ExamGecko
Login
Ask Question

PCNSE: Palo Alto Networks Certified Network Security Engineer

Vendor:
Exam Questions:
470
 Learners
  2.370
Last Updated
February - 2025
Language
English
12 Quizzes
PDF | VPLUS
This study guide should help you understand what to expect on the exam and includes a summary of the topics the exam might cover and links to additional resources. The information and materials in this document should help you focus your studies as you prepare for the exam.

Related questions

Question 1

Report Export Collapse

Before an administrator of a VM-500 can enable DoS and zone protection, what actions need to be taken?

Measure and monitor the CPU consumption of the firewall data plane to ensure that each firewall is properly sized to support DoS and zone protection
Measure and monitor the CPU consumption of the firewall data plane to ensure that each firewall is properly sized to support DoS and zone protection
Create a zone protection profile with flood protection configured to defend an entire egress zone against SYN. ICMP ICMPv6, UDP. and other IP flood attacks
Create a zone protection profile with flood protection configured to defend an entire egress zone against SYN. ICMP ICMPv6, UDP. and other IP flood attacks
Add a WildFire subscription to activate DoS and zone protection features
Add a WildFire subscription to activate DoS and zone protection features
Replace the hardware firewall because DoS and zone protection are not available with VM-Series systems
Replace the hardware firewall because DoS and zone protection are not available with VM-Series systems
Suggested answer: A
Explanation:

1 - https://docs.paloaltonetworks.com/best-practices/8-1/dos-and-zone-protection-best-practices/dos-and-zone-protection-best-practices/deploy-dos-and-zone-protection-using-bestpractices.html#:~:text=DoS%20and%20Zone%20Protection%20help,device%20at%20the%20internet%20perimeter.

2 - https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/zone-protection-and-dosprotection/zone-defense/take-baseline-cps-measurements-for-setting-flood-thresholds/how-to-measure-cps.html

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/zone-protection-and-dosprotection.html

asked 23/09/2024
Federico Miliacca
33 questions

Question 2

Report Export Collapse

Phase two of a VPN will not establish a connection. The peer is using a policy-based VPN configuration. What part of the configuration should the engineer verify'?

PAN-OS versions
PAN-OS versions
Proxy-IDs
Proxy-IDs
IKE Crypto Profile
IKE Crypto Profile
Security policy
Security policy
Suggested answer: B
Explanation:

Proxy-ID is a parameter that identifies the traffic that needs to be encrypted and tunneled in an IPSec VPN. Proxy-ID consists of the local and remote IP addresses, protocols, and ports. Proxy-ID is used when the peer is using a policy-based VPN configuration, which allows specifying the Proxy-ID settings manually. If the Proxy-ID settings do not match on both peers, the phase two of the VPN will not establish a connection. Therefore, the correct answer is B.

The other options are not parts of the configuration that the engineer should verify for phase two of a VPN:

PAN-OS versions: This option is not relevant for phase two of a VPN. PAN-OS versions are the software versions that run on Palo Alto Networks firewalls. They do not affect the VPN connection establishment, as long as they support the same VPN features and protocols2.

IKE Crypto Profile: This option is not relevant for phase two of a VPN. IKE Crypto Profile is a parameter that defines the encryption and authentication algorithms for IKE negotiation. IKE negotiation is part of phase one of the VPN, not phase two3.

Security policy: This option is not relevant for phase two of a VPN. Security policy is a rule that allows or denies traffic based on various criteria, such as source, destination, application, user, and service. Security policy does not affect the VPN connection establishment, but only the traffic that passes through the VPN tunnel4.

Reference: 1: https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/vpn/site-to-sitevpn/set-up-a-site-to-site-vpn-between-two-firewalls/policy-based-vpn 2:

https://docs.paloaltonetworks.com/pan-os.html 3:

https://docs.paloaltonetworks.com/pan-os/91/pan-os-admin/vpn/site-to-site-vpn-concepts/internet-key-exchange-ike-for-vpn/methods-ofsecuring-ipsec-vpn-tunnels-ike-phase-2 4:

https://docs.paloaltonetworks.com/pan-os/9-1/pan-osadmin/policy/security-policy.html

asked 23/09/2024
Wissem M'RAD
37 questions

Question 3

Report Export Collapse

During the process of developing a decryption strategy and evaluating which websites are required for corporate users to access, several sites have been identified that cannot be decrypted due to technical reasons. In this case, the technical reason is unsupported ciphers. Traffic to these sites will therefore be blocked if decrypted How should the engineer proceed?

