Free Practice Questions for Palo Alto Networks PSE-Strata-Pro-24 Exam 2025

A current NGFW customer has asked a systems engineer (SE) for a way to prove to their internal management team that its NGFW follows Zero Trust principles. Which action should the SE take?

• Use the "Monitor > PDF Reports" node to schedule a weekly email of the Zero Trust report to the internal management team.
• Help the customer build reports that align to their Zero Trust plan in the "Monitor > Manage Custom Reports" tab.
• Use a third-party tool to pull the NGFW Zero Trust logs, and create a report that meets the customer's needs.
• Use the "ACC" tab to help the customer build dashboards that highlight the historical tracking of the NGFW enforcing policies.

Which statement applies to the default configuration of a Palo Alto Networks NGFW?

• Security profiles are applied to all policies by default, eliminating implicit trust of any data traversing the firewall.
• The default policy action for intrazone traffic is deny, eliminating implicit trust within a security zone.
• The default policy action allows all traffic unless explicitly denied.
• The default policy action for interzone traffic is deny, eliminating implicit trust between security zones.

Which statement appropriately describes performance tuning Intrusion Prevention System (IPS) functions on a Palo Alto Networks NGFW running Advanced Threat Prevention?

• Leave all signatures turned on because they do not impact performance.
• Create a new threat profile to use only signatures needed for the environment.
• Work with TAC to run a debug and receive exact measurements of performance utilization for the IPS.
• To increase performance, disable any threat signatures that do not apply to the environment.

What is used to stop a DNS-based threat?

• DNS proxy
• Buffer overflow protection
• DNS tunneling
• DNS sinkholing

What are three valid Panorama deployment options? (Choose three.)

• As a virtual machine (ESXi, Hyper-V, KVM)
• With a cloud service provider (AWS, Azure, GCP)
• As a container (Docker, Kubernetes, OpenShift)
• On a Raspberry Pi (Model 4, Model 400, Model 5)
• As a dedicated hardware appliance (M-100, M-200, M-500, M-600)

Which two actions should a systems engineer take when a customer is concerned about how to remain aligned to Zero Trust principles as they adopt additional security features over time? (Choose two)

• Turn on all licensed Cloud-Delivered Security Services (CDSS) subscriptions in blocking mode for all policies.
• Apply decryption where possible to inspect and log all new and existing traffic flows.
• Use the Best Practice Assessment (BPA) tool to measure progress toward Zero Trust principles.
• Use the Policy Optimizer tool to understand security rules allowing users to bypass decryption.

Regarding APIs, a customer RFP states: "The vendor’s firewall solution must provide an API with an enforcement mechanism to deactivate API keys after two hours." How should the response address this clause?

• Yes - This is the default setting for API keys.
• No - The PAN-OS XML API does not support keys.
• No - The API keys can be made, but there is no method to deactivate them based on time.
• Yes - The default setting must be changed from no limit to 120 minutes.

Which three tools can a prospective customer use to evaluate Palo Alto Networks products to assess where they will fit in the existing architecture? (Choose three)

• Proof of Concept (POC)
• Policy Optimizer
• Security Lifecycle Review (SLR)
• Ultimate Test Drive
• Expedition

With Strata Cloud Manager (SCM) or Panorama, customers can monitor and manage which three solutions? (Choose three.)

• Prisma Access
• Prisma Cloud
• Cortex XSIAM
• NGFW
• Prisma SD-WAN

A prospective customer wants to validate an NGFW solution and seeks the advice of a systems engineer (SE) regarding a design to meet the following stated requirements:"We need an NGFW that can handle 72 Gbps inside of our core network. Our core switches only have up to 40 Gbps links available to which new devices can connect. We cannot change the IP address structure of the environment, and we need protection for threat prevention, DNS, and perhaps sandboxing."Which hardware and architecture/design recommendations should the SE make?

• PA-5445 or larger to cover the bandwidth need and the link types; Architect aggregate interface groups in Layer-2 or virtual wire mode that include 2 x 40Gbps interfaces on both sides of the path.
• PA-5430 or larger to cover the bandwidth need and the link types; Architect aggregate interface groups in Layer-3 mode that include 40Gbps interfaces on both sides of the path.
• PA-5445 or larger to cover the bandwidth need and the link types; Architect aggregate interface groups in Layer-3 mode that include 40Gbps interfaces on both sides of the path.
• PA-5430 or larger to cover the bandwidth need and the link types; Architect aggregate interface groups in Layer-2 or virtual wire mode that include 2 x 40Gbps interfaces on both sides of the path.