Palo Alto Networks PCNSE Updated Questions

1. Which two methods can be used to mitigate resource exhaustion of an application server? (Choose two)

2. A firewall administrator has completed most of the steps required to provision a standalone Palo Alto Networks Next-Generation Firewall. As a final step, the administrator wants to test one of the security policies.

Which CLI command syntax will display the rule that matches the test?

3. Which interface configuration will accept specific VLAN IDs?

4. Which three function are found on the dataplane of a PA-5050? (Choose three)

5. The web server is configured to listen for HTTP traffic on port 8080. The clients access the web server using the IP address 1.1.1.100 on TCP Port 80. The destination NAT rule is configured to translate both IP address and report to 10.1.1.100 on TCP Port 8080.





Which NAT and security rules must be configured on the firewall? (Choose two)

6. Given the following table.





Which configuration change on the firewall would cause it to use 10.66.24.88 as the next hop for the 192.168.93.0/30 network?

7. An Administrator is configuring an IPSec VPN toa Cisco ASA at the administrator's home and experiencing issues completing the connection.

The following is th output from the command:

less mp-log ikemgr.log:





What could be the cause of this problem?

8. What are three possible verdicts that WildFire can provide for an analyzed sample? (Choose three)

9. Click the Exhibit button below.









A firewall has three PBF rules and a default route with a next hop of 172.20.10.1 that is configured in the default VR. A user named Will has a PC with a 192.168.10.10 IP address. He makes an HTTPS connection to 172.16.10.20.

Which is the next hop IP address for the HTTPS traffic from Will's PC?

10. A firewall administrator has been asked to configure a Palo Alto Networks NGFW to prevent against compromised hosts trying to phone-home or beacon out to external command-and-control (C2) servers.

Which security Profile type will prevent these behaviors?

11. The GlobalProtect Portal interface and IP address have been configured .

Which other value needs to be defined to complete the network settings configuration of GlobalPortect Portal?

12. A users traffic traversing a Palo Alto networks NGFW sometimes can reach http //www company com At other times the session times out. At other times the session times out. The NGFW has been configured with a PBF rule that the user traffic matches when it goes to http://www.company.com

goes to http://www company com

How can the firewall be configured to automatically disable the PBF rule if the next hop goes down?

13. Company.com has an in-house application that the Palo Alto Networks device doesn't identify correctly. A Threat Management Team member has mentioned that this in-house application is very sensitive and all traffic being identified needs to be inspected by the Content-ID engine.

Which method should company.com use to immediately address this traffic on a Palo Alto Networks device?

14. Which three log-forwarding destinations require a server profile to be configured? (Choose three)

15. What are three valid actions in a File Blocking Profile? (Choose three)

16. How can a Palo Alto Networks firewall be configured to send syslog messages in a format compatible with non-standard syslog servers?

17. A Palo Alto Networks firewall is being targeted by an NTP Amplification attack and is being flooded with tens thousands of bogus UDP connections per second to a single destination IP address and post.

Which option when enabled with the correction threshold would mitigate this attack without dropping legitirnate traffic to other hosts insides the network?

18. Which Security Policy Rule configuration option disables antivirus and anti-spyware scanning of server-to-client flows only?

19. Which two statements are correct for the out-of-box configuration for Palo Alto Networks NGFWs? (Choose two)

20. Click the Exhibit button





An administrator has noticed a large increase in bittorrent activity. The administrator wants to determine where the traffic is going on the company.

What would be the administrator's next step?

21. YouTube videos are consuming too much bandwidth on the network, causing delays in mission-critical traffic. The administrator wants to throttle YouTube traffic.

The following interfaces and zones are in use on the firewall:

* ethernet1/1, Zone: Untrust (Internet-facing)

* ethernet1/2, Zone: Trust (client-facing)

A QoS profile has been created, and QoS has been enabled on both interfaces. A QoS rule exists to put the YouTube application into QoS class 6. Interface Ethernet1/1 has a QoS profile called Outbound, and interface Ethernet1/2 has a QoS profile called Inbound.

Which setting for class 6 with throttle YouTube traffic?

22. When is it necessary to activate a license when provisioning a new Palo Alto Networks firewall?

23. A company.com wants to enable Application Override.

Given the following screenshot:





Which two statements are true if Source and Destination traffic match the Application Override policy? (Choose two)

24. Which Panorama feature allows for logs generated by Panorama to be forwarded to an external Security Information and Event Management (SIEM) system?

