All firewall at a company are currently forwarding logs to Palo Alto Networks log collectors. The company also wants to deploy a sylog server and forward all firewall logs to the syslog server and to the log collectors. There is known logging peak time during the day, and the security team has asked the firewall engineer to determined how many logs per second the current Palo Alto Networking log processing at that particular time. Which method is the most time-efficient to complete this task?

Navigate to Panorama > Managed Collectors, and open the Statistics windows for each Log Collector during the peak time.

Navigate to Monitor > Unified logs, set the filter to the peak time, and browse to the last page to find out how many logs have been received.

Navigate to Panorama> Managed Devices> Health, open the Logging tab for each managed firewall and check the log rates during the peak time.

Navigate to ACC> Network Activity, and determine the total number of sessions and threats during the peak time.

All firewall at a company are currently forwarding logs to Palo Alto Networks log collectors. The company also wants to deploy a sylog server and forward all firewall logs to the syslog server and to the log collectors. There is known logging peak time during the day, and the security team has asked the firewall engineer to determined how many logs per second the current Palo Alto Networking log processing at that particular time. Which method is the most time-efficient to complete this task?

Navigate to Panorama > Managed Collectors, and open the Statistics windows for each Log Collector during the peak time.

Navigate to Monitor > Unified logs, set the filter to the peak time, and browse to the last page to find out how many logs have been received.

Navigate to Panorama> Managed Devices> Health, open the Logging tab for each managed firewall and check the log rates during the peak time.

Navigate to ACC> Network Activity, and determine the total number of sessions and threats during the peak time.

An administrator is assisting a security engineering team with a decryption rollout for inbound and forward proxy traffic. Incorrect firewall sizing is preventing the team from decrypting all of the traffic they want to decrypt. Which three items should be prioritized for decryption? (Choose three.)

Financial, health, and government traffic categories

Less-trusted internal IP subnets

A firewall administrator wants to be able at to see all NAT sessions that are going 'through a firewall with source NAT. Which CLI command can the administrator use?

show session all filter nat source

show session all filter nat-rule-source

show running nat-rule-ippool rule 'rule_name

show session all filter nat source

Following a review of firewall logs for traffic generated by malicious activity, how can an administrator confirm that WildFire has identified a virus?

By navigating to Monitor > Logs > WildFire Submissions, applying filter '(subtype eq wildfire-virus)'

By navigating to Monitor > Logs > Threat, applying filter '(subtype eq wildfire-virus)'

By navigating to Monitor > Logs > Traffic, applying filter '(subtype eq virus)'

By navigating to Monitor > Logs> Threat, applying filter '(subtype eq virus)'

A customer wants to deploy User-ID on a Palo Alto Network NGFW with multiple vsys. One of the vsys will support a GlobalProtect portal and gateway. the customer uses Windows

Deploy the GlobalProtect as a lee data hub.

Deploy Window User 0 agents on each domain controller.

Deploys AILS integrated Use 10 agent on each vsys.

Deploy a M.200 as a Users-ID collector.

The server team is concerned about the high volume of logs forwarded to their syslog server, it is determined that DNS is generating the most logs per second. The risk and compliance team requests that any Traffic logs indicating port abuse of port 53 must still be forwarded to syslog. All other DNS. Traffic logs can be exclude from syslog forwarding. How should syslog log forwarding be configured?

With '(port dst neq 53)' Traffic log filter inside Device > log Settings.

With (port,dst neq 53)' Traffic log filter Object > Log Forwarding.

With '(port dst neq 53)' Traffic log filter inside Device > log Settings.

With '(app neq dns-base)'' Traffic log filter inside Device> Log Settings.

With '(app neq dns-base)'' Traffic log filter inside Objects> Log Forwarding

An administrator needs to assign a specific DNS server to an existing template variable. Where would the administrator go to edit a template variable at the device level?

Manage variables under 'Panorama > Templates'

'Managed Devices > Device Association'

PDF Export under 'Panorama > Templates'

Variable CSV export under 'Panorama > Templates'

Manage variables under 'Panorama > Templates'

A firewall administrator is configuring an IPSec tunnel between a company's HQ and a remote location. On the HQ firewall, the interface used to terminate the IPSec tunnel has a static IP. At the remote location, the interface used to terminate the IPSec tunnel has a DHCP assigned IP address.Which two actions are required for this scenario to work? (Choose two.)

