Valid PCNSE Exam Updated Questions and Answers

dumps2023-08-07T10:16:01+08:00

The updated Palo Alto Networks PCNSE exam questions and answers are proved to be valid. We have customers just passed the test with the version. If you want to take and pass Palo Alto Networks PCNSE exam, study the updated PCNSE questions and answers here. Free updated PCNSE exam questions and answers are below.

Page 1 of 10

1. A bootstrap USB flash drive has been prepared using a Windows workstation to load the initial configuration of a Palo Alto Networks firewall that was previously being used in a lab. The USB flash drive was formatted using file system FAT32 and the initial configuration is stored in a file named init-cfg txt. The firewall is currently running PAN-OS 10.0 and using a lab config.

The contents of init-cfg txt in the USB flash drive are as follows:

The USB flash drive has been inserted in the firewalls' USB port, and the firewall has been restarted using command:> request resort system Upon restart, the firewall fails to begin the bootstrapping process. The failure is caused because

Firewall must be in factory default state or have all private data deleted for bootstrapping

The hostname is a required parameter, but it is missing in init-cfg txt

The USB must be formatted using the ext3 file system, FAT32 is not supported

PANOS version must be 91.x at a minimum but the firewall is running 10.0.x

The bootstrap.xml file is a required file but it is missing

2. Where is information about packet buffer protection logged?

Alert entries are in the Alarms log. Entries for dropped traffic, discarded sessions, and blocked IP address are in the Threat log

All entries are in the System log

Alert entries are in the System log. Entries for dropped traffic, discarded sessions and blocked IP addresses are in the Threat log

All entries are in the Alarms log

3. An engineer troubleshooting a VPN issue needs to manually initiate a VPN tunnel from the CLI.

Which CLI command can the engineer use?

test vpn flow

test vpn Ike―sa

test vpn tunnel

test vpn gateway

4. An administrator wants multiple web servers In the DMZ to receive connections initiated from the internet. Traffic destined for 206.15.22.9 port 80/TCP needs to be forwarded to the server at 10.1.1.22.

Based on the image, which NAT rule will forward web-browsing traffic correctly?

A)

Option

5. A company is using wireless controllers to authenticate users.

Which source should be used for User-ID mappings?

Syslog

XFF headers

server monitoring

client probing

6. An engineer wants to configure aggregate interfaces to increase bandwidth and redundancy between the firewall and switch.

Which statement is correct about the configuration of the interfaces assigned to an aggregate interface group?

They can have a different bandwidth.

They can have a different interface type such as Layer 3 or Layer 2.

They can have a different interface type from an aggregate interface group.

They can have different hardware media such as the ability to mix fiber optic and copper.

7. The administrator for a small company has recently enabled decryption on their Palo Alto Networks firewall using a self-signed root certificate. They have also created a Forward Trust and Forward Untrust certificate and set them as such

The admin has not yet installed the root certificate onto client systems

What effect would this have on decryption functionality?

Decryption will function and there will be no effect to end users

Decryption will not function because self-signed root certificates are not supported

Decryption will not function until the certificate is installed on client systems

Decryption will function but users will see certificate warnings for each SSL site they visit

8. An engineer is in the planning stages of deploying User-ID in a diverse directory services environment.

Which server OS platforms can be used for server monitoring with User-ID?

Microsoft Terminal Server, Red Hat Linux, and Microsoft Active Directory

Microsoft Active Directory, Red Hat Linux, and Microsoft Exchange

Microsoft Exchange, Microsoft Active Directory, and Novell eDirectory

Novell eDirectory, Microsoft Terminal Server, and Microsoft Active Directory

9. A company with already deployed Palo Alto firewalls has purchased their first Panorama server. The security team has already configured all firewalls with the Panorama IP address and added all the firewall serial numbers in Panorama.

What are the next steps to migrate configuration from the firewalls to Panorama?

Use API calls to retrieve the configuration directly from the managed devices

Export Named Configuration Snapshot on each firewall followed by Import Named Configuration Snapshot in Panorama

import Device Configuration to Panorama followed by Export or Push Device Config Bundle

Use the Firewall Migration plugin to retrieve the configuration directly from the managed devices

10. After configuring HA in Active/Passive mode on a pair of firewalls the administrator gets a failed commit with the following details.

