Palo Alto Networks NGFW-Engineer Practice Test 37
Question 360
A network operations team has passed initial acceptance for forward-trust decryption ca. The earlier condition was: A sanctioned TLS decryption policy is enabled but managed browsers reject the substitute certificates. Which continuing signal should it monitor while working to allow approved forward-proxy decryption without client trust warnings?
- Monitor spikes in untrusted upstream certificates and decryption failures.
- Monitor forward-trust certificate expiry and client TLS validation failures.
- Monitor failed client certificate validations and policy changes.
- Alert well before expiry for certificates actively used by management and VPN services.
Explanation
Correct Answer
B:Monitor forward-trust certificate expiry and client TLS validation failures. Forward-proxy decryption requires a trusted signing CA for generated server certificates. Ongoing evidence on the same failure path can detect drift after an initially successful deployment.
Incorrect Answers
A:Monitor spikes in untrusted upstream certificates and decryption failures. This signal follows forward-untrust decryption certificate rather than the documented forward-trust decryption ca failure. It might stay normal while the required control regresses.
C:Monitor failed client certificate validations and policy changes. This signal follows client certificate profile validation rather than the documented forward-trust decryption ca failure. It might stay normal while the required control regresses.
D:Alert well before expiry for certificates actively used by management and VPN services. This signal follows certificate renewal dependency rather than the documented forward-trust decryption ca failure. It might stay normal while the required control regresses.
Question 361
Following remediation, an operator must detect regression rather than repeat one-time testing. A client uses TLS inspection through the firewall and sees a distinct failure for an upstream certificate that cannot be trusted. Which monitoring activity is most relevant to the requirement to signal upstream certificate problems rather than silently creating apparent trust?
- Monitor spikes in untrusted upstream certificates and decryption failures.
- Monitor failed client certificate validations and policy changes.
- Monitor service-profile changes and certificate expiry before renewal.
- Monitor revocation service reachability and invalid-certificate acceptance attempts.
Explanation
Correct Answer
A:Monitor spikes in untrusted upstream certificates and decryption failures. Forward-untrust handling should distinguish upstream validation problems from a trusted intercepted connection. Ongoing evidence on the same failure path can detect drift after an initially successful deployment.
Incorrect Answers
B:Monitor failed client certificate validations and policy changes. This signal follows client certificate profile validation rather than the documented forward-untrust decryption certificate failure. It might stay normal while the required control regresses.
C:Monitor service-profile changes and certificate expiry before renewal. This signal follows tls service profile certificate identity rather than the documented forward-untrust decryption certificate failure. It might stay normal while the required control regresses.
D:Monitor revocation service reachability and invalid-certificate acceptance attempts. This signal follows certificate revocation checking rather than the documented forward-untrust decryption certificate failure. It might stay normal while the required control regresses.
Question 362
The affected PAN-OS capability is back in service after this problem: A privileged VPN portal must accept only clients with a certificate issued by an approved enterprise CA. What should operations track so the goal to enforce trusted client certificate authentication criteria remains satisfied?
- Monitor service-profile changes and certificate expiry before renewal.
- Alert well before expiry for certificates actively used by management and VPN services.
- Monitor new decryption exemptions and changes in bypassed traffic volume.
- Monitor failed client certificate validations and policy changes.
Explanation
Correct Answer
D:Monitor failed client certificate validations and policy changes. Certificate profiles specify how client certificates are validated for authenticated access. Ongoing evidence on the same failure path can detect drift after an initially successful deployment.
Incorrect Answers
A:Monitor service-profile changes and certificate expiry before renewal. This signal follows tls service profile certificate identity rather than the documented client certificate profile validation failure. It might stay normal while the required control regresses.
B:Alert well before expiry for certificates actively used by management and VPN services. This signal follows certificate renewal dependency rather than the documented client certificate profile validation failure. It might stay normal while the required control regresses.
C:Monitor new decryption exemptions and changes in bypassed traffic volume. This signal follows decryption policy exception scope rather than the documented client certificate profile validation failure. It might stay normal while the required control regresses.
Question 363
A change fixed the reported issue: The management API presents a self-signed certificate despite a CA-issued management certificate being available. Which recurring evidence best detects a return of the failure while the team continues to serve the intended trusted certificate for administrative TLS?
- Alert well before expiry for certificates actively used by management and VPN services.
- Monitor revocation service reachability and invalid-certificate acceptance attempts.
- Monitor service-profile changes and certificate expiry before renewal.
- Monitor CA trust changes and new certificate verification failures.
Explanation
Correct Answer
C:Monitor service-profile changes and certificate expiry before renewal. A service profile selects the certificate used for supported inbound management TLS. Ongoing evidence on the same failure path can detect drift after an initially successful deployment.
