NO.21 Which statement applies to Log Collector Groups?

NO.22 When configuring a Zone Protection profile, in which section (protection type) would an NGFW engineer configure options to protect against activities such as spoofed IP addresses and split handshake session establishment attempts?

NO.23 Which zone type allows traffic between zones in different virtual systems (VSYS), without the traffic leaving the firewall?

NO.24 When deploying Palo Alto Networks NGFWs in a cloud service provider (CSP) environment, which method ensures high availability (HA) across multiple availability zones?

NO.25 A network administrator is establishing a site-to-site VPN between a Palo Alto Networks firewall and a partner’s Check Point Security Gateway. The partner has provided a specific list of local and remote IP address subnets that are permitted through the tunnel. The initial tunnel configuration on the PAN-OS firewall fails during the IKE Phase 2 exchange.
Which configuration step is essential to ensure compatibility with the policy-based Check Point gateway?

NO.26 A cloud security team wants to extend its existing Palo Alto Networks Security policies into the organization’s Kubernetes environments. The team requires an NGFW solution that can be deployed natively as a container and managed by Panorama.
Which firewall form factor meets these requirements?

NO.27 Without performing a context switch, which set of operations can be performed that will affect the operation of a connected firewall on the Panorama GUI?

NO.28 A network security engineer wants to create Security policy rules that allow or deny traffic based on a user’s department, which corresponds to groups in the company’s Active Directory. To achieve this, the firewall needs to retrieve group information from the directory server.
Which configuration object must be created first to establish the connection with the Active Directory server?

NO.29 A security team wants to block peer-to-peer file sharing applications even when those applications attempt to evade detection by using non-standard ports.
Which NGFW capability enables this control?

NO.30 After enabling multiple security profiles such as IPS, antivirus, and URL filtering on an NGFW, users report degraded network performance.
Which factor is MOST likely causing the issue?

NO.31 Which two Palo Alto Networks firewall services are secured by attaching an SSL/TLS service profile to their configuration? (Choose two.)

NO.32 A network administrator is configuring an Aggregate Ethernet (AE) interface on an active/passive high availability (HA) pair. To reduce network downtime during a failover, the administrator wants the passive firewall’s AE interface to be fully negotiated with the switch before it becomes active.
Which Link Aggregation Control Protocol (LACP) setting achieves this administrator’s goal?

NO.33 A DevOps team is building a repeatable process for deploying new Palo Alto Networks VM-Series firewalls. The entire infrastructure, including virtual networks, subnets, and the firewalls themselves, must be defined in code to ensure consistency and enable version control.
Which tool is primarily used for this type of declarative Infrastructure as Code (IaC) provisioning?

NO.34 An network engineer is configuring SSL Forward Proxy decryption on a Palo Alto Networks firewall. The company’s internal clients trust a corporate root certificate authority (CA). To ensure the firewall can properly validate the certificates of external web servers, the engineer must configure a specific component.
Which component defines the mechanism for Online Certificate Status Protocol (OCSP) / certificate revocation list (CRL) status?

NO.35 After an engineer configures an IPSec tunnel with a Cisco ASA, the Palo Alto Networks firewall generates system messages reporting the tunnel is failing to establish. Which of the following actions will resolve this issue?

NO.36 A security engineer creates a policy allowing only members of the Finance?Active Directory group to access a cloud-based accounting application.
Which NGFW capability makes this policy possible?

NO.37 An administrator is designing a public key infrastructure (PKI) integration for a large-scale deployment with thousands of users authenticating via client certificates. A key design goal is to ensure that certificate revocation status is checked efficiently with minimal impact on firewall performance and minimal delay for the connecting user.
What is the primary advantage of using the Online Certificate Status Protocol (OCSP) instead of certificate revocation lists (CRLs) in this scenario?

NO.38 To maintain security efficacy of its public cloud resources by using native tools, a company purchases Cloud NGFW credits to replicate the Panorama, PA-Series, and VM-Series devices used in physical data centers.
Resources exist on AWS and Azure:
The AWS deployment is architected with AWS Transit Gateway, to which all resources connect The Azure deployment is architected with each application independently routing traffic The engineer deploying Cloud NGFW in these two cloud environments must account for the following:
Minimize changes to the two cloud environments
Scale to the demands of the applications while using the least amount of compute resources Allow the company to unify the Security policies across all protected areas Which two implementations will meet these requirements? (Choose two.)

NO.39 An organization is migrating its data center to Amazon Web Services (AWS) and needs to deploy VM-Series firewalls to inspect all ingress and egress traffic. The solution must provide both resilience across multiple Availability Zones and the ability to scale horizontally.
Which combination of AWS services and Palo Alto Networks components is required for this use case?