What are two explanations for this type of issue? (Choose two)

The peer IP is not included in the permit list on Management Interface Settings

The Backup Peer HA1 IP Address was not configured when the commit was issued

Either management or a data-plane interface is used as HA1-backup

One of the firewalls has gone into the suspended state

Page 2 of 10

11. An administrator has two pairs of firewalls within the same subnet. Both pairs of firewalls have been configured to use High Availability mode with Active/Passive. The ARP tables for upstream routes display the same MAC address being shared for some of these firewalls.

What can be configured on one pair of firewalls to modify the MAC addresses so they are no longer in conflict?

Configure a floating IP between the firewall pairs.

Change the Group IDs in the High Availability settings to be different from the other firewall pair on the same subnet.

Change the interface type on the interfaces that have conflicting MAC addresses from L3 to VLA

On one pair of firewalls, run the CLI command: set network interface vlan arp.

12. A network administrator configured a site-to-site VPN tunnel where the peer device will act as initiator None of the peer addresses are known

What can the administrator configure to establish the VPN connection?

Set up certificate authentication.

Use the Dynamic IP address type.

Enable Passive Mode

Configure the peer address as an FQD

13. An administrator needs to optimize traffic to prefer business-critical applications over non-critical applications QoS natively integrates with which feature to provide service quality?

certificate revocation

Content-ID

App-ID8 9 B

port inspection

14. Which data flow describes redistribution of user mappings?

User-ID agent to firewall

firewall to firewall

Domain Controller to User-ID agent

User-ID agent to Panorama

15. A firewall administrator wants to avoid overflowing the company syslog server with traffic logs.

What should the administrator do to prevent the forwarding of DNS traffic logs to syslog?

Disable logging on security rules allowing DN

Go to the Log Forwarding profile used to forward traffic logs to syslog. Then, under traffic logs match list, create a new filter with application not equal to DN

Create a security rule to deny DNS traffic with the syslog server in the destination

Go to the Log Forwarding profile used to forward traffic logs to syslog. Then, under traffic logs match list, create a new filter with application equal to DN

16. Which CLI command displays the physical media that are connected to ethernet1/8?

> show system state filter-pretty sys.si.p8.stats

> show system state filter-pretty sys.sl.p8.phy

> show interface ethernet1/8

> show system state filter-pretty sys.sl.p8.med

17. An internal system is not functioning. The firewall administrator has determined that the incorrect egress interface is being used. After looking at the configuration, the administrator believes that the firewall is not using a static route.

What are two reasons why the firewall might not use a static route? (Choose two.)

no install on the route

duplicate static route

path monitoring on the static route

disabling of the static route

18. A remote administrator needs firewall access on an untrusted interface.

Which two components are required on the firewall to configure certificate-based administrator authentication to the web Ul? (Choose two)

client certificate

certificate profile

certificate authority (CA) certificate

server certificate

19. DRAG DROP

An engineer is troubleshooting traffic routing through the virtual router. The firewall uses multiple routing protocols, and the engineer is trying to determine routing priority Match the default Administrative Distances for each routing protocol.

20. When configuring forward error correction (FEC) for PAN-OS SD-WAN, an administrator would turn on the feature inside which type of SD-WAN profile?

Certificate profile

Path Quality profile

SD-WAN Interface profile

Traffic Distribution profile

Page 3 of 10

21. How can an administrator use the Panorama device-deployment option to update the apps and threat version of an HA pair of managed firewalls?

Configure the firewall's assigned template to download the content updates.

Choose the download and install action for both members of the HA pair in the Schedule object.

Switch context to the firewalls to start the download and install process.

Download the apps to the primary; no further action is required.

22. An administrator has configured OSPF with Advanced Routing enabled on a Palo Alto Networks firewall running PAN-OS 10.2. After OSPF was configured, the administrator noticed that OSPF routes were not being learned.

Which two actions could an administrator take to troubleshoot this issue? (Choose two.)

Run the CLI command show advanced-routing ospf neighbor

In the WebUl, view the Runtime Stats in the logical router.

In the WebUl, view the Runtime Stats in the virtual router.

Look for configuration problems in Network > virtual router > OSPF

23. What is a key step in implementing WildFire best practices?

In a mission-critical network, increase the WildFire size limits to the maximum value.

