Palo Alto Networks Certified Software Firewall Engineer practice questions

1. Question 1 of 25

   To which service does the Cloud NGFW for Azure send its logs?

   • AKinesis Data Firehose
   • BS3 Bucket
   • CCloudWatch Log Group
   • DLog Analytics Workspace

   Show answer

   Correct answer: D

   Explanation

   Answer D: The Cloud NGFW can send traffic, threat, and decryption logs to an Azure Log Analytics Workspace that you will create in the Azure portal.

   Adapted from community discussion by Redrum702 · 2024-03-09 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • docs.paloaltonetworks.com documentation

   View community discussion3

   Candidate context

   Question 1 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCSFE or CertExamHQ.

   1. R

      Redrum702

      2024-03-09

      2 upvotes

      Answer D: The Cloud NGFW can send traffic, threat, and decryption logs to an Azure Log Analytics Workspace that you will create in the Azure portal.

   2. J

      javim

      2024-04-01

      2 upvotes

      Correct answer is D https://docs.paloaltonetworks.com/cloud-ngfw/azure/cloud-ngfw-for-azure/logging/configure-logging-for-cloud-ngfw-on-azure

   3. J

      john_smith

      2024-07-28

      1 upvote

      Answer D: Azure Log Analytics Workspace The Cloud NGFW can send traffic, threat, and decryption logs to an Azure Log Analytics Workspace that you will create in the Azure portal. https://docs.paloaltonetworks.com/cloud-ngfw/azure/cloud-ngfw-for-azure/logging/configure-logging-for-cloud-ngfw-on-azure#:~:text=The%20Cloud%20NGFW%20can%20send,create%20in%20the%20Azure%20portal.

2. Question 2 of 25

   Intelligent Traffic Offload (ITO) requires a firewall be deployed in which mode?

   • ALayer 2
   • BLayer 3
   • CTap
   • DVwire

   Show answer

   Correct answer: D

   How others answered

   • D100%

   Explanation

   Answer is D: Intelligent Traffic Offload is a VM-Series firewall Security subscription that, when configured with the NVIDIA BlueField-2 DPU, increases capacity throughput for the VM-Series firewall. The VM-Series firewall and the BlueField-2 DPU must be installed on an x86 physical host running Ubuntu 18.04, with kernel version 4.15.0-20. The VM-Series firewall must be deployed in virtual wire mode.

   Adapted from community discussion by Redrum702 · 2024-03-09 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   View community discussion4

   Candidate context

   Question 2 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCSFE or CertExamHQ.

   1. R

      Redrum702

      2024-03-09

      3 upvotes

      Answer is D: Intelligent Traffic Offload is a VM-Series firewall Security subscription that, when configured with the NVIDIA BlueField-2 DPU, increases capacity throughput for the VM-Series firewall. The VM-Series firewall and the BlueField-2 DPU must be installed on an x86 physical host running Ubuntu 18.04, with kernel version 4.15.0-20. The VM-Series firewall must be deployed in virtual wire mode.

   2. D

      davidtolo

      2024-06-20

      1 upvote

      Version 11.1 and Later In previous releases, ITO required that you deploy your VM-Series firewall in virtual wire mode. This limitation prevented deployments in Layer 3 mode supporting static or dynamic routing. This release removes that limitation by allowing you to deploy your VM-Series firewall with Intelligent Traffic Offload for L3 traffic supporting static and dynamic routing.

   3. D

      Doobiedoo

      2024-04-21

      Selected D1 upvote

      Virtual wire mode "vwire" is the correct answer. https://docs.paloaltonetworks.com/vm-series/11-1/vm-series-deployment/set-up-the-vm-series-firewall-on-kvm/intelligent-traffic-offload

   4. J

      javim

      2024-04-04

      Selected D1 upvote

      https://docs.paloaltonetworks.com/vm-series/11-0/vm-series-deployment/set-up-the-vm-series-firewall-on-kvm/intelligent-traffic-offload

3. Question 3 of 25

   Select 3

   What are three valid deployment options for Panorama in Amazon Web Services (AWS)? (Choose three.)

   • APanorama in AWS for management and log collection
   • BPanorama in AWS and Panorama on-premises for a high availability (HA) array
   • CPanorama in AWS CN-Series form factor for management and log collection
   • DPanorama in AWS with Cortex Data Lake
   • EOn-premises Panorama with log collectors in AWS

   Show answer

   Correct answer: A, D, E

   How others answered

   • ADE100%

   Explanation

   ADE are correct. https://docs.paloaltonetworks.com/panorama/11-1/panorama-admin/panorama-high-availability/panorama-ha-prerequisites Model and hypervisor must be the same, so HA with "AWS and on-prem" makes no sense. There is no CN-Series for Panorama. It can be deployed as: * Both a management server and log collector in AWS * Mgmt server on-prem with log collectors in AWS * Mgmt server in AWS and using Cortex Data Lake for logging

   Adapted from community discussion by Doobiedoo · 2024-10-21 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • docs.paloaltonetworks.com documentation

   View community discussion1

   Candidate context

   Question 3 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCSFE or CertExamHQ.

   1. D

      Doobiedoo

      2024-10-21

      Selected A, D, E2 upvotes

      ADE are correct. https://docs.paloaltonetworks.com/panorama/11-1/panorama-admin/panorama-high-availability/panorama-ha-prerequisites Model and hypervisor must be the same, so HA with "AWS and on-prem" makes no sense. There is no CN-Series for Panorama. It can be deployed as: * Both a management server and log collector in AWS * Mgmt server on-prem with log collectors in AWS * Mgmt server in AWS and using Cortex Data Lake for logging

4. Question 4 of 25

   After how many days does a daily warning message start appearing within the system before a Palo Alto Networks VM-Series license expires?

