A network administrator wants to use a certificate for the SSL/TLS Service Profile.Which type of certificate should the administrator use?

certificate authority (CA) certificate

Using multiple templates in a stack to manage many firewalls provides which two advantages?(Choose two.)

define a common standard template configuration for firewalls

standardize server profiles and authentication configuration across all stacks

inherit address-objects from templates

define a common standard template configuration for firewalls

standardize server profiles and authentication configuration across all stacks

standardize log-forwarding profiles for security polices across all stacks

A network security engineer is attempting to peer a virtual router on a PAN-OS firewall with an external router using the BGP protocol. The peer relationship is not establishing.What command could the engineer run to see the current state of the BGP state between the two devices?

show routing protocol bgp summary

show routing protocol bgp state

show routing protocol bgp summary

show routing protocol bgp rib-out

A network security engineer must implement Quality of Service policies to ensure specific levels of delivery guarantees for various applications in the environment They want to ensure that they know as much as they can about QoS before deploying.Which statement about the QoS feature is correct?

QoS can be used on firewalls with multiple virtual systems configured

QoS is only supported on firewalls that have a single virtual system configured

QoS can be used in conjunction with SSL decryption

QoS is only supported on hardware firewalls

QoS can be used on firewalls with multiple virtual systems configured

Which statement regarding HA timer settings is true?

Use the Recommended profile for typical failover timer settings

Use the Moderate profile for typical failover timer settings

Use the Aggressive profile for slower failover timer settings.

Use the Critical profile for faster failover timer settings.

When you navigate to Network: > GlobalProtect > Portals > Method section, which three options are available? (Choose three )

on-demand (manual user initiated connection)

An engineer must configure the Decryption Broker featureWhich Decryption Broker security chain supports bi-directional traffic flow?

Transparent Bridge security chain

Transparent Proxy security chain

What is the best description of the HA4 Keep-Alive Threshold (ms)?

the timeframe within which the firewall must receive keepalives from a cluster member to know that the cluster member is functional.

the maximum interval between hello packets that are sent to verify that the HA functionality on the other firewall is operational.

The time that a passive or active-secondary firewall will wait before taking over as the active or active-primary firewall

the timeframe within which the firewall must receive keepalives from a cluster member to know that the cluster member is functional.

The timeframe that the local firewall wait before going to Active state when another cluster member is preventing the cluster from fully synchronizing.

What happens when an A/P firewall cluster synchronies IPsec tunnel security associations (SAs)?

Phase 2 SAs are synchronized over HA2 links

Phase 1 and Phase 2 SAs are synchronized over HA2 links

Phase 1 SAs are synchronized over HA1 links

Phase 1 and Phase 2 SAs are synchronized over HA3 links

A standalone firewall with local objects and policies needs to be migrated into Panoram a. What procedure should you use so Panorama is fully managing the firewall?

Use the "import device configuration to Panorama" operation, then "export or push device config bundle" to push the configuration

Use the "import Panorama configuration snapshot" operation, then perform a device-group commit push with "include device and network templates"

Use the "import device configuration to Panorama" operation, then "export or push device config bundle" to push the configuration

Use the "import Panorama configuration snapshot" operation, then "export or push device config bundle" to push the configuration

Use the "import device configuration to Panorama" operation, then perform a device-group commit push with "include device and network templates"

Before you upgrade a Palo Alto Networks NGFW, what must you do?

Make sure that the firewall is running a supported version of the app + threat update

Make sure that the PAN-OS support contract is valid for at least another year

Export a device state of the firewall

Make sure that the firewall is running a version of antivirus software and a version of WildFire that support the licensed subscriptions.

Make sure that the firewall is running a supported version of the app + threat update

A remote administrator needs firewall access on an untrusted interface. Which two components are required on the firewall to configure certificate-based administrator authentication to the web Ul?(Choose two)

certificate authority (CA) certificate

When planning to configure SSL Froward Proxy on a PA 5260, a user asks how SSL decryption can be implemented using phased approach in alignment with Palo Alto Networks best practices What should you recommend?

