When you troubleshoot an SSL Decryption issue, which PAN-OS CL1 command do you use to check the details of the Forward Trust certificate. Forward Untrust certificate, and SSL Inbound Inspection certificate?

show system setting ssl-decrypt certificate

show system setting ssl-decrypt certs

debug dataplane show ssl-decrypt ssl-certs

show system setting ssl-decrypt certificate-cache

Which server platforms can be monitored when a company is deploying User-ID through server monitoring in an environment with diverse directory services?

Red Hat Linux, Microsoft Active Directory, and Microsoft Exchange

Red Hat Linux, Microsoft Exchange, and Microsoft Terminal Server

Novell eDirectory, Microsoft Terminal Server, and Microsoft Active Directory

Red Hat Linux, Microsoft Active Directory, and Microsoft Exchange

Novell eDirectory, Microsoft Exchange, and Microsoft Active Directory

Which two actions must an engineer take to configure SSL Forward Proxy decryption? (Choose two.)

Define a Forward Trust Certificate.

Configure SSL decryption rules.

Configure the decryption profile.

Define a Forward Trust Certificate.

Configure SSL decryption rules.

Configure a SSL/TLS service profile.

Which two items must be configured when implementing application override and allowing traffic through the firewall? (Choose two.)

Application override policy rule

A firewall engineer needs to update a company's Panorama-managed firewalls to the latest version of PAN-OS. Strict security requirements are blocking internet access to Panorama and to the firewalls. The PAN-OS images have previously been downloaded to a secure host on the network.Which path should the engineer follow to deploy the PAN-OS images to the firewalls?

Upload the image to Panorama > Device Deployment > Software menu, and deploy it to the firewalls.

Upload the image to Panorama > Software menu, and deploy it to the firewalls. *

Upload the image to Panorama > Device Deployment > Dynamic Updates menu, and deploy it to the firewalls. *

Upload the image to Panorama > Dynamic Updates menu, and deploy it to the firewalls.

Upload the image to Panorama > Device Deployment > Software menu, and deploy it to the firewalls.

Which function does the HA4 interface provide when implementing a firewall cluster which contains firewalls configured as active-passive pairs?

Perform synchronization of sessions, forwarding tables, and IPSec security associations between firewalls in an HA pair.

Perform packet forwarding to the active-passive peer during session setup and asymmetric traffic flow.

Perform synchronization of routes, IPSec security associations, and User-ID information.

Perform session cache synchronization for all HA cluster members with the same cluster ID.

Perform synchronization of sessions, forwarding tables, and IPSec security associations between firewalls in an HA pair.

An administrator has a Palo Alto Networks NGFW. All security subscriptions and decryption are enabled and the system is running close to its resource limits.Knowing that using decryption can be resource-intensive, how can the administrator reduce the load on the firewall?

Use ECDSA instead of RSA for traffic that isn't sensitive or high-priority.

Use RSA instead of ECDSA for traffic that isn't sensitive or high-priority.

Use the highest TLS protocol version to maximize security.

Use ECDSA instead of RSA for traffic that isn't sensitive or high-priority.

Use SSL Forward Proxy instead of SSL Inbound Inspection for decryption.

A security engineer wants to upgrade the company's deployed firewalls from PAN-OS 10.1 to 11.0.x to take advantage of the new TLSvl.3 support for management access.What is the recommended upgrade path procedure from PAN-OS 10.1 to 11.0.x?

Required: Download and install the latest preferred PAN-OS 10.1 maintenance release and reboot. Required: Download PAN-OS 10.2.0. Required: Download and install the latest preferred PAN-OS 10.2 maintenance release and reboot. Required: Download PAN-OS 11.0.0. Required: Download and install the desired PAN-OS 11.0.x.

Required: Download PAN-OS 10.2.0 or earlier release that is not EOL. Required: Download and install the latest preferred PAN-OS 10.2 maintenance release and reboot. Required: Download PAN-OS 11.0.0. Required: Download and install the desired PAN-OS 11.0.x.

Required: Download and install the latest preferred PAN-OS 10.1 maintenance release and reboot. Required: Download PAN-OS 10.2.0. Required: Download and install the latest preferred PAN-OS 10.2 maintenance release and reboot. Required: Download PAN-OS 11.0.0. Required: Download and install the desired PAN-OS 11.0.x.

