PSE-Strata無料更新100%試験合格率保証 [2023]
[2023年12月] 認証されたPalo Alto Networks試験問題集でPSE-Strata試験学習ガイド
質問 # 77
Which two features are found in a Palo Alto Networks NGFW but are absent in a legacy firewall product? (Choose two.)
- A. Identification of application is possible on any port
- B. Traffic is separated by zones
- C. Traffic control is based on IP port, and protocol
- D. Policy match is based on application
正解：A、D
質問 # 78
What two types of certificates are used to configure SSL Forward Proxy? (hoose two.)
- A. Enterprise CA-signed certificates
- B. Intermediate certificates
- C. Self-Signed certificates
- D. Private key certificates
正解：A、C
質問 # 79
A customer is concerned about malicious activity occurring directly on their endpoints and will not be visible to their firewalls.
Which three actions does the Traps agent execute during a security event, beyond ensuring the prevention of this activity? (Choose three.)
- A. Collects forensic information about the event
- B. Communicates the status of the endpoint to the ESM
- C. Notifies the user about the event
- D. Informs WildFire and sends up a signature to the Cloud
- E. Remediates the event by deleting the malicious file
正解：A、B、C
解説：
https://investors.paloaltonetworks.com/node/11156/html
質問 # 80
What are three considerations when deploying User-ID? (Choose three.)
- A. Specify included and excluded networks when configuring User-ID
- B. User-ID can support a maximum of 15 hops
- C. Only enable User-ID on trusted zones
- D. Use a dedicated service account for User-ID services with the minimal permissions necessary
- E. Enable WMI probing in high security networks
正解：A、C、D
質問 # 81
The firewall includes predefined reports, custom reports can be built for specific data and actionable tasks, or predefined and custom reports can be combined to compile information needed to monitor network security The firewall provides which three types of reports? (Choose three.)
- A. PDF Summary Reports
- B. SNMP Reports
- C. Botnet Reports
- D. Netflow Reports
- E. User or Group Activity Reports
正解：C、D、E
質問 # 82
Which three policies or certificates must be configured for SSL Forward Proxy decryption?
(Choose three.)
- A. A decryption policy
- B. Forward untrust certificate
- C. Forward trust certificate
- D. A decrypt port mirror policy
- E. Internal server certificate
正解：A、B、C
解説：
https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/decryption/keys-and- certificates-for-decryption-policies#_40372
質問 # 83
Which statement is true about Deviating Devices and metrics?
- A. Deviating Device Tab is only available for hardware-based firewalls
- B. Deviating Device Tab is only available with a SD-WAN Subscription
- C. An Administrator can set the metric health baseline along with a valid standard deviation
- D. A metric health baseline is determined by averaging the health performance for a given metric over seven days plus the standard deviation
正解：D
質問 # 84
Prisma SaaS provides which two SaaS threat prevention capabilities? (Choose two)
- A. SaaS AppID signatures
- B. remote procedural call (RPC) interrogation
- C. WildFire analysis
- D. shellcode protection
- E. file quarantine
正解：A、C
質問 # 85
Which profile or policy should be applied to protect against port scans from the internet?
- A. Zone protection profile on the zone of the ingress interface
- B. Interface management profile on the zone of the ingress interface
- C. An App-ID security policy rule to block traffic sourcing from the untrust zone
- D. Security profiles to security policy rules for traffic sourcing from the untrust zone
正解：A
解説：
https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-web-interface-help/network/network- network-profiles-zone-protection/reconnaissance-protection.html
質問 # 86
Which two features are found in Palo Alto Networks NGFW but are absent in a legacy firewall product? (Choose two.)
- A. Traffic control is based on IP, port, and protocol
- B. Identification of application is possible on any port
- C. Traffic is separated by zones
- D. Policy match is based on application
正解：B、D
質問 # 87
Which selection must be configured on PAN-OS External Dynamic Lists to support MineMeld indicators?
- A. Feed Base URL
- B. Prototype
- C. Inputs
- D. Class
正解：A
解説：
Explanation
https://live.paloaltonetworks.com/t5/minemeld-articles/connecting-pan-os-to-minemeld-using-external-dynamic-
質問 # 88
An Administrator needs a PDF summary report that contains information compiled from existing reports based on data for the Top five(5) in each category.
Which two timeframe options are available to send this report? (Choose two.)
- A. Monthly
- B. Daily
- C. Weekly
- D. Bi-weekly
正解：B、C
質問 # 89
What are two benefits of the sinkhole Internet Protocol (IP) address that DNS Security sends to the client in place of malicious IP addresses? (Choose two.)
