[2024年10月16日]PSE-SoftwareFirewall試験問題集でPalo Alto Networks練習テスト問題
最新でリアルなPSE-SoftwareFirewall試験問題集解答
質問 # 29
Which element protects and hides an internal network in an outbound flow?
- A. DNS sinkholing
- B. User-ID
- C. App-ID
- D. NAT
正解：D
解説：
NAT (Network Address Translation) protects and hides an internal network in an outbound flow by translating internal private IP addresses to a public IP address. This process masks the internal IP addresses from external networks, providing security and privacy for the internal network. NAT is commonly used in outbound traffic to allow multiple devices on a local network to communicate with external networks while appearing as a single IP address.
References:
* Palo Alto Networks NAT Configuration Guide: NAT Configuration
* Palo Alto Networks Concepts: NAT
質問 # 30
How are Palo Alto Networks Next-Generation Firewalls (NGFWs) deployed within a Cisco ACI architecture?
- A. SDN code hooks can help detonate malicious file samples designed to detect virtual environments.
- B. Traffic can be automatically redirected using static address objects.
- C. VXLAN or NVGRE traffic is terminated and inspected for translation to VLANs.
- D. Service graphs are configured to allow their deployment.
正解：D
解説：
Within a Cisco ACI architecture, Palo Alto Networks Next-Generation Firewalls (NGFWs) are deployed using service graphs. Service graphs in Cisco ACI define the sequence of network services that traffic must pass through. By configuring service graphs, administrators can seamlessly integrate Palo Alto Networks firewalls into the fabric to inspect and secure traffic flows.
References:
* Palo Alto Networks and Cisco ACI Integration Guide: Service Graphs Integration
* Cisco ACI Service Graph Documentation: Service Graphs
質問 # 31
Which two mechanisms could trigger a high availability (HA) failover event? (Choose two.)
- A. Ping monitoring
- B. Session polling
- C. Heartbeat polling
- D. Link monitoring
正解：A、D
質問 # 32
What are two requirements for automating service deployment of a VM-Series firewall from an NSX Manager? (Choose two.)
- A. The deployed VM-Series firewall can establish communications with Panorama.
- B. Panorama can establish communications to the public Palo Alto Networks update servers.
- C. Panorama has been configured to recognize both the NSX Manager and vCenter.
- D. vCenter has been given Palo Alto Networks subscription licenses for VM-Series firewalls.
正解：A、C
解説：
* For automating the deployment of VM-Series firewalls from NSX Manager, Panorama must be configured to recognize and communicate with both the NSX Manager and vCenter. This ensures that Panorama can manage the firewall policies and orchestration efficiently.
質問 # 33
Which two features of CN-Series firewalls protect east-west traffic between pods in different trust zones?
(Choose two.)
- A. Intrusion prevention system (IPS)
- B. Communication with Panorama
- C. External load balancer (ELB)
- D. Layer 7 visibility
正解：A、D
解説：
* Intrusion Prevention System (IPS):The CN-Series firewalls incorporate an Intrusion Prevention System to detect and prevent exploits and attacks on applications and systems. This feature is essential for securing east-west traffic, as it can identify and block threats within the data center traffic between pods in different trust zones.
* Layer 7 Visibility:CN-Series firewalls provide Layer 7 (application layer) visibility, enabling deep inspection of application traffic. This allows the firewall to understand and enforce policies based on the application and its behavior, rather than just ports and protocols, ensuring comprehensive security for east-west traffic within a Kubernetes environment.
References:
* Palo Alto Networks CN-Series Datasheet: CN-Series Datasheet
* Palo Alto Networks CN-Series Documentation: CN-Series Documentation
質問 # 34
Which two design options address split brain when configuring high availability (HA)? (Choose two.)
- A. Using the heartbeat backup
- B. Bundling multiple interfaces in an aggregated interface group and assigning HA2
- C. Adding a backup HA1 interface
- D. Sending heartbeats across the HA2 interfaces
正解：A、C
解説：
* Using the Heartbeat Backup:
* The heartbeat backup is a mechanism that helps to prevent split-brain scenarios in a high availability (HA) configuration by providing an additional path for heartbeatcommunication. This ensures that both firewalls in the HA pair are aware of each other's status.
質問 # 35
How does Prisma Cloud Compute offer workload security at runtime?
- A. It works with the identity provider (IdP) to identify overprivileged containers and services, and it restricts network access.
- B. It automatically builds an allow-list security model for every container and service.
- C. It quarantines containers that demonstrate increased CPU and memory usage.
- D. It automatically patches vulnerabilities and compliance issues for every container and service.
正解：B
解説：
Allow-list Security Model:
* Prisma Cloud Compute provides runtime security by automatically creating an allow-list security model for each container and service. This model ensures that only expected and authorized behaviors are allowed, effectively preventing unauthorized activities.
質問 # 36
Which two deployment modes of VM-Series firewalls are supported across NSX-T? (Choose two.)
- A. Bootstrap
- B. Host-based
- C. Prism Central
- D. Service Cluster
正解：B、D
解説：
Service Cluster Mode:
* In NSX-T, the Service Cluster mode allows the VM-Series firewalls to be deployed as part of a service cluster, where they can provide security services to workloads.
