Download the latest PSE-Strata-Pro-24 exam dumps PDF for Preparation.
Exam
:
PSE-Strata-Pro-24
Title
: Palo Alto Networks Systems
Engineer Professional Hardware Firewall
https://www.passcert.com/PSE-Strata-Pro-24.html
1 / 10
Download the latest PSE-Strata-Pro-24 exam dumps PDF for Preparation.
1.A company plans to deploy identity for improved visibility and identity-based controls for least privilege
access to applications and data. The company does not have an on-premises Active Directory (AD)
deployment, and devices are connected and managed by using a combination of Entra ID and Jamf.
Which two supported sources for identity are appropriate for this environment? (Choose two.)
A. Captive portal
B. User-ID agents configured for WMI client probing
C. GlobalProtect with an internal gateway deployment
D. Cloud Identity Engine synchronized with Entra ID
Answer: C, D
Explanation:
In this scenario, the company does not use on-premises Active Directory and manages devices with Entra
ID and Jamf, which implies a cloud-native and modern management setup.
Below is the evaluation of each option:
Option A: Captive portal
Captive portal is typically used in environments where identity mapping is needed for unmanaged devices
or guest users. It provides a mechanism for users to authenticate themselves through a web interface.
However, in this case, the company is managing devices using Entra ID and Jamf, which means identity
information can already be centralized through other means. Captive portal is not an ideal solution here.
This option is not appropriate.
Option B: User-ID agents configured for WMI client probing
WMI (Windows Management Instrumentation) client probing is a mechanism used to map IP addresses to
usernames in a Windows environment. This approach is specific to on-premises Active Directory
deployments and requires direct communication with Windows endpoints.
Since the company does not have an on-premises AD and is using Entra ID and Jamf, this method is not
applicable.
This option is not appropriate.
Option C: GlobalProtect with an internal gateway deployment
GlobalProtect is Palo Alto Networks' VPN solution, which allows for secure remote access. It also
supports identity-based mapping when deployed with internal gateways.
In this case, GlobalProtect with an internal gateway can serve as a mechanism to provide user and device
visibility based on the managed devices connecting through the gateway.
This option is appropriate.
Option D: Cloud Identity Engine synchronized with Entra ID
The Cloud Identity Engine provides a cloud-based approach to synchronize identity information from
identity providers like Entra ID (formerly Azure AD).
In a cloud-native environment with Entra ID and Jamf, the Cloud Identity Engine is a natural fit as it
integrates seamlessly to provide identity visibility for applications and data.
This option is appropriate.
Reference: Palo Alto Networks documentation on Cloud Identity Engine GlobalProtect configuration and
use cases in Palo Alto Knowledge Base
2.A systems engineer (SE) is working with a customer that is fully cloud-deployed for all applications.
The customer is interested in Palo Alto Networks NGFWs but describes the following challenges:
"Our apps are in AWS and Azure, with whom we have contracts and minimum-revenue guarantees. We
2 / 10
Download the latest PSE-Strata-Pro-24 exam dumps PDF for Preparation.
would use the built-in firewall on the cloud service providers (CSPs), but the need for centralized policy
management to reduce human error is more important."
Which recommendations should the SE make?
A. Cloud NGFWs at both CSPs; provide the customer a license for a Panorama virtual appliance from
their CSP's marketplace of choice to centrally manage the systems.
B. Cloud NGFWs in AWS and VM-Series firewall in Azure; the customer selects a PAYG licensing
Panorama deployment in their CSP of choice.
C. VM-Series firewalls in both CSPs; manually built Panorama in the CSP of choice on a host of either
type: Palo Alto Networks provides a license.
D. VM-Series firewall and CN-Series firewall in both CSPs; provide the customer a private-offer
Panorama virtual appliance from their CSP’s marketplace of choice to centrally manage the systems.
Answer: A
Explanation:
The customer is seeking centralized policy management to reduce human error while maintaining
compliance with their contractual obligations to AWS and Azure. Here's the evaluation of each option:
Option A: Cloud NGFWs at both CSPs; provide the customer a license for a Panorama virtual appliance
from their CSP's marketplace of choice to centrally manage the systems
Cloud NGFW is a fully managed Next-Generation Firewall service by Palo Alto Networks, offered in AWS
and Azure marketplaces. It integrates natively with the CSP infrastructure, making it a good fit for
customers with existing CSP agreements.
Panorama, Palo Alto Networks' centralized management solution, can be deployed as a virtual appliance
in the CSP marketplace of choice, enabling centralized policy management across all NGFWs.
