Actual PCNSE Exam Updated Material

dumps2022-02-14T02:49:23+08:00

It is easy for you to pass PCNSE exam easily. The updated PCNSE exam material is the best guides for you to study all the related topics. Free updated PCNSE exam actual material is below.

Page 1 of 13

1. Topic 1, Main Questions NEW

The SSL Forward Proxy decryption policy is configured. The following four certificate authority (CA) certificates are installed on the firewall.

An end-user visits the untrusted website https //www firewall-do-not-trust-website com

Which certificate authority (CA) certificate will be used to sign the untrusted webserver certificate?

Forward-Untrust-Certificate

Forward-Trust-Certificate

Firewall-CA

Firewall-Trusted-Root-CA

2. A standalone firewall with local objects and policies needs to be migrated into Panorama.

What procedure should you use so Panorama is fully managing the firewall?

Use the "import Panorama configuration snapshot" operation, then perform a device-group commit push with "include device and network templates"

Use the "import device configuration to Panorama" operation, then "export or push device config bundle" to push the configuration

Use the "import Panorama configuration snapshot" operation, then "export or push device config bundle" to push the configuration

Use the "import device configuration to Panorama" operation, then perform a device-group commit push with "include device and network templates"

3. Which CLI command displays the physical media that are connected to ethernetl/8?

> show system state filter-pretty sys.si.p8.stats

> show interface ethernetl/8

> show system state filter-pretty sys.sl.p8.phy

> show system state filter-pretty sys.si.p8.med

4. DRAG DROP

Based on PANW Best Practices for Planning DoS and Zone Protection, match each type of DoS attack to an example of that type of attack.

5. DRAG DROP

Place the steps in the WildFire process workflow in their correct order.

6. How can packet butter protection be configured?

at me device level (globally to protect firewall resources and ingress zones, but not at the zone level

at the device level (globally) and it enabled globally, at the zone level

at the interlace level to protect firewall resources

at zone level to protect firewall resources and ingress zones but not at the device level

7. in a template you can configure which two objects? (Choose two.)

SD WAN path quality profile

application group

IPsec tunnel

Monitor profile

8. Which statement accurately describes service routes and virtual systems?

Virtual systems can only use one interface for all global service and service routes of the firewall

The interface must be used for traffic to the required external services

Virtual systems that do not have specific service routes configured inherit the global service and service route settings for the firewall

Virtual systems cannot have dedicated service routes configured: and virtual systems always use the global service and service route settings for the firewall

9. The manager of the network security team has asked you to help configure the company's Security Profiles according to Palo Alto Networks best practice. As part of that effort, the manager has assigned you the Vulnerability Protection profile for the internet gateway firewall.

Which action and packet-capture setting for items of high severity and critical severity best matches Palo Alto Networks best practice'?

action 'reset-both' and packet capture 'extended-capture'

action 'default' and packet capture 'single-packet'

action 'reset-both' and packet capture 'single-packet'

action 'reset-server' and packet capture 'disable'

10. When you import the configuration of an HA pair into Panorama, how do you prevent the import from affecting ongoing traffic?

Disable HA

Disable the HA2 link

Disable config sync

Set the passive link state to 'shutdown

Page 2 of 13

11. Which configuration task is best for reducing load on the management plane?

Disable logging on the default deny rule

Enable session logging at start

Disable pre-defined reports

Set the URL filtering action to send alerts

12. Which two statements are true for the DNS Security service? (Choose two.)

It eliminates the need for dynamic DNS updates

It functions like PAN-DB and requires activation through the app portal

It removes the 100K limit for DNS entries for the downloaded DNS updates

It is automatically enabled and configured

13. An administrator has 750 firewalls. The administrator's central-management Panorama instance deploys dynamic updates to the firewalls.

The administrator notices that the dynamic updates from Panorama do not appear on some of the firewalls.

If Panorama pushes the configuration of a dynamic update schedule to managed firewalls, but the configuration does not appear what is the root cause?

Panorama has no connection to Palo Alto Networks update servers

Panorama does not have valid licenses to push the dynamic updates

No service route is configured on the firewalls to Palo Alto Networks update servers

Locally-defined dynamic update settings take precedence over the settings that Panorama pushed

14. An engineer is creating a security policy based on Dynamic User Groups (DUG) What benefit does this provide?

Automatically include users as members without having to manually create and commit policy or group changes

DUGs are used to only allow administrators access to the management interface on the Palo Alto Networks firewall

It enables the functionality to decrypt traffic and scan for malicious behaviour for User-ID based policies

Schedule commits at a regular intervals to update the DUG with new users matching the tags specified

15. Which value in the Application column indicates UDP traffic that did not match an App-ID signature?

not-applicable

incomplete

unknown-ip

unknown-udp

16. An administrator device-group commit push is tailing due to a new URL category

How should the administrator correct this issue?

verify that the URL seed Tile has been downloaded and activated on the firewall

change the new category action to alert" and push the configuration again

update the Firewall Apps and Threat version to match the version of Panorama

ensure that the firewall can communicate with the URL cloud

17. What are three tasks that cannot be configured from Panorama by using a template stack? (Choose three)

configure a device block list

rename a vsys on a multi-vsys firewall

enable operational modes such as normal mode, multi-vsys mode, or FIPS-CC mode

add administrator accounts

change the firewall management IP address

18. What type of address object would be useful for internal devices where the addressing structure assigns meaning to certain bits in the address, as illustrated in the diagram?