Allow the firewall to block the sites to improve the security posture
Allow the firewall to block the sites to improve the security posture
Add the sites to the SSL Decryption Exclusion list to exempt them from decryption
Add the sites to the SSL Decryption Exclusion list to exempt them from decryption
Install the unsupported cipher into the firewall to allow the sites to be decrypted
Install the unsupported cipher into the firewall to allow the sites to be decrypted
Create a Security policy to allow access to those sites
Create a Security policy to allow access to those sites
Suggested answer: B
Explanation:

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/decryption/decryption-exclusions Traffic that breaks decryption for technical reasons, such as using a pinned certificate, an incomplete certificate chain, unsupported ciphers, or mutual authentication (attempting to decrypt the traffic results in blocking the traffic). Palo Alto Networks provides a predefined SSL Decryption Exclusion list (DeviceCertificate ManagementSSL Decryption Exclusion) that excludes hosts with applications and services that are known to break decryption technically from SSL Decryption by default. If you encounter sites that break decryption technically and are not on the SSL Decryption Exclusion list, you can add them to list manually by server hostname. The firewall blocks sites whose applications and services break decryption technically unless you add them to the SSL Decryption Exclusion list.

asked 23/09/2024
Gerhard Seher
28 questions

Question 4

Report Export Collapse

If a URL is in multiple custom URL categories with different actions, which action will take priority?

Become a Premium Member for full access
  Unlock Premium Member

Question 5

Report Export Collapse

What is a correct statement regarding administrative authentication using external services with a local authorization method?

Prior to PAN-OS 10.2. an administrator used the firewall to manage role assignments, but access domains have not been supported by this method.
Prior to PAN-OS 10.2. an administrator used the firewall to manage role assignments, but access domains have not been supported by this method.
Starting with PAN-OS 10.2. an administrator needs to configure Cloud Identity Engine to use external authentication services for administrative authentication.
Starting with PAN-OS 10.2. an administrator needs to configure Cloud Identity Engine to use external authentication services for administrative authentication.
The administrative accounts you define locally on the firewall serve as references to the accounts defined on an external authentication server.
The administrative accounts you define locally on the firewall serve as references to the accounts defined on an external authentication server.
The administrative accounts you define on an external authentication server serve as references to the accounts defined locally on the firewall.
The administrative accounts you define on an external authentication server serve as references to the accounts defined locally on the firewall.
Suggested answer: C
Explanation:

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/firewall-administration/manage- firewall-administrators/administrative-authentication

asked 23/09/2024
shridhar deshpande
40 questions

Question 6

Report Export Collapse

You are auditing the work of a co-worker and need to verify that they have matched the Palo Alto Networks Best Practices for Anti-Spyware Profiles.

For which three severity levels should single-packet captures be enabled to meet the Best Practice standard? (Choose three.)

Become a Premium Member for full access
  Unlock Premium Member

Question 7

Report Export Collapse

An administrator configures a site-to-site IPsec VPN tunnel between a PA-850 and an external customer on their policy-based VPN devices.

What should an administrator configure to route interesting traffic through the VPN tunnel?

Become a Premium Member for full access
  Unlock Premium Member

Question 8

Report Export Collapse

A company requires that a specific set of ciphers be used when remotely managing their Palo Alto Networks appliances. Which profile should be configured in order to achieve this?

SSH Service profile
SSH Service profile
SSL/TLS Service profile
SSL/TLS Service profile
Decryption profile
Decryption profile
Certificate profile
Certificate profile
Suggested answer: A
Explanation:

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/certificate-management/configure- an-ssh-service-profile

asked 23/09/2024
javier mungaray
34 questions

Question 9

Report Export Collapse

When you navigate to Network: > GlobalProtect > Portals > Method section, which three options are available? (Choose three )

user-logon (always on)
user-logon (always on)
pre-logon then on-demand
pre-logon then on-demand
on-demand (manual user initiated connection)
on-demand (manual user initiated connection)
post-logon (always on)
post-logon (always on)
certificate-logon
certificate-logon
Suggested answer: A, B, C
Explanation:

The Method section of the GlobalProtect portal configuration allows you to specify how users connect to the portal. The options are: user-logon (always on): The agent connects to the portal as soon as the user logs in to the endpoint. pre-logon then on-demand: The agent connects to the portal before the user logs in to the endpoint and then switches to on-demand mode after the user logs in. on-demand (manual user initiated connection): The agent connects to the portal only when the user initiates the connection manually. Reference: https://docs.paloaltonetworks.com/pan-os/10-1/pan- os-admin/globalprotect/configure-the-globalprotect-portal/configure-the-agent/configure-the-app- tab.html

asked 23/09/2024
Jeremiah Gem Galeon
43 questions

Question 10

Report Export Collapse

When you import the configuration of an HA pair into Panorama, how do you prevent the import from affecting ongoing traffic?

Become a Premium Member for full access
  Unlock Premium Member