Configure the firewall to retrieve content updates every minute.

In a security-first network, set the WildFire size limits to the minimum value.

Ensure that a Threat Prevention subscription is active.

24. Which time determines how long the passive firewall will wait before taking over as the active firewall alter losing communications with the HA peer?

Heartbeat Interval

Additional Master Hold Up Time

Promotion Hold Time

Monitor Fall Hold Up Time

25. How would an administrator monitor/capture traffic on the management interface of the Palo Alto Networks NGFW?

Use the debug dataplane packet-diag set capture stage firewall file command.

Enable all four stages of traffic capture (TX, RX, DROP, Firewall).

Use the debug dataplane packet-diag set capture stage management file command.

Use the tcpdump command.

26. An engineer is pushing configuration from Panorama lo a managed firewall.

What happens when the pushed Panorama configuration has Address Object names that duplicate the Address Objects already configured on the firewall?

The firewall rejects the pushed configuration, and the commit fails.

The firewall renames the duplicate local objects with "-1" at the end signifying they are clones; it will update the references to the objects accordingly and fully commit the pushed configuration.

The firewall fully commits all of the pushed configuration and overwrites its locally configured objects

The firewall ignores only the pushed objects that have the same name as the locally configured objects, and it will commit the rest of the pushed configuration.

27. What happens when an A/P firewall cluster synchronizes IPsec tunnel security associations (SAs)?

Phase 1 and Phase 2 SAs are synchronized over HA3 links.

Phase 1 SAs are synchronized over HA1 links.

Phase 2 SAs are synchronized over HA2 links.

Phase 1 and Phase 2 SAs are synchronized over HA2 links.

28. A network administrator wants to deploy SSL Forward Proxy decryption.

What two attributes should a forward trust certificate have? (Choose two.)

A subject alternative name

A private key

A server certificate

A certificate authority (CA) certificate

29. An engineer is creating a template and wants to use variables to standardize the configuration across a large number of devices Which Mo variable types can be defined? (Choose two.)

Path group

Zone

IP netmask

FQDN

30. Which configuration task is best for reducing load on the management plane?

Disable logging on the default deny rule

Enable session logging at start

Disable pre-defined reports

Set the URL filtering action to send alerts

Page 4 of 10

31. Which statement best describes the Automated Commit Recovery feature?

It performs a connectivity check between the firewall and Panorama after every configuration commit on the firewall. It reverts the configuration changes on the firewall if the check fails.

It restores the running configuration on a firewall and Panorama if the last configuration commit fails.

It performs a connectivity check between the firewall and Panorama after every configuration commit on the firewall. It reverts the configuration changes on the firewall and on Panorama if the check fails.

It restores the running configuration on a firewall if the last configuration commit fails.

32. An administrator creates an application-based security policy rule and commits the change to the firewall.

Which two methods should be used to identify the dependent applications for the respective rule? (Choose two.)

Use the show predefined xpath <value> command and review the output.

Review the App Dependency application list from the Commit Status view.

Open the security policy rule and review the Depends On application list.

Reference another application group containing similar applications.

33. What are two best practices for incorporating new and modified App-IDs? (Choose two)

Configure a security policy rule to allow new App-lDs that might have network-wide impact

Study the release notes and install new App-IDs if they are determined to have low impact

Perform a Best Practice Assessment to evaluate the impact or the new or modified App-IDs

Run the latest PAN-OS version in a supported release tree to have the best performance for the new App-IDs

34. What happens, by default, when the GlobalProtect app fails to establish an IPSec tunnel to the GlobalProtect gateway?

It stops the tunnel-establishment processing to the GlobalProtect gateway immediately.

It tries to establish a tunnel to the GlobalProtect gateway using SSL/TL

It keeps trying to establish an IPSec tunnel to the GlobalProtect gateway.

It tries to establish a tunnel to the GlobalProtect portal using SSL/TL

35. The UDP-4501 protocol-port is used between which two GlobalProtect components?

GlobalProtect app and GlobalProtect gateway

GlobalProtect portal and GlobalProtect gateway

GlobalProtect app and GlobalProtect satellite

GlobalProtect app and GlobalProtect portal

36. Information Security is enforcing group-based policies by using security-event monitoring on Windows User-ID agents for IP-to-User mapping in the network. During the rollout, Information Security identified a gap for users authenticating to their VPN and wireless networks.