25. Which client software can be used to connect remote Linux client into a Palo Alto Networks Infrastructure without sacrificing the ability to scan traffic and protect against threats?

26. A client is deploying a pair of PA-5000 series firewalls using High Availability (HA) in Active/Passive mode .

Which statement is true about this deployment?

27. A network administrator uses Panorama to push security polices to managed firewalls at branch offices .

Which policy type should be configured on Panorama if the administrators at the branch office sites to override these products?

28. A network security engineer is asked to perform a Return Merchandise Authorization (RMA) on a firewall

Which part of files needs to be imported back into the replacement firewall that is using Panorama?

29. Which two events trigger the operation of automatic commit recovery? (Choose two.)

30. An administrator has left a firewall to use the data of port for all management service which there functions are performed by the data face? (Choose three.)

31. People are having intermittent quality issues during a live meeting via web application.

32. Which three items are import considerations during SD-WAN configuration planning? (Choose three.)

33. Which two virtualized environments support Active/Active High Availability (HA) in PAN-OS 8.0? (Choose two.)

34. A network Administrator needs to view the default action for a specific spyware signature.

The administrator follows the tabs and menus through Objects> Security Profiles> Anti-Spyware and select default profile.

What should be done next?

35. Which URL Filtering Security Profile action logs the URL Filtering category to the URL Filtering log?

36. Site-A and Site-B need to use IKEv2 to establish a VPN connection. Site A connects directly to the internet using a public IP address. Site-B uses a private IP address behind an ISP router to connect to the internet.

How should NAT Traversal be implemented for the VPN connection to be established between Site-A and Site-B?

37. Starting with PAN-OS version 9.1, Global logging information is now recoded in which firewall log?

38. Which three options are available when creating a security profile? (Choose three)

39. Which setting allow a DOS protection profile to limit the maximum concurrent sessions from a source IP address?

40. Which three options does the WF-500 appliance support for local analysis? (Choose three)

41. How are IPV6 DNS queries configured to user interface ethernet1/3?

42. Which command can be used to validate a Captive Portal policy?

43. Refer to Exhibit:









configured in the default VR. A user named XX-bes a PC with a 192.168.101.10 IP address.

He makes an HTTPS connection to 172.16.10.29.

What is the next hop IP address for the HTTPS traffic from Wills PC?

44. Palo Alto Networks maintains a dynamic database of malicious domains.

Which two Security Platform components use this database to prevent threats? (Choose two)

45. Which Palo Alto Networks VM-Series firewall is supported for VMware NSX?

46. Which operation will impact performance of the management plane?

47. Which three rule types are available when defining policies in Panorama? (Choose three.)

48. A company has a web server behind a Palo Alto Networks next-generation firewall that it wants to make accessible to the public at 1.1.1.1. The company has decided to configure a destination NAT Policy rule.

Given the following zone information:

• DMZ zone: DMZ-L3

• Public zone: Untrust-L3

• Guest zone: Guest-L3

• Web server zone: Trust-L3

• Public IP address (Untrust-L3): 1.1.1.1

• Private IP address (Trust-L3): 192.168.1.50

What should be configured as the destination zone on the Original Packet tab of NAT Policy rule?

49. A firewall administrator is troubleshooting problems with traffic passing through the Palo Alto Networks firewall .

Which method shows the global counters associated with the traffic after configuring the appropriate packet filters?

50. A host attached to ethernet1/3 cannot access the internet. The default gateway is attached to ethernet1/4. After troubleshooting. It is determined that traffic cannot pass from the ethernet1/3 to ethernet1/4 .

What can be the cause of the problem?

51. Which authentication source requires the installation of Palo Alto Networks software, other than PAN-OS 7x, to obtain a username-to-IP-address mapping?

52. A company hosts a publicly accessible web server behind a Palo Alto

Networks next-generation firewall with the following configuration information:

* Users outside the company are in the "Untrust-L3" zone.

* The web server physically resides in the "Trust-L3" zone.

* Web server public IP address: 23.54.6.10

* Web server private IP address: 192.168.1.10

Which two items must the NAT policy contain to allow users in the Untrust-L3 zone to access the web server? (Choose two.)