Incorrect Answers
A:Alert well before expiry for certificates actively used by management and VPN services. This signal follows certificate renewal dependency rather than the documented tls service profile certificate identity failure. It might stay normal while the required control regresses.
B:Monitor revocation service reachability and invalid-certificate acceptance attempts. This signal follows certificate revocation checking rather than the documented tls service profile certificate identity failure. It might stay normal while the required control regresses.
D:Monitor CA trust changes and new certificate verification failures. This signal follows certificate issuer integration rather than the documented tls service profile certificate identity failure. It might stay normal while the required control regresses.
Question 364
A network operations team has passed initial acceptance for certificate renewal dependency. The earlier condition was: A firewall's certificate expires during a planned GlobalProtect gateway migration. Which continuing signal should it monitor while working to maintain usable trusted certificates throughout the gateway cutover?
- Monitor revocation service reachability and invalid-certificate acceptance attempts.
- Alert well before expiry for certificates actively used by management and VPN services.
- Monitor new decryption exemptions and changes in bypassed traffic volume.
- Monitor forward-trust certificate expiry and client TLS validation failures.
Explanation
Correct Answer
B:Alert well before expiry for certificates actively used by management and VPN services. Certificate renewal must preserve the key, chain and correct service association. Ongoing evidence on the same failure path can detect drift after an initially successful deployment.
Incorrect Answers
A:Monitor revocation service reachability and invalid-certificate acceptance attempts. This signal follows certificate revocation checking rather than the documented certificate renewal dependency failure. It might stay normal while the required control regresses.
C:Monitor new decryption exemptions and changes in bypassed traffic volume. This signal follows decryption policy exception scope rather than the documented certificate renewal dependency failure. It might stay normal while the required control regresses.
D:Monitor forward-trust certificate expiry and client TLS validation failures. This signal follows forward-trust decryption ca rather than the documented certificate renewal dependency failure. It might stay normal while the required control regresses.
Question 365
Following remediation, an operator must detect regression rather than repeat one-time testing. A remote access client certificate was revoked but a test connection still succeeds. Which monitoring activity is most relevant to the requirement to enforce the configured certificate revocation policy for client authentication?
- Monitor revocation service reachability and invalid-certificate acceptance attempts.
- Monitor new decryption exemptions and changes in bypassed traffic volume.
- Monitor CA trust changes and new certificate verification failures.
- Monitor spikes in untrusted upstream certificates and decryption failures.
Explanation
Correct Answer
A:Monitor revocation service reachability and invalid-certificate acceptance attempts. Revocation checking guards against previously issued credentials that should no longer authenticate. Ongoing evidence on the same failure path can detect drift after an initially successful deployment.
Incorrect Answers
B:Monitor new decryption exemptions and changes in bypassed traffic volume. This signal follows decryption policy exception scope rather than the documented certificate revocation checking failure. It might stay normal while the required control regresses.
C:Monitor CA trust changes and new certificate verification failures. This signal follows certificate issuer integration rather than the documented certificate revocation checking failure. It might stay normal while the required control regresses.
D:Monitor spikes in untrusted upstream certificates and decryption failures. This signal follows forward-untrust decryption certificate rather than the documented certificate revocation checking failure. It might stay normal while the required control regresses.
Question 366
The affected PAN-OS capability is back in service after this problem: An inspection bypass rule covers an entire business zone even though only a limited incompatible application needs exemption. What should operations track so the goal to avoid unnecessarily broad TLS decryption exclusions remains satisfied?
- Monitor CA trust changes and new certificate verification failures.
- Monitor forward-trust certificate expiry and client TLS validation failures.
- Monitor failed client certificate validations and policy changes.
- Monitor new decryption exemptions and changes in bypassed traffic volume.
Explanation
Correct Answer
D:Monitor new decryption exemptions and changes in bypassed traffic volume. A broad decryption bypass weakens visibility beyond the application that requires an exception. Ongoing evidence on the same failure path can detect drift after an initially successful deployment.
Incorrect Answers
A:Monitor CA trust changes and new certificate verification failures. This signal follows certificate issuer integration rather than the documented decryption policy exception scope failure. It might stay normal while the required control regresses.
B:Monitor forward-trust certificate expiry and client TLS validation failures. This signal follows forward-trust decryption ca rather than the documented decryption policy exception scope failure. It might stay normal while the required control regresses.
C:Monitor failed client certificate validations and policy changes. This signal follows client certificate profile validation rather than the documented decryption policy exception scope failure. It might stay normal while the required control regresses.
Question 367
A change fixed the reported issue: User-based security rules stop matching after workstations renew their addresses. Which recurring evidence best detects a return of the failure while the team continues to associate the right authenticated username with current client IP addresses?
- Monitor stale directory-group data and group mapping sync errors.
- Monitor Cloud Identity Engine sync failures and identity group update delays.
- Monitor stale mappings and unidentified-user traffic from the client segment.