Root cause analysis showed that users were authenticating via RADIUS and that authentication events were not captured on the domain controllers that were being monitored Information Security found that authentication events existed on the Identity Management solution (IDM). There did not appear to be direct integration between PAN-OS and the IDM solution

How can Information Security extract and learn iP-to-user mapping information from authentication events for VPN and wireless users?

Add domain controllers that might be missing to perform security-event monitoring for VPN and wireless users.

Configure the integrated User-ID agent on PAN-OS to accept Syslog messages over TL

Configure the User-ID XML API on PAN-OS firewalls to pull the authentication events directly from the IDM solution

Configure the Windows User-ID agents to monitor the VPN concentrators and wireless controllers for IP-to-User mapping.

37. A super user is tasked with creating administrator accounts for three contractors. For compliance purposes, all three contractors will be working with different device-groups m their hierarchy to deploy policies and objects.

Which type of role-based access is most appropriate for this project?

Create a Dynamic Admin with the Panorama Administrator role.

Create a Device Group and Template Admin.

Create a Custom Panorama Admin.

Create a Dynamic Read only superuser

38. A network security administrator wants to enable Packet-Based Attack Protection in a Zone Protection profile.

What are two valid ways to enable Packet-Based Attack Protection? (Choose two.)

ICMP Drop

TCP Drop

TCP Port Scan Block

SYN Random Early Drop

39. An engineer must configure the Decryption Broker feature

Which Decryption Broker security chain supports bi-directional traffic flow?

Layer 2 security chain

Layer 3 security chain

Transparent Bridge security chain

Transparent Proxy security chain

40. Which statement accurately describes service routes and virtual systems?

Virtual systems that do not have specific service routes configured inherit the global service and service route settings for the firewall.

Virtual systems can only use one interface for all global service and service routes of the firewall.

Virtual systems cannot have dedicated service routes configured; and virtual systems always use the global service and service route settings for the firewall.

The interface must be used for traffic to the required external services.

Page 5 of 10

41. An engineer must configure a new SSL decryption deployment.

Which profile or certificate is required before any traffic that matches an SSL decryption rule is decrypted?

There must be a certificate with both the Forward Trust option and Forward Untrust option selected.

A Decryption profile must be attached to the Security policy that the traffic matches.

A Decryption profile must be attached to the Decryption policy that the traffic matches.

There must be a certificate with only the Forward Trust option selected.

42. Which type of policy in Palo Alto Networks firewalls can use Device-ID as a match condition?

NAT

DOS protection

QoS

Tunnel inspection

43. Which GlobalProtect gateway selling is required to enable split-tunneling by access route, destination domain, and application?

No Direct Access to local networks

Tunnel mode

iPSec mode

Satellite mode

44. An administrator is using Panorama to manage multiple firewalls. After upgrading all devices to the latest PAN-OS software, the administrator enables log forwarding from the firewalls to Panorama.

However, pre-existing logs from the firewalls are not appearing in Panorama.

Which action should be taken to enable the firewalls to send their pre-existing logs to Panorama?

Export the log database.

Use the import option to pull logs.

Use the scp logdb export command.

Use the ACC to consolidate the logs.

45. When planning to configure SSL Froward Proxy on a PA 5260, a user asks how SSL decryption can be implemented using phased approach in alignment with Palo Alto Networks best practices

What should you recommend?

Enable SSL decryption for known malicious source IP addresses

Enable SSL decryption for source users and known malicious URL categories

Enable SSL decryption for malicious source users

Enable SSL decryption for known malicious destination IP addresses

46. A company has recently migrated their branch office's PA-220S to a centralized Panorama. This Panorama manages a number of PA-7000 Series and PA-5200 Series devices All device group and template configuration is managed solely within Panorama

They notice that commit times have drastically increased for the PA-220S after the migration

What can they do to reduce commit times?

Disable "Share Unused Address and Service Objects with Devices" in Panorama Settings.

Update the apps and threat version using device-deployment

Perform a device group push using the "merge with device candidate config" option

Use "export or push device config bundle" to ensure that the firewall is integrated with the Panorama config.

