认证考试题库及答案

ACEExam

Question1of72.

Whichofthefollowingisnotdefinedorassignedaspartofthesecurityrules?

答案：A

「NATrules

C'Fileblockingprofile

CSecurityprofiles

厂Applications

Markforfollowup

Question2of72.

ItispossibletousedifferentSSLforwardproxycertificatesfordifferentvsysinamulti-vsys

environment.

答案：A

TrueFalse

rr

Markforfollowup

Question3of72.

InActive/ActiveHAenvironments,redundancyfortheHA3interfacecanbeachievedby

答案：C

ConfiguringHA3inaredundantgroup

ConfiguringacorrespondingHA4interface

「ConfiguringHA3asanAggregateEthernetbundle

「ConfiguringmultipleHA3interfaces

Markforfollowup

Question4of72.

InPANOS4.0orgreater,whichofthefollowingisanaccuratestatementinregardtosupportfor

IPv6?

答案：C

「PANOSsupportsContentIDinIPv6,butonlyinLayer3Mode.

UserIDisonlysupportedinIPv6whenthePaloAltoNetworksfirewallisdeployedinVwiremode.

尸PANOSsupportsdual-stackIP,forIPv4andIPv6.ThisincludesVirtualWireandLayer3

deployments.

CThreatPreventioncapabilitiesarenotsupportedinIPv6.

CNoneoftheabove

Markforfollowup

Question5of72.

WhatneedstobedonepriortocommittingaconfigurationinPanoramaaftermakingachange

viatheCLIorwebinterfaceonadevice?

答案：D

C'Re-importtheconfigurationfromthedeviceintoPanorama

MakethesamechangeagainviaPanorama

SynchronizetheconfigurationbetweenthedeviceandPanorama

Noadditionalactionsrequired

Noneoftheabove

Markforfollowup

Question6of72.

Ifacustomerhas1forestwith3domainsandwantsaresilientPANAgentdeployment,whatis

themostappropriateagentarchitecture?

答案：B

厂Agentsdeployedontwoseparateserverswithintheforest

「TwoAgentsdeployedperdomain,onseparateservers

「Twoagentsdeployedonvirtualserversonaserverwithintheforest

广,Anagentdeployedonaserverwithineachdomain

Markforfollowup

Question7of72.

WhichmodewillallowausertochoosehowtheywishtoconnecttotheGlobalProtectNetwork

astheywouldlike?

答案：C

广OptionalMode

「AlwaysOnMode

OnDemandMode

「SingleSign-OnMode

Markforfollowup

Question8of72.

Active/ActiveHAcanbeconfiguredtoprovide:

答案：C

「Highersessioncount

C'RedundantVirtualRouters

「Supportforasymmetricroutingenvironments

「Lowerfail-overtimes

Markforfollowup

Question9of72.

WhenforwardingmulticastpacketsinL2mode,wecanconfiguresecuritypolicestomatchon

multicastIPaddresses.

答案：B

TrueFalse

rr

Markforfollowup

Question10of72.

ToproperlyconfigureDOSprotectiontolimitthenumberofsessionsindividuallyfromspecific

sourceIPsyouwouldconfigureaDOSProtectionrulewiththefollowingcharacteristics:

答案：B

「Action:Protect,AggregateProfilewith"ResourcesProtection"configured

IAction:Protect,ClassifiedProfilewith"ResourcesProtection"configured,andClassifiedAddresswith

"source-ip-only"configured

「Action:Deny,AggregateProfilewith"ResourcesProtection"configured

尸Action:Deny,ClassifiedProfilewith"ResourcesProtection"configured,andClassifiedAddresswith

"source-ip-only"configured

('Noneoftheabove

rMarkforfollowup

Question11of72.

ForcorrectroutingtoSSLVPNclientstooccur,thefollowingmustbeconfigured:

答案：B

—Astaticrouteonthenext-hopgatewayoftheSSLVPNclientIPpoolwithadestinationofthePAN

device

rNoroutingneedstobeconfigured-thePANdeviceautomaticallyrespondstoARPrequestsforthe

SSLVPNclientIPpool

C'NetworkAddressTranslationmustbeenabledfortheSSLVPNclientIPpool

广AdynamicroutingprotocolbetweenthePANdeviceandthenext-hopgatewaytoadvertisetheSSL

VPNclientIPpool

Markforfollowup

Question12of72.