IP Netmask

IP Wildcard Mask

IP Address

IP Range

19. SSL Forward Proxy decryption is configured but the firewall uses Untrusted-CA to sign the website https //www important-website com certificate End-users are receiving me "security certificate is not trusted is warning Without SSL decryption the web browser shows that the website certificate is trusted and signed by a well-known certificate chain Well-Known-lntermediate and Well-Known-Root-CA.

The network security administrator who represents the customer requires the following two behaviors when SSL Forward Proxy is enabled:

1 End-users must not get the warning for the https://www.very-important-website.com website.

2 End-users should get the warning for any other untrusted website

Which approach meets the two customer requirements?

Navigate to Device > Certificate Management > Certificates > Device Certificates import Well-Known-lntermediate-CA and Well-Known-Root-CA select the Trusted Root CA checkbox and commit the configuration

Install the Well-Known-lntermediate-CA and Well-Known-Root-CA certificates on all end-user systems m the user and local computer stores

Navigate to Device > Certificate Management - Certificates s Default Trusted Certificate Authorities import Well-Known-intermediate-CA and Well-Known-Root-CA select the Trusted Root CA check box and commit the configuration

Clear the Forward Untrust Certificate check box on the Untrusted-CA certificate and commit the configuration

20. An organization has recently migrated its infrastructure and configuration to NGFWs, for which Panorama manages the devices. The organization is coming from a L2-L4 firewall vendor, but wants to use App-ID while identifying policies that are no longer needed

Which Panorama tool can help this organization?

Config Audit

Policy Optimizer

Application Groups

Test Policy Match

Page 3 of 13

21. An administrator with 84 firewalls and Panorama does not see any WildFire logs in Panorama.

All 84 firewalls have an active WildFire subscription On each firewall WildFire logs are available.

This issue is occurring because forwarding of which type of logs from the firewalls to Panorama is missing?

System logs

Traffic logs

WridFire logs

Threat logs

22. A customer wants to spin their session load equally across two SD-WAN-enabled interfaces.

Where would you configure this setting?

Path Quality profile

ECMP setting on virtual router

Traffic Dtstnbution profile

SD-WAN Interface profile

23. DRAG DROP

Below are the steps in the workflow for creating a Best Practice Assessment in a firewall and Panorama configuration Place the steps in order.

24. An organization is building a Bootstrap Package to deploy Palo Alto Networks VM-Series firewalls into their AWS tenant.

Which two statements are correct regarding the bootstrap package contents? (Choose two)

The /config /content and /software folders are mandatory while the /license and /plugin folders are optional

The bootstrap package is stored on an AFS share or a discrete container file bucket

The directory structure must include a /config /content, /software and /license folders

The init-cfg txt and bootstrap.xml files are both optional configuration items for the /config folder

The bootstrap xml file allows for automated deployment of VM-Senes firewalls with full network and policy configurations.

25. A network-security engineer attempted to configure a bootstrap package on Microsoft Azure, but the virtual machine provisioning process failed. In reviewing the bootstrap package, the engineer only had the following directories: /config, /license and /software

Why did the bootstrap process fail for the VM-Series firewall in Azure?

All public cloud deployments require the /plugins folder to support proper firewall native integrations

The /content folder is missing from the bootstrap package

The VM-Series firewall was not pre-registered in Panorama and prevented the bootstrap process from successfully completing

The /config or /software folders were missing mandatory files to successfully bootstrap

26. A remote administrator needs access to the firewall on an untrust interlace.

Which three options would you configure on an interface Management profile lo secure management access? (Choose three)

HTTP

User-ID

SSH

HTTPS

Permitted IP Addresses

27. What is a key step in implementing WildFire best practices?

In a mission-critical network, increase the WildFire size limits to the maximum value

In a security-first network set the WildFire size limits to the minimum value

Configure the firewall to retrieve content updates every minute

Ensure that a Threat Prevention subscription is active

28. Given the following snippet of a WildFire submission log. did the end-user get access to the requested information and why or why not?

Yes. because the action is set to "allow ''

No because WildFire categorized a file with the verdict "malicious"

Yes because the action is set to "alert"

No because WildFire classified the seventy as "high."