This option addresses the customer's need for centralized management while leveraging their existing
contracts with AWS and Azure.
This option is appropriate.
Option B: Cloud NGFWs in AWS and VM-Series firewall in Azure; the customer selects a PAYG licensing
Panorama deployment in their CSP of choice
This option suggests using Cloud NGFW in AWS but VM-Series firewalls in Azure. While VM-Series is a
flexible virtual firewall solution, it may not align with the customer’s stated preference for CSP-managed
services like Cloud NGFW.
This option introduces a mix of solutions that could complicate centralized management and reduce
operational efficiency.
This option is less appropriate.
Option C: VM-Series firewalls in both CSPs; manually built Panorama in the CSP of choice on a host of
either type: Palo Alto Networks provides a license
VM-Series firewalls are well-suited for cloud deployments but require more manual configuration
compared to Cloud NGFW.
Building a Panorama instance manually on a host increases operational overhead and does not leverage
the customer’s existing CSP marketplaces.
This option is less aligned with the customer's needs.
Option D: VM-Series firewall and CN-Series firewall in both CSPs; provide the customer a private-offer
Panorama virtual appliance from their CSP’s marketplace of choice to centrally manage the systems
This option introduces both VM-Series and CN-Series firewalls in both CSPs. While CN-Series firewalls
are designed for Kubernetes environments, they may not be relevant if the customer does not specifically
3 / 10
Download the latest PSE-Strata-Pro-24 exam dumps PDF for Preparation.
require container-level security.
Adding CN-Series firewalls may introduce unnecessary complexity and costs.
This option is not appropriate.
Reference: Palo Alto Networks documentation on Cloud NGFW
Panorama overview in Palo Alto Knowledge Base VM-Series firewalls deployment guide in CSPs: Palo
Alto Documentation
3.A customer claims that Advanced WildFire miscategorized a file as malicious and wants proof, because
another vendor has said that the file is benign.
How could the systems engineer assure the customer that Advanced WildFire was accurate?
A. Review the threat logs for information to provide to the customer.
B. Use the WildFire Analysis Report in the log to show the customer the malicious actions the file took
when it was detonated.
C. Open a TAG ticket for the customer and allow support engineers to determine the appropriate action.
D. Do nothing because the customer will realize Advanced WildFire is right.
Answer: B
Explanation:
Advanced WildFire is Palo Alto Networks' cloud-based malware analysis and prevention solution. It
determines whether files are malicious by executing them in a sandbox environment and observing their
behavior. To address the customer's concern about the file categorization, the systems engineer must
provide evidence of the file's behavior.
Here’s the analysis of each option:
Option A: Review the threat logs for information to provide to the customer
Threat logs can provide a summary of events and verdicts for malicious files, but they do not include the
detailed behavior analysis needed to convince the customer.
While reviewing the logs is helpful as a preliminary step, it does not provide the level of proof the
customer needs.
This option is not sufficient on its own.
Option B: Use the WildFire Analysis Report in the log to show the customer the malicious actions the file
took when it was detonated
WildFire generates an analysis report that includes details about the file's behavior during detonation in
the sandbox, such as network activity, file modifications, process executions, and any indicators of
compromise (IoCs).
This report provides concrete evidence to demonstrate why the file was flagged as malicious. It is the
most accurate way to assure the customer that WildFire's decision was based on observed malicious
actions.
This is the best option.
Option C: Open a TAG ticket for the customer and allow support engineers to determine the appropriate
action
While opening a support ticket is a valid action for further analysis or appeal, it is not a direct way to
assure the customer of the current WildFire verdict.
This option does not directly address the customer’s request for immediate proof.
This option is not ideal.
Option D: Do nothing because the customer will realize Advanced WildFire is right
4 / 10
Download the latest PSE-Strata-Pro-24 exam dumps PDF for Preparation.
This approach is dismissive of the customer's concerns and does not provide any evidence to support
WildFire's decision.
This option is inappropriate.
Reference: Palo Alto Networks documentation on WildFire
WildFire Analysis Reports
4.Which three known variables can assist with sizing an NGFW appliance? (Choose three.)
A. Connections per second
B. Max sessions
C. Packet replication
D. App-ID firewall throughput
E. Telemetry enabled
Answer: A, B, D
Explanation:
When sizing a Palo Alto Networks NGFW appliance, it's crucial to consider variables that affect its
performance and capacity. These include the network's traffic characteristics, application requirements,
and expected workloads.