   • A7
   • B14
   • C30
   • D60

   Show answer

   Correct answer: C

   How others answered

   • C100%

   Explanation

   "C" is the correct answer. When a license is within 30 days of expiration, a warning message displays in the system log daily until you renew the subscription or it expires. https://docs.paloaltonetworks.com/vm-series/11-1/vm-series-deployment/license-the-vm-series-firewall/what-happens-when-licenses-expire

   Adapted from community discussion by Doobiedoo · 2024-10-21 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • docs.paloaltonetworks.com documentation

   View community discussion1

   Candidate context

   Question 4 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCSFE or CertExamHQ.

   1. D

      Doobiedoo

      2024-10-21

      Selected C2 upvotes

      "C" is the correct answer. When a license is within 30 days of expiration, a warning message displays in the system log daily until you renew the subscription or it expires. https://docs.paloaltonetworks.com/vm-series/11-1/vm-series-deployment/license-the-vm-series-firewall/what-happens-when-licenses-expire

5. Question 5 of 25

   Select 2

   Which two methods of Zero Trust implementation can benefit an organization? (Choose two.)

   • ACompliance is validated.
   • BBoundaries are established.
   • CSecurity automation is seamlessly integrated.
   • DAccess controls are enforced.

   Show answer

   Correct answer: B, D

   How others answered

   • BD100%

   Explanation

   Correct answers are B & D - Boundaries are established is a method of Zero Trust implementation that involves defining and segmenting the network into smaller zones based on data sensitivity, user identity, device type, or application function. Boundaries are established can benefit an organization by isolating and protecting critical assets from unauthorized access or lateral movement. - Access controls are enforced can benefit an organization by preventing data exfiltration, malware propagation, or credential theft. Compliance is validated and security automation is seamlessly integrated are not methods of Zero Trust implementation, but they may be potential outcomes or benefits of implementing Zero Trust.

   Adapted from community discussion by javim · 2024-04-16 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • docs.paloaltonetworks.com documentation

   View community discussion2

   Candidate context

   Question 5 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCSFE or CertExamHQ.

   1. J

      javim

      2024-04-16

      Selected B, D2 upvotes

      Correct answers are B & D - Boundaries are established is a method of Zero Trust implementation that involves defining and segmenting the network into smaller zones based on data sensitivity, user identity, device type, or application function. Boundaries are established can benefit an organization by isolating and protecting critical assets from unauthorized access or lateral movement. - Access controls are enforced can benefit an organization by preventing data exfiltration, malware propagation, or credential theft. Compliance is validated and security automation is seamlessly integrated are not methods of Zero Trust implementation, but they may be potential outcomes or benefits of implementing Zero Trust.

   2. B

      bbbb72f

      2024-07-26

      1 upvote

      C & D is correct - Refecence: https://docs.paloaltonetworks.com/best-practices/zero-trust-best-practices/zero-trust-best-practices/what-is-zero-trust-and-why-do-i-need-it -- "The goal of Zero Trust is to eliminate implicit trust from the enterprise. Eliminating implicit trust helps prevent successful data breaches, simplifies operations through automation and a reduced rulebase, and simplifies regulatory compliance and audits because Zero Trust environments are designed for compliance and easy auditing."

6. Question 6 of 25

   Select 2

   Which two actions can be performed for VM-Series firewall licensing by an orchestration system? (Choose two.)

   • ACreating a license
   • BRenewing a license
   • CRegistering an authorization code
   • DDownloading a content update

   Show answer

   Correct answer: B, C

   How others answered

   • BC75%
   • CD25%

   Explanation

   I think it should be: BC "Use the licensing API to register auth codes, retrieve licenses attached to an auth code, renew licenses, or deactivate all licenses on a VM-Series firewall" https://docs.paloaltonetworks.com/vm-series/10-2/vm-series-deployment/license-the-vm-series-firewall/vm-series-models/licensing-api

   Adapted from community discussion by glorki · 2023-11-27 · 5 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • docs.paloaltonetworks.com documentation

   View community discussion4

   Candidate context

   Question 6 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCSFE or CertExamHQ.

   1. G

      glorki

      2023-11-27

      5 upvotes

      I think it should be: BC "Use the licensing API to register auth codes, retrieve licenses attached to an auth code, renew licenses, or deactivate all licenses on a VM-Series firewall" https://docs.paloaltonetworks.com/vm-series/10-2/vm-series-deployment/license-the-vm-series-firewall/vm-series-models/licensing-api

   2. R

      Redrum702

      2024-03-03

      2 upvotes

      I would say you're correct after looking at the link you provided

   3. B

      bbbb72f

      2024-07-26

      1 upvote

      C & D "This quickplay solution provides an Ansible playbook to license a VM-series NGFW using an activated authcode, provide content updates, and upgrade or downgrade to a user-inputted PAN-OS software version." Reference: Ansible Playbook to Baseline the NGFW | Palo Alto Networks

   4. 1

      1298ac2

      2024-06-27

      Selected B, C1 upvote

      I agree from the point that licenses are deployed on devices not created.

7. Question 7 of 25

   What is a design consideration for a prospect who wants to deploy VM-Series firewalls in an Amazon Web Services (AWS) environment?

   • ASpecial AWS plugins are needed for load balancing.
   • BResources are shared within the cluster.
   • COnly active-passive high availability (HA) is supported.
   • DHigh availability (HA) clusters are limited to fewer than 8 virtual appliances.