29. In a device group, which two configuration objects are defined? (Choose two )

DNS Proxy

address groups

SSL/TLS profiles

URL Filtering profiles

30. An administrator is considering upgrading the Palo Alto Networks NGFW and central management Panorama version

What is considered best practice for this scenario?

Perform the Panorama and firewall upgrades simultaneously

Upgrade the firewall first wait at least 24 hours and then upgrade the Panorama version

Upgrade Panorama to a version at or above the target firewall version

Export the device state perform the update, and then import the device state

Page 4 of 13

31. An engines must configure the Decryption Broker feature.

To which router must the engineer assign the decryption forwarding interfaces that are used m the Decryption Broker security Chain?

a virtual router that has no additional interfaces for passing data-plane traffic and no other configured routes than those used in for the security chain

the virtual router that routes the traffic that the Decryption Broker security chain inspects

a virtual router that is configured with at least one dynamic routing protocol and has at least one entry in the RIB

the default virtual router (If there is no default virtual router the engineer must create one during setup)

32. Which User-ID mapping method should be used in a high-security environment where all IP address-to-user mappings should always be explicitly known?

PAN-OS integrated User-ID agent

LDAP Server Profile configuration

GlobalProtect

Windows-based User-ID agent

33. Given the following configuration, which route is used for destination 10.10.0.4?

Route 4

Route 3

Route 1

Route 3

34. When you configure a Layer 3 interface what is one mandatory step?

Configure Security profiles, which need to be attached to each Layer 3 interface

Configure Interface Management profiles which need to be attached to each Layer 3 interface

Configure virtual routers to route the traffic for each Layer 3 interface

Configure service routes to route the traffic for each Layer 3 interface

35. The following objects and policies are defined in a device group hierarchy

C)

Address Objects

-Shared Address 1

-Branch Address2

Policies -Shared Polic1

l -Branch Policyl

D)

Address Objects

-Shared Addressl

-Shared Address2

-Branch Addressl

Policies -Shared Policyl

-Shared Policy2

-Branch Policyl

Option A

Option B

Option C

Option D

36. What are two valid deployment options for Decryption Broker? (Choose two)

Transparent Bridge Security Chain

Layer 3 Security Chain

Layer 2 Security Chain

Transparent Mirror Security Chain

37. What are two common reasons to use a "No Decrypt" action to exclude traffic from SSL decryption? (Choose two.)

the website matches a category that is not allowed for most users

the website matches a high-risk category

the web server requires mutual authentication

the website matches a sensitive category

38. An administrator is using Panorama and multiple Palo Alto Networks NGFWs. After upgrading all devices to the latest PAN-OS® software, the administrator enables log forwarding from the firewalls to Panoram A. Pre-existing logs from the firewalls are not appearing in Panoram A.

Which action would enable the firewalls to send their pre-existing logs to Panorama?

Use the import option to pull logs.

Export the log database

Use the scp logdb export command

Use the ACC to consolidate the logs

39. An enterprise information Security team has deployed policies based on AD groups to restrict user access to critical infrastructure systems However a recent phisning campaign against the organization has prompted Information Security to look for more controls that can secure access to critical assets For users that need to access these systems Information Security wants to use PAN-OS multi-factor authentication (MFA) integration to enforce MFA.

What should the enterprise do to use PAN-OS MFA1?

Configure a Captive Porta1 authentication policy that uses an authentication profile that references a RADIUS profile

Create an authentication profile and assign another authentication factor to be used by a Captive Portal authentication policy

Configure a Captive Portal authentication policy that uses an authentication sequence

Use a Credential Phishing agent to detect prevent and mitigate credential phishing campaigns

40. Based on the graphic, which statement accurately describes the output shown in the Server Monitoring panel?

The User-ID agent is connected to a domain controller labeled lab-client.

The host lab-client has been found by the User-ID agent.

The host lab-client has been found by a domain controller.

The User-ID agent is connected to the firewall labeled lab-client.

Page 5 of 13

41. A organizations administrator has the funds available to purchase more firewalls to increase the organization's security posture.

The partner SE recommends placing the firewalls as close as possible to the resources that they protect

Is the SE's advice correct and why or why not?

Yes Firewalls are session based so they do not scale to millions of CPS

No Placing firewalls m front of perimeter DDoS devices provides greater protection tor sensitive devices inside the network

Yes Zone Protection profiles can be tailored to the resources that they protect via the configuration of specific device types and operating systems

No Firewalls provide new defense and resilience to prevent attackers at every stage of the cyberattack lifecycle independent of placement

42. Refer to the diagram.

An administrator needs to create an address object that will be useable by the NYC. MA, CA and WA device groups

Where will the object need to be created within the device-group hierarchy?

Americas

East

West

43. A superuser is tasked with creating administrator accounts for three contractors For compliance purposes, all three contractors will be working with different device-groups in their hierarchy to deploy policies and objects.