WhenNetworkAddressTranslationhasbeenperformedontraffic,DestinationZonesinSecurity

rulesshouldbebasedon:

答案；A

Post-NATaddresses

「Pre-NATaddresses

thesamezonesusedintheNATrules

Noneoftheabove

Markforfollowup

Question13of72.

Whenusing802.IQwithaggregatelinks,whatTAG-IDmustbeconfiguredonthevirtualwirein

orderforLACPonaCiscoswitchtooperateproperly?

答案：A

ro

ri

r2

r3

Markforfollowup

Question14of72.

OnaPA-4050withtapinterfacesconfiguredononecopperportandonefiberport,howmany

virtualwirescanbeconfiguredusingtheremainingports?

答案：B

rio

ii

12

ro

Noneoftheabove

Markforfollowup

Question15of72.

Alocal/enterprisePKIsystemisrequiredtodeployoutboundforwardproxySSLdecryption

capabilities.

答案：B

TrueFalse

rr

Markforfollowup

Question16of72.

WhichofthefollowingcanbeconfiguredasanexthopinaPolicy-BasedForwardingRule:

答案：B

「ADynamicRoutingProtocol

「VirtualSystem

广ARedistributionProfile

「VirtualRouter

Alloftheabove

rMarkforfollowup

Question17of72.

Fornon-Microsoftclients,whatCaptivePortalmethodissupported?

答案：C

CNTLMAuth

「UserAgent

「WebFormCaptivePortal

「LocalDatabase

Markforfollowup

Question18of72.

WhichoneoftheoptionsdescribesthesequenceoftheGlobalProtectagentconnectingtoa

Gateway?

答案：A

…Theagentconnectstotheportal,obtainsalistoftheGateways,andconnectstotheGatewaywith

thefastestSSLconnecttime

「TheagentconnectstotheclosestGatewayandsendstheHIPreporttotheportal

尸Theagentconnectstotheportal,obtainsalistoftheGateways,andconnectstotheGatewaywith

thefastestPINGresponsetime

LTheagentconnectstotheportalandrandomlyestablishesconnectiontothefirstavailableGateway

rMarkforfollowup

Question19of72.

AnOutboundSSLdecryptionrulecannotbecreatedusingwhichtypeofzone?

答案：A

「Tap

「VirtualWire

rL2

rL3

C'Noneoftheabove

Markforfollowup

Question20of72.

WhichofthefollowingrepresentspotentialHTTPtrafficeventsthatcanbeusedtoidentify

potentialBotnets?

答案：A

TrafficfromusersthatbrowsetoIPaddressesinsteadoffully-qualifieddomainnames,trafficto

domainsthathavebeenregisteredinthelast30days,downloadingexecutablefilesfromunknown

URL's

TrafficfromusersthatbrowsetoIPaddressesinsteadoffully-qualifieddomainnames,trafficto

/domainsthathavebeenregisteredinthelast60days,downloadingexecutablefilesfromunknown

URL's,IRC-basedCommandandControltraffic

TrafficfromusersthatbrowsetoIPaddressesinsteadoffully-qualifieddomainnames,downloading

W32.Welchia.WormfromaWindowsshare,traffictodomainsthathavebeenregisteredinthelast30

days,downloadingexecutablefilesfromunknownURL's

TrafficfromusersthatbrowsetoIPaddressesinsteadoffully-qualifieddomainnames,trafficto

domainsthathavebeenregisteredinthelast60days,downloadingexecutablefilesfromunknown

URL's

rMarkforfollowup

Question21of72.

WhatistheCLIcommandthatwillinitiateallIPSecVPNtunnelsonadevice?

答案：B

「setvpnallup

「testvpnipsec-sa

「testvpnike-as

('requestvpnipsec-astest

C'Noneoftheabove

Markforfollowup

Question22of72.

You'veinstalledandconfiguredaUserIdentificationAgentonaremotecomputer,butwhenthe

agentuserinterfaceislaunchedthemessage''ConnectionFailed“isshownandnousernames

areresolved.Whatisthemostlikelycauseofthisproblem?

答案：A

-TheUserIdentificationAgentservicedoesnothavereadpermissiontotheActiveDirectorySecurity

log

「TheUserIdentificationAgenttimeoutvaluesarenotconfiguredcorrectly.