53. A network design calls for a "router on a stick" implementation with a PA-5060 performing inter-VLAN routing All VLAN-tagged traffic will be forwarded to the PA-5060 through a single dot1q trunk interface

Which interface type and configuration setting will support this design?

54. What will be the source address in the ICMP packet?

55. A company hosts a publically accessible web server behind a Palo Alto Networks next generation firewall with the following configuration information.

✑ Users outside the company are in the "Untrust-L3" zone

✑ . The web server physically resides in the "Trust-L3" zone.

✑ Web server public IP address: 23.54.6.10

✑ Web server private IP address: 192.168.1.10

Which two items must be NAT policy contain to allow users in the untrust-L3 zone to access the web server? (Choose two)

56. Which two interface types can be used when configuring GlobalProtect Portal? (Choose two)

57. Which three fields can be included in a pcap filter? (Choose three)

58. A network security engineer needs to configure a virtual router using IPv6 addresses.

Which two routing options support these addresses? (Choose two)

59. A network security engineer is asked to provide a report on bandwidth usage .

Which tab in the ACC provides the information needed to create the report?

60. A company is upgrading its existing Palo Alto Networks firewall from version 7.0.1 to 7.0.4.

Which three methods can the firewall administrator use to install PAN-OS 8.0.4 across the enterprise? (Choose three)

61. The company's Panorama server (IP 10.10.10.5) is not able to manage a firewall that was recently deployed. The firewall's dedicated management port is being used to connect to the management network.

Which two commands may be used to troubleshoot this issue from the CLI of the new firewall? (Choose two)

62. After pushing a security policy from Panorama to a PA-3020 firwall, the firewall administrator notices that traffic logs from the PA-3020 are not appearing in Panorama’s traffic logs .

What could be the problem?

63. A network engineer has revived a report of problems reaching 98.139.183.24 through vr1 on the firewall. The routing table on this firewall is extensive and complex.

Which CLI command will help identify the issue?

64. During the packet flow process, which two processes are performed in application identification? (Choose two.)

65. A company has a policy that denies all applications it classifies as bad and permits only application it classifies as good.

The firewall administrator created the following security policy on the company's firewall.





Which interface configuration will accept specific VLAN IDs?

Which two benefits are gained from having both rule 2 and rule 3 presents? (choose two)

66. Which Public Key infrastructure component is used to authenticate users for GlobalProtect when the Connect Method is set to pre-logon?

67. When a malware-infected host attempts to resolve a known command-and-control server, the traffic matches a security policy with DNS sinhole enabled, generating a traffic log.

What will be the destination IP Address in that log entry?

68. A host attached to Ethernet 1/4 cannot ping the default gateway. The widget on the dashboard shows Ethernet 1/1 and Ethernet 1/4 to be green. The IP address of Ethernet 1/1 is 192.168.1.7 and the IP address of Ethernet 1/4 is 10.1.1.7. The default gateway is attached to Ethernet 1/1. A default route is properly configured.

What can be the cause of this problem?

69. Which URL Filtering Security Profile action togs the URL Filtering category to the URL Filtering log?

70. Several offices are connected with VPNs using static IPV4 routes. An administrator has been tasked with implementing OSPF to replace static routing.

Which step is required to accoumplish this goal?

71. A network design change requires an existing firewall to start accessing Palo Alto Updates from a data plane interface address instead of the management interface.

Which configuration setting needs to be modified?

72. Which two logs on the firewall will contain authentication-related information useful for troubleshooting purpose (Choose two)

73. Starting with PAN-OS version 9.1, application dependency information is now reported in which new locations? (Choose two.)

74. A distributed log collection deployment has dedicated log Collectors. A developer needs a device to send logs to Panorama instead of sending logs to the Collector Group.

What should be done first?

75. Several offices are connected with VPNs using static IPv4 routes. An administrator has been tasked with implementing OSPF to replace static routing.

Which step is required to accomplish this goal?

76. Panorama provides which two SD_WAN functions? (Choose two.)

77. DRAG DROP

When using the predefined default profile, the policy will inspect for viruses on the decoders. Match each decoder with its default action.

Answer options may be used more than once or not at all.

78. A VPN connection is set up between Site-A and Site-B, but no traffic is passing in the system log of Site-A, there is an event logged as like-nego-p1-fail-psk.

What action will bring the VPN up and allow traffic to start passing between the sites?

