View all questions & answers for the Palo Alto Next-Generation Firewall Engineer Exam Materials exam

Palo Alto Next-Generation Firewall Engineer Exam Materials - Question #134 Discussion

Comment Image Comment Image Comment Image

To comply with new directives mandating the use of quantum-resistant cryptography for all data-in-transit, a network engineer is tasked with reconfiguring existing IKEv2 VPN tunnels between PA-Series firewalls to meet this requirement. Which two actions should the engineer take to ensure compliance? (Choose two answers)

  • A. Configure an IKE Crypto profile with one or more post-quantum rounds selected and apply it to an IKE Gateway configured for the post-quantum key exchange mechanism.
  • B. Establish a shared secret of at least 64 characters and configure it as a post-quantum pre-shared key (PPK) within an IKEv2-only IKE Gateway.
  • C. Generate a post-quantum pre-shared key (PPK) and apply it within the IPSec tunnel configuration's advanced settings.
  • D. Enable GlobalProtect with quantum-resistant tunneling and apply the profile to the IKE Gateway.
Correct Answer: A,B

Brave-Dump Community Votes

Answer: A, B (1 vote) 100%

Community Explanations & Comments (1)

Anonymous User 8 months ago
Selected: A, B
Implement Post-Quantum Pre-Shared Keys (PQ PPKs) based on RFC 8784.
Implement Post-Quantum Key Exchange (PQ KEM) Hybrid Keys based on RFC 9242 and RFC 9370.