Pass Your Aviatrix Certification ACE Exam on Oct 15, 2022 with 74 Questions [Q15-Q39]

Rate this post

Pass Your Aviatrix Certification ACE Exam on Oct 15, 2022 with 74 Questions

ACE Free Exam Study Guide! (Updated 74 Questions)

How to book the Aviatrix Certified Engineer (ACE) Exam

Follow the following steps in order to register for the Aviatrix Certified Engineer (ACE) Exam:

Step 1: Visit Aviatrix ACE training website by clicking here
Step 3: Scroll down and select the preffered course level
Step 3: Hit the Sign Up button against the exam course
Step 3: Click the “Sign up today” button on the new page that appears
Step 4: Complete the course at your own pace
Step 5: After course completion, follow the instructions to schedule and pay for the exam

Aviatrix ACE Exam Syllabus Topics:

Topic	Details
Topic 1	Line Rate Encryption in the Cloud and with On-Prem Operations, Visibility, and Troubleshooting
Topic 2	Aviatrix Transit Technical Features Overview An Introduction to Public Cloud (Cloud) Networking
Topic 3	Network Architecture Options for Azure and Multi-Cloud Deployment AWS Networking and Security 101
Topic 4	How to build a network architecture across AWS and Azure Azure cloud architect’s guide to multi-cloud networking
Topic 5	How to eliminate barriers for GCP and multi-cloud adoption Optimize Network Availability, Security, and Automation on AWS
Topic 6	Network architecture options for Azure and multi-cloud deployments Azure Networking and Security 101

Q15. Which of the following is NOT a valid option for built-in CLI access roles?

read/write

superusers

vsysadmin

deviceadmin

Q16. When configuring a Security Policy Rule based on FQDN Address Objects, which of the following statements is True?

The firewall resolves the FQDN first when the policy is committed, and resolves the FQDN again each time Security Profiles are evaluated.

The firewall resolves the FQDN first when the policy is committed, and resolves the FQDN again at DNS TTL expiration.

In order to create FQDN-based objects, you need to manually define a list of associated IP addresses.

Q17. How do you limit the amount of information recorded in the URL Content Filtering Logs?

Enable DSRI

Disable URL packet captures

Enable URL log caching

Enable Log container page only

Q18. Aviatrix Controller provides a VPC Creator tool that allows customers to create VPC, VNETs across multiple clouds like AWS, GCP, Azure and OCI from single pane of glass.

True

False

Aviatrix Controller provides a VPC Tracker tool. VPC Tracker is a tool that collects and helps you manage your network CIDR ranges at a central place, eliminating the need to keep an Excel sheet on all your VPC network addresses allocations.By using VPC Tracker tool one can create a VPC.
VPC Tracker: https://docs.aviatrix.com/HowTos/vpc_tracker.html
Create a VPC: https://docs.aviatrix.com/HowTos/create_vpc.html

Q19. Private, Public, Transit VIFs (Virtual interfaces) are terms related to which…
SELECT THE CORRECT ANSWER

Azure ExpressRoute

AWS Virtual Private Gateway (VGW)

AWS DirectConnect

AWS Transit Gateway

(AWS Direct Connect virtual interfaces)
You must create one of the following virtual interfaces to begin using your AWS Direct Connect connection.
* Private virtual interface: A private virtual interface should be used to access an Amazon VPC using private IP addresses.
* Public virtual interface: A public virtual interface can access all AWS public services using public IP addresses.
* Transit virtual interface: A transit virtual interface should be used to access one or more Amazon VPC
* Transit Gateways associated with Direct Connect gateways. You can use transit virtual interfaces with 1/2/5/10 Gbps AWS Direct Connect connections. For information about Direct Connect gateway configurations, see Direct Connect gateways.

Q20. Which of the following statements is NOT True regarding a Decryption Mirror interface?

Requires superuser privilege

Supports SSL outbound

Can be a member of any VSYS

Supports SSL inbound

Q21. When configuring Admin Roles for Web UI access, what are the available access levels?

Enable and Disable only

None, Superuser, Device Administrator

Allow and Deny only

Enable, Read-Only and Disable

Q22. In PANOS 6.0 and later, which of these items may be used as match criterion in a PolicyBased Forwarding Rule? (Choose three.)

Source User

Source Zone

Destination Zone

Application

Q23. You have decided to implement a Virtual Wire Subinterface. Which options can be used to classify traffic?

Either VLAN tag or IP address, provided that each tag or ID is contained in the same zone.

Subinterface ID and VLAN tag only

By Zone and/or IP Classifier

VLAN tag, or VLAN tag plus IP address (IP address, IP range, or subnet).

Q24. A “Continue” action can be configured on which of the following Security Profiles?

