PCNSE6 試験問題を無料オンラインアクセス

A Palo Alto Networks firewall is being targeted by an NTP Amplification attack and is being flooded with tens of thousands of bogus UDP connections per second to a single destination IP address and port.
Which option, when enabled with the correct threshold, would mitigate this attack without dropping legitimate traffic to other hosts inside the network?

• A.Zone Protection Policy with UDP Flood Protection
• B.Security Policy rule to deny traffic to the IP address and port that is under attack
• C.Classified DoS Protection Policy using destination IP only with a Protect action
• D.QoS Policy to throttle traffic below maximum limit

What has happened when the traffic log shows an internal host attempting to open a session to a properly configured sinkhole address?

• A.A malicious domain is trying to contact an internal DNS server.
• B.The internal host attempted to use DNS to resolve a known malicious domain into an IP address.
• C.The internal host is trying to resolve a DNS query by connecting to a rogue DNS server.
• D.A rogue DNS server is now using the sinkhole address to direct traffic to a known malicious domain.

By default, all PA-5060 syslog data is forwarded out the Management interface. What needs to be configured in order to send syslog data out of a different interface?

• A.Configure a Service Route for the Syslog service to use a dataplane interface.
• B.Configure Service Route Only for Threats and URL Filtering, and the traffic will use the same route.
• C.Configure an Interface Management Profile and apply it to the interface that the syslogs will be sent through.
• D.Create a Log-Forwarding Profile that points to the device that will receive the syslogs.

HOTSPOT
Assuming that the default antivirus profile is installed, match each decoder with its default action.
Answer options may be used more than once or not at all.

正解：

Explanation:
FTP, SMB - Block HTTP - Block POP3, SMTP - Alert IMAP - Alert

A security architect has been asked to implement User-ID in a MacOS environment with no enterprise email, using a Sun LDAP server for user authentication.
In this environment, which two User-ID methods are effective for mapping users to IP addresses? Choose 2 answers

• A.GlobalProtect
• B.Captive Portal
• C.Mac OS Agent
• D.Terminal Server Agent