79. Which CLI command displays the current management plan memory utilization?

80. A critical US-CERT notification is published regarding a newly discovered botnet. The malware is very evasive and is not reliably detected by endpoint antivirus software. Furthermore, SSL is used to tunnel malicious traffic to command-and-control servers on the internet and SSL Forward Proxy Decryption is not enabled.

Which component once enabled on a perirneter firewall will allow the identification of existing infected hosts in an environment?

81. Support for which authentication method was added in PAN-OS 8.0?

82. An administrator is configuring an IPSec VPN to a Cisco ASA at the administrator's home and experiencing issues completing the connection.

The following is the output from the command:





What could be the cause of this problem?

83. A company has a pair of Palo Alto Networks firewalls configured as an Acitve/Passive High Availability (HA) pair.

What allows the firewall administrator to determine the last date a failover event occurred?

84. A logging infrastructure may need to handle more than 10,000 logs per second.

Which two options support a dedicated log collector function? (Choose two)

85. In an enterprise deployment, a network security engineer wants to assign to a group of administrators without creating local administrator accounts on the firewall.

Which authentication method must be used?

86. A network security engineer has a requirement to allow an external server to access an internal web server. The internal web server must also initiate connections with the external server.

What can be done to simplify the NAT policy?

87. A Network Administrator wants to deploy a Large Scale VPN solution. The Network Administrator has chosen a GlobalProtect Satellite solution. This configuration needs to be deployed to multiple remote offices and the Network Administrator decides to use Panorama to deploy the configurations.

How should this be accomplished?

88. What are two prerequisites for configuring a pair of Palo Alto Networks firewalls in an active/passive High Availability (HA) pair? (Choose two.)

89. DRAG DROP

Please match the terms to their corresponding definitions.

90. In SSL Forward Proxy decryption, which two certificates can be used for certificate signing? (Choose two.)

91. Use the image below If the firewall has the displayed link monitoring configuration what will cause a failover?

92. A variable name must start with which symbol?

93. An administrator has 750 firewalls. The administrator's central-management Panorama instance deploys dynamic updates to the firewalls.

The administrator notices that the dynamic updates from Panorama do not appear on some of the firewalls.

If Panorama pushes the configuration of a dynamic update schedule to managed firewalls, but the configuration does not appear what is the root cause?

94. In a Panorama template which three types of objects are configurable? (Choose three)

95. An organization is building a Bootstrap Package to deploy Palo Alto Networks VM-Series firewalls into their AWS tenant.

Which two statements are correct regarding the bootstrap package contents? (Choose two)

96. An engineer must configure the Decryption Broker feature

Which Decryption Broker security chain supports bi-directional traffic flow?

97. DRAG DROP

Match each SD-WAN configuration element to the description of that element.

98. Which two statements correctly identify the number of Decryption Broker security chains that are supported on a pair of decryption-forwarding interfaces'? (Choose two)

99. Which Panorama objects restrict administrative access to specific device-groups?

100. During SSL decryption which three factors affect resource consumption1? (Choose three)

101. In a firewall, which three decryption methods are valid? (Choose three)

102. Before you upgrade a Palo Alto Networks NGFW what must you do?

103. Which value in the Application column indicates UDP traffic that did not match an App-ID signature?

104. An administrator cannot see any Traffic logs from the Palo Alto Networks NGFW in Panorama reports. The configuration problem seems to be on the firewall.

Which settings, if configured incorrectly, most likely would stop only Traffic logs from being sent from the NGFW to Panorama?

A)





B)





C)





D)

105. An engineer must configure a new SSL decryption deployment

Which profile or certificate is required before any traffic that matches an SSL decryption rule is decrypted?

106. A company needs to preconfigure firewalls to be sent to remote sites with the least amount of preconfiguration Once deployed each firewall must establish secure tunnels back to multiple regional data centers to include the future regional data centers

Which VPN preconfigured configuration would adapt to changes when deployed to the future site?

107. Given the following snippet of a WildFire submission log. did the end-user get access to the requested information and why or why not?

108. When you import the configuration of an HA pair into Panorama, how do you prevent the import from affecting ongoing traffic?

109. Which User-ID mapping method should be used in a high-security environment where all IP address-to-user mappings should always be explicitly known?

