NO.15 A cybersecurity team suspects a sophisticated, custom malware campaign targeting specific internal hosts. Traditional signature-based AV and WildFire submissions show no hits, yet anomalous network behavior persists, and host forensics confirm compromise. The Palo Alto Networks firewall’s Threat Prevention policies are enabled. Which specific, less common misconfiguration or oversight on the firewall’s advanced threat prevention features could be allowing this stealthy malware to bypass detection, and what troubleshooting step would best confirm it?

NO.16 A Palo Alto Networks firewall is configured with an External Dynamic List (EDL) sourced from an internal web server. The web server is located in a different security zone. Which of the following security policy rules must be in place to allow the firewall to successfully fetch updates for this EDL?

NO.17 A Palo Alto Networks firewall is configured with an Anti-Spyware profile that includes a custom signature designed to detect a specific command-and-control (C2) beacon. The signature is defined with a ‘Context’ of ‘Server’ and a ‘Direction’ of ‘C2’. During a security incident investigation, you observe traffic from an internal compromised host initiating an outbound connection to a known C2 server, but the custom signature is not triggering. Which of the following could be potential reasons for the signature not triggering, assuming the C2 beacon itself matches the signature’s pattern?

NO.18 A financial institution has a requirement to send all traffic originating from the ‘Finance’ security zone, destined for external banking APIs (known IP ranges), through a dedicated, high-throughput internet link. Simultaneously, all other internet traffic from the ‘Finance’ zone should use the standard, lower-cost internet uplink. A PBF rule is configured as follows:

After deployment, users in the ‘Finance’ zone report that some API traffic is still going over the standard link. What is the most probable cause for this misbehavior?

NO.19 Based on the show security policy rule would match all FTP traffic from the inside zone to the outside zone?

NO.20 An organization uses an on-premises web application for internal sensitive data processing. They need to ensure that only authenticated users from specific Active Directory groups (e.g., ‘Finance-Admins’) can access the application. Furthermore, the application requires a custom HTTP header ‘X-App-Auth: ‘ to be present in all requests for successful operation. If this header is missing or incorrect, the request should be blocked. Which configuration combines these requirements most effectively on a Palo Alto Networks firewall?

NO.21 An administrator has configured a Security policy where the matching condition includes a single application and the action is deny If the application s default deny action is reset-both what action does the firewall take*?

NO.22 You are deploying a new application on a Palo Alto Networks firewall and need to create a custom Application (App-ID) for it. The application communicates over TCP port 8443, uses TLS, and sends a specific HTTP header ‘X-App-ID: MyWebApp’ in all its requests. The application also uses a unique URI path structure, To ensure the most accurate and robust App-ID, which custom application signature configuration would be most appropriate?

NO.23 Which two DNS policy actions in the anti-spyware security profile can prevent hacking attacks through DNS queries to malicious domains? (Choose two.)

NO.24 A Palo Alto Networks firewall is performing SSL Forward Proxy decryption. An analyst observes that certain legitimate SaaS applications (e.g., specific Microsoft 365 services) are experiencing intermittent connectivity issues when decryption is enabled, despite having valid certificates. After reviewing the traffic logs, the analyst sees ‘Application not recognized’ or ‘Unknown’ for these connections. Which advanced decryption profile setting is most likely to resolve this issue without disabling decryption entirely for these critical applications?

NO.25 You are auditing a Palo Alto Networks firewall configuration. An External Dynamic List for ‘Domain’ type is configured to fetch from
https://threatfeed.example.com/domains.txt
with an update interval of 1 hour. The firewall’s system logs show repeated messages like ‘EDL Refresh Error: ssI_error_ssI:ssI_routines: ss13_read_bytes: sslv3 alert handshake failure’. What is the most probable root cause for this specific error?

NO.26 To what must an interface be assigned before it can process traffic?

NO.27 When is an event displayed under threat logs?

NO.28 Which three configuration settings are required on a Palo Alto networks firewall management interface?

NO.29 Which stage of the cyber-attack lifecycle makes it important to provide ongoing education to users on spear phishing links, unknown emails, and risky websites?

NO.30 Refer to the exhibit. An administrator is using DNAT to map two servers to a single public IP address. Traffic will be steered to the specific server based on the application, where Host A (10.1.1.100) receives HTTP traffic and Host B (10.1.1.101) receives SSH traffic.

Which two Security policy rules will accomplish this configuration? (Choose two.)

NO.31 Which DNS Query action is recommended for traffic that is allowed by Security policy and matches Palo Alto Networks Content DNS Signatures?