Optional: Download and install the latest preferred PAN-OS 10.1 release. Optional: Install the latest preferred PAN-OS 10.2 maintenance release. Required: Download PAN-OS 11.0.0. Required: Download and install the desired PAN-OS 11.0.x.

Required: Download and install the latest preferred PAN-OS 10.1 maintenance release and reboot. Required: Download PAN-OS 10.2.0. Optional: Install the latest preferred PAN-OS 10.2 maintenance release. Required: Download PAN-OS 11.0.0. Required: Download and install the desired PAN-OS 11.0.x.

A firewall engineer has determined that, in an application developed by the company's internal team, sessions often remain idle for hours before the client and server exchange any data. The application is also currently identified as unknown-tcp by the firewalls. It is determined that because of a high level of trust, the application does not require to be scanned for threats, but it needs to be properly identified in Traffic logs for reporting purposes.Which solution will take the least time to implement and will ensure the App-ID engine is used to identify the application?

Create a custom application with specific timeouts, then create an application override rule and reference the custom application.

Create a custom application with specific timeouts and signatures based on patterns discovered in packet captures.

Access the Palo Alto Networks website and raise a support request through the Customer Support Portal.

Create a custom application with specific timeouts, then create an application override rule and reference the custom application.

Access the Palo Alto Networks website and complete the online form to request that a new application be added to App-ID.

What happens when the log forwarding built-in action with tagging is used?

Destination IP addresses of selected unwanted traffic are blocked. *

Selected logs are forwarded to the Azure Security Center.

Destination zones of selected unwanted traffic are blocked.

Selected unwanted traffic source zones are blocked.

A network security engineer needs to ensure that virtual systems can communicate with one another within a Palo Alto Networks firewall. Separate virtual routers (VRs) are created for each virtual system.In addition to confirming security policies, which three configuration details should the engineer focus on to ensure communication between virtual systems? {Choose three.)

External zones with the virtual systems added.

Add a route with next hop next-vr by using the VR configured in the virtual system.

Ensure the virtual systems are visible to one another.

External zones with the virtual systems added.

Layer 3 zones for the virtual systems that need to communicate.

Add a route with next hop set to none, and use the interface of the virtual systems that need to communicate.

Add a route with next hop next-vr by using the VR configured in the virtual system.

Ensure the virtual systems are visible to one another.

A company configures its WildFire analysis profile to forward any file type to the WildFire public cloud. A company employee receives an email containing an unknown link that downloads a malicious Portable Executable (PE) file.What does Advanced WildFire do when the link is clicked?

Does not perform malicious content analysis on the linked page, but performs it on the corresponding PE file.

Performs malicious content analysis on the linked page, but not the corresponding PE file.

Performs malicious content analysis on the linked page and the corresponding PE file.

Does not perform malicious content analysis on either the linked page or the corresponding PE file.

Does not perform malicious content analysis on the linked page, but performs it on the corresponding PE file.

A network administrator notices a false-positive state after enabling Security profiles. When the administrator checks the threat prevention logs, the related signature displays the following:threat type: spyware category: dns-c2 threat ID: 1000011111Which set of steps should the administrator take to configure an exception for this signature?

Navigate to Objects > Security Profiles > Anti-Spyware Select related profile Select DNS exceptions tabs Search related threat ID and click enable Commit

Navigate to Objects > Security Profiles > Vulnerability Protection Select related profile Select the signature exceptions tab and then click show all signatures Search related threat ID and click enable Change the default action Commit

Navigate to Objects > Security Profiles > Vulnerability Protection Select related profile Select the Exceptions lab and then click show all signatures Search related threat ID and click enable Commit

Navigate to Objects > Security Profiles > Anti-Spyware Select related profile Select the Exceptions lab and then click show all signatures Search related threat ID and click enable Commit

A firewall engineer is configuring quality of service (OoS) policy for the IP address of a specific server in an effort to limit the bandwidth consumed by frequent downloads of large files from the internet.Which combination of pre-NAT and / or post-NAT information should be used in the QoS rule?