Below is the analysis of each option:
Option A: Connections per second
Connections per second (CPS) is a critical metric for determining how many new sessions the firewall can
handle per second. High CPS requirements are common in environments with high traffic turnover, such
as web servers or applications with frequent session terminations and creations.
This is an important sizing variable.
Option B: Max sessions
Max sessions represent the total number of concurrent sessions the firewall can support. For
environments with a large number of users or devices, this metric is critical to prevent session exhaustion.
This is an important sizing variable.
Option C: Packet replication
Packet replication is used in certain configurations, such as TAP mode or port mirroring for traffic
inspection. While it impacts performance, it is not a primary variable for firewall sizing as it is a specific
use case.
This is not a key variable for sizing.
Option D: App-ID firewall throughput
App-ID throughput measures the firewall's ability to inspect traffic and apply policies based on application
signatures. It directly impacts the performance of traffic inspection under real-world conditions.
This is an important sizing variable.
Option E: Telemetry enabled
While telemetry provides data for monitoring and analysis, enabling it does not significantly impact the
sizing of the firewall. It is not a core variable for determining firewall performance or capacity.
This is not a key variable for sizing.
Reference: Palo Alto Networks documentation on Firewall Sizing Guidelines Knowledge Base article on
Performance and Capacity Sizing
5.Which statement applies to the default configuration of a Palo Alto Networks NGFW?
5 / 10
Download the latest PSE-Strata-Pro-24 exam dumps PDF for Preparation.
A. Security profiles are applied to all policies by default, eliminating implicit trust of any data traversing the
firewall.
B. The default policy action for intrazone traffic is deny, eliminating implicit trust within a security zone.
C. The default policy action allows all traffic unless explicitly denied.
D. The default policy action for interzone traffic is deny, eliminating implicit trust between security zones.
Answer: D
Explanation:
The default configuration of a Palo Alto Networks NGFW includes a set of default security rules that
determine how traffic is handled when no explicit rules are defined. Here's the explanation for each
option:
Option A: Security profiles are applied to all policies by default, eliminating implicit trust of any data
traversing the firewall
Security profiles (such as Antivirus, Anti-Spyware, and URL Filtering) are not applied to any policies by
default. Administrators must explicitly apply them to security rules.
This statement is incorrect.
Option B: The default policy action for intrazone traffic is deny, eliminating implicit trust within a security
zone
By default, traffic within the same zone (intrazone traffic) is allowed. For example, traffic between devices
in the "trust" zone is permitted unless explicitly denied by an administrator.
This statement is incorrect.
Option C: The default policy action allows all traffic unless explicitly denied
Palo Alto Networks firewalls do not have an "allow all" default rule. Instead, they include a default "deny
all" rule for interzone traffic and an implicit "allow" rule for intrazone traffic.
This statement is incorrect.
Option D: The default policy action for interzone traffic is deny, eliminating implicit trust between security
zones
By default, traffic between different zones (interzone traffic) is denied. This aligns with the principle of zero
trust, ensuring that no traffic is implicitly allowed between zones. Administrators must define explicit rules
to allow interzone traffic.
This statement is correct.
Reference: Palo Alto Networks documentation on Security Policy Defaults Knowledge Base article on
Default Security Rules
6.A company has multiple business units, each of which manages its own user directories and identity
providers (IdPs) with different domain names. The company’s network security team wants to deploy a
shared GlobalProtect remote access service for all business units to authenticate users to each business
unit's IdP.
Which configuration will enable the network security team to authenticate GlobalProtect users to multiple
SAML IdPs?
A. GlobalProtect with multiple authentication profiles for each SAML IdP
B. Multiple authentication mode Cloud Identity Engine authentication profile for use on the GlobalProtect
portals and gateways
C. Authentication sequence that has multiple authentication profiles using different authentication
methods
6 / 10
Download the latest PSE-Strata-Pro-24 exam dumps PDF for Preparation.
D. Multiple Cloud Identity Engine tenants for each business unit
Answer: A
Explanation:
To configure GlobalProtect to authenticate users from multiple SAML identity providers (IdPs), the correct
approach involves creating multiple authentication profiles, one for each IdP. Here's the analysis of each
option:
Option A: GlobalProtect with multiple authentication profiles for each SAML IdP
GlobalProtect allows configuring multiple SAML authentication profiles, each corresponding to a specific
IdP.
These profiles are associated with the GlobalProtect portal or gateway. When users attempt to
authenticate, they can be directed to the appropriate IdP based on their domain or other attributes.
This is the correct approach to enable authentication for users from multiple IdPs.