110. What are three valid qualifiers for a Decryption Policy Rule match? (Choose three)

111. An engineer is planning an SSL decryption implementation

Which of the following statements is a best practice for SSL decryption?

112. An administrator plans to deploy 15 firewalls to act as GlobalProtect gateways around the world Panorama will manage the firewalls.

The firewalls will provide access to mobile users and act as edge locations to on-premises infrastructure. The administrator wants to scale the configuration out quickly and wants all of the firewalls to use the same template configuration.

Which two solutions can the administrator use to scale this configuration? (Choose two.)

113. What are two common reasons to use a "No Decrypt" action to exclude traffic from SSL decryption? (Choose two.)

114. Which action disables Zero Touch Provisioning (ZTP) functionality on a ZTP firewall during the onboarding process?

115. An administrator needs to gather information about the CPU utilization on both the management plane and the data plane

Where does the administrator view the desired data?

116. Given the following configuration, which route is used for destination 10.10.0.4?

117. An administrator needs to troubleshoot a User-ID deployment. The administrator believes that there is an issue related to LDAP authentication. The administrator wants to create a packet capture on the management plane

Which CLI command should the administrator use to obtain the packet capture for validating the configuration?

118. When you configure a Layer 3 interface what is one mandatory step?

119. Which three statements accurately describe Decryption Mirror? (Choose three.)

120. The SSL Forward Proxy decryption policy is configured. The following four certificate authority (CA) certificates are installed on the firewall.





An end-user visits the untrusted website https //www firewall-do-not-trust-website com

Which certificate authority (CA) certificate will be used to sign the untrusted webserver certificate?

121. An administrator has a PA-820 firewall with an active Threat Prevention subscription. The administrator is considering adding a WildFire subscription

How does adding the WildFire subscription improve the security posture of the organization1?

122. A network administrator wants to use a certificate for the SSL/TLS Service Profile.

Which type of certificate should the administrator use?

123. PBF can address which two scenarios? (Select Two)

124. A firewall is configured with SSL Forward Proxy decryption and has the following four enterprise certificate authorities (Cas)

i. Enterprise-Trusted-CA; which is verified as Forward Trust Certificate (The CA is also installed in the trusted store of the end-user browser and system)

ii. Enterpnse-Untrusted-CA, which is verified as Forward Untrust Certificate

iii. Enterprise-lntermediate-CA

iv. Enterprise-Root-CA which is verified only as Trusted Root CA

An end-user visits https //www example-website com/ with a server certificate Common Name (CN) www example-website com. The firewall does the SSL Forward Proxy decryption for the website and the server certificate is not trusted by the firewall

The end-user's browser will show that the certificate for www example-website com was issued by which of the following?

125. Refer to the exhibit.





Which certificate can be used as the Forward Trust certificate?

126. Which CLI command displays the physical media that are connected to ethernetl/8?

127. DRAG DROP

Match each GlobalProtect component to the purpose of that component

128. An internal system is not functioning. The firewall administrator has determined that the incorrect egress interface is being used After looking at the configuration, the administrator believes that the firewall is not using a static route

What are two reasons why the firewall might not use a static route"? (Choose two.)

129. DRAG DROP

Match each type of DoS attack to an example of that type of attack

130. DRAG DROP

Place the steps in the WildFire process workflow in their correct order.

131. DRAG DROP

Below are the steps in the workflow for creating a Best Practice Assessment in a firewall and Panorama configuration Place the steps in order.

132. An organization has recently migrated its infrastructure and configuration to NGFWs, for which Panorama manages the devices. The organization is coming from a L2-L4 firewall vendor, but wants to use App-ID while identifying policies that are no longer needed

Which Panorama tool can help this organization?

133. A traffic log might list an application as "not-applicable" for which two reasons'? (Choose two)

134. When setting up a security profile which three items can you use? (Choose three)

135. A firewall should be advertising the static route 10 2 0 0/24 into OSPF. The configuration on the neighbor is correct but the route is not in the neighbor's routing table

Which two configurations should you check on the firewall'? (Choose two)

136. The following objects and policies are defined in a device group hierarchy









A)





B)





C)

Address Objects

-Shared Address 1

-Branch Address2

Policies -Shared Polic1

l -Branch Policyl

D)

Address Objects

-Shared Addressl

-Shared Address2

-Branch Addressl

Policies -Shared Policyl

-Shared Policy2

-Branch Policyl