Palo-Alto-Networks PCNSE Exam Dumps

Palo-Alto-Networks PCNSE Sample Question Answers

Question # 1

An administrator allocates bandwidth to a Prisma Access Remote Networks compute location with three remote networks. What is the minimum amount of bandwidth the administrator could configure at the compute location? 

A. 90Mbps
B. 300 Mbps
C. 75Mbps
D. 50Mbps

Show Answer

Question # 2

You need to allow users to access the office-suite applications of their choice. How should you configure the firewall to allow access to any office-suite application? 

A. Create an Application Group and add Office 365, Evernote Google Docs and Libre Office
B. Create an Application Group and add business-systems to it.
C. Create an Application Filter and name it Office Programs, then filter it on the office programs subcategory.
D. Create an Application Filter and name it Office Programs then filter on the business-systems category.

Show Answer

Question # 3

The manager of the network security team has asked you to help configure the company's Security Profiles according to Palo Alto Networks best practice As part of that effort, the manager has assigned you the Vulnerability Protection profile for the internet gateway firewall. Which action and packet-capture setting for items of high severity and critical severity best matches Palo Alto Networks best practice? 

A. action 'reset-both' and packet capture 'extended-capture'
B. action 'default' and packet capture 'single-packet'
C. action 'reset-both' and packet capture 'single-packet'
D. action 'reset-server' and packet capture 'disable' 

Show Answer

Question # 4

SAML SLO is supported for which two firewall features? (Choose two.)

A. GlobalProtect Portal
B. CaptivePortal
C. WebUI
D. CLI

Show Answer

Question # 5

An administrator device-group commit push is tailing due to a new URL category How should the administrator correct this issue?

A. verify that the URL seed Tile has been downloaded and activated on the firewall
B. change the new category action to alert" and push the configuration again
C. update the Firewall Apps and Threat version to match the version of Panorama
D. ensure that the firewall can communicate with the URL cloud 

Show Answer

Question # 6

A network security engineer wants to prevent resource-consumption issues on the firewall. Which strategy is consistent with decryption best practices to ensure consistent performance?

A. Use RSA in a Decryption profile tor higher-priority and higher-risk traffic, and use less processorintensive decryption methods for lower-risk traffic
B. Use PFS in a Decryption profile for higher-priority and higher-risk traffic, and use less processorintensive decryption methods for tower-risk traffic
C. Use Decryption profiles to downgrade processor-intensive ciphers to ciphers that are less processor-intensive
D. Use Decryption profiles to drop traffic that uses processor-intensive ciphers 

Show Answer

Question # 7

An administrator is using Panorama to manage me and suspects an IKE Crypto mismatch between peers, from the firewalls to Panoram a. However, pre-existing logs from the firewalls are not appearing in Panorama. Which action should be taken to enable the firewalls to send their pre-existing logs to Panorama?

A. Export the log database.
B. Use the import option to pull logs.
C. Use the ACC to consolidate the logs.
D. Use the scp logdb export command.

Show Answer

Question # 8

A customer wants to set up a VLAN interface for a Layer 2 Ethernet port. Which two mandatory options are used to configure a VLAN interface? (Choose two.)

A. Virtual router
B. Security zone
C. ARP entries
D. Netflow Profile

Show Answer

Question # 9

What are two valid deployment options for Decryption Broker? (Choose two) 

A. Transparent Bridge Security Chain
B. Layer 3 Security Chain
C. Layer 2 Security Chain
D. Transparent Mirror Security Chain

Show Answer

Question # 10

An administrator has a PA-820 firewall with an active Threat Prevention subscription The administrator is considering adding a WildFire subscription. How does adding the WildFire subscription improve the security posture of the organization1?

A. Protection against unknown malware can be provided in near real-time
B. WildFire and Threat Prevention combine to provide the utmost security posture for the firewall
C. After 24 hours WildFire signatures are included in the antivirus update
D. WildFire and Threat Prevention combine to minimize the attack surface 

Show Answer

Question # 11

An administrator has a PA-820 firewall with an active Threat Prevention subscription The administrator is considering adding a WildFire subscription. How does adding the WildFire subscription improve the security posture of the organization1?

A. Protection against unknown malware can be provided in near real-time
B. WildFire and Threat Prevention combine to provide the utmost security posture for the firewall
C. After 24 hours WildFire signatures are included in the antivirus update
D. WildFire and Threat Prevention combine to minimize the attack surface 

Show Answer

Question # 12

What are two common reasons to use a "No Decrypt" action to exclude traffic from SSL decryption? (Choose two.)

A. the website matches a category that is not allowed for most users
B. the website matches a high-risk category
C. the web server requires mutual authentication
D. the website matches a sensitive category

Show Answer

Question # 13

What are three valid qualifiers for a Decryption Policy Rule match? (Choose three.) 

