Ask Question
Palo Alto Networks PCNSC Practice Test - Questions Answers, Page 3
List of questions
Question 21
Your customer believes that the Panorama appliance is being overwhelmed by the logs from deployed Palo Alto Networks Next-Generation Firewalls. What CLl command can you run to determine the number of logs per second sent by each firewall?
To determine the number of logs per second sent by each firewall to a Panorama appliance, the appropriate CLI command to use is:
D . debug log-receiver statistics
This command provides detailed statistics about the logs being received by the Panorama, including the rate at which logs are being sent by each connected firewall. This information can help identify whether the Panorama is being overwhelmed by the volume of logs and which firewalls are contributing the most to the log traffic.
Palo Alto Networks - CLI Commands for Troubleshooting Panorama: https://docs.paloaltonetworks.com
Palo Alto Networks - Managing Logs and Log Forwarding: https://knowledgebase.paloaltonetworks.com
Question 22
Where and how is Expedition installed^
Expedition, the migration tool provided by Palo Alto Networks, is installed on an Ubuntu server. The installation process involves running a script that automatically downloads and installs all necessary dependencies.
A . On an Ubuntu server, by running an installation script that will automatically download all dependencies
This method simplifies the installation process by automating the download and configuration of all required components, ensuring that the installation is straightforward and minimizes the potential for errors related to missing dependencies.
Palo Alto Networks - Expedition Installation Guide: https://live.paloaltonetworks.com/t5/expedition-migration-tool/ct-p/migration_tool
Palo Alto Networks - Expedition User Guide: https://live.paloaltonetworks.com/t5/expedition-documentation/ct-p/migration_tool_docs
Question 23
DRAG DROP
In Panorama the web interface displays the security rules in evaluation order Organize the security rules m the order in which they will be evaluated?
Palo Alto Networks - Panorama Admin Guide: https://docs.paloaltonetworks.com/panorama/10-0/panorama-admin/policy/policy-precedence-and-evaluation-order
Palo Alto Networks - Security Policy Evaluation: https://knowledgebase.paloaltonetworks.com
Question 24
Which three steps must an administrator perform to load only address objects from a PAN-OS saved configuration file into a VM-3C0 firewall that is in production? (Choose three)
To load only address objects from a PAN-OS saved configuration file into a VM-300 firewall that is in production, the administrator must follow these three steps:
C . Enter the configuration mode from the CLI: This step is necessary to prepare the firewall to accept the new configuration.
D . Use the load config partial command: This command allows the administrator to load only specific parts of the configuration, such as address objects, from a saved configuration file without overwriting the entire configuration. The command syntax typically looks like this: load config partial from <source-configuration> mode merge exclude everything but address objects.
E . Import named configuration snapshot through the web interface: This involves importing the configuration snapshot that contains the address objects through the web interface, but only after ensuring that the specific address objects are targeted and not the entire configuration.
Palo Alto Networks - PAN-OS CLI Quick Start: https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-cli-quick-start
Palo Alto Networks - How to Use the Partial Configuration Load Feature: https://knowledgebase.paloaltonetworks.com
Question 25
SSL Forward Proxy decryption is enabled on (he firewall When clients use Chrome to browse to HTTPS sites, the firewall returns the Forward Trust certificate, even when accessing websites with invalid certificates The clients need to be presented with a browser warning error with the option to proceed to websites with invalid certificates
Which two options will satisfy this requirement? (Choose two.)
When SSL Forward Proxy decryption is enabled, and clients using Chrome need to see browser warnings for websites with invalid certificates, the following options will satisfy the requirement:
A . Create a Decryption Profile with the Block sessions with expired certificates option enabled: This option ensures that sessions with expired certificates are blocked, which will present a warning to the user.
B . Create a self-signed Forward Untrust enabled certificate: This certificate will be used for websites with invalid or untrusted certificates, prompting the browser to display a warning.
These configurations ensure that users are properly warned when accessing sites with invalid certificates, allowing them to decide whether to proceed.
Palo Alto Networks - SSL Decryption Best Practices: https://docs.paloaltonetworks.com/best-practices
Palo Alto Networks - Configuring SSL Forward Proxy: https://knowledgebase.paloaltonetworks.com
Question 26
A customer has a pair of Panorama HA appliances tunning local log collectors and wants to have log redundancy on logs forwarded from firewalls Which two configuration options fulfill the customer's requirement for log redundancy? (Choose two)
To fulfill the customer's requirement for log redundancy on logs forwarded from firewalls in a Panorama HA setup, the following configuration options are necessary:
B . Log redundancy must be enabled per Collector Group: This ensures that logs are redundantly stored across multiple log collectors within the same collector group.
