Which service, when enabled, provides inbound traffic protection?
Correct Answer: D
DNS Security is a service that provides inbound traffic protection by preventing DNS-based attacks. DNS Security uses machine learning and threat intelligence to identify and block malicious domains, command and control (C2) traffic, and DNS tunneling. Reference: [DNS Security]
Question 7
Which two deployment modes of VM-Series firewalls are supported across NSX-T? (Choose two.)
Correct Answer: B,C
The two deployment modes of VM-Series firewalls that are supported across NSX-T are: Bootstrap Service Cluster NSX-T is a software-defined network (SDN) solution that provides network virtualization, automation, and security for cloud-native applications. Bootstrap is a method of deploying and configuring VM-Series firewalls in NSX-T using a bootstrap package that contains the initial setup information, such as licenses, certificates, software updates, and configuration files. Service Cluster is a mode of deploying VM-Series firewalls in NSX-T as a group of firewalls that act as a single logical firewall to provide scalability and high availability. Prism Central, Host-based, and Service Insertion are not deployment modes of VM-Series firewalls in NSX-T, but they are related concepts that can be used for other purposes. Reference: Palo Alto Networks Certified Software Firewall Engineer (PCSFE), [Deploy the VM-Series Firewall on NSX-T], [Bootstrap the VM-Series Firewall for NSX-T], [Deploy the VM-Series Firewall as a Service Cluster on NSX-T]
Question 8
Where do CN-Series devices obtain a VM-Series authorization key?
Correct Answer: A
CN-Series devices obtain a VM-Series authorization key from Panorama. Panorama is a centralized management server that provides visibility and control over multiple Palo Alto Networks firewalls and devices. A VM-Series authorization key is a license key that activates the VM-Series firewall features and capacities. CN-Series devices obtain a VM-Series authorization key from Panorama by registering with Panorama using their CPU ID and requesting an authorization code from Panorama's license pool. Panorama then generates an authorization key for the CN-Series device and sends it back to the device for activation. CN-Series devices do not obtain a VM-Series authorization key from local installation, GitHub, or Customer Support Portal, as those are not valid or relevant sources for license management. Reference: Palo Alto Networks Certified Software Firewall Engineer (PCSFE), [Panorama Overview], [VM-Series Licensing Overview], [CN-Series Licensing]
Question 9
What are two environments supported by the CN-Series firewall? (Choose two.)
Correct Answer: B,D
The two environments supported by the CN-Series firewall are: OpenShift Native K8 The CN-Series firewall is a containerized firewall that integrates with Kubernetes and provides visibility and control over container traffic. The CN-Series firewall can be deployed in various environments that support Kubernetes, such as public clouds, private clouds, or on-premises data centers. OpenShift is an environment supported by the CN-Series firewall. OpenShift is a platform that provides enterprise-grade Kubernetes and container orchestration, as well as developer tools and services. Native K8 is an environment supported by the CN-Series firewall. Native K8 is a term that refers to the standard Kubernetes distribution that is available from the Kubernetes project website, without any vendor-specific modifications or additions. Positive K and OpenStack are not environments supported by the CN-Series firewall, but they are related concepts that can be used for other purposes. Reference: Palo Alto Networks Certified Software Firewall Engineer (PCSFE), [CN-Series Datasheet], [CN-Series Deployment Guide for OpenShift], [CN-Series Deployment Guide for Native K8], [What is OpenShift?], [What is Kubernetes?]
Question 10
Which of the following can provide application-level security for a web-server instance on Amazon Web Services (AWS)?
Correct Answer: A
VM-Series firewalls can provide application-level security for a web-server instance on Amazon Web Services (AWS). VM-Series firewalls are virtualized versions of the Palo Alto Networks next-generation firewall that can be deployed on various cloud platforms, including AWS. VM-Series firewalls can protect web servers from cyberattacks by applying granular security policies based on application, user, content, and threat information. Hardware firewalls, Terraform templates, and security groups are not solutions that can provide application-level security for a web-server instance on AWS, but they are related concepts that can be used in conjunction with VM-Series firewalls. Reference: Palo Alto Networks Certified Software Firewall Engineer (PCSFE), [VM-Series on AWS], [VM-Series Datasheet], [Terraform for VM-Series on AWS], [Security Groups for Your VPC]