TheUserIdentificationAgentsoftwaredidnotinstallproperly.

「TheUserIdentificationAgentcannotcommunicatetothefirewall

「Noneoftheabove

Markforfollowup

Question23of72.

WhichroutingprotocolissupportedonthePaloAltoNetworksplatform?

答案：B

CRIPvl

CBGP

CRSTP

CISIS

「Noneoftheabove

Markforfollowup

Question24of72.

IfyouwanttopreventclientPCsusingSSHport-forwardingtobypassfirewallenforcement,

whatisthebestwayofaccomplishingthis?

答案：A

「EnableSSHdecryption,blockSSHtunneltraffic

「EnableSSLdecryption,blockSSHtraffic

('EnableSSLdecryption,blockSSHtunneltraffic

广EnableSSHdecryption,blockSSHtraffic

Markforfollowup

Question25of72.

WhensettingupGlobaIProtect,whatisthejoboftheGlobalProtectPortal?Selectthebest

answer

答案：C

ToloadbalanceGlobalProtectclientconnectionstoGlobalProtectGateways

「TomaintainthelistofGlobalProtectGatewaysandlistofcategoriesforcheckingtheclientmachine

_ToapplyGlobalServerLoadBalancingtoGlobalProtectclientstootherGlobalProtectPortalsor

Gateways.

尸TomaintainthelistofremoteGlobalProtectPortalsandlistofcategoriesforcheckingtheclient

machine

Markforfollowup

Question26of72.

ThemaximumnumberofinterfacesthatcanbeconfiguredinasingleVirtualWireobjectis:

答案：B

ri

r2

r4

r8

r16

Markforfollowup

Question27of72.

The"DisableServerReturnInspection"optiononasecurityprofile:

答案：D

「canonlybeconfiguredinTapMode

doesnotperformhigher-levelinspectionoftrafficfromthesidethatoriginatedtheTCPSYNpacket

doesnotperformhigher-levelinspectionoftrafficfromthesidethatoriginatedtheTCPSYNpacket

「performshigher-levelinspectionoftrafficfromthesidethatoriginatedtheTCPSYNpacket

€'Noneoftheabove

Markforfollowup

Question28of72.

The"Drive-ByDownload"protectionfeature,underFileBlockingprofilesinContend-ID,

provides:

答案：B

C'Increasedspeedonthedownloadsoftheallowedfiletypes.

尸Protectionagainstunwanteddownloads,byalertingtheuserwitharesponsepageindicatingthata

fileisgoingtobedownloaded.

广anadministratortheabilitytoleverageAuthenticationProfilesinordertoprotectagainstunwanted

downloads.

CPassword-protectedaccesstospecificfiledownloads,forauthorizedusers.

Markforfollowup

Question29of72.

ToallowthePANdevicetoresolveinternalandexternalDNShostnamesforreportingandfor

securitypolicy,anadministratorcandothefollowing:

答案：B

InthedevicesettingssetthePrimaryDNSservertoanexternalserverandthesecondarytoan

internalserver.

CreateaDNSProxyObjectwithadefaultDNSServerforexternalresolutionandaDNSserverfor

internaldomain.Then,inthedevicesettings,pointtothisproxyobjectforDNSresolution.

CreateaDNSProxyObjectwithadefaultDNSServerforexternalresolutionandaDNSserverfor

internaldomain.Then,inthedevicesettings,selecttheproxyobjectasthePrimaryDNSandcreatea

customsecurityrulewhichreferencesthatobject.

Inthedevicesettingsdefineinternalhostsviaastaticlist.

「Noneoftheabove

Markforfollowup

Question30of72.

WhathappensatthepointofThreatPreventionlicenseexpiration?

答案：A

J」ThreatPreventionnolongerupdated;existingdatabasestilleffective

ThreatPreventionnolongerused;trafficisallowedorblockedbyconfigurationperSecurityRule

('ThreatPreventionnolongerused;applicabletrafficisblocked

CThreatPreventionisnolongerused;applicabletrafficisallowed

Markforfollowup

Question31of72.

Wherecanyouenablethe''DynamicURLFiltering"option?