Enable SSL decryption for source users and known malicious URL categories

Enable SSL decryption for known malicious source IP addresses

Enable SSL decryption for source users and known malicious URL categories

Enable SSL decryption for malicious source users

Enable SSL decryption for known malicious destination IP addresses

What would allow a network security administrator to authenticate and identify a user with a new BYOD-type device that is not joined to the corporate domain'?

an Authentication policy with 'unknown' selected in the Source User field

a Security policy with 'known-user" selected in the Source User field

an Authentication policy with 'unknown' selected in the Source User field

a Security policy with 'unknown' selected in the Source User field

an Authentication policy with 'known-user' selected in the Source User field

What are two common reasons to use a "No Decrypt" action to exclude traffic from SSL decryption?(Choose two.)

the web server requires mutual authentication

the website matches a sensitive category

the website matches a category that is not allowed for most users

the website matches a high-risk category

the web server requires mutual authentication

the website matches a sensitive category

An administrator has a PA-820 firewall with an active Threat Prevention subscription The administrator is considering adding a WildFire subscription.How does adding the WildFire subscription improve the security posture of the organization1?

Protection against unknown malware can be provided in near real-time

WildFire and Threat Prevention combine to provide the utmost security posture for the firewall

After 24 hours WildFire signatures are included in the antivirus update

WildFire and Threat Prevention combine to minimize the attack surface

What are two valid deployment options for Decryption Broker? (Choose two)

Transparent Bridge Security Chain

Transparent Mirror Security Chain

An administrator needs to assign a specific DNS server to one firewall within a device group. Where would the administrator go to edit a template variable at the device level?

Manage variables under Panorama > templates

Variable CSV export under Panorama > templates

PDF Export under Panorama > templates

Manage variables under Panorama > templates

Managed Devices > Device Association

An administrator is using Panorama to manage me and suspects an IKE Crypto mismatch between peers, from the firewalls to Panoram a. However, pre-existing logs from the firewalls are not appearing in Panorama.Which action should be taken to enable the firewalls to send their pre-existing logs to Panorama?

Use the import option to pull logs.

Use the ACC to consolidate the logs.

Use the scp logdb export command.

A firewall administrator is trying to identify active routes learned via BGP in the virtual router runtime stats within the GUI. Where can they find this information?

routes listed in the routing table with flags A?B

routes listed in the routing table with flags Oi

routes listed in the routing table with flags A?B

routes listed in the forwarding table with BGP in the Protocol column

A bootstrap USB flash drive has been prepared using a Windows workstation to load the initial configuration of a Palo Alto Networks firewall that was previously being used in a lab. The USB flash drive was formatted using file system FAT32 and the initial configuration is stored in a file named initcfg txt. The firewall is currently running PAN-OS 10.0 and using a lab config The contents of init-cfg txi in the USB flash drive are as follows: The USB flash drive has been inserted in the firewalls' USB port, and the firewall has been restarted using command:> request resort system Upon restart, the firewall fails to begin the bootstrapping process. The failure is caused because

The USB must be formatted using the ext3 file system, FAT32 is not supported

Firewall must be in factory default state or have all private data deleted for bootstrapping

The hostname is a required parameter, but it is missing in init-cfg txt

The USB must be formatted using the ext3 file system, FAT32 is not supported

PANOS version must be 91.x at a minimum but the firewall is running 10.0.x

The bootstrap.xml file is a required file but it is missing

A network security engineer wants to prevent resource-consumption issues on the firewall.Which strategy is consistent with decryption best practices to ensure consistent performance?