URL Filtering and File Blocking

URL Filtering only

URL Filtering, File Blocking, and Data Filtering

URL Filtering and Anti-virus

Q25.

Taking into account only the information in the screenshot above, answer the following question. In order for ping
traffic to traverse this device from e1/2 to e1/1, what else needs to be configured? Select all that apply.

Security policy from trust zone to Internet zone that allows ping

Create the appropriate routes in the default virtual router

Security policy from Internet zone to trust zone that allows ping

Create a Management profile that allows ping. Assign that management profile to e1/1 and e1/2

Q26. Which of the following objects cannot use User-ID as a match criteria?

Security Policies

QoS

Policy Based Forwarding

DoS Protection

None of the above

Q27. As the Palo Alto Networks Administrator you have enabled Application Block pages.
Afterwards, not knowing they are attempting to access a blocked web based application, users call the Help Desk to complain about network connectivity issues. What is the cause of the increased number of help desk calls?

The File Blocking Block Page was disabled.

Some AppID’s are set with a Session Timeout value that is too low.

The firewall admin did not create a custom response page to notify potential users that their attempt to access the web based application is being blocked due to policy.

Application Block Pages will only be displayed when Captive Portal is configured.

Q28. Which of the following facts about dynamic updates is correct?

Antivirus updates are released daily. Application and Threat updates are released weekly.

Application and Antivirus updates are released weekly. Threat and “Threat and URL Filtering” updates are released
weekly.

Application and Threat updates are released daily. Antivirus and URL Filtering updates are released weekly.

Threat and URL Filtering updates are released daily. Application and Antivirus updates are released weekly.

Q29. The following can be configured as a next hop in a Static Route:

A Policy-Based Forwarding Rule

Virtual System

A Dynamic Routing Protocol

Virtual Router

Q30. Which of the following facts about dynamic updates is correct?

Antivirus updates are released daily. Application and Threat updates are released weekly.

Application and Antivirus updates are released weekly. Threat and “Threat and URL Filtering” updates are released weekly.

Application and Threat updates are released daily. Antivirus and URL Filtering updates are released weekly.

Threat and URL Filtering updates are released daily. Application and Antivirus updates are released weekly.

Q31. When adding an application in a Policy-based Forwarding rule, only a subset of the entire App-ID database is
represented. Why would this be?

Policy-based forwarding can only indentify certain applications at this stage of the packet flow, as the majority of
applications are only identified once the session is created.

Policy-based forwarding rules require that a companion Security policy rule, allowing the needed Application
traffic, must first be created.

The license for the Application ID database is no longer valid.

A custom application must first be defined before it can be added to a Policy-based forwarding rule.

Q32. Choose two examples where you would leverage the Aviatrix Controller’s S2C (Site-2-Cloud) workflow? (Choose 2)

Connect your branch office to the cloud resources

Connect two branch offices directly to each other

Connect several telecommuting employees to cloud resources based on their geographic location

Connect a partner directly to a VPC/VNET hosting your application

What are the use cases for Site2Cloud?
Popular use cases of S2C:
* SaaS provider to its customer site If you need to move data continuously and securely from customer or partner sites to your SaaS service hosted in AWS, Azure or Google, building an encrypted tunnel between the customer site to you is required.
* Branch offices to cloud If you have many branch offices that need to access applications hosted in AWS or Azure, using Site2Cloud is the most economical way to build a secure tunnel. Why pay extra to SD-WAN vendors to go through their “cloud” when you can use your existing Internet connection?

Q33. “What is the result of an Administrator submitting a WildFire report’s verdict back to Palo Alto Networks as “Incorrect”?

The signature will be updated for False positive and False negative files in the next AV signature update.

The signature will be updated for False positive and False negative files in the next Application signature update.

You will receive an email to disable the signature manually.

You will receive an update within 15 minutes.

Q34. After the installation of a new Application and Threat database, the firewall must be rebooted.

True

False

Q35. The following can be configured as a next hop in a Static Route:

A Policy-Based Forwarding Rule

Virtual System

A Dynamic Routing Protocol

Virtual Router

Q36. Which option allows an administrator to segrate Panorama and Syslog traffic, so that the Management Interface is not
employed when sending these types of traffic?

Custom entries in the Virtual Router, pointing to the IP addresses of the Panorama and Syslog devices.

Define a Loopback interface for the Panorama and Syslog Devices

On the Device tab in the Web UI, create custom server profiles for Syslog and Panorama

Service Route Configuration

Q37. In a Palo Alto Networks firewall, every interface in use must be assigned to a zone in order to process traffic.

True

False

Q38. When configuring the firewall for UserID, what is the maximum number of Domain Controllers that can be
configured?

100

150

Q39. Which fields can be altered in the default Vulnerability profile?

Severity