[Mar 02, 2023] Lesson Brilliant PDF for the ACE Tests Free Updated Today
Get New 2023 Valid Practice Aviatrix Certification ACE Q&A - Testing Engine
NEW QUESTION 39
Select the implicit rules enforced on traffic failing to match any user defined Security Policies:
- A. Inter-zone traffic is denied
- B. Inter-zone traffic is allowed
- C. Intra-zone traffic is allowed
- D. Intra-zone traffic is denied
Answer: A,C
NEW QUESTION 40
Aviatrix Controller allows customers to export Netflow data from all or select Aviatrix Gateways to any Netflow collector on a custom port.
- A. False
- B. True
Answer: B
Explanation:
Aviatrix Controller can allows customers to export Netflow data from all or select Aviatrix Gateways to any Netflow collector on a custom port (your designated service point) by enablingusing NetFlow Agent .
Read Following Link for detailed Tutorial Steps. [Netflow
Integration](https://docs.aviatrix.com/HowTos/netflow.html)
Aviatrix Controller and gateways can forward Netflow logs to your designated service point.
Aviatrix Gateways generate and export information about network traffic. Flows come directly from Gateways to CoPilot.
The flows are sent from the Aviatrix gateways directly to CoPilot's instance.
https://docs.aviatrix.com/HowTos/copilot_faq.html
Link (Netflow Integration): https://docs.aviatrix.com/HowTos/netflow.html
NEW QUESTION 41
Enabling "Highlight Unused Rules" in the Security policy window will:
- A. Allow the administrator to temporarily disable rules that do not match traffic, for testing purposes.
- B. Highlight all rules that did not match traffic since the rule was created or since last reboot of the firewall.
- C. Highlight all rules that did not immediately match traffic.
- D. Allows the administrator to troubleshoot rules when a validation error occurs at the time of commit.
Answer: B
NEW QUESTION 42
When configuring a Security Policy Rule based on FQDN Address Objects, which of the following statements is True?
- A. The firewall resolves the FQDN first when the policy is committed, and resolves the FQDN again at DNS TTL
expiration. - B. In order to create FQDN-based objects, you need to manually define a list of associated IP addresses.
- C. The firewall resolves the FQDN first when the policy is committed, and resolves the FQDN again each time Security
Profiles are evaluated.
Answer: A
NEW QUESTION 43
What option should be configured when using User Identification?
- A. Enable User Identification per interface
- B. Enable User Identification per Zone
- C. Enable User Identification per Security Rule
- D. None of the above
Answer: B
NEW QUESTION 44
In order to route traffic between layer 3 interfaces on the PAN firewall you need:
- A. Vwire
- B. Security Profile
- C. Virtual Router
- D. VLAN
Answer: D
NEW QUESTION 45
Choose two statements that best describe Aviatrix UserVPN/OpenVPN service?
- A. Requires AWS NAT Gateway
- B. Can integrate with DUO for MFA
- C. Can integrate with Active Directory
- D. Is limited to one Gateway per VPC/VNET
Answer: A,B
NEW QUESTION 46
Which option allows an administrator to segrate Panorama and Syslog traffic, so that the Management Interface is not
employed when sending these types of traffic?
- A. On the Device tab in the Web UI, create custom server profiles for Syslog and Panorama
- B. Custom entries in the Virtual Router, pointing to the IP addresses of the Panorama and Syslog devices.
- C. Define a Loopback interface for the Panorama and Syslog Devices
- D. Service Route Configuration
Answer: D
NEW QUESTION 47
A "Continue" action can be configured on which of the following Security Profiles?
- A. URL Filtering only
- B. URL Filtering and File Blocking
- C. URL Filtering, File Blocking, and Data Filtering
- D. URL Filtering and Anti-virus
Answer: B
NEW QUESTION 48
Which of the following fields is not available in DoS policy?
- A. Destination Zone
- B. Source Zone
- C. Application
- D. Service
Answer: C
NEW QUESTION 49
Which of the following must be configured when deploying User-ID to obtain information from an 802.1x
authenticator?
- A. An Agentless deployment of User-ID, employing only the Palo Alto Networks Firewall
- B. XML API for User-ID Agent
- C. A User-ID agent, with the "Use for NTLM Authentication" option enabled.
- D. Terminal Server Agent
Answer: B
NEW QUESTION 50
Aviatrix platform has several operational features and capabilities built-in to help network engineers perform day to day operational tasks.
