A security team is configuring SSL decryption and wants to balance security with compatibility. They need to support older clients that only support TLS 1.0, but they also want to enforce strong ciphers. What is the best approach?

Use a decryption profile to block TLS 1.0 traffic.

Enable TLS 1.0 in the SSL/TLS profile but restrict the cipher suites to strong ones.

Disable TLS 1.0 and require all clients to upgrade.

Use a certificate profile to restrict the protocol version.

What is the primary role of a subordinate CA in PAN-OS SSL decryption?

To issue forward trust and forward untrust certificates

To store private keys for decrypted sessions

To validate client certificates for authentication

To encrypt traffic between the firewall and the internet

An organization wants to use certificates from a public CA for user authentication to the firewall's management interface. They have already imported the CA certificate. What additional configuration is required to enable certificate authentication for administrators?

Enable 'Certificate Authentication' on the management interface and select the CA certificate.

Create a certificate profile that references the CA and assign it to the admin authentication profile.

Import the CA certificate into the firewall's default trust store and enable 'Use CRL'.

Create a decryption profile that references the CA and assign it to the admin role.

Palo Alto NetworksCertified Next-Generation Firewall Engineer

Domain 2Objective 5

2.5 Configure Certificates NEXT-GENERATION-FIREWALL-ENGINEER Practice Questions (Page 3)

Part of the PAN-OS Device Setting Configuration domain, which accounts for 40% of the NEXT-GENERATION-FIREWALL-ENGINEER exam.

22questions here

5free pages

6concepts

40%of the exam

Questions 11–15

11foundation · easy
Which validation method can be configured in a certificate profile to check the revocation status of certificates?
Select an answer first
12expert · hard
A security team is configuring SSL decryption and wants to balance security with compatibility. They need to support older clients that only support TLS 1.0, but they also want to enforce strong ciphers. What is the best approach?
Select an answer first
13foundation · easy
What is the primary role of a subordinate CA in PAN-OS SSL decryption?
Select an answer first
14foundation · easy
When a server presents an untrusted certificate, which certificate does the firewall use to continue decryption?
Select an answer first
15application · medium
An organization wants to use certificates from a public CA for user authentication to the firewall's management interface. They have already imported the CA certificate. What additional configuration is required to enable certificate authentication for administrators?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NEXT-GENERATION-FIREWALL-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “NEXT-GENERATION-FIREWALL-ENGINEER” is a trademark of its owner, used for identification only.

2.5 Configure Certificates NEXT-GENERATION-FIREWALL-ENGINEER Practice Questions (Page 3)

Questions 11–15

Which validation method can be configured in a certificate profile to check the revocation status of certificates?

A security team is configuring SSL decryption and wants to balance security with compatibility. They need to support older clients that only support TLS 1.0, but they also want to enforce strong ciphers. What is the best approach?

What is the primary role of a subordinate CA in PAN-OS SSL decryption?

When a server presents an untrusted certificate, which certificate does the firewall use to continue decryption?

An organization wants to use certificates from a public CA for user authentication to the firewall's management interface. They have already imported the CA certificate. What additional configuration is required to enable certificate authentication for administrators?

Keep studying — PAN-OS Device Setting Configuration