   Show answer

   Correct answer: C

   Explanation

   C is the only answer that make sense, but Act/Pasv in this mode will function poorly (60 sec or more to switch). https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClD9CAK

   Adapted from community discussion by djedeen · 2024-03-26 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • docs.paloaltonetworks.com documentation

   View community discussion3

   Candidate context

   Question 7 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCSFE or CertExamHQ.

   1. D

      djedeen

      2024-03-26

      3 upvotes

      C is the only answer that make sense, but Act/Pasv in this mode will function poorly (60 sec or more to switch). https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClD9CAK

   2. S

      scn_lewisk

      2024-04-03

      1 upvote

      C is correct. https://docs.paloaltonetworks.com/vm-series/10-1/vm-series-deployment/set-up-the-vm-series-firewall-on-aws/high-availability-for-vm-series-firewall-on-aws

   3. A

      articpolarbear

      2024-06-29

      1 upvote

      C cannot be correct, you can deploy Load Balancers, ASG, HA in AWS.

8. Question 8 of 25

   When implementing active-active high availability (HA), which feature must be configured to allow the HA pair to share a single IP address that may be used as the network's gateway IP address?

   • AARP load sharing
   • BFloating IP address
   • CHSRP
   • DVRRP

   Show answer

   Correct answer: A

   How others answered

   • A100%

   Explanation

   A) In a Layer 3 interface deployment and active/active HA configuration, ARP load-sharing allows the firewalls to share an IP address and provide gateway services. Use ARP load-sharing only when no Layer 3 device exists between the firewall and end hosts, that is, when end hosts use the firewall as their default gateway.

   Adapted from community discussion by djedeen · 2024-03-26 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   View community discussion3

   Candidate context

   Question 8 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCSFE or CertExamHQ.

   1. D

      djedeen

      2024-03-26

      3 upvotes

      A) In a Layer 3 interface deployment and active/active HA configuration, ARP load-sharing allows the firewalls to share an IP address and provide gateway services. Use ARP load-sharing only when no Layer 3 device exists between the firewall and end hosts, that is, when end hosts use the firewall as their default gateway.

   2. J

      javim

      2024-04-07

      1 upvote

      A & B are correct answers. The question doesn't specified if there is a L3 device between PA and end host (ARP load Sharing) A -> https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/high-availability/ha-concepts/arp-load-sharing B -> https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/high-availability/ha-concepts/floating-ip-address-and-virtual-mac-address

   3. 1

      1298ac2

      2024-06-27

      Selected A1 upvote

      I think it is A (ARP Load Shareing), as you will need at least two floating IP to distribute the traffic over both fw and you will be using two default gw in your network.

9. Question 9 of 25

   Which software firewall would assist a prospect who is interested in securing extensive DevOps deployments?

   • ACN-Series
   • BIon-Series
   • CCloud next-generation firewall (NGFW)
   • DVM-Series

   Show answer

   Correct answer: A

   How others answered

   • A100%

   Explanation

   Answers is A CN-Series is the container-native version of the ML-powered NGFW designed specifically for Kubernetes environments. The Palo Alto Networks CN-Series containerized firewall is the best-in-class next generation firewall purpose built to secure the Kubernetes environment from network based attacks. The CN-Series firewall enables network security teams to gain layer-7 visibility into Kubernetes environments, provide inline threat protection for containerized applications deployed anywhere, and dynamically scale security without compromising DevOps agility.

   Adapted from community discussion by SyedHussain · 2024-09-16 · 6 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • docs.paloaltonetworks.com documentation

   View community discussion1

   Candidate context

   Question 9 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCSFE or CertExamHQ.

   1. S

      SyedHussain

      2024-09-16

      6 upvotes

      Answers is A CN-Series is the container-native version of the ML-powered NGFW designed specifically for Kubernetes environments. The Palo Alto Networks CN-Series containerized firewall is the best-in-class next generation firewall purpose built to secure the Kubernetes environment from network based attacks. The CN-Series firewall enables network security teams to gain layer-7 visibility into Kubernetes environments, provide inline threat protection for containerized applications deployed anywhere, and dynamically scale security without compromising DevOps agility.

10. Question 10 of 25

    How are CN-Series firewalls licensed?

    • AData-plane vCPU
    • BService-plane vCPU
    • CManagement-plane vCPU
    • DControl-plane vCPU

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    https://www.paloaltonetworks.com/apps/pan/public/downloadResource?pagePath=/content/pan/en_US/resources/datasheets/cn-series-container-firewall Last page it mentions that CN-series are licensed based on data plane vCPU "CN-Series licensing is similar to VM-Series licensing. Both VM-Series and CN-Series Firewalls are licensed based on Software NGFW Credits. CN-Series firewalls are licensed based on the number of Data Plane vCPUs"

    Adapted from community discussion by scn_lewisk · 2024-10-04 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.paloaltonetworks.com documentation

    View community discussion2

    Candidate context

    Question 10 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCSFE or CertExamHQ.

    1. S

       scn_lewisk

       2024-10-04

       Selected A2 upvotes

       https://www.paloaltonetworks.com/apps/pan/public/downloadResource?pagePath=/content/pan/en_US/resources/datasheets/cn-series-container-firewall Last page it mentions that CN-series are licensed based on data plane vCPU "CN-Series licensing is similar to VM-Series licensing. Both VM-Series and CN-Series Firewalls are licensed based on Software NGFW Credits. CN-Series firewalls are licensed based on the number of Data Plane vCPUs"

    2. R

       Redrum702

       2024-09-20

       1 upvote

       Answer C: https://docs.paloaltonetworks.com/cn-series/getting-started/cn-series-firewall-for-kubernetes/cn-series-core-building-blocks#:~:text=%E2%80%94The%20management%20plane%20(CN%2D,manifest%20files%20with%20ConfigMap%20objects.