- A. It represents the remediation server that the client should visit for patching
- B. It will take over as the new DNS resolver for that client and prevent further DNS requests from occurring in the meantime
- C. In situations where the internal DNS server is between the client and the firewall, it gives the firewall the ability to identify the clients who originated the query to the malicious domain
- D. The client communicates with it instead of the malicious IP address
正解：C、D
質問 # 90
How frequently do WildFire signatures move into the antivirus database?
- A. once a week
- B. every 1 hour
- C. every 24 hours
- D. every 12 hours
正解：C
質問 # 91
What are two advantages of the DNS Sinkholing feature? (Choose two.)
- A. It can work upstream from the internal DNS server.
- B. It can be deployed independently of an Anti-Spyware Profile.
- C. It monitors DNS requests passively for malware domains.
- D. It forges DNS replies to known malicious domains.
正解：A、D
解説：
Explanation
https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/threat-prevention/dns-sinkholing
質問 # 92
Which three platform components can identify and protect against malicious email links? (Choose three.)
- A. WF-500
- B. M-200
- C. WildFire hybrid cloud solution
- D. WildFire public cloud
- E. M-600
正解：A、B、D
質問 # 93
Match the functions to the appropriate processing engine within the dataplane.
正解：
解説：
質問 # 94
Which three settings must be configured to enable Credential Phishing Prevention? (Choose three.)
- A. define URL Filtering Profile
- B. enable App-ID
- C. enable User-ID
- D. validate credential submission detection
- E. define an SSL decryption rulebase
正解：A、C、D
解説：
Explanation
https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/threat-prevention/prevent-credential-phishing.html
質問 # 95
What can be applied to prevent users from unknowingly downloading malicious file types from the internet?
- A. A file blocking profile to security policy rules that allow general web access
- B. An antivirus profile to security policy rules that deny general web access
- C. A zone protection profile to the untrust zone
- D. A vulnerability profile to security policy rules that deny general web access
正解：A
解説：
https://docs.paloaltonetworks.com/best-practices/8-1/internet-gateway-best-practices/best-practice-internet-gateway-security-policy/create-best-practice-security-profiles.html
質問 # 96
Which three features are used to prevent abuse of stolen credentials? (Choose three.)
- A. URL Filtering Profiles
- B. multi-factor authentication
- C. SSL decryption rules
- D. WildFire Profiles
- E. Prisma Access
正解：B、C、D
質問 # 97
What is a best practice when configuring a security policy to completely block a specific application?
- A. On the Actions tab, configure a file blocking security profile
- B. On the Service/URL. Category tab, set the service to application-default
- C. On the Service/URL. Category tab, manually specify a port/service
- D. One the Service/URL. Category tab, set the service to any
正解：D
質問 # 98
How do you configure the rate of file submissions to WildFire in the NGFW?
- A. QoS tagging
- B. maximum number of files per minute
- C. maximum number of files per day
- D. based on the purchased license uploaded
正解：B
質問 # 99
What is the HA limitation specific to the PA-200 appliance?
- A. Is the only Palo Alto Networks firewall that does not have any HA capabilities
- B. Has a dedicated HA1 and HA2 ports, but no HA3
- C. Can be deployed in either an active/passive or active/active HA pair
- D. Can only synchronize configurations and does not support session synchronization
正解：D
質問 # 100
......
Palo Alto Networks PSE -Strata（Palo Alto Networks System Engineer Professional -Strata）認定試験は、サイバーセキュリティの分野におけるIT専門家の専門知識と知識を検証するグローバルに認められた認定プログラムです。この認定試験は、Palo Alto Networksファイアウォール製品とサービスで働く個人のスキルをテストするように設計されています。 PSE-STRATA認定試験は、サイバーセキュリティでキャリアを開始している人や、この分野での知識とスキルを向上させようとしている人に最適なエントリーレベルの認定です。
Palo Alto NetworksのPSE-Strata（Palo Alto Networks System Engineer Professional - Strata）試験は、Palo Alto Networksが提供する認定試験で、Palo Alto Networksセキュリティソリューションの実装と管理を担当するシステムエンジニアの知識とスキルを評価することを目的としています。試験は、ネットワークセキュリティ、クラウドセキュリティ、エンドポイントセキュリティ、脅威防止など、広範囲にわたるトピックをカバーしています。
正真正銘のベスト試験材料はPSE-Strataオンライン練習試験：https://www.jpntest.com/shiken/PSE-Strata-mondaishu