Below, match the Aviatrix platform feature with the operational problem it addresses.
Answer:
Explanation:
NEW QUESTION 51
When Destination Network Address Translation is being performed, the destination in the corresponding Security
Policy Rule should use:
- A. The PreNAT destination zone and PreNAT IP address.
- B. The PreNAT destination zone and PostNAT IP address.
- C. The PostNAT destination zone and PreNAT IP address.
- D. The PostNAT destination zone and PostNAT IP address.
Answer: C
NEW QUESTION 52
ACE Inc. currently uses AWS as their primary cloud provider with a strong desire to expand to Azure and GCP. IT team has strict security and control requirements from different business units that require isolation and control from each other. The different business units want
* to own their own transit architecture
* the ability to control firewall rules for their own application
* to not share same transit with other business units but have ability to connect to other business units if needed The architecture board has mandated that there needs to be a single design pattern that accommodates above requirements irrespective of the public cloud vendor being used.
Choose the best design option to meet above needs. Each option presents a complete solution.
- A. Deploy several Transit Gateway
- B. Use AWS Transit Gateway (TGW). Deploy several TGWs in each region and peer them together as needed. Use TGW VPN to build IPSec tunnels to Azure Virtual WAN and Google Cloud VPN.
Answer: B
NEW QUESTION 53
What are two sources of information for determining if the firewall has been successful in communicating with an
external User-ID Agent?
- A. There's only one location - System Logs
- B. System Logs and the indicator light under the User-ID Agent settings in the firewall
- C. System Logs and indicator light on the chassis
- D. There's only one location - Traffic Logs
Answer: B
NEW QUESTION 54
The "Drive-By Download" protection feature, under File Blocking profiles in Content-ID, provides:
- A. Protection against unwanted downloads by showing the user a response page indicating that a file is going to be
downloaded. - B. Password-protected access to specific file downloads for authorized users.
- C. Increased speed on downloads of file types that are explicitly enabled.
- D. The ability to use Authentication Profiles, in order to protect against unwanted downloads.
Answer: A
NEW QUESTION 55
Administrative Alarms can be enabled for which of the following except?
- A. Traffic Log capacity
- B. Security Policy Tags
- C. Security Violation Thresholds
- D. Certificate Expirations
Answer: D
NEW QUESTION 56
Choose the two best statements that describe challenges of deploying a NextGen Firewall (NGFW) in public cloud. (Choose 2)
- A. Firewalls can only be deployed in Active/Standby
- B. Firewalls can only be deployed in Active/Active
- C. Reduced firewall feature availability
- D. Reduced effective throughput of the NGFW
- E. Reduced visibility due to NAT
Answer: C,E
Explanation:
The Aviatrix Next Generation Transit Network is built upon the AWS Transit Gateway to provide better security, scalability and functional capabilities that are important for dynamic AWS implementations.
Aviatrix was a launch partner of the AWS Transit Gateway (TGW). The Aviatrix advanced features were built in collaboration with the AWS product team.
Visibility: Aviatrix is the go-to partner for AWS when it comes to networking and routing. With the introduction of the AWS TGW, Aviatrix has built robust visualization tools that lets you plan and implement connection architectures that span Accounts, Regions and Clouds.
NEW QUESTION 57
What is the size limitation of files manually uploaded to WildFire?
- A. Hard-coded at 10 megabytes
- B. Configurable up to 10 megabytes
- C. Hard-coded at 2 megabytes
- D. Configurable up to 20 megabytes
Answer: B
NEW QUESTION 58
An example of when would you use Aviatrix FlightPath is:
- A. To insert Firewall into traffic path between 2 VPCs
- B. To connect your branch office to the cloud resources
- C. To troubleshoot connectivity between EC2 instances in 2 AWS VPCs
- D. To view controller logs
Answer: C
Explanation:
EC2 related information such as Security Groups, Route table and route table entries and network ACL.
This helps you to identify connectivity problems.
You do not need to launch Aviatrix gateways to use this tool, but you need to create Aviatrix accounts so that the Controller can use the account credentials to execute AWS APIs to retrieve relevant information.
NEW QUESTION 59
......
ACE Dumps PDF - 100% Passing Guarantee: https://pass4sure.verifieddumps.com/ACE-valid-exam-braindumps.html