Which type of role-based access is most appropriate for this project?

Create a Dynamic Admin with the Panorama Administrator role

Create a Custom Panorama Admin

Create a Device Group and Template Admin

Create a Dynamic Read only superuser

44. Which statement is true regarding a Best Practice Assessment?

It shows how your current configuration compares to Palo Alto Networks recommendations

It runs only on firewalls

When guided by an authorized sales engineer, it helps determine the areas of greatest risk where you should focus prevention activities.

It provides a set of questionnaires that help uncover security risk prevention gaps across all areas of network and security architecture

45. Which two statements correctly identify the number of Decryption Broker security chains that are supported on a pair of decryption-forwarding interfaces'? (Choose two)

A single transparent bridge security chain is supported per pair of interfaces

L3 security chains support up to 32 security chains

L3 security chains support up to 64 security chains

A single transparent bridge security chain is supported per firewall

46. An administrator wants to enable zone protection Before doing so, what must the administrator consider?

Activate a zone protection subscription.

To increase bandwidth no more than one firewall interface should be connected to a zone

Security policy rules do not prevent lateral movement of traffic between zones

The zone protection profile will apply to all interfaces within that zone

47. A firewall should be advertising the static route 10 2 0 0/24 into OSPF. The configuration on the neighbor is correct but the route is not in the neighbor's routing table

Which two configurations should you check on the firewall'? (Choose two)

Within the redistribution profile ensure that Redist is selected

In the redistribution profile check that the source type is set to "ospf"

In the OSFP configuration ensure that the correct redistribution profile is selected in the OSPF Export Rules section

Ensure that the OSPF neighbor state is "2-Way"

48. A remote administrator needs firewall access on an untrusted interface.

Which two components are required on the firewall to configure certificate-based administrator authentication to the web Ul? (Choose two)

client certificate

certificate profile

certificate authority (CA) certificate

server certificate

49. What are two characteristic types that can be defined for a variable? (Choose two )

zone

FQDN

path group

IP netmask

50. An existing NGFW customer requires direct interne! access offload locally at each site and iPSec connectivity to all branches over public internet. One requirement is mat no new SD-WAN hardware be introduced to the environment.

What is the best solution for the customer?

Configure a remote network on PAN-OS

Upgrade to a PAN-OS SD-WAN subscription

Deploy Prisma SD-WAN with Prisma Access

Configure policy-based forwarding

Page 6 of 13

51. When setting up a security profile which three items can you use? (Choose three )

Wildfire analysis

anti-ransom ware

antivirus

URL filtering

decryption profile

52. An administrator notices that an interlace configuration has been overridden locally on a firewall. They require an configuration to be managed from Panorama and overrides are not allowed.

What is one way the administrator can meet this requirement?

Perform a device-group commit push from Panorama using the "Include Device and Network Templates" option.

Reload the running configuration and perform a Firewall local commit.

Perform a template commit push from Panorama using the "Force Template Values'' option

Perform a commit force from the CLI of the firewall.

53. To support a new compliance requirement, your company requires positive username attribution of every IP address used by wireless devices You must collect IP address-to-username mappings as soon as possible with minimal downtime and minimal configuration changes to the wireless devices themselves. The wireless devices are from various manufacturers

Given the scenario, choose the option for sending IP address-to-username mappings to the firewall

UID redistribution

RADIUS

syslog listener

XFF headers

54. Users within an enterprise have been given laptops that are joined to the corporate domain. In some cases, IT has also deployed Linux-based OS systems with a graphical desktop. Information Security needs IP-to-user mapping, which it will use in group-based policies that will limit internet access for the Linux desktop users.

Which method can capture IP-to-user mapping information for users on the Linux machines?

You can configure Captive Portal with an authentication policy.

IP-to-user mapping for Linux users can only be learned if the machine is joined to the domain.

You can set up a group-based security policy to restrict internet access based on group membership

You can deploy the User-ID agent on the Linux desktop machines

55. An engineer must configure the Decryption Broker feature

Which Decryption Broker security chain supports bi-directional traffic flow?

Layer 2 security chain

Layer 3 security chain

Transparent Bridge security chain

Transparent Proxy security chain

56. An administrator needs to evaluate a recent policy change that was committed and pushed to a firewall device group.

How should the administrator identify the configuration changes?

review the configuration logs on the Monitor tab

click Preview Changes under Push Scope

use Test Policy Match to review the policies in Panorama

context-switch to the affected firewall and use the configuration audit tool

57. in an HA failover scenario what occurs when sessions match an SSL Forward Proxy Decryption policy?

HA Sync does not occur the existing session is transferred to the active firewall.

HA Sync does not occur the firewall drops the session.

HA Sync occurs the session is sent to testpath

HA Sync occurs the firewall allows the session Put does not decrypt the session.

58. What happens, by default, when the GlobalProtect app fails to establish an IPSec tunnel to the GlobalProtect gateway?

It keeps trying to establish an IPSec tunnel to the GlobalProtect gateway

It stops the tunnel-establishment processing to the GlobalProtect gateway immediately

It tries to establish a tunnel to the GlobalProtect gateway using SSL/TLS

It tries to establish a tunnel to the GlobalProtect portal using SSL/TLS

59. An administrator needs to validate that policies mat will be deployed win match the appropriate rules in the devce-oroup hierarchy.

Which toot can the administrator use to review the policy creation logic and verify that unwanted traffic is not allowed?

Policy Optimizer

Test Policy Match

Preview Changes

Managed Devices Health

60. A traffic log might list an application as "not-applicable" for which two reasons'? (Choose two )

The firewall did not install the session

The TCP connection terminated without identifying any application data

The firewall dropped a TCP SYN packet

There was not enough application data after the TCP connection was established

Page 7 of 13

61. DRAG DROP

Match each type of DoS attack to an example of that type of attack

62. An administrator has configured PAN-OS SD-WAN and has received a request to find out the reason for a session failover for a session that has already ended.

Where would you find this in Panorama or firewall logs?

Traffic Logs

System Logs

Session Browser

You cannot find failover details on closed sessions

63. An engineer must configure a new SSL decryption deployment

Which profile or certificate is required before any traffic that matches an SSL decryption rule is decrypted?

There must be a certificate with both the Forward Trust option and Forward Untrust option selected

A Decryption profile must be attached to the Decryption policy that the traffic matches

A Decryption profile must be attached to the Security policy that the traffic matches

There must be a certificate with only the Forward Trust option selected

64. Which action disables Zero Touch Provisioning (ZTP) functionality on a ZTP firewall during the onboarding process?

performing a local firewall commit

removing the firewall as a managed device in Panorama

performing a factory reset of the firewall

removing the Panorama serial number from the ZTP service

65. Before you upgrade a Palo Alto Networks NGFW, what must you do?

Make sure that the PAN-OS support contract is valid for at least another year

Export a device state of the firewall

Make sure that the firewall is running a version of antivirus software and a version of WildFire that support the licensed subscriptions.

Make sure that the firewall is running a supported version of the app + threat update

66. What happens when en A P firewall cluster synchronies IPsec tunnel secunty associations (SAs)?

Phase 2 SAs are synchronized over HA2 finks

Phase 1 and Phase 2 SAs are synchronized over HA2 links

Phase 1 SAs are synchronized over HA1 links

Phase 1 and Phase 2 SAs are synchronized over HA3 links

67. What are two best practices for incorporating new and modified App-IDs? (Choose two.)

Run the latest PAN-OS version in a supported release tree to have the best performance for the new App-IDs

Configure a security policy rule to allow new App-IDs that might have network-wide impact

Perform a Best Practice Assessment to evaluate the impact of the new or modified App-IDs

Study the release notes and install new App-IDs if they are determined to have low impact

68. DRAG DROP

Match each GlobalProtect component to the purpose of that component

69. What are three valid qualifiers for a Decryption Policy Rule match? (Choose three)

Destination Zone

App-ID

Custom URL Category

User-ID

Source Interface

70. An administrator needs to troubleshoot a User-ID deployment. The administrator believes that there is an issue related to LDAP authentication. The administrator wants to create a packet capture on the management plane

Which CLI command should the administrator use to obtain the packet capture for validating the configuration?

> ftp export mgmt-pcap from mgmt.pcap to <FTP host>

> scp export mgmt-pcap from mgmt.pcap to {usernameQhost:path>

> scp export pcap-mgmt from pcap.mgiat to (username@host:path)

> scp export pcap from pcap to (usernameQhost:path)

Page 8 of 13

71. An administrator needs to implement an NGFW between their DMZ and Core network EIGRP Routing between the two environments is required.

Which interface type would support this business requirement?

Layer 3 interfaces but configuring EIGRP on the attached virtual router

Virtual Wire interfaces to permit EIGRP routing to remain between the Core and DMZ

Layer 3 or Aggregate Ethernet interfaces but configuring EIGRP on subinterfaces only

Tunnel interfaces to terminate EIGRP routing on an IPsec tunnel {with the GlobalProtect License to support LSVPN and EIGRP protocols)

72. An enterprise has a large Palo Alto Networks footprint that includes onsite firewalls and Prisma Access for mobile users, which is managed by Panorama. The enterprise already uses GlobalProtect with SAML authentication to obtain iP-to-user mapping information.

However information Security wants to use this information in Prisma Access for policy enforcement based on group mapping Information Security uses on-prermses Active Directory (AD) but is uncertain about what is needed for Prisma Access to learn groups from AD

How can portaes based on group mapping be learned and enforced in Prisma Access?

Configure Prisma Access to learn group mapping via SAML assertion

Assign a master device in Panorama through which Prisma Access learns groups

Set up group mapping redistribution between an onsite Palo Alto Networks firewall and Prisma Access

Create a group mapping configuration that references an LDAP profile that points to on-premises domain controllers

73. DRAG DROP

Match each SD-WAN configuration element to the description of that element.

74. A customer is replacing their legacy remote access VPN solution. The current solution is in place to secure internet egress and provide access to resources located in the main datacenter for the connected clients.

Prisma Access has been selected to replace the current remote access VPN solution.

During onboarding the following options and licenses were selected and enabled

What must be configured on Prisma Access to provide connectivity to the resources in the datacenter?

Configure a mobile user gateway in the region closest to the datacenter to enable connectivity to the datacenter

Configure a remote network to provide connectivity to the datacenter

Configure Dynamic Routing to provide connectivity to the datacenter

Configure a service connection to provide connectivity to the datacenter

75. While troubleshooting an SSL Forward Proxy decryption issue which PAN-OS CLI command would you use to check the details of the end-entity certificate that is signed by the Forward Trust Certificate or Forward Untrust Certificate?

show system setting ssl-decrypt certs

show systea setting ssl-decrypt certificate-cache

show systen setting ssl-decrypt certificate

debug dataplane show ssl-decrypt ssl-stats

76. A security engineer needs to mitigate packet floods that occur on a set of servers behind the internet facing interface of the firewall.

Which Security Profile should be applied to a policy to prevent these packet floods?

URL Filtering profile

Vulnerability Protection profile

Data Filtering profile

DoS Protection profile

77. A network administrator wants to deploy GlobalProtect with pre-logon for Windows 10 endpoints and follow Palo Alto Networks best practices.

To install the certificate and key for an endpoint, which three components are required? (Choose three.)

server certificate

local computer store

private key

self-signed certificate

machine certificate

78. Which type of interface does a firewall use to forward decrypted traffic to a security chain for inspection?

Layer 2

Tap

Layer 3

Decryption Mirror

79. A company needs to preconfigure firewalls to be sent to remote sites with the least amount of preconfiguration Once deployed each firewall must establish secure tunnels back to multiple regional data centers to include the future regional data centers

Which VPN preconfigured configuration would adapt to changes when deployed to the future site?

IPsec tunnels using IKEv2

PPTP tunnels

GlobalProtect satellite

GlobalProtect client

80. What are three reasons why an installed session can be identified with the application

The TCP connection was terminated without identifying any application data

The client sent a TCP segment with the PUSH flag set

There is not enough application data after the TCP connection was established

The TCP connection did not fully establish

There was no application data after the TCP connection was established

Page 9 of 13

81. Which benefit do policy rule UUIDs provide?

functionality for scheduling policy actions

the use of user IP mapping and groups in policies

cloning of policies between device-groups

an audit trail across a policy's lifespan

82. When you configure an active/active high availability pair which two links can you use? (Choose two)

HA2 backup

HA3

Console Backup

HSCI-C

83. You need to allow users to access the office-suite applications of their choice.

How should you configure the firewall to allow access to any office-suite application?

Create an Application Group and add Office 365, Evernote Google Docs and Libre Office

Create an Application Group and add business-systems to it.

Create an Application Filter and name it Office Programs, then filter it on the office programs subcategory.

Create an Application Filter and name it Office Programs then filter on the business-systems category.

84. In a firewall, which three decryption methods are valid? (Choose three )

SSL Inbound Inspection

SSL Outbound Proxyless Inspection

SSL Inbound Proxy

Decryption Mirror

SSH Proxy

85. A customer is replacing its legacy remote-access VPN solution Prisma Access has been selected as the replacement During onboarding, the following options and licenses were selected and enabled:

The customer wants to forward to a Splunk SIEM the logs that are generated by users that are connected to Prisma Access for Mobile Users

Which two settings must the customer configure? (Choose two)

Configure a log forwarding profile and select the Panorama/Cortex Data Lake checkbox Apply the Log Forwarding profile to all of the security policy rules in Mobile_User_Device_Group

Configure Cortex Data Lake log forwarding and add the Splunk syslog server

Configure a Log Forwarding profile, select the syslog checkbox and add the Splunk syslog server Apply the Log Forwarding profile to all of the security policy rules in the Mobiie_User_Device_Group

Configure Panorama Collector group device log forwarding to send logs to the Splunk syslog server

86. Using multiple templates in a stack to manage many firewalls provides which two advantages? (Choose two.)

inherit address-objects from templates

define a common standard template configuration for firewalls

standardize server profiles and authentication configuration across all stacks

standardize log-forwarding profiles for security polices across all stacks

87. PBF can address which two scenarios? (Select Two)

forwarding all traffic by using source port 78249 to a specific egress interface

providing application connectivity the primary circuit fails

enabling the firewall to bypass Layer 7 inspection

routing FTP to a backup ISP link to save bandwidth on the primary ISP link

88. You are auditing the work of a co-worker and need to verify that they have matched the Palo Alto Networks Best Practices for Anti-Spyware Profiles.

For.

Which three severity levels should single-packet captures be enabled to meet the Best Practice standard? (Choose three)

High

Medium

Critical

Informational

Low

89. As a best practice, which URL category should you target first for SSL decryption*?

Online Storage and Backup

High Risk

Health and Medicine

Financial Services

90. Which Panorama objects restrict administrative access to specific device-groups?

templates

admin roles

access domains

authentication profiles

Page 10 of 13

91. When an in-band data port is set up to provide access to required services, what is required for an interface that is assigned to service routes?

The interface must be used for traffic to the required services

You must enable DoS and zone protection

You must set the interface to Layer 2 Layer 3. or virtual wire

You must use a static IP address

92. A firewall is configured with SSL Forward Proxy decryption and has the following four enterprise certificate authorities (Cas)

i. Enterprise-Trusted-CA; which is verified as Forward Trust Certificate (The CA is also installed in the trusted store of the end-user browser and system)

ii. Enterpnse-Untrusted-CA, which is verified as Forward Untrust Certificate

iii. Enterprise-lntermediate-CA

iv. Enterprise-Root-CA which is verified only as Trusted Root CA

An end-user visits https //www example-website com/ with a server certificate Common Name (CN) www example-website com. The firewall does the SSL Forward Proxy decryption for the website and the server certificate is not trusted by the firewall

The end-user's browser will show that the certificate for www.example-website.com was issued by which of the following?

Enterprise-Untrusted-CA which is a self-signed CA

Enterprise-Trusted-CA which is a self-signed CA

Enterprise-lntermediate-CA which was. in turn, issued by Enterprise-Root-CA

Enterprise-Root-CA which is a self-signed CA

93. In a security-first network what is the recommended threshold value for content updates to be dynamically updated?

1 to 4 hours

6 to 12 hours

24 hours

36 hours

94. What does SSL decryption require to establish a firewall as a trusted third party and to establish trust between a client and server to secure an SSL/TLS connection?

link state

stateful firewall connection

certificates

profiles

95. Which three statements accurately describe Decryption Mirror? (Choose three.)

Decryption Mirror requires a tap interface on the firewall

Decryption, storage, inspection and use of SSL traffic are regulated in certain countries

Only management consent is required to use the Decryption Mirror feature

You should consult with your corporate counsel before activating and using Decryption Mirror in a production environment

Use of Decryption Mirror might enable malicious users with administrative access to the firewall to harvest sensitive information that is submitted via an encrypted channel

96. An internal system is not functioning. The firewall administrator has determined that the incorrect egress interface is being used. After looking at the configuration, the administrator believes that the firewall is not using a static route.

What are two reasons why the firewall might not use a static route? (Choose two.)

no install on the route

duplicate static route

path monitoring on the static route

disabling of the static route

97. An administrator plans to deploy 15 firewalls to act as GlobalProtect gateways around the world Panorama will manage the firewalls.

The firewalls will provide access to mobile users and act as edge locations to on-premises infrastructure. The administrator wants to scale the configuration out quickly and wants all of the firewalls to use the same template configuration

Which two solutions can the administrator use to scale this configuration? (Choose two.)

variables

template stacks

collector groups

virtual systems

98. Use the image below.

If the firewall has the displayed link monitoring configuration what will cause a failover?

ethernet1/3 and ethernet1/6 going down

etheme!1/3 going down

ethernet1/6 going down

ethernet1/3 or ethernet1/6 going down

99. During SSL decryption which three factors affect resource consumption1? (Choose three )

TLS protocol version

transaction size

key exchange algorithm

applications that use non-standard ports

certificate issuer

100. A network security engineer has applied a File Blocking profile to a rule with the action of Block. The user of a Linux CLI operating system has opened a ticket. The ticket states that the user is being blocked by the firewall when trying to download a TAR file. The user is getting no error response on the system.

Where is the best place to validate if the firewall is blocking the user's TAR file?

Threat log

Data Filtering log

WildFire Submissions log

URL Filtering log

Page 11 of 13

101. Which rule type controls end user SSL traffic to external websites?

SSL Outbound Proxyless Inspection

SSL Forward Proxy

SSL Inbound Inspection

SSH Proxy

102. When overriding a template configuration locally on a firewall, what should you consider?

Only Panorama can revert the override

Panorama will lose visibility into the overridden configuration

Panorama will update the template with the overridden value

The firewall template will show that it is out of sync within Panorama

103. A network administrator wants to use a certificate for the SSL/TLS Service Profile Which

type of certificate should the administrator use?

certificate authority (CA) certificate

client certificate

machine certificate

server certificate

104. An administrator wants to upgrade a firewall HA pair to PAN-OS 10.1. The firewalls are currently running PAN-OS 8.1.17.

