Key

Explanation
In a public cloud deployment, if your firewall is licensed with the BYOL option, you must Deactivate VM before you change the instance type or VM type and apply the license again on the firewall after you complete the model or instance upgrade. When you change the instance type, because the firewall has a new UUID and CPU ID, the existing license will no longer be valid.
https://docs.paloaltonetworks.com/vm-series/9-0/vm-series-deployment/about-the-vm-series-firewall/upgrade-th

QUESTION 32
What is required for an EC2 instance to access the internet directly from an AWS VPC?

Internet Gateway

Transit Gateway

Virtual Private Gateway

Customer Gateway

QUESTION 33
Which three features are not supported by VM-Series NGFWs on Azure Stack? (Choose three.)

Azure Application Insight

Resource Group

Azure Security Center

Bootstrapping

ARM Template

QUESTION 34
What is the scope of the Amazon Web Services 1AM Service?

zonal

VPC

global

regional

QUESTION 35
Amazon Web Services WAF can be enabled on which two resources?(Choose two.)

AWS CDN

AWS NAT Gateway

AWS ALB

AWS NLB

QUESTION 36
The customer has an Amazon Web Services Elastic Computing Cloud that provides a service to the internet directly and needs to secure that cloud with a VM-Series NGFW.
Which component handles address translation?

The server VMs have private use only (RFC 1918) IPs. Amazon’s cloud infrastructure translates those addresses to publicly accessible IP addresses. The VM-Series NGFW has publicly accessible IP addresses.

The server VMs have private use only (RFC 1918) IPs. The VM-Series NGFW translates those addresses to publicly accessible IP addresses.

The server VMs and the VM-Series NGFW have private use only (RFC 1918) IPs. Amazons cloud infrastructure translates those addresses to publicly accessible IP addresses

The servers and VM-Series NGFW have publicly accessible IP addresses for management purposes.

QUESTION 37
How can you create a custom compliance standard in Prisma Public Cloud?

Generate a new Compliance Report.

Create compliance framework in a spreadsheet then import into Prisma Public Cloud.

From Compliance tab, clone a default framework and customize.

From Compliance tab > Compliance Standards, click “Add New.”

Explanation
https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/prisma-cloud-compliance/create-a-c

QUESTION 38
What are the two options to dynamically register tags used by Dynamic Address Groups that are referenced in policy? (Choose two.)

VM Monitoring

External Dynamic List

CFT Template

XML API

Explanation
https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/policy/monitor-changes-in-the-virtual-environment/

QUESTION 39
What are three examples of outbound traffic flow? (Choose three.)

issue yum update command on an instance inside Amazon Web Services

Microsoft Windows inside Azure requesting a security patch

web server inside Amazon Web Services receiving web requests from internet

issue apt-get install command on an instance inside Amazon Web Services

outgoing Prisma Public Cloud API calls

QUESTION 40
What is the default capacity license of a VM-Series NGFW being deployed from the Google Cloud Platform Marketplace?

VM-300

VM-GCP

VM-100

VM-500

QUESTION 41
An administrator deploys a VM-Series firewall into Amazon Web Services. Which attribute must be disabled on the data-plane elastic network interface for the instance to handle traffic that is not destined to its own IP address?

security group

IT Certification Exam Questions & Answers

Leave a Reply Cancel reply