A. Destination Zone
B. App-ID
C. Custom URL Category
D. User-ID
E. Source Interface

Show Answer

Question # 14

When planning to configure SSL Froward Proxy on a PA 5260, a user asks how SSL decryption can be implemented using phased approach in alignment with Palo Alto Networks best practices What should you recommend? 

A. Enable SSL decryption for known malicious source IP addresses
B. Enable SSL decryption for source users and known malicious URL categories
C. Enable SSL decryption for malicious source users
D. Enable SSL decryption for known malicious destination IP addresses

Show Answer

Question # 15

A prospect is eager to conduct a Security Lifecycle Review (SLR) with the aid of the Palo Alto Networks NGFW. Which interface type is best suited to provide the raw data for an SLR from the network in a way that is minimally invasive? 

A. Layer 3
B. Virtual Wire
C. Tap
D. Layer 2

Show Answer

Question # 16

Before you upgrade a Palo Alto Networks NGFW, what must you do? 

A. Make sure that the PAN-OS support contract is valid for at least another year
B. Export a device state of the firewall
C. Make sure that the firewall is running a version of antivirus software and a version of WildFire that support the licensed subscriptions.
D. Make sure that the firewall is running a supported version of the app + threat update

Show Answer

Question # 17

When configuring forward error correction (FEC) for PAN-OS SD-WAN, an administrator would turn on the feature inside which type of SD-WAN profile?

A. Certificate profile B. Path Quality profile C. SD-WAN Interface profile D. Traffic Distribution profile
B. Path Quality profile
C. SD-WAN Interface profile
D. Traffic Distribution profile

Show Answer

Question # 18

An engineer must configure the Decryption Broker feature Which Decryption Broker security chain supports bi-directional traffic flow?

A. Layer 2 security chain B. Layer 3 security chain C. Transparent Bridge security chain D. Transparent Proxy security chain
B. Layer 3 security chain
C. Transparent Bridge security chain
D. Transparent Proxy security chain

Show Answer

Question # 19

When you navigate to Network: > GlobalProtect > Portals > Method section, which three options are available? (Choose three ) 

A. user-logon (always on)
B. pre-logon then on-demand
C. on-demand (manual user initiated connection)
D. post-logon (always on)
E. certificate-logon

Show Answer

Question # 20

A network security engineer must implement Quality of Service policies to ensure specific levels of delivery guarantees for various applications in the environment They want to ensure that they know as much as they can about QoS before deploying. Which statement about the QoS feature is correct?

A. QoS is only supported on firewalls that have a single virtual system configured
B. QoS can be used in conjunction with SSL decryption
C. QoS is only supported on hardware firewalls
D. QoS can be used on firewalls with multiple virtual systems configured

Show Answer

Question # 21

Using multiple templates in a stack to manage many firewalls provides which two advantages? (Choose two.) 

A. inherit address-objects from templates
B. define a common standard template configuration for firewalls
C. standardize server profiles and authentication configuration across all stacks
D. standardize log-forwarding profiles for security polices across all stacks

Show Answer

Question # 22

A network administrator wants to use a certificate for the SSL/TLS Service Profile. Which type of certificate should the administrator use?

A. certificate authority (CA) certificate
B. client certificate 
C. machine certificate
D. server certificate

Show Answer

Question # 23

When using certificate authentication for firewall administration, which method is used for authorization? 

A. Radius 
B. LDAP 
C. Kerberos 
D. Local

Show Answer

Question # 24

A security engineer wants to upgrade the company's deployed firewalls from PAN-OS 10.1 to 11.0.x to take advantage of the new TLSvl.3 support for management access. What is the recommended upgrade path procedure from PAN-OS 10.1 to 11.0.x?

A. Required: Download PAN-OS 10.2.0 or earlier release that is not EOL. Required: Download and install the latest preferred PAN-OS 10.2 maintenance release and reboot. Required: Download PAN-OS 11.0.0. Required: Download and install the desired PAN-OS 11.0.x.
B. Required: Download and install the latest preferred PAN-OS 10.1 maintenance release and reboot. Required: Download PAN-OS 10.2.0. Required: Download and install the latest preferred PAN-OS 10.2 maintenance release and reboot. Required: Download PAN-OS 11.0.0. Required: Download and install the desired PAN-OS 11.0.x.
C. Optional: Download and install the latest preferred PAN-OS 10.1 release. Optional: Install the latest preferred PAN-OS 10.2 maintenance release. Required: Download PANOS 11.0.0. Required: Download and install the desired PAN-OS 11.0.x
D. Required: Download and install the latest preferred PAN-OS 10.1 maintenance release and reboot. Required: Download PAN-OS 10.2.0. Optional: Install the latest preferred PAN-OS 10.2 maintenance release. Required: Download PAN-OS 11.0.0. Required: Download and install the desired PAN-OS 11.0.x.

Show Answer

Question # 25

A company wants to add threat prevention to the network without redesigning the network routing. What are two best practice deployment modes for the firewall? (Choose two.)