11. Question 11 of 25

    Why are containers uniquely suitable for runtime security based on allow lists?

    • AContainers have only a few defined processes that should ever be executed.
    • BDevelopers define the processes used in containers within the Dockerfile.
    • CDocker has a built-in runtime analysis capability to aid in allow listing.
    • DOperations teams know which processes are used within a container.

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    A. Containers have only a few defined processes that should ever be executed. Reasons: Nature of Containers: Containers are designed to be lightweight and specialized, executing only a specific set of processes required by the application. This makes it easier to define and manage allow lists for runtime security. Source: Docker Documentation - What is a Container? Isolation and Immutability: Containers are isolated from each other and from the underlying operating system, and are generally immutable after creation. This means that any additional or unexpected processes can be readily identified and blocked, enhancing security. Source: Kubernetes Documentation - Containers

    Adapted from community discussion by bbbb72f · 2024-07-27 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion2

    Candidate context

    Question 11 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCSFE or CertExamHQ.

    1. B

       bbbb72f

       2024-07-27

       2 upvotes

       A. Containers have only a few defined processes that should ever be executed. Reasons: Nature of Containers: Containers are designed to be lightweight and specialized, executing only a specific set of processes required by the application. This makes it easier to define and manage allow lists for runtime security. Source: Docker Documentation - What is a Container? Isolation and Immutability: Containers are isolated from each other and from the underlying operating system, and are generally immutable after creation. This means that any additional or unexpected processes can be readily identified and blocked, enhancing security. Source: Kubernetes Documentation - Containers

    2. T

       TopicNerd

       2024-08-05

       Selected A1 upvote

       A. Containers have only a few defined processes that should ever be executed.

12. Question 12 of 25

    Which feature provides real-time analysis using machine learning (ML) to defend against new and unknown threats?

    • AAdvanced URL Filtering (AURLF)
    • BCortex Data Lake
    • CDNS Security
    • DPanorama VM-Series plugin

    Show answer

    Correct answer: A

    How others answered

    • A92%

    Explanation

    Answer is A: in addition to the protection offered by PAN-DB, Advanced URL Filtering provides real-time analysis using machine learning (ML) to defend against new and unknown threats.

    Adapted from community discussion by Redrum702 · 2024-03-03 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 12 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCSFE or CertExamHQ.

    1. 2

       2533eed

       2024-04-02

       Selected A6 upvotes

       Anything related to ML needs to have "Advanced" in its name.

    2. R

       Redrum702

       2024-03-03

       3 upvotes

       Answer is A: in addition to the protection offered by PAN-DB, Advanced URL Filtering provides real-time analysis using machine learning (ML) to defend against new and unknown threats.

    3. Q

       Questionario

       2024-07-31

       Selected A1 upvote

       A is the answer, has been linked already... it offers ML B is not even topic of the exam C has no machine learning, only inline cloud analysis D is just wrong

    4. L

       lol1000

       2024-04-10

       1 upvote

       I think it's A. D could also work since Palo is all about AI on all of the subs...

13. Question 13 of 25

    Which type of group allows sharing cloud-learned tags with on-premises firewalls?

    • ADevice
    • BNotify
    • CAddress
    • DTemplate

    Show answer

    Correct answer: C

    How others answered

    • C100%

    Supporting references

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    View community discussion4

    Candidate context

    Question 13 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCSFE or CertExamHQ.

    1. V

       VanFanel

       2024-09-20

       2 upvotes

       yes for NSX. But the correct answer is C - dynamic address group https://docs.paloaltonetworks.com/cloud-ngfw/aws/cloud-ngfw-on-aws/panorama-integration-overview/tag_based_policies

    2. V

       VanFanel

       2024-09-20

       Selected C1 upvote

       the correct answer is C - dynamic address group https://docs.paloaltonetworks.com/cloud-ngfw/aws/cloud-ngfw-on-aws/panorama-integration-overview/tag_based_policies

    3. R

       Redrum702

       2024-09-20

       1 upvote

       Answer is A: https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/policy/use-tags-to-group-and-visually-distinguish-objects

    4. A

       ak1r28

       2024-09-17

       1 upvote

       Is there such a things as a "Notify" group? A device group or address group is possible, but I haven't read of a "Notify" group.

14. Question 14 of 25

    A manager wants to enhance the performance of a Palo Alto Networks VM-Series firewall. How can the use of CLI increase the number of cores in the dataplane?

    • AUse init-cfg.txt with parameter "plugin-op-commands=dp-cores:<#-cores>.
    • BUse cfg.txt with parameter "plugin-op-commands=dp-cores:<#-cores>.
    • CRequest vm_series dp-cores <#-cores>.
    • DRequest plugins vm_series dp-cores <#-cores>.

    Show answer

    Correct answer: D

    How others answered

    • D100%

    Explanation

    If the VM-Series firewall is in initial deployment the answer would be A If it is a deployed firewall the answer is D. And for the question context I think that the correct answer in D. https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-new-features/virtualization-features/customize-dataplane-cores

    Adapted from community discussion by javim · 2024-10-04 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.paloaltonetworks.com documentation

    View community discussion1

    Candidate context

    Question 14 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCSFE or CertExamHQ.

    1. J

       javim

       2024-10-04

       Selected D3 upvotes

       If the VM-Series firewall is in initial deployment the answer would be A If it is a deployed firewall the answer is D. And for the question context I think that the correct answer in D. https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-new-features/virtualization-features/customize-dataplane-cores

15. Question 15 of 25

    What is created by the Panorama plugin as part of the infrastructure setup in Amazon Web Services (AWS) cloud?

    • ARoute tables and Security VPC with GWLB Endpoints only
    • BAWS Transit Gateway, route tables, and NAT Gateway subnets
    • CNAT Gateway subnets, Security VPC with GWLB Endpoints, and route tables
    • DSecurity VPC with GWLB endpoints, NAT Gateway subnets, and AWS Transit Gateway

    Show answer

    Correct answer: C

    How others answered

    • C100%

    Explanation

    Answer is C: As part of the infrastructure setup on the AWS cloud, the plugin creates Security VPC with GWLB Endpoints, firewalls, and NAT Gateway subnets and route tables. The plugin does not create AWS Transit Gateway (TGW). https://docs.paloaltonetworks.com/vm-series/10-1/vm-series-deployment/set-up-the-vm-series-firewall-on-aws/panorama-orchestrated-deployment-in-aws

    Adapted from community discussion by Redrum702 · 2024-09-21 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.paloaltonetworks.com documentation

    View community discussion2

    Candidate context

    Question 15 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCSFE or CertExamHQ.

    1. R

       Redrum702

       2024-09-21

       2 upvotes

       Answer is C: As part of the infrastructure setup on the AWS cloud, the plugin creates Security VPC with GWLB Endpoints, firewalls, and NAT Gateway subnets and route tables. The plugin does not create AWS Transit Gateway (TGW). https://docs.paloaltonetworks.com/vm-series/10-1/vm-series-deployment/set-up-the-vm-series-firewall-on-aws/panorama-orchestrated-deployment-in-aws

    2. J

       javim

       2024-09-30

       Selected C1 upvote

       As part of the infrastructure setup on the AWS cloud, the plugin creates Security VPC with GWLB Endpoints, firewalls, and NAT Gateway subnets and route tables. The plugin does not create AWS Transit Gateway (TGW). VM-Series firewall can inspect traffic routed between the VPCs.

16. Question 16 of 25

    To list NGFW pods connected to a management plane, which Panorama CLI command should be used?

    • Arequests plugins kubernetes get-node-license-info
    • Brequests plugins kubernetes get-license-tokens
    • Crequests plugins vm-series list-dp-pods
    • Drequests tech-support dump

    Show answer

    Correct answer: A

    How others answered

    • A50%
    • C50%

    Only 50% agreed on this answer — treat it as contested rather than settled.

    Explanation

    "A" is the closets to the real answer. There is no documentation on this, so I installed the kubernetes plugin on my lab Panorama. The real command is "request plugins kubernetes get-license-info". The description for this command is "Get the number of tokens and pods running in all clusters". If you're curious, install the plugin yourself and browse to the API operational commands for the plugin: https://{youPanoramaIP}/php/rest/browse.php/op::request::plugins::kubernetes

    Adapted from community discussion by Doobiedoo · 2024-04-18 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.paloaltonetworks.com documentation

    View community discussion4

    Candidate context

    Question 16 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCSFE or CertExamHQ.

    1. D

       Doobiedoo

       2024-04-18

       Selected A2 upvotes

       "A" is the closets to the real answer. There is no documentation on this, so I installed the kubernetes plugin on my lab Panorama. The real command is "request plugins kubernetes get-license-info". The description for this command is "Get the number of tokens and pods running in all clusters". If you're curious, install the plugin yourself and browse to the API operational commands for the plugin: https://{youPanoramaIP}/php/rest/browse.php/op::request::plugins::kubernetes

    2. S

       SyedHussain

       2024-03-17

       3 upvotes

       I didnt find the command, anyone can give reference link for the answer

    3. J

       javim

       2024-04-22

       2 upvotes

       The correct answer is C In the study module of CN-Series: Trobleshooting, the definition of "request plugins vm-series list-dp-pods " is "List the NGFW pods connected to this MP and license status"

    4. A

       admirecom2000

       2024-06-24

       1 upvote

       The correct answer is C, questions is about Connected Pod and not License check Troubleshoot section https://docs.paloaltonetworks.com/cn-series/troubleshooting/cn-series-troubleshooting

17. Question 17 of 25

    Which plugin is used to create and push device group-based policies to the Cloud NGFW?

    • APanorama AWS
    • BZero Touch Provisioning (ZTP)
    • CPanorama Interconnect «•
    • DCloud Services

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    "A" is correct. Read the "New Features" for the CloudConnector plugin for version 2.0.0. It explicitly states "[CloudConnector 2.0.0] Enables you to use the Panorama AWS plugin 5.0.0 to author and push device group based policies to Cloud NGFW for AWS resources." https://docs.paloaltonetworks.com/compatibility-matrix/panorama/plugins#idb0212b0e-3222-4cd0-b386-de4ff45987f4

    Adapted from community discussion by Doobiedoo · 2024-10-18 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.paloaltonetworks.com documentation

    View community discussion1

    Candidate context

    Question 17 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCSFE or CertExamHQ.

    1. D

       Doobiedoo

       2024-10-18

       Selected A2 upvotes

       "A" is correct. Read the "New Features" for the CloudConnector plugin for version 2.0.0. It explicitly states "[CloudConnector 2.0.0] Enables you to use the Panorama AWS plugin 5.0.0 to author and push device group based policies to Cloud NGFW for AWS resources." https://docs.paloaltonetworks.com/compatibility-matrix/panorama/plugins#idb0212b0e-3222-4cd0-b386-de4ff45987f4

18. Question 18 of 25

    When deploying a firewall in Amazon Web Services (AWS) utilizing the orchestration through Panorama, which plugin is required?

    • Avm_series-2.0.1 or later
    • Bcloud_services-3.2.0 or later
    • Caws-3.0.1 or later
    • Daws-5.0.1 or later

    Show answer

    Correct answer: C

    How others answered

    • C100%

    Explanation

    "C" is correct answer. In the plugin compatibility matrix, AWS plugin version 3.0.0 explicitly says it "Introduces Panorama Orchestration and new monitoring parameters.". https://docs.paloaltonetworks.com/compatibility-matrix/panorama/plugins#idb0212b0e-3222-4cd0-b386-de4ff45987f4

    Adapted from community discussion by Doobiedoo · 2024-10-18 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    View community discussion2

    Candidate context

    Question 18 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCSFE or CertExamHQ.

    1. S

       SyedHussain

       2024-09-16

       4 upvotes

       Answer should be C https://docs.paloaltonetworks.com/plugins/vm-series-and-panorama-plugins-release-notes/panorama-plugin-for-aws/aws-plugin-300/whats-new-in-panorama-plugin-for-aws-300#id3986df9a-770d-4c6a-9b91-40f747b6b2e8

    2. D

       Doobiedoo

       2024-10-18

       Selected C2 upvotes

       "C" is correct answer. In the plugin compatibility matrix, AWS plugin version 3.0.0 explicitly says it "Introduces Panorama Orchestration and new monitoring parameters.". https://docs.paloaltonetworks.com/compatibility-matrix/panorama/plugins#idb0212b0e-3222-4cd0-b386-de4ff45987f4

19. Question 19 of 25

    What is the minimum number of management interfaces created when the Google Cloud Platform (GCP) Marketplace deploys an instance of the VM-Series firewall?

    • A1
    • B2
    • C3
    • D4

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    A: One management, and two data plane. The Marketplace deploys an instance of the VM-Series firewall with a minimum of one management interface and two dataplane interfaces (Trust and Untrust) https://docs.paloaltonetworks.com/vm-series/10-2/vm-series-deployment/set-up-the-vm-series-firewall-on-google-cloud-platform/deploy-vm-series-on-gcp/deploy-the-vm-series-firewall-on-gcp

    Adapted from community discussion by scn_lewisk · 2024-10-04 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.paloaltonetworks.com documentation
    • Google Cloud documentation

    View community discussion2

    Candidate context

    Question 19 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCSFE or CertExamHQ.

    1. S

       scn_lewisk

       2024-10-04

       Selected A2 upvotes

       A: One management, and two data plane. The Marketplace deploys an instance of the VM-Series firewall with a minimum of one management interface and two dataplane interfaces (Trust and Untrust) https://docs.paloaltonetworks.com/vm-series/10-2/vm-series-deployment/set-up-the-vm-series-firewall-on-google-cloud-platform/deploy-vm-series-on-gcp/deploy-the-vm-series-firewall-on-gcp

    2. J

       javim

       2024-10-01

       Selected A2 upvotes

       One MGMT interface, but three network interface, mgmt, untrust and trust. https://cloud.google.com/architecture/partners/palo-alto-networks-ngfw

20. Question 20 of 25

    An engineer is setting up tags in Panorama, but it is not working. How can the engineer verify the issue while viewing the Amazon Web Services (AWS) plugin logs from the CLI?

    • Aless aws-plugin plugin_aws.log
    • Btail plugins-log plugin_aws_ret.log
    • Cless plugins-log
    • Dtail aws-plugin

    Show answer

    Correct answer: C

    How others answered

    • C50%
    • B50%

    Only 50% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Answer appears to be C: PLUG-2246 When viewing Panorama plugin for AWS logs, you cannot use the tail command. To view the AWS plugin logs from the CLI, use the following command: less plugins-log

    Adapted from community discussion by Redrum702 · 2024-09-18 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.paloaltonetworks.com documentation

    View community discussion4

    Candidate context

    Question 20 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCSFE or CertExamHQ.

    1. R

       Redrum702

       2024-09-18

       4 upvotes

       Answer appears to be C: PLUG-2246 When viewing Panorama plugin for AWS logs, you cannot use the tail command. To view the AWS plugin logs from the CLI, use the following command: less plugins-log

    2. J

       javim

       2024-10-21

       Selected C1 upvote

       Correct answer is C Know where to find the logs related to the AWS plugin on Panorama for troubleshooting. Use the CLI command less plugins-log to view a list of all available logs less plugins-log plugin_aws_ret.log -> displays logs related to IP address and tag retrieval. less plugins-log plugin_aws_proc.log -> displays logs related to processing of the registered IP address and tags. https://docs.paloaltonetworks.com/vm-series/11-1/vm-series-deployment/set-up-the-vm-series-firewall-on-aws/about-aws-vm-monitoring/set-up-vm-monitoring-on-aws

    3. L

       lol1000

       2024-10-11

       Selected C1 upvote

       Answer A Use the CLI command less plugins-log to view a list of all available logs less plugins-log plugin_aws_ret.log displays logs related to IP address and tag retrieval. https://docs.paloaltonetworks.com/vm-series/11-1/vm-series-deployment/set-up-the-vm-series-firewall-on-aws/about-aws-vm-monitoring/set-up-vm-monitoring-on-aws

    4. C

       commit666

       2024-11-14

       1 upvote

       correct answer is B plugins-log plugin_aws_ret.log contains logs related to IP address and tag retrieval.

21. Question 21 of 25

    In the Cloud NGFW for Amazon Web Services (AWS) centralized inbound deployment architecture, what is the next hop for the traffic after it passes through the application load balancer (ALB)?