C . A Collector Group must contain at least two Log Collectors: For log redundancy to work, there must be at least two log collectors in the collector group so that if one log collector fails, the other can continue to collect logs.
These configurations ensure that log data is replicated across multiple log collectors, providing redundancy and resilience in the event of a failure.
Palo Alto Networks - Configure Log Forwarding and Redundancy: https://docs.paloaltonetworks.com/panorama/10-0/panorama-admin/manage-log-collection/configure-log-forwarding-and-redundancy
Palo Alto Networks - Panorama High Availability: https://docs.paloaltonetworks.com/panorama/10-0/panorama-admin/set-up-panorama/set-up-high-availability
Question 27
What happens when a packet from an existing session is received by a firewall that
When a packet from an existing session is received by a firewall that is part of an HA (High Availability) pair:
D . The firewall takes ownership of the session from the peer firewall
In a high-availability configuration, if a firewall in an HA pair receives a packet for an existing session that it is not currently handling, it will take ownership of that session from the peer firewall. This ensures seamless continuity of the session and maintains the stateful nature of the firewall's session handling.
Palo Alto Networks - High Availability Concepts: https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/high-availability/ha-concepts
Question 28
Which interface deployments support the Aggregate Ethernet Active configuration? (Choose three.)
The interface deployments that support the Aggregate Ethernet (AE) Active configuration are:
B . LACP in Layer 3: Link Aggregation Control Protocol (LACP) can be used in Layer 3 interfaces to bundle multiple physical interfaces into a single logical interface for redundancy and increased bandwidth.
C . LACP in Layer 2: LACP can be used in Layer 2 interfaces to aggregate multiple Ethernet interfaces, enhancing throughput and providing failover capabilities within a Layer 2 network.
D . LACP in Virtual Wire: LACP can also be configured in Virtual Wire mode, which allows the firewall to aggregate interfaces while operating in a transparent mode, bridging traffic between interfaces without routing.
These configurations leverage LACP to improve network performance and reliability by combining multiple physical links into a single logical link.
Palo Alto Networks - Aggregate Interfaces: https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/networking/aggregate-ethernet/aggregate-ethernet-overview
Palo Alto Networks - LACP and LLDP Support: https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/networking/aggregate-ethernet/lacp-and-lldp-support
Question 29
A customer has a five-year-old firewall in production in the time since the firewall was installed, the IT team deleted unused security policies on a regular basis but they did not remove the address objects and groups that were part of these security policies.
What is the best way to delete all of the unused address objects on the firewall?
To delete all of the unused address objects on the firewall, the best method is:
B . Using CLI execute request configuration address-objects remove-unused-objects
This CLI command is designed to identify and remove all unused address objects in the firewall's configuration. It is the most efficient and accurate method for cleaning up unused objects without manually checking each one.
Palo Alto Networks - PAN-OS CLI Quick Start: https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-cli-quick-start
Palo Alto Networks - Removing Unused Address Objects: https://knowledgebase.paloaltonetworks.com
Question 30
Which category of Vulnerability Signatures is most likely to trigger false positive alerts?
Unlock Premium Member
Related questions
Export
If you didn't receive an email within 5 minutes, you should submit a support request to [email protected].
|
BASIC - 1 Month
$
10
Full latest questions
No CAPTCHA
New Updates
Export to VPLUS
Export to PDF - All questions
Team support
|
PLUS - 2 Months
$
15
Full latest questions
No CAPTCHA
New Updates
Export to VPLUS
Export to PDF - All questions
Team support
|
PRO - 6 Months
$
40
Full latest questions
No CAPTCHA
New Updates
Export to VPLUS
Export to PDF - All questions
Team support
|
Full latest questions
No CAPTCHA
New Updates
Export to VPLUS
Export to PDF - All questions
Team support
Full latest questions
No CAPTCHA
New Updates
Export to VPLUS
Export to PDF - All questions
Team support
Full latest questions
No CAPTCHA
New Updates
Export to VPLUS
Export to PDF - All questions
Team support
Selling illegal goods, money scams etc.
Serious attack on a group.
Harassing an individual (including doxing)
Threatening or glorifying violence or serious harm, including self-harm
Nudity/Sexual content
Sexually explicit or suggestive imagery or writing involving minors
Sexually explicit or suggestive imagery or writing involving non-consenting adults or non-humans
Reusing content without attribution (link and blockquotes)
Not in English or has very bad formatting, grammar, and spelling
Author's credential is offensive, spam, or impersonation
Ex. Illegal content, incomplete question...
Practice Tests
Vendor:
Exam Questions:
Learners
Last Updated
Language
Question