質問 # 37
Which solution is best for securing an EKS environment?
- A. API orchestration
- B. VM-Series single host
- C. CN-Series high availability (HA) pair
- D. PA-Series using load sharing
正解：C
解説：
CN-Series for EKS Security:
* The CN-Series firewalls are specifically designed to secure Kubernetes environments, such as Amazon EKS. Deploying them in a high availability (HA) pair ensures robust, fault-tolerant security for containerized workloads, providing continuous protection and high availability.
質問 # 38
A CN-Series firewall can secure traffic between which elements?
- A. Source applications
- B. Host containers
- C. Pods
- D. Containers
正解：C
解説：
The CN-Series firewalls are specifically designed to secure containerized environments. They can secure traffic between Kubernetes pods, which are the smallest deployable units in a Kubernetes cluster, and are often composed of one or more containers. The primary focus of CN-Series firewalls is to ensure security within Kubernetes environments by managing traffic and enforcing security policies at the pod level.
References:
* Palo Alto Networks CN-Series Datasheet: CN-Series Datasheet
* Palo Alto Networks CN-Series Documentation: CN-Series Documentation
質問 # 39
What do tags allow a VM-Series firewall to do in a virtual environment?
- A. Enable machine learning (ML).
- B. Adapt Security policy rules dynamically.
- C. Provide adaptive reporting.
- D. Integrate with security information and event management (SIEM) solutions.
正解：B
解説：
Tags in a VM-Series firewall environment allow administrators to dynamically adjust security policy rules based on changes within the virtual environment. These tags can be used to label and categorize virtual machines (VMs) or other entities within the environment, and policies can be created to automatically respond to these tags. This facilitates adaptive security measures that align with the current state and requirements of the environment.
References:
* Palo Alto Networks VM-Series Deployment Guide: Dynamic Address Groups and Tags
質問 # 40
Which type of group allows sharing cloud-learned tags with on-premises firewalls?
- A. Address
- B. Device
- C. Template
- D. Notify *
正解：A
解説：
* Address Group:
* Address groups in Palo Alto Networks firewalls allow for the grouping of multiple addresses or address objects. This capability enables the sharing of cloud-learned tags with on-premises firewalls, facilitating the consistent application of security policies across hybrid cloud environments.
質問 # 41
Which three NSX features can be pushed from Panorama in PAN-OS? (Choose three.)
- A. Security groups
- B. Multiple authorization codes
- C. User IP mappings
- D. Security group assignment of virtual machines (VMs)
- E. Steering rules
正解：C、D、E
解説：
User IP mappings:
* Panorama can push user-to-IP mapping information to the NSX manager, enabling dynamic security policy enforcement based on user identity.
質問 # 42
What helps avoid split brain in active-passive high availability (HA) pair deployment?
- A. Using a standard traffic interface as the HA3 link
- B. Enabling preemption on both firewalls in the HA pair
- C. Using a standard traffic interface as the HA2 backup
- D. Using the management interface as the HA1 backup link
正解：D
解説：
To avoid split brain scenarios in an active-passive high availability (HA) pair deployment, the management interface can be used as the HA1 backup link. This ensures reliable communication between the HA pair and prevents both firewalls from assuming the active role simultaneously, which can happen if they lose connectivity with each other on the primary HA1 link.
References:
* Palo Alto Networks High Availability Guide: HA Configuration
* Best Practices for HA Configuration: Avoiding Split Brain
質問 # 43
Why are containers uniquely suitable for runtime security based on allow lists?
- A. Containers have only a few defined processes that should ever be executed.
- B. Operations teams know which processes are used within a container.
- C. Developers define the processes used in containers within the Dockerfile.
- D. Docker has a built-in runtime analysis capability to aid in allow listing.
正解：A
解説：
Containers are typically designed to run a specific application or service, meaning they have a limited and well-defined set of processes. This makes it easier to implement and manage runtime security based on allow lists, as any deviation from the expected processes can be quickly identified and mitigated.
Reference: Security best practices for container environments emphasize the use of allow lists to enforce runtime security, leveraging the predictable nature of container processes.
Palo Alto Networks Container Security Guide
質問 # 44
What is the appropriate file format for Kubernetes applications?
- A. .exe
- B. .xml
- C. .yaml
- D. Json
正解：C
解説：
In Kubernetes, configuration files are typically written in YAML (.yaml) format. YAML (Yet Another Markup Language) is preferred due to its readability and ease of use for defining complex data structures like those required for Kubernetes deployments. Kubernetes uses these YAML files to define resources such as pods, services, and deployments.
References:
* Kubernetes Documentation on YAML: Kubernetes YAML
* Kubernetes Getting Started Guide: YAML Basics
質問 # 45
A customer in a VMware ESXi environment wants to add a VM-Series firewall and partition an existing group of virtual machines (VMs) in the same subnet into two groups. One group requires no additional security, but the second group requires substantially more security.
How can this partition be accomplished without editing the IP addresses or the default gateways of any of the guest VMs?
