PSE-PLATFORM Online Practice Questions and Answers

Which license is required to receive weekly dynamic updates to the correlation objects on the firewall and Panorama?

A. WildFire on the firewall, and AutoFocus on Panorama

B. URL Filtering on the firewall, and MindMeld on Panorama

C. Threat Prevention on the firewall, and Support on Panorama

D. GlobalProtect on the firewall, and Threat Prevention on Panorama

DNS sinkholing helps identify infected hosts on the protected network using DNS traffic in situations where the firewall cannot see the infected client's DNS query (that is, the firewall cannot see the originator of DNS query)

Which of the following Statements is true?

A. DNS Sinkholing requires the Vulnerability Protection Profile be enabled.

B. Sinkholing malware DNS queries solves this visibilty problem by forging responses to the client host queries directed at fake domains created in a controlled "Fake Internet" called Zanadu which designed for testing and honeypots.

C. Infected hosts can then be easily identified in the traffic logs because any host that attempts to connect the sinkhole IP address are most likely infected with malware.

D. DNS Sinkholing requires a license SinkHole license in order to activate.

A customer is seeing an increase in the number of malicious files coming in from undetectable sources in

their network.

These files include doc and .pdf file types. The customer believes that someone has clicked an email that

might have contained a malicious file type. The customer already uses a firewall with User-ID enabled.

Which feature must also be enabled to prevent these attacks?

A. WildFire

B. App-ID

C. Custom App-ID rules

D. Content Filtering

Which variable is used to regulate the rate of file submission to WildFire?

A. Based on the purchase license

B. Maximum number of files per minute

C. Available bandwidth

D. Maximum number of files per day

Which configuration creates the most comprehensive "best-practice" Anti Spyware profile to prevent command and Control traffic?

A. Clone the Strict Anti-Spyware Profile, enable DNS Sinkholing and Passive DNS Monitoring, and deploy this customized clone

B. Clone the Default Anti-Spyware Profile and enable DNS Sinkholing and Passive DNS Monitoring, and deploy this customized clone

C. Edit and deploy the Default Anti-Spyware Profile (DNS Sinkholing and Passive DNS Monitoring is already enabled)

D. Edit and deploy the Strict Anti-Spyware Profile Profile (DNS Sinkholing and Passive DNS Monitoring is already enabled)

Which four actions can be configured in an Anti-Spyware profile to address command-and-control traffic from compromised hosts? (Choose four.)

A. Allow

B. Drop

C. Quarantine

D. Redirect

E. Alert

F. Reset

Which three signature-based Threat Prevention features of the firewall are informed by intelligence from the Threat Intelligence Cloud? (Choose three.)

A. Vulnerability protection

B. Anti-Spyware

C. Anti-Virus

D. Botnet detection

E. App-ID protection

An administrator needs a PDF summary report that contains information compiled from existing reports

based on data for the top 5 in each category.

How often will the Administrator receive the report?

A. Bi-weekly

B. Daily

C. Weekly

D. Monthly

Which three actions should be taken before deploying a firewall evaluation unit in the customer's environment? (Choose three.)

A. Inform the customer that they will need to provide a SPAN port for the evaluation unit assuming a TAP mode deployment.

B. Request that the customs make port 3978 available to allow the evaluation unit to communicate with Panorama.

C. Reset the evaluation unit to factory default to ensure that data from any previous customer evaluation is removed.

D. Upgrade the evaluation unit to the most current recommended firmware, unless a demo of the upgrade process is planned.

E. Set expectations around which information will be presented in the Security Lifecycle Review because sensitive information may be made visible.

The botnet report displays a confidence score of 1 to 5 indicating the likelihood of a botnet infection.

Which three sources are used by the firewall as the basis of this score? (Choose three.)

A. Bad Certificate Reports

B. Traffic Type

C. Botnet Reports

D. Number of Events

E. Executable Downloads

F. Threat Landscape