    • AIngress VPC TGW ENI
    • BInternet gateway
    • CEgress VPC TGW ENI
    • DAWS Transit Gateway •

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    Centralized Inbound 1. Traffic from the internet arrives at the internet gateway. 2. The internet gateway routes traffic to the application load balancer (ALB). 3. The ALB then sends traffic to the ingress VPC TGW ENI. 4. The TGW ENI sends traffic to the TGW. 5. The TGW routes traffic to the security VPC TGW ENI. 6. The TGW ENI sends traffic to NGFW endpoint and on to the NGFW for inspection. 7. If the traffic is allowed, the NGFW endpoint sends the traffic to TGW. 8. The TGW then routes the traffic to the protected VPC TGW ENI and then on to the destination. [https://docs.paloaltonetworks.com/cloud-ngfw/aws/cloud-ngfw-on-aws/create-cloud-ngfw-instances-and-endpoints/direct-traffic-to-cloud-ngfw-for-aws/cloud-ngfw-for-aws-centralized-deployments]

    Adapted from community discussion by 3574e4e · 2024-12-04 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.paloaltonetworks.com documentation

    View community discussion1

    Candidate context

    Question 21 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCSFE or CertExamHQ.

    1. 3

       3574e4e

       2024-12-04

       Selected A3 upvotes

       Centralized Inbound 1. Traffic from the internet arrives at the internet gateway. 2. The internet gateway routes traffic to the application load balancer (ALB). 3. The ALB then sends traffic to the ingress VPC TGW ENI. 4. The TGW ENI sends traffic to the TGW. 5. The TGW routes traffic to the security VPC TGW ENI. 6. The TGW ENI sends traffic to NGFW endpoint and on to the NGFW for inspection. 7. If the traffic is allowed, the NGFW endpoint sends the traffic to TGW. 8. The TGW then routes the traffic to the protected VPC TGW ENI and then on to the destination. [https://docs.paloaltonetworks.com/cloud-ngfw/aws/cloud-ngfw-on-aws/create-cloud-ngfw-instances-and-endpoints/direct-traffic-to-cloud-ngfw-for-aws/cloud-ngfw-for-aws-centralized-deployments]

22. Question 22 of 25

    Which Cloud NGFW for AWS deployment method requires traffic to pass through an AWS Transit Gateway?

    • AEast-west
    • BCentralized
    • CInter VPC
    • DDistributed

    Show answer

    Correct answer: A

    How others answered

    • A50%
    • B50%

    Only 50% agreed on this answer — treat it as contested rather than settled.

    Explanation

    A transit gateway is connects virtual private cloud and on-premises networks through a central hub. East-West traffic is defined as traffic that goes between VPCs. VPC traffic does not traverse a a transit gateway. A centralized model is a model that utilizes transit gateways. All this info is pulled from the aws transit gateway deployment guide. I think the Answer is B

    Adapted from community discussion by 29fb203 · 2024-05-23 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion3

    Candidate context

    Question 22 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCSFE or CertExamHQ.

    1. 2

       29fb203

       2024-05-23

       2 upvotes

       A transit gateway is connects virtual private cloud and on-premises networks through a central hub. East-West traffic is defined as traffic that goes between VPCs. VPC traffic does not traverse a a transit gateway. A centralized model is a model that utilizes transit gateways. All this info is pulled from the aws transit gateway deployment guide. I think the Answer is B

    2. C

       commit666

       2024-05-14

       1 upvote

       Correct Answer: A Provides deployment details for the Centralized design model, which scales enterprise cloud deployments. This guide describes deploying VM-Series firewalls to provide resilient visibility and protection for the subscriber virtual private cloud’s (VPC’s) inbound, east-west, and outbound traffic using the AWS transit gateway and Gateway Load Balancer. https://www.paloaltonetworks.com/apps/pan/public/downloadResource?pagePath=/content/pan/en_US/resources/guides/aws-transit-gateway-deployment-guide

    3. C

       commit666

       2024-05-21

       Selected A1 upvote

       https://www.paloaltonetworks.com/apps/pan/public/downloadResource?pagePath=/content/pan/en_US/resources/guides/aws-transit-gateway-deployment-guide

23. Question 23 of 25

    What can software next-generation firewall (NGFW) credits be used to provision?

    • ARemote browser isolation
    • BVirtual Panorama appliances
    • CMigrating NGFWs from hardware to VMs
    • DEnablement of DNS security

    Show answer

    Correct answer: B

    How others answered

    • B100%

    Explanation

    The correct answer is B Software NGFW credits can be used to fund Software NGFWs (VM-Series and CN-Series), Cloud-Delivered Security Services (CDSS), or virtual Panorama appliances in networks with or without internet access (air-gapped networks, for example). https://docs.paloaltonetworks.com/vm-series/9-1/vm-series-deployment/license-the-vm-series-firewall/software-ngfw

    Adapted from community discussion by javim · 2024-04-09 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    View community discussion4

    Candidate context

    Question 23 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCSFE or CertExamHQ.

