by Sachin, on Jul 12, 2022 11:13:18 PM
Q1. What is WildFire in Palo Alto?
Ans
Palo Alto Networks WildFire cloud-based threat analysis service is the industry's most advanced analysis and prevention engine for highly evasive zero-day exploits and malware.
Q2. What are five benefits of Palo Alto Networks next generation firewalls?
Ans
- Multi-functional. Traditional firewalls provide basic packet filtering, network and port address translations, stateful inspections, and can even support virtual private networks.
- Application awareness.
- Streamlined infrastructure.
- Threat protection.
- Network speed.
Q3. What is Palo Alto used for?
Ans
Palo Alto Networks offers an enterprise cybersecurity platform which provides network security, cloud security, endpoint protection, and various cloud-delivered security services.
Q4. What is the unique feature in Palo Alto firewall?
Ans
The Palo Alto Networks VM-Series is a virtualised next-generation firewall featuring our PAN-OSTM operating system. The VM-Series identifies, controls and safely enables intra-host traffic and comes with the following unique virtualisation security features.
Q5. What is GlobalProtect in Palo Alto?
Ans
GlobalProtect network security client for endpoints, from Palo Alto Networks, enables organizations to protect the mobile workforce by extending the Next-Generation Security Platform to all users, regardless of location.
Q6. What is sinkhole in Palo Alto?
Ans
The DNS sinkhole enables the Palo Alto Networks device to forge a response to a DNS query for a known malicious domain/URL and causes the malicious domain name to resolve to a definable IP address (fake IP) that is given to the client
Q7. What is Palo Alto Content ID?
Ans
Content-ID gives you a real-time threat prevention engine, combined with a comprehensive URL database, and elements of application identification to: Limit unauthorized data and file transfers. Detect and block exploits, malware and malware communications. Control unapproved web surfing.
Q8. What is Vwire in Palo Alto?
Ans
The V-Wire deployment options overcome the limitations of TAP mode deployment, as engineers are able to monitor and control traffic traversing the link. A Virtual Wire interface supports App-ID, User-ID, Content-ID, NAT and decryption.
Q9. What are the features Palo Alto supports when it is in Virtual Wire mode?
Ans
- App-ID
- Decryption
- Content-ID
- User-ID
- NAT
Q10. What is the advantage of Palo Alto’s Single Pass Parallel Processing (SP3) architecture?
Ans
- High throughput and low latency
- Active security functions
- Provision of single and fully integrated policy
- Easier management of firewall policy
Q11. What is App-ID?
Ans
App-ID is the short form for Application Identification. It is the main component in Palo Alto. The responsibility of App-ID is to identify the applications, which traverse the firewalls independently.
Q12. What are the benefits of using Panorama in Palo Alto?
Ans
- You can update the software in bulk with a single click.
- You can get a complete report, which enables you to validate the compliance status.
- You can use Panorama logs from managed services, which enables solving logging issues.
Q13. What are the main areas Panorama adds value to?
Ans
- Distributed administration, which enables to control and delegate access to firewall configurations locally and globally.
- Centralized configuration and deployment.
- Logging (aggregated) with central oversight for analysis and reporting.
Q14. What is the endpoint security in Palo Alto?
Ans
Endpoint security ensures the protection of individual access points in the network and sensitive data. It is a process, which illustrates techniques, tools, and applications or products, which can be used to protect devices including computer systems, laptops, smartphones, etc.
Q15. Which are the log types that can be viewed in Palo Alto?
Ans
- Traffic Logs
- Threat Log
- URL Filtering Logs
- WildFire Submissions Logs
- Data Filtering Logs
- Correlation Logs
- Tunnel Inspection Logs
- Unified logs
- HIP Match logs
- GTP logs
- SCTP logs
- System logs
- Alarm logs
- Configuration logs
Q16. What are Active/Passive and Active/Active modes in Palo Alto?
Ans
- Active/Passive: This mode is supported in deployment types including virtual wire, Layer 2, and Layer 3. In this mode, the configuration settings are shared by both the firewalls. In case, the Active firewall fails, the Passive firewall becomes active and maintains the network security.
- Active/Active: This mode is supported in deployment types including virtual wire and Layer 3. In this mode, both the firewalls work synchronously and process the traffic.
Q17. What are the different configuration modes for Palo Alto interfaces?
Ans
Tap mode: With the use of a tap or switch SPAN/mirror port, users can observe any form of traffic flow throughout the networking system.
Virtual Wire: The firewall system is installed passively on any network segment using this deployment model, which combines two interfaces.
Layer 2 mode: Multiple networking interfaces will be configured into a "virtual-switch" or VLAN mode in this layer mode.
Layer 3 deployment: The Palo Alto firewall routes allow traffic to flow between various interfaces in this layer 3 deployment. The IP address should be added to each interface by the user.
Q18. What are the benefits of using Palo Alto Networks Products?
Ans
Palo Alto Networks' products offer unparalleled insight into network traffic and malicious activities, both in the network and on the endpoint. When this visibility is combined with Splunk, a client may do correlations and analyses on a variety of data types. Correlations can be made between multiple types of Palo Alto Networks data, such as comparing Wildfire reports to traffic logs to find infected hosts or firewall logs to endpoint logs. But correlations and analyses across various sources of data and vendors, such as correlating firewall logs with web server logs or advanced endpoint security logs with Windows event logs, are where Splunk's true power lies.
Q19. In Palo Alto, what is Ha Lite?
Ans
The high-availability feature of the PA-200 is referred to as HA-Lite. It provides a slimmed-down version of the HA features present on other Palo Alto Networks hardware platforms. Because there are just a few ports available for synchronization on PA-200s, a HA’s limited version is required.
Q20. What is U Turn Nat in Palo Alto?
Ans
In Palo Alto, the logical path where traffic appears when accessing an internal resource and resolving their exterior address is referred to as U-Turn NAT. Internal users need to reach an internal DMZ server utilizing the external public IP address of the servers.
Q21. What is Application Incomplete in Palo Alto?
Ans
The Application Incomplete can be understood as - either the three-way TCP handshake is not completed or it is completed but there was no data to identify the application after the handshake.
Q22. What is Application Override in Palo Alto?
Ans
Application override is used to override the App-ID (normal Application Identification) of specific traffic transmitted through the firewall.
Q23. What are the log forwarding options supported in the Palo Alto firewall?
Ans
- Forwarding of logs from firewalls to Panorama and from Panorama to external services
- Forwarding of logs from firewalls to Panorama and to external services in parallel
Q24. How to troubleshoot HA using CLI?
Ans
- show high-availability state : Show the HA state of the firewall
- show high-availability state-synchronization: to check sync status
- show high-availability path-monitoring : to show the status of path monitoring
- request high-availablity state suspend : to suspend active box and make the current passive box as active
Q25. What is Single-pass parallel processing?
Ans
Application Incomplete can be interpreted as-either the three-way TCP handshake is not completed or completed, and there was no information to classify the process just after handshake.Where as Application override is being used to bypass the App-ID (Normal Application Identification) for unique traffic transmitted via a firewall.