答案：D

「InthezoneconfigurationthatincludestheinterfacefortheURLfilteredtraffic

「IntheZoneProtectionProfilesettings

UnderDevice/Licenses/URLFiltering

IntheURLFilteringsecurityprofileobject

「Noneoftheabove

Markforfollowup

Question32of72.

WhichofthefollowingtypesofprotectionareavailableinDoSpolicy?

答案：A

<•SessionLimit,SYNFlood,UDPFlood

「SessionLimit,SYNFlood,HostSwapping,UDPFlood

「SessionLimit,SYNFlood,PortScanning,HostSwapping

「SessionLimit,PortScanning,HostSwapping,UDPFlood

Markforfollowup

Question33of72.

AcustomerwouldliketoidentifyanyTCPportscansorUDPportsscanstraversingtheirnetwork

links.Wherecanthistypeofsecuritypolicybeconfigured?

答案：A

「Network/NetworkProfiles/ZoneProtection

CPolicies/Profile/ZoneProtection

CObjects/ZoneProtection

Interfaces/Interfacenumber/ZoneProtection

rMarkforfollowup

Question34of72.

ToreducetheamountofURLlogsgeneratedyoucanconfigure:

答案：A

AURLFilteringProfilewith"Logcontainerpageonly"enabled

「AURLFilteringProfilewith"DynamicURLFiltering"enabled

「AURLFilteringProfilewiththeblocklistsetto"Alert"

「ThefollowingCLIcommand:"setsystemurl-log-length256

Markforfollowup

Question35of72.

WhenconfiguringSecurityrulesbasedonFQDNobjects,whichofthefollowingstatementsare

true?

答案：A

…ThefirewallresolvestheFQDNfirstwhenthepolicyiscommitted,andisrefreshedatTTLexpiration.

ThereisnolimitonthenumberofIPaddressesstoredforeachresolvedFQDN.

尸InordertocreateFQDN-basedobjects,youneedtomanuallydefinealistofassociatedIP.Upto10

IPaddressescanbeconfiguredforeachFQDNentry.

「ThefirewallresolvestheFQDNfirstwhenthepolicyiscommitted,andisrefreshedeachtimeSecurity

rulesareevaluated.

尸ThefirewallresolvestheFQDNfirstwhenthepolicyiscommitted,andisrefreshedatTTLexpiration.

TheresolutionofthisFQDNstoresupto10differentIPaddresses.

rMarkforfollowup

Question36of72.

WhatisrequiredtoconfiguremultiplePhase2IPSecVPNtunnelstothesamePhase1gateway?

答案：B

CMultipleP2tunnelswithdifferentProxyID'sondifferenttunnelinterfaces

C'MultipleP2tunnelswithdifferentProxyID'sonthesametunnelinterface

CMultipletunnelinterfaces

C'MultipleP2tunnelswithdifferentPeerID'sonthesametunnelInterfaces

Markforfollowup

Question37of72.

WithSSHdecryptionenabled,theSCPapplicationwillbeidentifiedas:

答案：A

Cssh

「sftp

「scp

「ssh-tunnel

Markforfollowup

Question38of72.

WhichofthefollowinglicensesisnecessaryinordertoprovidemoreaccurateBotnetreporting?

答案：D

GlobaIProtectGatewayLicense

「ThreatPreventionLicense

「VirtualSystemLicense

「URL-FilteringLicense

CAlloftheabove

Markforfollowup

Question39of72.

WhenauserlogsinviaCaptivePortal,theiruserinformationischeckedagainst:

答案：B

C'ActiveDirectory

CRadius

「Localdatabase

「Alloftheabove

Markforfollowup

Question40of72.

WhatoptionshouldbeconfiguredwhenusingUserIdentification?

答案：C

「EnableUserIdentificationperinterface

EnableUserIdentificationperSecurityRule

EnableUserIdentificationperZone

「Noneoftheabove

Markforfollowup

Question41of72.

WhichofthefollowingarenecessarycomponentsofaGlobalProtectsolution?

答案：D

「GlobalProtectNetConnectzGlobalProtectAgent,GlobalProtectPortal,GlobalProtectServer

_GlobalProtectGateway,GlobalProtectNetConnect,GlobalProtectAgent,GlobalProtectPortal,

GlobalProtectServer

「GlobalProtectGateway,GlobalProtectAgent,GlobalProtectServer

广,GlobalProtectGateway,GlobalProtectAgent,GlobalProtectPortal

「Noneoftheabove

Markforfollowup

Question42of72.