    1. J

       javim

       2024-04-09

       Selected B4 upvotes

       The correct answer is B Software NGFW credits can be used to fund Software NGFWs (VM-Series and CN-Series), Cloud-Delivered Security Services (CDSS), or virtual Panorama appliances in networks with or without internet access (air-gapped networks, for example). https://docs.paloaltonetworks.com/vm-series/9-1/vm-series-deployment/license-the-vm-series-firewall/software-ngfw

    2. C

       ChrjSM0512

       2024-05-28

       1 upvote

       This is a tricky question as you might get confuse between answer B and C, however parsing the answer C make me realize that the right answer must be the B. https://docs.paloaltonetworks.com/vm-series/9-1/vm-series-deployment/license-the-vm-series-firewall/software-ngfw/provision-panorama ( anser C is not correct as you might have an on-prem PAN-OS already license and you'll not have the option to transfer that license to a new deployed VM using those credits ) therefore the right answer is B

    3. 2

       29fb203

       2024-05-10

       2 upvotes

       Yes the correct answer is B https://docs.paloaltonetworks.com/vm-series/9-1/vm-series-deployment/license-the-vm-series-firewall/software-ngfw

    4. T

       TheIronSheik

       2024-07-01

       1 upvote

       this should be a mulitple choice question. The PSE study guide indicates credits can be used for PANO

24. Question 24 of 25

    Select 3

    The Cloud NGFW for AWS can capture and save which three types of logs? (Choose three.)

    • AThreat
    • BWildFire submissions
    • CDecryption
    • DURL Filtering
    • ETraffic

    Show answer

    Correct answer: A, C, E

    How others answered

    • ACE100%

    Explanation

    Correct Answer: ACE Cloud NGFW can capture and save three types of logs. Traffic—Traffic logs display an entry for the start and end of each session. See Cloud NGFW for AWS Traffic Log Fields for more information. Threat—Threat logs display entries when traffic matches one of the security profiles attached to a security rule on the firewall. Each entry includes the following information: date and time; type of threat (such as virus or spyware); threat description or URL (Name column); alarm action (such as allow or block); and severity level. Decryption—Decryption logs display entries for unsuccessful TLS handshakes by default and can display entries for successful TLS handshakes if you enable them in Decryption policy.

    Adapted from community discussion by Redrum702 · 2024-09-05 · 10 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.paloaltonetworks.com documentation

    View community discussion3

    Candidate context

    Question 24 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCSFE or CertExamHQ.

    1. R

       Redrum702

       2024-09-05

       10 upvotes

       Correct Answer: ACE Cloud NGFW can capture and save three types of logs. Traffic—Traffic logs display an entry for the start and end of each session. See Cloud NGFW for AWS Traffic Log Fields for more information. Threat—Threat logs display entries when traffic matches one of the security profiles attached to a security rule on the firewall. Each entry includes the following information: date and time; type of threat (such as virus or spyware); threat description or URL (Name column); alarm action (such as allow or block); and severity level. Decryption—Decryption logs display entries for unsuccessful TLS handshakes by default and can display entries for successful TLS handshakes if you enable them in Decryption policy.

    2. C

       commit666

       2024-11-21

       Selected A, C, E3 upvotes

       https://docs.paloaltonetworks.com/cloud-ngfw/aws/cloud-ngfw-on-aws/create-cloud-ngfw-instances-and-endpoints/configure-logging-for-the-cloud-ngfw-on-aws

    3. C

       commit666

       2024-11-14

       2 upvotes

       ACE Traffic Threat Decryption https://docs.paloaltonetworks.com/cloud-ngfw/aws/cloud-ngfw-on-aws/create-cloud-ngfw-instances-and-endpoints/configure-logging-for-the-cloud-ngfw-on-aws

25. Question 25 of 25

    What is the correct sequence of events for offloading by the Intelligent Traffic Offload (ITO) service?

    • ASample packets sent to ITO > ITO instructs Smart NIC to inspect of bypass > Smart NIC sends rest of flow to VM-Series for inspection
    • BITO instructs Smart NIC to inspect of bypass > Sample packets sent to ITO > Smart NIC forwards flow directly to destination
    • CSample packets sent to ITO > ITO instructs Smart NIC to inspect of bypass > Smart NIC forwards flow directly to destination
    • DITO instructs Smart NIC to inspect of bypass > Sample packets sent to ITO > Smart NIC sends rest of flow to VM-Series for inspection

    Show answer

    Correct answer: C

    How others answered

    • C75%
    • A25%

    Explanation

    "C" is the correct answer. The question is asking for the events for "offloading", not for "inspecting". Therefore the correct sequence is... 1) Sample packets sent to ITO 2) ITO instructs Smart NIC to inspect or bypass (bypass is the same as saying "offload") 3) Smart NIC forwards flow directly to destination (this is call "offloading" and bypasses inspection) Check out "Figure 2: ITO offload use case" in this blog: https://live.paloaltonetworks.com/t5/community-blogs/boost-vm-series-performance-with-smartnic-integration/ba-p/413658

    Adapted from community discussion by Doobiedoo · 2024-04-19 · 5 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • live.paloaltonetworks.com documentation

    View community discussion2

    Candidate context

    Question 25 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCSFE or CertExamHQ.

    1. D

       Doobiedoo

       2024-04-19

       Selected C5 upvotes

       "C" is the correct answer. The question is asking for the events for "offloading", not for "inspecting". Therefore the correct sequence is... 1) Sample packets sent to ITO 2) ITO instructs Smart NIC to inspect or bypass (bypass is the same as saying "offload") 3) Smart NIC forwards flow directly to destination (this is call "offloading" and bypasses inspection) Check out "Figure 2: ITO offload use case" in this blog: https://live.paloaltonetworks.com/t5/community-blogs/boost-vm-series-performance-with-smartnic-integration/ba-p/413658

    2. R

       Ravenspo

       2024-07-30

       Selected C1 upvote

       Key word in the question is "offloading". The whole purpose of the ITO is to not inspect traffic that doesn't need it, to speed up the flow through the firewall. So, what is the sequence to offload? ITO decides traffic doesn't need inspection, so directs smart NIC to bypass. Answer 'C'.

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCSFE practice, question 1 of 25