47. An engineer has been given approval to upgrade their environment 10 PAN-OS 10 2. The environment consists of both physical and virtual firewalls a virtual Panorama HA pair, and virtual log collectors

What is the recommended order when upgrading to PAN-OS 10.2?

Upgrade Panorama, upgrade the log collectors, upgrade the firewalls

Upgrade the firewalls upgrade log collectors, upgrade Panorama

Upgrade the firewalls upgrade Panorama, upgrade the log collectors

Upgrade the log collectors, upgrade the firewalls, upgrade Panorama

48. What is the best description of the HA4 Keep-Alive Threshold (ms)?

the maximum interval between hello packets that are sent to verify that the HA functionality on the other firewall is operational.

The time that a passive or active-secondary firewall will wait before taking over as the active or active-primary firewall

the timeframe within which the firewall must receive keepalives from a cluster member to know that the cluster member is functional.

The timeframe that the local firewall wait before going to Active state when another cluster member is preventing the cluster from fully synchronizing.

49. Which three items are import considerations during SD-WAN configuration planning? (Choose three.)

link requirements

the name of the ISP

IP Addresses

branch and hub locations

50. A network security administrator wants to begin inspecting bulk user HTTPS traffic flows egressing out of the internet edge firewall.

Which certificate is the best choice to configure as an SSL Forward Trust certificate?

A self-signed Certificate Authority certificate generated by the firewall

A Machine Certificate for the firewall signed by the organization's PKI

A web server certificate signed by the organization's PKI

A subordinate Certificate Authority certificate signed by the organization's PKI

Page 6 of 10

51. An administrator accidentally closed the commit window/screen before the commit was finished.

Which two options could the administrator use to verify the progress or success of that commit task? (Choose two.)

A. System Logs

B. Task Manager

C. Traffic Logs

D. Configuration Logs

52. Based on the screenshots above, and with no configuration inside the Template Stack itself, what access will the device permit on its Management port?

The firewall will allow HTTP, Telnet, HTTPS, SSH, and Ping from IP addresses defined as $permitted-subnet-2.

The firewall will allow HTTP, Telnet, HTTPS, SSH, and Ping from IP addresses defined as $permitted-subnet-l and Spermitted-subnet-2.

The firewall will allow HTTP, Telnet, HTTPS, SSH, and Ping from IP addresses defined as $permitted-subnet-l.

The firewall will allow HTTP, Telnet, SNMP, HTTPS, SSH, and Ping from IP addresses defined as $permitted-subnet-l and $permitted-subnet-2.

53. An engineer receives reports from users that applications are not working and that websites are only partially loading in an asymmetric environment. After investigating, the engineer observes the flow_tcp_non_syn_drop counter increasing in the show counters global output.

Which troubleshooting command should the engineer use to work around this issue?

set deviceconfig setting tcp asymmetric-path drop

set deviceconfig setting session tcp-reject-non-syn no

set session tcp-reject-non-syn yes

set deviceconfig setting tcp asymmetric-path bypass

54. An administrator wants to grant read-only access to all firewall settings, except administrator accounts, to a new-hire colleague in the IT department.

Which dynamic role does the administrator assign to the new-hire colleague?

Device administrator (read-only)

System administrator (read-only)

Firewall administrator (read-only)

Superuser (read-only)

55. Which feature of Panorama allows an administrator to create a single network configuration that can be reused repeatedly for large-scale deployments even if values of configured objects, such as routes and interface addresses, change?

Template stacks

Template variables

The Shared device group

A device group

56. An administrator connected a new fiber cable and transceiver to interface Ethernetl/l on a Palo Alto Networks firewall. However, the link does not seem to be coming up.

If an administrator were to troubleshoot, how would they confirm the transceiver type, tx-power, rx-power, vendor name, and part number via the CLI?

show system state filter sw.dev.interface.config

show chassis status slot s1

show system state filter-pretty sys.s1.*

show system state filter ethernet1/1

57. You need to allow users to access the office-suite applications of their choice.

How should you configure the firewall to allow access to any office-suite application?

Create an Application Group and add Office 365, Evernote Google Docs and Libre Office

Create an Application Group and add business-systems to it.

Create an Application Filter and name it Office Programs, then filter it on the office programs subcategory.

Create an Application Filter and name it Office Programs then filter on the business-systems category.

58. You have upgraded Panorama to 10.2 and need to upgrade six Log Collectors.

When upgrading Log Collectors to 10.2, you must do what?

Upgrade the Log Collectors one at a time.

Add Panorama Administrators to each Managed Collector.

Add a Global Authentication Profile to each Managed Collector.

Upgrade all the Log Collectors at the same time.

59. Which DoS Protection Profile detects and prevents session exhaustion attacks against specific destinations?

Resource Protection

TCP Port Scan Protection

Packet Based Attack Protection

Packet Buffer Protection

60. An administrator is attempting to create policies tor deployment of a device group and template stack. When creating the policies, the zone drop down list does not include the required zone.

What must the administrator do to correct this issue?

Specify the target device as the master device in the device group

Enable "Share Unused Address and Service Objects with Devices" in Panorama settings

Add the template as a reference template in the device group

Add a firewall to both the device group and the template

Page 7 of 10

61. Refer to the image.

An administrator is tasked with correcting an NTP service configuration for firewalls that cannot use the Global template NTP servers. The administrator needs to change the IP address to a preferable server for this template stack but cannot impact other template stacks.

How can the issue be corrected?

Override the value on the NYCFW template.

Override a template value using a template stack variable.

Override the value on the Global template.

Enable "objects defined in ancestors will take higher precedence" under Panorama settings.

62. In a Panorama template which three types of objects are configurable? (Choose three)

certificate profiles

HIP objects

QoS profiles

security profiles

interface management profiles

63. An engineer configures SSL decryption in order to have more visibility to the internal users' traffic when it is regressing the firewall.

Which three types of interfaces support SSL Forward Proxy? (Choose three.)

High availability (HA)

Layer 2

Virtual Wire

Tap

Layer 3

64. An ISP manages a Palo Alto Networks firewall with multiple virtual systems for its tenants.

Where on this firewall can the ISP configure unique service routes for different tenants?

Setup > Services > Virtual Systems > Set Location > Service Route Configuration > Inherit Global Service Route Configuration

Setup > Services > Global > Service Route Configuration > Customize

Setup > Services > Virtual Systems > Set Location > Service Route Configuration > Customize

Setup > Services > Global > Service Route Configuration > Use Management Interface for all

65. When using SSH keys for CLI authentication for firewall administration, which method is used for authorization?

Local

LDAP

Kerberos

Radius

66. A customer is replacing their legacy remote access VPN solution The current solution is in place to secure only internet egress for the connected clients Prisma Access has been selected to replace the current remote access VPN solution During onboarding the following options and licenses were selected and enabled

- Prisma Access for Remote Networks 300Mbps

- Prisma Access for Mobile Users 1500 Users

- Cortex Data Lake 2TB

- Trusted Zones trust

- Untrusted Zones untrust

- Parent Device Group shared

How can you configure Prisma Access to provide the same level of access as the current VPN solution?

Configure mobile users with trust-to-untrust Security policy rules to allow the desired traffic outbound to the internet

Configure mobile users with a service connection and trust-to-trust Security policy rules to allow the desired traffic outbound to the internet

Configure remote networks with a service connection and trust-to-untrust Security policy rules to allow the desired traffic outbound to the internet

Configure remote networks with trust-to-trust Security policy rules to allow the desired traffic outbound to the internet

67. Which profile generates a packet threat type found in threat logs?

Zone Protection

WildFire

Anti-Spyware

Antivirus

68. An engineer reviews high availability (HA) settings to understand a recent HA failover event. Review the screenshot below.

Which timer determines the frequency at which the HA peers exchange messages in the form of an ICMP (ping)

Hello Interval

Promotion Hold Time

Heartbeat Interval

Monitor Fail Hold Up Time

69. Where can an administrator see both the management-plane and data-plane CPU utilization in the WebUI?

System Resources widget

System Logs widget

Session Browser

General Information widget

70. An administrator can not see any Traffic logs from the Palo Alto Networks NGFW in Panorama reports. The configuration problem seems to be on the firewall.

Which settings, if configured incorrectly, most likely would stop only Traffic logs from being sent from the NGFW to Panorama?

A)

Option A

Option B

Option C

Option D

Page 8 of 10

71. Review the information below. A firewall engineer creates a U-NAT rule to allow users in the trust zone access to a server in the same zone by using an external, public NAT IP for that server.

Given the rule below, what change should be made to make sure the NAT works as expected?

Change destination NAT zone to Trust_L3.

Change destination translation to Dynamic IP (with session distribution) using firewall ethI/2 address.

Change Source NAT zone to Untrust_L3.

Add source Translation to translate original source IP to the firewall eth1/2 interface translation.

72. What are two best practices for incorporating new and modified App-IDs? (Choose two.)

Run the latest PAN-OS version in a supported release tree to have the best performance for the new App-IDs

Configure a security policy rule to allow new App-IDs that might have network-wide impact

Perform a Best Practice Assessment to evaluate the impact of the new or modified App-IDs

Study the release notes and install new App-IDs if they are determined to have low impact

73. Based on the graphic which statement accurately describes the output shown in the Server Monitoring panel?

The User-ID agent is connected to a domain controller labeled lab-client

The host lab-client has been found by a domain controller

The host lab-client has been found by the User-ID agent.

The User-ID aaent is connected to the firewall labeled lab-client

74. An engineer is tasked with configuring SSL forward proxy for traffic going to external sites.

Which of the following statements is consistent with SSL decryption best practices?

The forward trust certificate should not be stored on an HS

The forward untrust certificate should be signed by a certificate authority that is trusted by the clients.

Check both the Forward Trust and Forward Untrust boxes when adding a certificate for use with SSL decryption

The forward untrust certificate should not be signed by a Trusted Root CA

75. The following objects and policies are defined in a device group hierarchy

A. Address Objects

-Shared Address1

-Shared Address2

-Branch Address1

Policies

-Shared Policy1

-Branch Policy1

B. Address Objects

-Shared Address1

-Shared Address2

-Branch Address1

-DC Address1

Policies

-Shared Policy1

-Shared Policy2

-Branch Policy1

C.

Address Objects

-Shared Address 1

-Branch Address2

Policies -Shared Polic1

-Branch Policy 1

D)

Address Objects

-Shared Address 1

-Shared Address 2

-Branch Address 1

Policies

-Shared Policy 1

-Shared Policy 2

-Branch Policy 1

A. Option A

B. Option B

C. Option C

D. Option D

76. DRAG DROP

Match each GlobalProtect component to the purpose of that component

77. A company is looking to increase redundancy in their network.

Which interface type could help accomplish this?

Layer 2

Virtual wire

Tap

Aggregate ethernet

78. A firewall administrator notices that many Host Sweep scan attacks are being allowed through the firewall sourced from the outside zone.

What should the firewall administrator do to mitigate this type of attack?

Create a DOS Protection profile with SYN Flood protection enabled and apply it to all rules allowing traffic from the outside zone

Enable packet buffer protection in the outside zone.

Create a Security rule to deny all ICMP traffic from the outside zone.

Create a Zone Protection profile, enable reconnaissance protection, set action to Block, and apply it to the outside zone.

79. Where is Palo Alto Networks Device Telemetry data stored on a firewall with a device certificate installed?

Cortex Data Lake

Panorama

On Palo Alto Networks Update Servers

M600 Log Collectors

80. The firewall identifies a popular application as an unKnown-tcp.

Which two options are available to identify the application? (Choose two.)

Create a custom application.

Submit an App-ID request to Palo Alto Networks.

Create a custom object for the application server.

Create a Security policy to identify the custom application.

Page 9 of 10

81. Which source is the most reliable for collecting User-ID user mapping?

GlobalProtect

Microsoft Active Directory

Microsoft Exchange

Syslog Listener

82. A customer wants to set up a VLAN interface for a Layer 2 Ethernet port.

Which two mandatory options are used to configure a VLAN interface? (Choose two.)

Virtual router

Security zone

ARP entries

Netflow Profile

83. An administrator needs to assign a specific DNS server to one firewall within a device group.

Where would the administrator go to edit a template variable at the device level?

Variable CSV export under Panorama > templates

PDF Export under Panorama > templates

Manage variables under Panorama > templates

Managed Devices > Device Association

84. An engineer manages a high availability network and requires fast failover of the routing protocols. The engineer decides to implement BFD.