HowmanybytesoftheURLarecapturedintheURLLog?

答案：C

C2047

r255

r511

1023

Markforfollowup

Question43of72.

ThefollowingcanbeconfiguredasanexthopinaStaticRoute:

答案：D

「APolicy-BasedForwardingRule

「VirtualSystem

LADynamicRoutingProtocol

「VirtualRouter

「Noneoftheabove

Markforfollowup

Question44of72.

Whichbestdescribesthefirewallrulestobeappliedtoasession?

答案：B

「lastmatchapplied

「firstmatchapplied

『mostspecificmatchapplied

Callmatchesapplied

Markforfollowup

Question45of72.

ForasecuritypolicytoallowinboundNATedtraffictoawebserverwithaprivateIPaddressin

thetrustzone,theentryintheDestinationAddresscolumnofthesecurityruleshouldbebased

ontheprivateIPaddressofthewebserver.

答案：B

TrueFalse

rr

Markforfollowup

Question46of72.

WhichlocalinterfacecannotbeassignedtoIKEgateway?

答案：D

CVLAN

「Loopback

rL3

rTunnel

Markforfollowup

Question47of72.

AtrafficlogentrywithanApplicationof"incomplete"means:

答案：A

TheTCPSYN-ACKresponsepacketwasnotseenbeforethesessiontimedout

CaptivePortalhasnotbeenconfiguredproperly

AninvalidSSLcertificateisinuse

「TheApp-IDenginecouldnotfindamatchingapplication

「Noneoftheabove

Markforfollowup

Question48of72.

Whencreatingacustomvulnerabilityprofileandselecting"BlockIP"astheaction,howlongwill

theIPaddressbeblocked?

答案：D

厂'OneHour

「Configurablefromonesecondtotwohours

「TwoHours

CConfigurablefromonesecondtoonehour

Markforfollowup

Question49of72.

WhichstatementaccuratelyreflectsthefunctionalityofusingregionsasobjectsinSecurity

policies?

答案：D

Theadministratorcansetupcustomregions,includinglatitudeandlongitude,tospecifythe

geographicpositionofthatparticularregion.Thesecustomregionscanbeusedinthe"SourceUser"

fieldoftheSecurityPolicies.

Theadministratorcansetupcustomregions,includinglatitudeandlongitude,tospecifythe

geographicpositionofthatparticularregion.Bothpredefinedregionsandcustomregionscanbeused

inthe"SourceUser"field.

Regionscannotbeusedinthe"SourceUser"fieldoftheSecurityPolicies,unlesstheadministrator

C

hassetupcustomregions.

Predefinedregionsareprovidedforcountries,notbutnotforcities.Theadministratorcansetup

「customregions,includinglatitudeandlongitude,tospecifythegeographicpositionofthatparticular

region.

Markforfollowup

Question50of72.

WithURLfiltering,theorderofcheckingwithinaprofileis1)allowlist;2)blocklist;3)URL

categories.

答案：B

TrueFalse

Markforfollowup

Question51of72.

BotnetDetection,undertheMonitortab,willaccomplishthefollowing:

答案：D

尸Providetheadministratorwithpacketcapturesthatcanbeusedlatertocreatecustomsignaturesfor

preventingunknownbotnets.

「ToblocktheinstallationofBotnetsthroughanadvanceddeep-packetinspectionalgorithm.

PreventBotnet-infectclientcomputersfromrespondingtoCommandandControldata.

PresentareportofknownBotnets,baseduponconditionsstipulatedbytheadministrator,foundover

r

aperiodoftime.

Noneoftheabove

rMarkforfollowup

Question52of72.

HApathmonitoringcanbeconfiguredinVirtualWiremode.

答案：A

TrueFalse

rr

Markforfollowup

Question53of72.

A"Continue"actioncanbeconfiguredonwhichofthefollowingSecurityProfiles.

答案：C

「URLFiltering,FileBlocking,andDataFiltering

「URLFiltering

「URLFilteringandFileBlocking

「URLFilteringandAntivirus

「Alloftheabove

Markforfollowup

Question54of72.