- A. Create a Layer 3 interface in the same subnet as the VMs and then configure proxy Address Resolution Protocol (ARP).
- B. Send the VLAN out of the virtual environment into a hardware Palo Alto Networks firewall in Layer 3 mode. Use the same IP address as the old default gateway, then delete it.
- C. Edit the IP address of all of the affected VMs.
- D. Create a new virtual switch and use the VM-Series firewall to separate virtual switches using virtual wire mode. Then move the guests that require more security into the new virtual switch.
正解：D
解説：
Creating a New Virtual Switch:
* By creating a new virtual switch, you can segment the network within the ESXi environment. The VM-Series firewall can then be used to provide security controls between these virtual switches using virtual wire mode.
質問 # 46
Which component can provide application-based segmentation and prevent lateral threat movement?
- A. App-ID *
- B. URL Filtering
- C. DNS Security
- D. NAT
正解：A
解説：
App-ID is a feature that provides application-based segmentation and helps prevent lateral threat movement within a network. By identifying and controlling applications traversing the network regardless of port, protocol, or encryption (SSL or SSH), App-ID allows granular security policies to be applied, thereby limiting the spread of threats within the network.
References:
* Palo Alto Networks App-ID Technology: App-ID
* Palo Alto Networks Application and Threat Content: App-ID Overview
質問 # 47
Which software firewall would help a prospect interested in securing an environment with Kubernetes?
- A. KN-Series
- B. VM-Series
- C. CN-Series
- D. ML-Series
正解：C
解説：
* The CN-Series firewalls are purpose-built for securing Kubernetes environments. They provide network security, visibility, and threat prevention specifically tailored to containerized applications and microservices running in Kubernetes.
質問 # 48
Which two actions can be performed for VM-Series firewall licensing by an orchestration system? (Choose two.)
- A. Downloading a content update
- B. Creating a license
- C. Registering an authorization code
- D. Renewing a license
正解：A、C
解説：
Registering an Authorization Code:
* An orchestration system can automate the registration of authorization codes, which is a critical step in licensing the VM-Series firewall. This process involves submitting the code to Palo Alto Networks to activate the license.
質問 # 49
Which component scans for threats in allowed traffic?
- A. TLS decryption
- B. Intelligent Traffic Offload
- C. Security profiles
- D. NAT
正解：C
解説：
* Security Profiles:
* Security profiles in Palo Alto Networks firewalls are used to scan for threats in allowed traffic.
These profiles include features such as Antivirus, Anti-Spyware, Vulnerability Protection, URL Filtering, and others that inspect traffic and detect potential threats.
質問 # 50
Which two subscriptions should be recommended to a customer who is deploying VM-Series firewalls to a private data center but is concerned about protecting data-center resources from malware and lateral movement? (Choose two.)
- A. Threat Prevention
- B. Intelligent Traffic Offload
- C. SD-WAN
- D. WildFire
正解：A、D
解説：
For a customer deploying VM-Series firewalls in a private data center and concerned about protecting resources from malware and lateral movement, the following subscriptions are recommended:
* Threat Prevention:This subscription provides comprehensive threat detection and prevention capabilities, including IPS, anti-virus, anti-spyware, and vulnerability protection.
* WildFire:This advanced threat intelligence service analyzes suspicious files and identifies new malware, providing protection against zero-day exploits and threats.
References:
* Palo Alto Networks Threat Prevention: Threat Prevention
* Palo Alto Networks WildFire: WildFire
質問 # 51
Which two statements apply to the VM-Series plugin? (Choose two.)
- A. It can manage Panorama plugins.
- B. It enables management of cloud-specific interactions between VM-Series firewalls and supported public cloud platforms.
- C. It can manage capabilities common to both VM-Series firewalls and hardware firewalls.
- D. It can be upgraded independently of PAN-OS.
正解：B、D
解説：
* Independent Upgrade:
* The VM-Series plugin can be upgraded independently of the PAN-OS version. This allows for flexibility in maintaining and enhancing the plugin without the need for a complete PAN-OS upgrade.
質問 # 52
Which two routing options are supported by VM-Series? (Choose two.)
- A. RIP
- B. OSPF
- C. BGP
- D. IGRP
正解：B、C
解説：
The VM-Series firewalls support various dynamic routing protocols to ensure efficient and resilient network traffic management. Among these, OSPF (Open Shortest Path First) and BGP (Border Gateway Protocol) are supported. OSPF is used for intra-domain routing, while BGP is essential for inter-domain routing, allowing VM-Series to participate in complex and scalable network topologies.
References:
* Palo Alto Networks VM-Series Deployment Guide: VM-Series Deployment Guide
* Palo Alto Networks Administrator's Guide: Routing Protocols
質問 # 53
......
PSE-SoftwareFirewall認証試験問題集解答を提供しています：https://drive.google.com/open?id=1Y1RcYR50v1m3D1XyhVA_I0j2h5B8NHNL
あなたを簡単に合格させるPSE-SoftwareFirewall試験正確なPDF問題：https://www.passtest.jp/Palo-Alto-Networks/PSE-SoftwareFirewall-shiken.html