QUESTION: 13

Which component scans for threats in allowed traffic?

Intelligent Traffic Offload
TLS decryption
Security profiles
NAT

Answer(s): C

Explanation:

Security profiles are the components that scan for threats in allowed traffic. Security profiles are sets of rules or settings that define how the firewall will inspect and handle traffic based on various threat prevention technologies, such as antivirus, anti-spyware, vulnerability protection, URL filtering, file blocking, data filtering, and WildFire analysis. Security profiles can be applied to Security policy rules to enforce granular protection against known and unknown threats in allowed traffic. Intelligent Traffic Offload, TLS decryption, and NAT are not components that scan for threats in allowed traffic, but they are related features that can enhance security and performance.

Reference:

Palo Alto Networks Certified Software Firewall Engineer (PCSFE), [Security Profiles Overview], [Threat Prevention Datasheet]

Reveal Solution Next Question

QUESTION: 14

Which two deployment modes of VM-Series firewalls are supported across NSX-T? (Choose two.)

Prism Central
Bootstrap
Service Cluster
Host-based

Answer(s): B,C

Explanation:

The two deployment modes of VM-Series firewalls that are supported across NSX-T are:
Bootstrap
Service Cluster
NSX-T is a software-defined network (SDN) solution that provides network virtualization, automation, and security for cloud-native applications. Bootstrap is a method of deploying and configuring VM-Series firewalls in NSX-T using a bootstrap package that contains the initial setup information, such as licenses, certificates, software updates, and configuration files. Service Cluster is a mode of deploying VM-Series firewalls in NSX-T as a group of firewalls that act as a single logical firewall to provide scalability and high availability. Prism Central, Host-based, and Service Insertion are not deployment modes of VM-Series firewalls in NSX-T, but they are related concepts that can be used for other purposes.

Reference:

Palo Alto Networks Certified Software Firewall Engineer (PCSFE), [Deploy the VM-Series Firewall on NSX-T], [Bootstrap the VM-Series Firewall for NSX-T], [Deploy the VM-Series Firewall as a Service Cluster on NSX-T]

Reveal Solution Next Question

QUESTION: 15

A customer in a VMware ESXi environment wants to add a VM-Series firewall and partition an existing group of virtual machines (VMs) in the same subnet into two groups. One group requires no additional security, but the second group requires substantially more security.

How can this partition be accomplished without editing the IP addresses or the default gateways of any of the guest VMs?

Edit the IP address of all of the affected VMs. www*
Create a new virtual switch and use the VM-Series firewall to separate virtual switches using virtual wire mode. Then move the guests that require more security into the new virtual switch.
Create a Layer 3 interface in the same subnet as the VMs and then configure proxy Address Resolution Protocol (ARP).
Send the VLAN out of the virtual environment into a hardware Palo Alto Networks firewall in Layer 3 mode. Use the same IP address as the old default gateway, then delete it.

Answer(s): B

Explanation:

The partition can be accomplished without editing the IP addresses or the default gateways of any of the guest VMs by creating a new virtual switch and using the VM-Series firewall to separate virtual switches using virtual wire mode. Then move the guests that require more security into the new virtual switch. A virtual switch is a software-based switch that connects virtual machines (VMs) in a VMware ESXi environment. A virtual wire is a deployment mode of the VM-Series firewall that allows it to act as a bump in the wire between two network segments, without requiring an IP address or routing configuration. By creating a new virtual switch and using the VM-Series firewall to separate virtual switches using virtual wire mode, the customer can isolate the group of VMs that require more security from the rest of the network, and apply security policies to the traffic passing through the firewall. The partition cannot be accomplished without editing the IP addresses or the default gateways of any of the guest VMs by editing the IP address of all of the affected VMs, creating a Layer 3 interface in the same subnet as the VMs and then configuring proxy Address Resolution Protocol (ARP), or sending the VLAN out of the virtual environment into a hardware Palo Alto Networks firewall in Layer 3 mode. Use the same IP address as the old default gateway, then delete it, as those methods would require changing the network configuration of the guest VMs or introducing additional complexity and latency.

Reference:

Palo Alto Networks Certified Software Firewall Engineer (PCSFE), [Deploying Virtual Switches], [Virtual Wire Deployment], [Deploying Virtual Wire on VMware ESXi]

Reveal Solution Next Question

QUESTION: 16

How must a Palo Alto Networks Next-Generation Firewall (NGFW) be configured in order to secure traffic in a Cisco ACI environment?

It must be deployed as a member of a device cluster
It must use a Layer 3 underlay network
It must receive all forwarding lookups from the network controller
It must be identified as a default gateway

Answer(s): B

Explanation:

A Palo Alto Networks Next-Generation Firewall (NGFW) must be configured to use a Layer 3 underlay network in order to secure traffic in a Cisco ACI environment. A Layer 3 underlay network is a physical network that provides IP connectivity between devices, such as routers, switches, and firewalls. A Palo Alto Networks NGFW must use a Layer 3 underlay network to communicate with the Cisco ACI fabric and receive traffic redirection from the Cisco ACI policy-based redirect mechanism. A Palo Alto Networks NGFW does not need to be deployed as a member of a device cluster, receive all forwarding lookups from the network controller, or be identified as a default gateway in order to secure traffic in a Cisco ACI environment, as those are not valid requirements or options for firewall integration with Cisco ACI.

Reference:

Palo Alto Networks Certified Software Firewall Engineer (PCSFE), [Deploy the VM-Series Firewall on Cisco ACI], [Cisco ACI Underlay Network]

Reveal Solution Next Question

Free PCSFE Exam Braindumps (page: 5)

QUESTION: 13

Explanation:

Reference:

QUESTION: 14

Explanation:

Reference:

QUESTION: 15

Explanation:

Reference:

QUESTION: 16

Explanation:

Reference: