Free PSE-STRATA sample questions

Correct answers: Configure a syslog parse profile to extract user and IP information from the RADIUS server's accounting logs.; Use the XML API to programmatically push user-to-IP mappings from a script that queries the RADIUS server.

Correct answer: Create two Decryption policy rules: a top rule with a 'No Decrypt' action for financial and healthcare URL categories, and a bottom rule with a 'Decrypt' action for all other traffic.

The best practice for managing decryption exceptions is to use a dedicated Decryption policy rulebase. By placing a specific 'No Decrypt' rule at the top for sensitive categories (Financial Services, Health and Medicine), you ensure this traffic is explicitly bypassed. A second, broader rule below it can then enforce decryption for all other traffic. This provides clear, auditable policy control.

Correct answer: True

This statement is true. A key feature of the Virtual Wire deployment mode is its ability to be inserted into a network segment transparently (like a bump on the wire) while still providing full Layer 7 threat inspection capabilities. All traffic passing through the v-wire can be subjected to Security policies that leverage App-ID, Content-ID, and User-ID.

Correct answer: The firewall has exhausted its available packet buffer memory.

The output clearly shows 'packet buffer Util' at 100%. Packet buffers are used to temporarily store packets during processing. When they are exhausted, the firewall will start dropping packets, leading to significant performance degradation, retransmissions, and slow application response. This indicates the firewall is unable to process traffic as fast as it is arriving, often due to being undersized for the traffic load or a misconfiguration causing excessive buffering.

Correct answer: Layer 3

When deploying VM-Series firewalls behind a load balancer in a public cloud for auto-scaling, the firewalls must operate in Layer 3 mode. The NLB forwards traffic to the IP address of the firewall's Layer 3 interface. This allows the firewall to act as a routing hop, perform source NAT on the egress traffic to ensure symmetric return flows, and participate in the scalable architecture. Other modes like Virtual Wire or Layer 2 are not suitable for this cloud-native, load-balanced design.

Correct answer: To specify which underlying application decoder the firewall should use before applying the custom signature.

The 'Parent App' setting is crucial for custom App-IDs. It tells the firewall which existing application decoder (e.g., ssl, http, ssh) to use to parse the traffic stream. The custom signature is then applied to the decoded application data. If the parent app is not correctly identified (e.g., setting it to 'http' for an SSL-encrypted app), the firewall cannot decrypt or decode the traffic, and the custom signature will never match.

Correct answer: Set the Translated Address type to 'FQDN' and specify the internal server's FQDN.

When using destination NAT for services that rely on the HTTP Host Header (like virtual hosting), simply translating the IP address can cause issues. By setting the Translated Address type to 'FQDN' in the NAT policy, the firewall performs a DNS lookup for the FQDN and uses the result for the destination IP translation. Crucially, this mode ensures that the original Host Header from the client's request is preserved and passed to the internal server, allowing it to serve the correct website.

Correct answer: Data Filtering Log; filter by `(dst in 1.2.3.4) and (direction eq 'upload')`

The Data Filtering log is specifically designed to record instances where files or data patterns matching a Data Filtering profile are detected in traffic. To find files transferred outbound to an attacker, the correct approach is to query the Data Filtering log, filter for the attacker's destination IP (`dst in 1.2.3.4`), and specify the direction as 'upload' (from the perspective of the internal network). This provides the most direct and accurate list of potential exfiltration events.

Correct answer: Host Information Profile (HIP) objects and HIP-based security policies.

Host Information Profile (HIP) is the feature designed for this exact purpose. The GlobalProtect agent collects endpoint state information (like OS patch level, disk encryption status, antivirus version). This data is used to match against HIP Objects on the firewall. Security policies can then use these HIP Objects as match criteria to grant or deny access, or to direct non-compliant users to a specific quarantine zone.

Correct answer: To specify the virtual system (vsys) in which to perform the policy lookup.

On a multi-vsys firewall, security policies are unique to each virtual system. The `test security-policy-match` command requires the context of a specific vsys to perform its lookup. The `target ` keyword and argument are used to specify which virtual system's policy rulebase should be evaluated for the simulated traffic.