Pre-NAT source IP address Pre-NAT source zone

Post-NAT source IP address Pre-NAT source zone

Post-NAT source IP address Post-NAT source zone

Pre-NAT source IP address Post-NAT source zone

Pre-NAT source IP address Pre-NAT source zone

A firewall engineer creates a source NAT rule to allow the company's internal private network 10.0.0.0/23 to access the internet. However, for security reasons, one server in that subnet (10.0.0.10/32) should not be allowed to access the internet, and therefore should not be translated with the NAT rule.Which set of steps should the engineer take to accomplish this objective?

1. Create a source NAT rule (NAT-Rule-1) to translate 10.0.0/23 with source address translation set to dynamic IP and port. 2. Create another NAT rule (NAT-Rule-2) with source IP address in the original packet set to 10.0.0.10/32 and source translation set to none. 3. Place (NAT-Rule-2) above (NAT-Rule-1).

1. Create a source NAT rule (NAT-Rule-1) to translate 10.0.0/23 with source address translation set to dynamic IP and port. 2. Create another NAT rule (NAT-Rule-2) with source IP address in the original packet set to 10.0.0.10/32 and source translation set to none. 3. Place (NAT-Rule-1) above (NAT-Rule-2).

1- Create a NAT rule (NAT-Rule-1) and set the source address in the original packet to 10.0.0.0/23. 2. Check the box for negate option to negate this IP subnet from NAT translation.

1. Create a source NAT rule (NAT-Rule-1) to translate 10.0.0/23 with source address translation set to dynamic IP and port. 2. Create another NAT rule (NAT-Rule-2) with source IP address in the original packet set to 10.0.0.10/32 and source translation set to none. 3. Place (NAT-Rule-2) above (NAT-Rule-1).

1. Create a NAT rule (NAT-Rule-1) and set the source address in the original packet to 10.0.0.10/32. 2. Check the box for negate option to negate this IP from the NAT translation.

Which rule type controls end user SSL traffic to external websites?

SSL Outbound Proxyless Inspection

A security team has enabled real-time WildFire signature lookup on all its firewalls. Which additional action will further reduce the likelihood of newly discovered malware being allowed through the firewalls?

Increase the frequency of the antivirus dynamic updates

increase the frequency of the applications and threats dynamic updates.

Increase the frequency of the antivirus dynamic updates

Enable the 'Hold Mode' option in Objects > Security Profiles > Antivirus.

Enable the 'Report Grayware Files' option in Device > Setup > WildFire.

A firewall administrator manages sets of firewalls which have two unique idle timeout values. Datacenter firewalls needs to be set to 20 minutes and BranchOffice firewalls need to be set to 30 minutes. How can the administrator assign these settings through the use of template stacks?

Create two separate template stacks one each for Datacenter and BranchOffice, and verify that Datacenter_template are at the top of their stack

Create one template stack and place the BranchOffice_Template in higher priority than Datacenter_Template.

Create one template stack and place the Datanceter_Template in higher priority than BranchOffice_template.

Create two separate template stacks one each for Datacenter and BranchOffice, and verify that Datacenter_Template and BranchOffice_template are at the bottom of their stack.

Create two separate template stacks one each for Datacenter and BranchOffice, and verify that Datacenter_template are at the top of their stack

Exhibit. Review the screenshots and consider the following information1. FW-1is assigned to the FW-1_DG device group, and FW-2 is assigned to OFFICE_FW_DC2. There are no objects configured in REGIONAL_DG and OFFICE_FW_DG device groupsWhich IP address will be pushed to the firewalls inside Address Object Server-1?

Server-1 on FW-1 will have IP 4.4.4.4. Server-1 on FW-2 will have IP 1.1.1.1

Server-1 on FW-1 will have IR 111.1. Server-1 will not be pushed to FW-2.

Server-1 on FW-1 will have IP 2.2.2.2. Server-1 will not be pushed to FW-2.

Server-1 on FW-1 will have IP 3.3.3.3. Server-1 will not be pushed to FW-2.

Refer to the exhibit.View the screenshots A QoS profile and policy rules are configured as shown. Based on this information which two statements are correct?

DNS has a higher priority and more bandwidth than SSH.

Facetime has a higher priority but lower bandwidth than Zoom.