- Monitor mapping changes attributed to unauthorized sources.
Explanation
Correct Answer
C:Monitor stale mappings and unidentified-user traffic from the client segment. User-ID policy depends on current IP-to-identity mapping for the source session. Ongoing evidence on the same failure path can detect drift after an initially successful deployment.
Incorrect Answers
A:Monitor stale directory-group data and group mapping sync errors. This signal follows directory group mapping rather than the documented user-id user to ip mapping failure. It might stay normal while the required control regresses.
B:Monitor Cloud Identity Engine sync failures and identity group update delays. This signal follows cloud identity engine sync rather than the documented user-id user to ip mapping failure. It might stay normal while the required control regresses.
D:Monitor mapping changes attributed to unauthorized sources. This signal follows user-id source trust boundary rather than the documented user-id user to ip mapping failure. It might stay normal while the required control regresses.
Question 368
A network operations team has passed initial acceptance for directory group mapping. The earlier condition was: A security rule references an AD group but its renamed members are missing from the firewall's matching identity set. Which continuing signal should it monitor while working to refresh group membership information for policy decisions?
- Monitor Cloud Identity Engine sync failures and identity group update delays.
- Monitor stale directory-group data and group mapping sync errors.
- Monitor User-ID redistribution disconnects and unexpected mapped IP ranges.
- Monitor terminal server mapping agent health and unexpected shared-user attribution.
Explanation
Correct Answer
B:Monitor stale directory-group data and group mapping sync errors. Group mapping supplies directory membership for group-specific policy matching. Ongoing evidence on the same failure path can detect drift after an initially successful deployment.
Incorrect Answers
A:Monitor Cloud Identity Engine sync failures and identity group update delays. This signal follows cloud identity engine sync rather than the documented directory group mapping failure. It might stay normal while the required control regresses.
C:Monitor User-ID redistribution disconnects and unexpected mapped IP ranges. This signal follows user-id redistribution rather than the documented directory group mapping failure. It might stay normal while the required control regresses.
D:Monitor terminal server mapping agent health and unexpected shared-user attribution. This signal follows terminal server user mapping rather than the documented directory group mapping failure. It might stay normal while the required control regresses.
Question 369
Following remediation, an operator must detect regression rather than repeat one-time testing. A multi-site environment uses Cloud Identity Engine but one cloud directory group has not populated firewall group policy. Which monitoring activity is most relevant to the requirement to deliver current cloud group context into supported identity policy?
- Monitor Cloud Identity Engine sync failures and identity group update delays.
- Monitor User-ID redistribution disconnects and unexpected mapped IP ranges.
- Monitor mapping changes attributed to unauthorized sources.
- Monitor authentication portal failures and unauthenticated-user flows.
Explanation
Correct Answer
A:Monitor Cloud Identity Engine sync failures and identity group update delays. Cloud identity integration depends on a functioning selected directory synchronization path. Ongoing evidence on the same failure path can detect drift after an initially successful deployment.
Incorrect Answers
B:Monitor User-ID redistribution disconnects and unexpected mapped IP ranges. This signal follows user-id redistribution rather than the documented cloud identity engine sync failure. It might stay normal while the required control regresses.
C:Monitor mapping changes attributed to unauthorized sources. This signal follows user-id source trust boundary rather than the documented cloud identity engine sync failure. It might stay normal while the required control regresses.
D:Monitor authentication portal failures and unauthenticated-user flows. This signal follows captive portal user identification rather than the documented cloud identity engine sync failure. It might stay normal while the required control regresses.
Question 370
The affected PAN-OS capability is back in service after this problem: Regional firewalls cannot use mappings learned by a central trusted firewall and the same clients become unknown users. What should operations track so the goal to redistribute approved identity mapping data across trusted segments remains satisfied?
- Monitor mapping changes attributed to unauthorized sources.
- Monitor terminal server mapping agent health and unexpected shared-user attribution.
- Alert on abnormally old User-ID mappings and inconsistent username changes.
- Monitor User-ID redistribution disconnects and unexpected mapped IP ranges.
Explanation
Correct Answer
D:Monitor User-ID redistribution disconnects and unexpected mapped IP ranges. Identity redistribution shares user context only through configured trusted channels. Ongoing evidence on the same failure path can detect drift after an initially successful deployment.
Incorrect Answers
A:Monitor mapping changes attributed to unauthorized sources. This signal follows user-id source trust boundary rather than the documented user-id redistribution failure. It might stay normal while the required control regresses.
B:Monitor terminal server mapping agent health and unexpected shared-user attribution. This signal follows terminal server user mapping rather than the documented user-id redistribution failure. It might stay normal while the required control regresses.
C:Alert on abnormally old User-ID mappings and inconsistent username changes. This signal follows identity mapping timeout rather than the documented user-id redistribution failure. It might stay normal while the required control regresses.