Option B: Multiple authentication mode Cloud Identity Engine authentication profile for use on the
GlobalProtect portals and gateways
The Cloud Identity Engine (CIE) can synchronize identities from multiple directories, but it does not
directly support multiple SAML IdPs for a shared GlobalProtect setup.
This option is not applicable.
Option C: Authentication sequence that has multiple authentication profiles using different
authentication methods
Authentication sequences allow multiple authentication methods (e.g., LDAP, RADIUS, SAML) to be tried
in sequence for the same user, but they are not designed for handling multiple SAML IdPs.
This option is not appropriate for the scenario.
Option D: Multiple Cloud Identity Engine tenants for each business unit
Deploying multiple CIE tenants for each business unit adds unnecessary complexity and is not required
for configuring GlobalProtect to authenticate users to multiple SAML IdPs.
This option is not appropriate.
7.Device-ID can be used in which three policies? (Choose three.)
A. Security
B. Decryption
C. Policy-based forwarding (PBF)
D. SD-WAN
E. Quality of Service (QoS)
Answer: A, C, E
Explanation:
Device-ID is a feature in Palo Alto Networks firewalls that identifies devices based on their unique
attributes (e.g., MAC addresses, device type, operating system). Device-ID can be used in several policy
types to provide granular control.
Here's how it applies to each option:
Option A: Security
Device-ID can be used in Security policies to enforce rules based on the device type or identity. For
example, you can create policies that allow or block traffic for specific device types (e.g., IoT devices).
This is correct.
Option B: Decryption
7 / 10
Download the latest PSE-Strata-Pro-24 exam dumps PDF for Preparation.
Device-ID cannot be used in decryption policies. Decryption policies are based on traffic types,
certificates, and other SSL/TLS attributes, not device attributes.
This is incorrect.
Option C: Policy-based forwarding (PBF)
Device-ID can be used in PBF policies to control the forwarding of traffic based on the identified device.
For example, you can route traffic from certain device types through specific ISPs or VPN tunnels.
This is correct.
Option D: SD-WAN
SD-WAN policies use metrics such as path quality (e.g., latency, jitter) and application information for
traffic steering. Device-ID is not a criterion used in SD-WAN policies.
This is incorrect.
Option E: Quality of Service (QoS)
Device-ID can be used in QoS policies to apply traffic shaping or bandwidth control for specific devices.
For example, you can prioritize or limit bandwidth for traffic originating from IoT devices or specific
endpoints.
This is correct.
Reference: Palo Alto Networks documentation on Device-ID
8.The PAN-OS User-ID integrated agent is included with PAN-OS software and comes in which two forms?
(Choose two.)
A. Integrated agent
B. GlobalProtect agent
C. Windows-based agent
D. Cloud Identity Engine (CIE)
Answer: A, C
Explanation:
User-ID is a feature in PAN-OS that maps IP addresses to usernames by integrating with various directory
services (e.g., Active Directory). User-ID can be implemented through agents provided by Palo Alto
Networks.
Here’s how each option applies:
Option A: Integrated agent
The integrated User-ID agent is built into PAN-OS and does not require an external agent installation. It is
configured directly on the firewall and integrates with directory services to retrieve user information.
This is correct.
Option B: GlobalProtect agent
GlobalProtect is Palo Alto Networks' VPN solution and does not function as a User-ID agent. While it can
be used to authenticate users and provide visibility, it is not categorized as a User-ID agent.
This is incorrect.
Option C: Windows-based agent
The Windows-based User-ID agent is a standalone agent installed on a Windows server. It collects user
mapping information from directory services and sends it to the firewall.
This is correct.
Option D: Cloud Identity Engine (CIE)
The Cloud Identity Engine provides identity services in a cloud-native manner but is not a User-ID agent.
8 / 10
Download the latest PSE-Strata-Pro-24 exam dumps PDF for Preparation.
It synchronizes with identity providers like Azure AD and Okta.
This is incorrect.
Reference: Palo Alto Networks documentation on User-ID
Knowledge Base article on User-ID Agent Options
9.Which two actions can a systems engineer take to discover how Palo Alto Networks can bring value to a
customer's business when they show interest in adopting Zero Trust? (Choose two.)
A. Ask the customer about their internal business flows, such as how their users interact with applications
and data across the infrastructure.
B. Explain how Palo Alto Networks can place virtual NGFWs across the customer's network to ensure
assets and traffic are seen and controlled.
C. Use the Zero Trust Roadshow package to demonstrate to the customer how robust Palo Alto Networks
capabilities are in meeting Zero Trust.