Which upgrade path maintains synchronization of the HA session (and prevents network outage)?

Upgrade directly to the target major version

Upgrade one major version at a time

Upgrade the HA pair to a base image

Upgrade two major versions at a time

105. in URL filtering, which component matches URL patterns?

live URL feeds on the management plane

security processing on the data plane

signature matching on the data plane

single-pass pattern matching on the data plane

106. Which of the following commands would you use to check the total number of the sessions that are currently going through SSL Decryption processing?

show session all ssI-decrypt yes count yes

show session filter ssl-decryption yes total-count yes

show session all filter ssl-decrypt yes count yes

show session all filter ssl-decryption yes total-count yes

107. An administrator cannot see any Traffic logs from the Palo Alto Networks NGFW in Panorama reports. The configuration problem seems to be on the firewall.

Which settings, if configured incorrectly, most likely would stop only Traffic logs from being sent from the NGFW to Panorama?

A)

Option A

Option B

Option C

Option D

108. In a Panorama template which three types of objects are configurable? (Choose three)

HIP objects

QoS profiles

interface management profiles

certificate profiles

security profiles

109. In SSL Forward Proxy decryption, which two certificates can be used for certificate signing? (Choose two.)

wildcard server certificate

enterprise CA certificate

client certificate

server certificate

self-signed CA certificate

110. DRAG DROP

Please match the terms to their corresponding definitions.

Page 12 of 13

111. The UDP-4501 protocol-port is used between which two GlobalProtect components?

GlobalProtect app and GlobalProtect gateway

GlobalProtect portal and GlobalProtect gateway

GlobalProtect app and GlobalProtect satellite

GlobalProtect app and GlobalProtect portal

112. An administrator has a PA-820 firewall with an active Threat Prevention subscription. The administrator is considering adding a WildFire subscription.

How does adding the WildFire subscription improve the security posture of the organization1?

Protection against unknown malware can be provided in near real-time

WildFire and Threat Prevention combine to provide the utmost security posture for the firewall

After 24 hours WildFire signatures are included in the antivirus update

WildFire and Threat Prevention combine to minimize the attack surface

113. A variable name must start with which symbol?

114. Refer to the exhibit.

Which certificate can be used as the Forward Trust certificate?

Domain Sub-CA

Domain-Root-Cert

Certificate from Default Trusted Certificate Authorities

Forward-Trust

115. A security engineer needs firewall management access on a Inside interface.

When three settings are required on an SSI/TVS Service Profile to provide secure Wet) Ui authentication? (Choose three.)

Maximum TLS version

Minimum TLV version

Encryption Algorithm

Certificate

Authentication Algorithm

116. An administrator needs to gather information about the CPU utilization on both the management plane and the data plane

Where does the administrator view the desired data?

Monitor > Utilization

Resources Widget on the Dashboard

Support > Resources

Application Command and Control Center

117. Which two statements are true about DoS Protection and Zone Protection Profiles? (Choose two).

Zone Protection Profiles protect ingress zones

Zone Protection Profiles protect egress zones

DoS Protection Profiles are packet-based, not signature-based

DoS Protection Profiles are linked to Security policy rules

118. With the default TCP and UDP settings on the firewall what will be me identified application in the following session?

incomplete

unknown-tcp

insufficient-data

unknown-udp

119. When deploying PAN-OS SD-WAN, which routing protocol can you use to build a routing overlay?

OSPFv3

BGP

OSPF

RIP

120. An engineer is planning an SSL decryption implementation

Which of the following statements is a best practice for SSL decryption?

Obtain an enterprise CA-signed certificate for the Forward Trust certificate

Obtain a certificate from a publicly trusted root CA for the Forward Trust certificate

Use an enterprise CA-signed certificate for the Forward Untrust certificate

Use the same Forward Trust certificate on all firewalls in the network

Page 13 of 13

121. Topic 2, Main Questions pool

For which two reasons would a firewall discard a packet as part of the packet flow sequence? (Choose two)

equal-cost multipath

ingress processing errors

rule match with action "allow"

rule match with action "deny"

122. Which method does an administrator use to integrate all non-native MFA platforms in PAN-OS® software?

Okta

DUO

RADIUS

PingID

123. To protect your firewall and network from single source denial of service (DoS) attacks that can overwhelm its packet buffer and cause legitimate traffic to drop, you can configure.

BGP (Border Gateway Protocol)

PBP (Packet Buffer Protection)

PGP (Packet Gateway Protocol)

PBP (Protocol Based Protection)

124. In a virtual router, which object contains all potential routes?

MIB

RIB

SIP

FIB

Actual PCNSE Exam Updated Material

Actual PCNSE Exam Updated Material

Share this post

Leave a Reply Cancel reply

Related Posts