SMTP has a higher priority but lower bandwidth than Zoom.

DNS has a higher priority and more bandwidth than SSH.

google-video has a higher priority and more bandwidth than WebEx.

Facetime has a higher priority but lower bandwidth than Zoom.

An administrator wants to use LDAP, TACACS+, and Kerberos as external authentication services for authenticating users. What should the administrator be aware of regarding the authentication sequence, based on the Authentication profile in the order Kerberos LDAP, and TACACS+?

The firewall evaluates the profiles in top-to-bottom order until one Authentication profile successfully authenticates the user.

The firewall evaluates the profiles in the alphabetical order the Authentication profiles have been named until one profile successfully authenticates the user.

The firewall evaluates the profiles in top-to-bottom order until one Authentication profile successfully authenticates the user.

The priority assigned to the Authentication profile defines the order of the sequence.

If the authentication times cut for the firs: Authentication profile in the authentication sequence, no further authentication attempts will be made.

A security engineer needs to mitigate packet floods that occur on a RSF servers behind the internet facing interface of the firewall. Which Security Profile should be applied to a policy to prevent these packet floods?

Vulnerability Protection profile

An administrator pushes a new configuration from Panorama to a par of firewalls that are configured as an active/passive HA pair. Which NGFW receives the from Panorama?

Both the active and passive firewalls independently, with no synchronization afterward

The active firewall which then synchronizes to the passive firewall

The passive firewall, which then synchronizes to the active firewall

Both the active and passive firewalls which then synchronize with each other

Both the active and passive firewalls independently, with no synchronization afterward

When backing up and saving configuration files, what is achieved using only the firewall and is not available in Panorama?

Load named configuration snapshot

An engineer is reviewing policies after a PAN-OS upgrade What are the two differences between Highlight Unused Rules and the Rule Usage Hit counters immediately after a reboot?

Highlight Unused Rules will highlight all rules.

Rule Usage Hit counter will not be reset

Highlight Unused Rules will highlight all rules.

Highlight Unused Rules will highlight zero rules.

Rule Usage Hit counter will not be reset

Rule Usage Hit counter will reset

An administrator needs to gather information about the CPU utilization on both the management plane and the data plane. Where does the administrator view the desired data?

Resources Widget on the Dashboard

Application Command and Control Center

Resources Widget on the Dashboard

Which are valid ACC GlobalProtect Activity tab widgets? (Choose two.)

GlobalProtect Deployment Activity

Successful GlobalProtect Connection Activity

Successful GlobalProtect Deployed Activity

GlobalProtect Deployment Activity

GlobalProtect Quarantine Activity

Successful GlobalProtect Connection Activity

What are three prerequisites for credential phishing prevention to function? (Choose three.)

In the URL filtering profile, use the drop-down list to enable user credential detection.

Add the URL filtering profile to one or more Security policy rules.

Set phishing category to block in the URL Filtering profile.

In the URL filtering profile, use the drop-down list to enable user credential detection.

Select the action for Site Access for each category.

Add the URL filtering profile to one or more Security policy rules.

Set phishing category to block in the URL Filtering profile.

An engineer is tasked with decrypting web traffic in an environment without an established PKI When using a self-signed certificate generated on the firewall which type of certificate should be in? approved web traffic?

The same certificate as the Forward Trust certificate

An Enterprise Root CA certificate

The same certificate as the Forward Trust certificate

The same certificate as the Forward Untrust certificate

A network security engineer is going to enable Zone Protection on several security zones How can the engineer ensure that Zone Protection events appear in the firewall's logs?

Select the check box 'Log packet-based attack events' in the Zone Protection profile

No action is needed Zone Protection events appear in the threat logs by default

Select the check box 'Log Zone Protection events' in the Content-ID settings of the firewall

Access the CLI in each firewall and enter the command set system setting additional-threat-log on

Palo Alto Networks PCNSE Practice Test 10 - Free Online Exam Questions 361-400

A firewall administrator needs to check which egress interface the firewall will use to route the IP 10.2.5.3.

Which command should they use?

Become a Premium Member for full access

Unlock Premium Member

Palo Alto Networks PCNSE Practice Test 10

Question

Palo Alto Networks PCNSE Practice Tests

Practice Tests