ThebestpracticetoadvertiseaninterfaceIPviaOSPFwithoutitactingasanOSPFneighborand

withoutitcreatingunnecessaryType5LSA'sis:

答案：C

ConfiguretheinterfaceasaVirtualLink

「ConfigurearoutingpolicytoimporttheconnectedsubnetintotheOSPFarea

CConfiguretheinterfaceasapassiveOSPFinterface

ConfigureastaticrouteandconfigurearoutingpolicytoimportthestaticrouteintotheOSPFarea

「Noneoftheabove

Markforfollowup

Question55of72.

WithSSHdecryptionenabled,X-Windowforwardingwillbeidentifiedas:

答案：C

rssh

C'xwindow

「ssh-tunnel

「rdp

「Noneoftheabove

Markforfollowup

Question56of72.

Whencreatinganapplicationfilter,whichofthefollowingcharacteristicscannotbeselectedasa

"match"?

答案：C

Excessivebandwidth

Usedbymalware

「Excessivesessions

I'Transfersfiles

Markforfollowup

Question57of72.

Userscanbeauthenticatedseriallytomultipleauthenticationserversbyconfiguring:

答案：C

「AuthenticationProfile

广,AcustomAdministratorProfile

CAuthenticationSequence

「MultipleRADIUSServerssharingaVSAconfiguration

Markforfollowup

Question58of72.

WhichtwostatementsaretrueabouttheSessionOwnerdeviceinanActive/ActiveHApair?

答案：C

尸TheSessionOwnerperformsLayer3andLayer4packetprocessing,theActivePrimarydeviceis

alwaystheSessionOwner

一TheSessionOwnerdoesallLayer7processing,TheActivePrimarydeviceisalwaystheSession

Owner

TheSessionOwnerperformsallLayer3andLayer4packetprocessing,theSessionOwneris

responsibleforgeneratingtrafficlogs

TheSessionOwnerisresponsibleforgeneratingtrafficlogs,theActivePrimarydeviceisalwaysthe

SessionOwner.

Markforfollowup

Question59of72.

You'dliketoscheduleafirewallpolicytoonlyallowacertainapplicationduringaparticulartime

ofday.Wherecanthispolicyoptionbeconfigured?

答案：A

('Policies/Optionscolumn

「Policies/Service

TPolicies/Application

CPolicies/Profile

「Noneoftheabove

Markforfollowup

Question60of72.

WhatisthecorrectpolicytomosteffectivelyblockSkype?

答案：A

「AllowSkype-probe,blockSkype

,BlockSkype

「BlockSkype-probe,blockSkype

AllowSkype,blockSkype-probe

Noneoftheabove

Markforfollowup

Question61of72.

WhatrightstothedomaindoestheTerminalServicesAgentrequireinordertoidentifyuserson

aterminalserver?

答案：A

「DoesnotneedDomainpermissions

CReadaccesstotheSecuritylogs

「DomainUser

C'DomainAdmin

Markforfollowup

Question62of72.

WhichofthefollowingarevalidHAstatesinanActive/ActiveHighAvailabilitydeployment?

答案：A

「ActivePrimary.Tentative,Non-functional

「ActivePrimary,ActiveTentative,Non-functional

「ActivePrimary,ActiveTentative,Tentative

ActiveTentative,Tentative,Non-functional

rMarkforfollowup

Question63of72.

WhichofthefollowingfieldsisnotavailableinDoSpolicy?

答案：A

「Application

「SourceZone

「Service

C'DestinationZone

「Noneoftheabove

Markforfollowup

Question64of72.

WhichofthefollowingareaccuratestatementsdescribingtheHA3linkinanActive-ActiveHA

deployment?

答案：A

「HA3isaLayer2link,HA3isusedtohandleasymmetricrouting

「HA3isthecontrollink,HA3isalayer2link

「HA3isusedtohandleasymmetricrouting,HA3isthedatalink

「HA3isusedforsessionsynchronization,HA3isaLayer2link

rMarkforfollowup

Question65of72.

InQoS,whichofthefollowingwouldbethehighestprioritytrafficfromtheoptionslistedbelow

onasaturated100Mbpslink?

答案：C

「Class1traffic,settohighandguaranteed1Mbps.

C'Class1traffic,settohigh.

「Class8traffic,settorealtime.

C'Class8traffic,settorealtimeandguaranteed1Mbps

Noneoftheabove

Markforfollowup

Question66of72.

Whatisthedefaultactionagainstvirusdetection