Use Decryption profiles to downgrade processor-intensive ciphers to ciphers that are less processor-intensive

Use RSA in a Decryption profile tor higher-priority and higher-risk traffic, and use less processorintensive decryption methods for lower-risk traffic

Use PFS in a Decryption profile for higher-priority and higher-risk traffic, and use less processorintensive decryption methods for tower-risk traffic

Use Decryption profiles to downgrade processor-intensive ciphers to ciphers that are less processor-intensive

Use Decryption profiles to drop traffic that uses processor-intensive ciphers

An engineer is in the planning stages of deploying User-ID in a diverse directory services environment.Which server OS platforms can be used for server monitoring with User-ID?

Microsoft Exchange, Microsoft Active Directory, and Novell eDirectory

Microsoft Terminal Server, Red Hat Linux, and Microsoft Active Directory

Microsoft Active Directory, Red Hat Linux, and Microsoft Exchange

Microsoft Exchange, Microsoft Active Directory, and Novell eDirectory

Novell eDirectory, Microsoft Terminal Server, and Microsoft Active Directory

What are three reasons for excluding a site from SSL decryption? (Choose three.)

the website is not present in English

An administrator device-group commit push is tailing due to a new URL category How should the administrator correct this issue?

update the Firewall Apps and Threat version to match the version of Panorama

verify that the URL seed Tile has been downloaded and activated on the firewall

change the new category action to alert" and push the configuration again

update the Firewall Apps and Threat version to match the version of Panorama

ensure that the firewall can communicate with the URL cloud

The manager of the network security team has asked you to help configure the company's Security Profiles according to Palo Alto Networks best practice As part of that effort, the manager has assigned you the Vulnerability Protection profile for the internet gateway firewall.Which action and packet-capture setting for items of high severity and critical severity best matches Palo Alto Networks best practice?

action 'reset-both' and packet capture 'single-packet'

action 'reset-both' and packet capture 'extended-capture'

action 'default' and packet capture 'single-packet'

action 'reset-both' and packet capture 'single-packet'

action 'reset-server' and packet capture 'disable'

The following objects and policies are defined in a device group hierarchy

Address Objects-Shared Address 1-Branch Address2 Policies-Shared Polic1 l-Branch Policy1

Address Objects -Shared Addressl -Shared Address2 -Branch Addressl Policies -Shared Policyl -Shared Policy2 -Branch Policy1

An administrator is attempting to create policies tor deployment of a device group and template stack. When creating the policies, the zone drop down list does not include the required zone.What must the administrator do to correct this issue?

Add the template as a reference template in the device group

Specify the target device as the master device in the device group

Enable "Share Unused Address and Service Objects with Devices" in Panorama settings

Add the template as a reference template in the device group

Add a firewall to both the device group and the template

An existing NGFW customer requires direct interne! access offload locally at each site and iPSec connectivity to all branches over public internet. One requirement is mat no new SD-WAN hardware be introduced to the environment.What is the best solution for the customer?

Upgrade to a PAN-OS SD-WAN subscription

Configure a remote network on PAN-OS

Upgrade to a PAN-OS SD-WAN subscription

Deploy Prisma SD-WAN with Prisma Access

Configure policy-based forwarding

Palo Alto Networks PCNSE Practice Test 1 - Free Online Exam Prep & Questions

Spam

Selling illegal goods, money scams etc.

Hate Speech

Serious attack on a group.

Harassment and bullying

Harassing an individual (including doxing)

Harmful activities

Threatening or glorifying violence or serious harm, including self-harm

Adult content (Consensual)

Nudity/Sexual content

Sexual exploitation and abuse (child safety)

Sexually explicit or suggestive imagery or writing involving minors

Sexual exploitation and abuse (adults and animals)

Sexually explicit or suggestive imagery or writing involving non-consenting adults or non-humans

Plagiarism

Reusing content without attribution (link and blockquotes)

Poorly written

Not in English or has very bad formatting, grammar, and spelling

Inappropriate credential

Author's credential is offensive, spam, or impersonation

Other

Ex. Illegal content, incomplete question...

Palo Alto Networks PCNSE Practice Test 1

Question

Palo Alto Networks PCNSE Practice Tests

Practice Tests