A. VirtualWire 
B. Layer3 
C. TAP 
D. Layer2 

Show Answer

Question # 26

An engineer configures a specific service route in an environment with multiple virtual systems instead of using the inherited global service route configuration. What type of service route can be used for this configuration?

A. IPv6 Source or Destination Address 
B. Destination-Based Service Route 
C. IPv4 Source Interface 
D. Inherit Global Setting

Show Answer

Question # 27

Which three statements accurately describe Decryption Mirror? (Choose three.)

A. Decryption Mirror requires a tap interface on the firewall
B. Use of Decryption Mirror might enable malicious users with administrative access to the firewall to harvest sensitive information that is submitted via an encrypted channel
C. Only management consent is required to use the Decryption Mirror feature.
D. Decryption, storage, inspection, and use of SSL traffic are regulated in certain countries.
E. You should consult with your corporate counsel before activating and using DecryptionMirror in a production environment.

Show Answer

Question # 28

During the implementation of SSL Forward Proxy decryption, an administrator imports the company's Enterprise Root CA and Intermediate CA certificates onto the firewall. The company's Root and Intermediate CA certificates are also distributed to trusted devices using Group Policy and GlobalProtect. Additional device certificates and/or Subordinate certificates requiring an Enterprise CA chain of trust are signed by the company's Intermediate CA. Which method should the administrator use when creating Forward Trust and Forward Untrust certificates on the firewall for use with decryption?

A. Generate a single subordinate CA certificate for both Forward Trust and Forward Untrust. 
B. Generate a CA certificate for Forward Trust and a self-signed CA for Forward Untrust. 
C. Generate a single self-signed CA certificate for Forward Trust and another for Forward Untrust 
D. Generate two subordinate CA certificates, one for Forward Trust and one for Forward Untrust.

Show Answer

Question # 29

An administrator wants to add User-ID information for their Citrix MetaFrame Presentation Server (MPS) users. Which option should the administrator use?

A. Terminal Server Agent for User Mapping
 B. Windows-Based User-ID Agent 
C. PAN-OS Integrated User-ID Agent 
D. PAN-OS XML API

Show Answer

Question # 30

An administrator is receiving complaints about application performance degradation. After checking the ACC, the administrator observes that there is an excessive amount of VoIP traffic. Which three elements should the administrator configure to address this issue? (Choose three.)

A. An Application Override policy for the SIP traffic 
B. QoS on the egress interface for the traffic flows 
C. QoS on the ingress interface for the traffic flows 
D. A QoS profile defining traffic classes 
E. A QoS policy for each application ID 

Show Answer

Question # 31

A security engineer needs firewall management access on a trusted interface. Which three settings are required on an SSL/TLS Service Profile to provide secure Web UI authentication? (Choose three.)

A. Minimum TLS version 
B. Certificate 
C. Encryption Algorithm 
D. Maximum TLS version 
E. Authentication Algorithm 

Show Answer

Question # 32

An engineer is bootstrapping a VM-Series Firewall Other than the /config folder, which three directories are mandatory as part of the bootstrap package directory structure? (Choose three.)

A. /content 
B. /software 
C. /piugins 
D. /license 
E. /opt 

Show Answer

Question # 33

Where can a service route be configured for a specific destination IP?

A. Use Netw ork > Virtual Routers, select the Virtual Router > Static Routes > IPv4 
B. Use Device > Setup > Services > Services 
C. Use Device > Setup > Services > Service Route Configuration > Customize > Destination
 D. Use Device > Setup > Services > Service Route Configuration > Customize > IPv4

Show Answer

Question # 34

Certain services in a customer implementation are not working, including Palo Alto Networks Dynamic version updates. Which CLI command can the firewall administrator use to verify if the service routes were correctly installed and that they are active in the Management Plane?

A. debug dataplane internal vif route 255
 B. show routing route type management 
C. debug dataplane internal vif route 250 
D. show routing route type service-route

Show Answer

Question # 35

How can Panorama help with troubleshooting problems such as high CPU or resource exhaustion on a managed firewall?

A. Panorama provides information about system resources of the managed devices in the Managed Device > Health menu.
B. Firewalls send SNMP traps to Panorama wen resource exhaustion is detected Panorama generates a system log and can send email alerts.
C. Panorama monitors all firewalls using SNMP. It generates a system log and can send email alerts when resource exhaustion is detected on a managed firewall.
D. Panorama provides visibility all the system and traffic logs received from firewalls it does not offer any ability to see or monitor resource utilization on managed firewalls

Show Answer

Question # 36

Which statement accurately describes how web proxy is run on a firewall with multiple virtual systems?

A. It can run on a single virtual system and multiple virtual systems.
B. It can run on multiple virtual systems without issue.
C. It can run only on a single virtual system. 
D. It can run only on a virtual system with an alias named "web proxy.

Show Answer

Question # 37

An administrator is troubleshooting why video traffic is not being properly classified. If this traffic does not match any QoS classes, what default class is assigned?

A. 1 
B. 2 
C. 3 
D. 4

Show Answer