Which three dynamic routing protocols support BFD? (Choose three.)

OSPF

RIP

BGP

IGRP

OSPFv3 virtual link

85. An engineer is deploying multiple firewalls with common configuration in Panorama.

What are two benefits of using nested device groups? (Choose two.)

Inherit settings from the Shared group

Inherit IPSec crypto profiles

Inherit all Security policy rules and objects

Inherit parent Security policy rules and objects

86. A company requires that a specific set of ciphers be used when remotely managing their

Palo Alto Networks appliances.

Which profile should be configured in order to achieve this?

SSH Service profile

SSL/TLS Service profile

Decryption profile

Certificate profile

87. Refer to the exhibit.

An organization has Palo Alto Networks NGFWs that send logs to remote monitoring and security management platforms. The network team has reported excessive traffic on the corporate WAN.

How could the Palo Alto Networks NGFW administrator reduce WAN traffic while maintaining support for all the existing monitoring/security platforms?

Forward logs from firewalls only to Panorama and have Panorama forward logs to other external services

Configure log compression and optimization features on all remote firewalls

Any configuration on an M-500 would address the insufficient bandwidth concerns

Forward logs from external sources to Panorama for correlation, and from Panorama send them to the NGFW

88. An administrator is troubleshooting why video traffic is not being properly classified.

If this traffic does not match any QoS classes, what default class is assigned?

89. A network security administrator has an environment with multiple forms of authentication. There is a network access control system in place that authenticates and restricts access for wireless users, multiple Windows domain controllers, and an MDM solution for company-provided smartphones. All of these devices have their authentication events logged.

Given the information, what is the best choice for deploying User-ID to ensure maximum coverage?

Syslog listener

agentless User-ID with redistribution

standalone User-ID agent

captive portal

90. An engineer is designing a deployment of multi-vsys firewalls.

What must be taken into consideration when designing the device group structure?

Multiple vsys and firewalls can be assigned to a device group, and a multi-vsys firewall must have all its vsys in a single device group.

Only one vsys or one firewall can be assigned to a device group, except for a multi-vsys firewall, which must have all its vsys in a single device group.

Multiple vsys and firewalls can be assigned to a device group, and a multi-vsys firewall can have each vsys in a different device group.

Only one vsys or one firewall can be assigned to a device group, and a multi-vsys firewall can have each vsys in a different device group.

Page 10 of 10

91. Which log type would provide information about traffic blocked by a Zone Protection profile?

Data Filtering

IP-Tag

Traffic

Threat

92. A company wants to install a PA-3060 firewall between two core switches on a VLAN trunk link. They need to assign each VLAN to its own zone and to assign untagged (native) traffic to its own zone which options differentiates multiple VLAN into separate zones?

Create V-Wire objects with two V-Wire interfaces and define a range of "0-4096 in the "Tag Allowed" field of the V-Wire object.

Create V-Wire objects with two V-Wire subinterfaces and assign only a single VLAN ID to the Tag Allowed" field of the V-Wire object. Repeat for every additional VLAN and use a VLAN ID of 0 for untagged traffic. Assign each interface/sub interface to a unique zone.

Create Layer 3 subinterfaces that are each assigned to a single VLAN ID and a common virtual router. The physical Layer 3 interface would handle untagged traffic. Assign each interface/subinterface t

unique zone. Do not assign any interface an IP address.

Create VLAN objects for each VLAN and assign VLAN interfaces matching each VLAN I

Repeat for every additional VLAN and use a VLAN ID of 0 for untagged traffic. Assign each interface/sub interface to a unique zone.

93. An administrator notices that an interface configuration has been overridden locally on a firewall. They require all configuration to be managed from Panorama and overrides are not allowed.

What is one way the administrator can meet this requirement?

Perform a commit force from the CLI of the firewall.

Perform a template commit push from Panorama using the "Force Template Values" option.

Perform a device-group commit push from Panorama using the "Include Device and Network Templates" option.

Reload the running configuration and perform a Firewall local commit.

Valid PCNSE Exam Updated Questions and Answers

Valid PCNSE Exam Updated Questions and Answers

Share this post

Leave a Reply Cancel reply

Related Posts