D. Ask the customer about their approach to Zero Trust, explaining that it is a strategy more than it is
something they purchase.
Answer: A, D
Explanation:
To help a customer understand how Palo Alto Networks can bring value when adopting a Zero Trust
architecture, the systems engineer must focus on understanding the customer's specific needs and
explaining how the Zero Trust strategy aligns with their business goals.
Here’s the detailed analysis of each option:
Option A: Ask the customer about their internal business flows, such as how their users interact with
applications and data across the infrastructure
Understanding the customer's internal workflows and how their users interact with applications and
data is a critical first step in Zero Trust. This information allows the systems engineer to identify potential
security gaps and suggest tailored solutions.
This is correct.
Option B: Explain how Palo Alto Networks can place virtual NGFWs across the customer's network to
ensure assets and traffic are seen and controlled
While placing NGFWs across the customer's network may be part of the implementation, this approach
focuses on the product rather than the customer's strategy. Zero Trust is more about policies and
architecture than specific product placement.
This is incorrect.
Option C: Use the Zero Trust Roadshow package to demonstrate to the customer how robust Palo Alto
Networks capabilities are in meeting Zero Trust
While demonstrating capabilities is valuable during the later stages of engagement, the initial focus
should be on understanding the customer's business requirements rather than showcasing products.
This is incorrect.
Option D: Ask the customer about their approach to Zero Trust, explaining that it is a strategy more than it
is something they purchase
Zero Trust is not a product but a strategy that requires a shift in mindset. By discussing their approach, the
systems engineer can identify whether the customer understands Zero Trust principles and guide them
accordingly.
This is correct.
9 / 10
Download the latest PSE-Strata-Pro-24 exam dumps PDF for Preparation.
Reference: Palo Alto Networks documentation on Zero Trust
Zero Trust Architecture Principles in NIST 800-207
10.A large global company plans to acquire 500 NGFWs to replace its legacy firewalls and has a specific
requirement for centralized logging and reporting capabilities.
What should a systems engineer recommend?
A. Combine Panorama for firewall management with Palo Alto Networks' cloud-based Strata Logging
Service to offer scalability for the company's logging and reporting infrastructure.
B. Use Panorama for firewall management and to transfer logs from the 500 firewalls directly to a
third-party SIEM for centralized logging and reporting.
C. Highlight the efficiency of PAN-OS, which employs AI to automatically extract critical logs and generate
daily executive reports, and confirm that the purchase of 500 NGFWs is sufficient.
D. Deploy a pair of M-1000 log collectors in the customer data center, and route logs from all 500 firewalls
to the log collectors for centralized logging and reporting.
Answer: A
Explanation:
A large deployment of 500 firewalls requires a scalable, centralized logging and reporting infrastructure.
Here's the analysis of each option:
Option A: Combine Panorama for firewall management with Palo Alto Networks' cloud-based Strata
Logging Service to offer scalability for the company's logging and reporting infrastructure
The Strata Logging Service (or Cortex Data Lake) is a cloud-based solution that offers massive scalability
for logging and reporting. Combined with Panorama, it allows for centralized log collection, analysis, and
policy management without the need for extensive on-premises infrastructure.
This approach is ideal for large-scale environments like the one described in the scenario, as it ensures
cost-effectiveness and scalability.
This is the correct recommendation.
Option B: Use Panorama for firewall management and to transfer logs from the 500 firewalls directly to a
third-party SIEM for centralized logging and reporting
While third-party SIEM solutions can be integrated with Palo Alto Networks NGFWs, directly transferring
logs from 500 firewalls to a SIEM can lead to bottlenecks and scalability issues. Furthermore, relying on
third-party solutions may not provide the same level of native integration as the Strata Logging Service.
This is not the ideal recommendation.
Option C: Highlight the efficiency of PAN-OS, which employs AI to automatically extract critical logs and
generate daily executive reports, and confirm that the purchase of 500 NGFWs is sufficient
While PAN-OS provides AI-driven insights and reporting, this option does not address the requirement for
centralized logging and reporting. It also dismisses the need for additional infrastructure to handle logs
from 500 firewalls.
This is incorrect.
Option D: Deploy a pair of M-1000 log collectors in the customer data center, and route logs from all 500
firewalls to the log collectors for centralized logging and reporting
The M-1000 appliance is an on-premises log collector, but it has limitations in terms of scalability and
storage capacity when compared to cloud-based options like the Strata Logging Service. Deploying only
two M-1000 log collectors for 500 firewalls would result in potential performance and storage challenges.
This is not the best recommendation.
10 / 10