Question 1

What is the main security benefit of adding a CN-Series firewall to an existing VM-Series firewall deployment when the customer is using containers?

AIt provides perimeter threat detection and inspection outside the container itself.

BIt prevents lateral threat movement within the container itself.

CIt monitors and logs traffic outside the container itself.

DIt enables core zone segmentation within the container itself.

Answer : B

Question 2

An IT security administrator is maintaining connectivity and security between on-premises infrastructure, private cloud, and public cloud environments in Strata Cloud Manager (SCM).

Which set of practices must be implemented to effectively manage certificates and ensure secure communication across these segmented environments?

AUse a centralized certificate management solution. Regularly renew and update certificates. Employ strong encryption protocols.

BUse self-signed certificates for all environments.
Renew certificates manually once a year.
Avoid automating certificate management to maintain control.

CRely on the cloud provider's default certificates.
Avoid renewing certificates to reduce overhead and complexity. Manage certificate deployment manually.

DImplement different certificate authorities (CAs) for each environment. Use default certificate settings.
Renew certificates only when they expire to reduce overhead and complexity.

Answer : A

Question 3

Which statement best demonstrates a fundamental difference between Content-ID and traditional network security methods?

AContent-ID inspects traffic at the application layer to provide real-time threat protection.

BContent-ID focuses on blocking malicious IP addresses and ports.

CTraditional methods provide comprehensive application layer inspection.

DTraditional methods block specific applications using signatures.

Answer : A

Question 4

Which two SSH Proxy decryption profile configurations will reduce network attack surface? (Choose two.)

AAllow sessions if resources not available.

BAllow sessions with unsupported versions.

CBlock sessions on certificate errors.

DBlock sessions with unsupported versions.

Answer : C

Question 5

Which feature is available in both Panorama and Strata Cloud Manager (SCM)?

ATemplate stacks

BConfiguration snippets

CPolicy Optimizer

DPlug-ins