On the HQ firewall select peer IP address type FQDN

On the HQ firewall enable DDNS under the interface used for the IPSec tunnel

On the HQ firewall select peer IP address type FQDN

On the remote location firewall select peer IP address type Dynamic

On the HQ firewall enable DDNS under the interface used for the IPSec tunnel

On the remote location firewall enable DONS under the interface used for the IPSec tunnel

A company wants to deploy IPv6 on its network which requires that all company Palo Alto Networks firewalls process IPv6 traffic and to be configured with IPv6 addresses. Which consideration should the engineers take into account when planning to enable IPv6?

Device > Setup Settings Enable on each interface

Device > Setup Settings Do not enable on each interface

Network > Zone Settings Do not enable on each interface

Network > Zone Settings Enable on each interface

Device > Setup Settings Enable on each interface

Which conditions must be met when provisioning a high availability (HA) cluster? (Choose two.)

Dedicated HA communication interfaces for the cluster must be used over HSCI interfaces

HA cluster members must be the same firewall model and run the same PAN-OS version.

HA cluster members must share the same zone names.

Dedicated HA communication interfaces for the cluster must be used over HSCI interfaces

Panorama must be used to manage HA cluster members.

HA cluster members must be the same firewall model and run the same PAN-OS version.

A firewall administrator has confirm reports of a website is not displaying as expected, and wants to ensure that decryption is not causing the issue. Which three methods can the administrator use to determine if decryption is causing the website to fail? (Choose three.)

Investigate decryption logs of the specific traffic to determine reasons for failure.

Temporarily disable SSL decryption for all websites to troubleshoot the issue

Create a policy-based 'No Decrypt' rule in the decryption policy to include specific traffic from decryption.

Investigate decryption logs of the specific traffic to determine reasons for failure.

Temporarily disable SSL decryption for all websites to troubleshoot the issue

Create a policy-based 'No Decrypt' rule in the decryption policy to include specific traffic from decryption.

Move the policy with action decrypt to the top of the decryption policy rulebase.

An internal audit team has requested additional information to be included inside traffic logs forwarded from Palo Alto Networks firewalls to an interal syslog server. Where can the firewall engineer define the data to be added into each forwarded log?

Custom Log Format within Device Server Profiles> Syslog

Data Patterns within Objects > Custom Objects

Custom Log Format within Device Server Profiles> Syslog

Built-in Actions within Objects > Log Forwarding Profile

Logging and Reporting Settings within Device > Setup > Management

A threat intelligence team has requested more than a dozen Short signatures to be deployed on all perimeter Palo Alto Networks firewalls. How does the firewall engineer fulfill this request with the least time to implement?

Use Panorama IPs Signature Converter to create custom vulnerability signatures, and push them to the firewalls.

Use Expedition to create custom vulnerability signatures, deploy them to Panorama using API and push them to the firewalls.

Create custom vulnerability signatures manually on one firewall export them, and then import them to the rest of the firewalls

Use Panorama IPs Signature Converter to create custom vulnerability signatures, and push them to the firewalls.

Create custom vulnerability signatures manually in Panorama, and push them to the firewalls

A firewall administrator is changing a packet capture filter to troubleshoot a specific traffic flow Upon opening the newly created packet capture, the administrator still sees traffic for the previous fitter What can the administrator do to limit the captured traffic to the newly configured filter?

Command line> debug dataplane packet-diag clear filter all

Command line > debug dataplane packet-diag clear filter-marked-session all

In the GLH under Monitor > Packet Capture > Manage Filters under Ingress Interface select an interface

Command line> debug dataplane packet-diag clear filter all

In the GUI under Monitor > Packet Capture > Manage Filters under the Non-IP field, select 'exclude'

An administrator is informed that the engineer who previously managed all the VPNs has left the company. According to company policies the administrator must update all the IPSec VPNs with new pre-shared keys Where are the pre-shared keys located on the firewall?

Network/Network Profiles/IKE Gateways

Network/Network ProfilesTlPSec Crypto

Network/Network Profiles/IKE Crypto

A firewall engineer needs to patch the company's Palo Alto Network firewalls to the latest version of PAN-OS. The company manages its firewalls by using panorama. Logs are forwarded to Dedicated Log Collectors, and file samples are forwarded to WildFire appliances for analysis. What must the engineer consider when planning deployment?

Panorama, Dedicated Log Collectors and WildFire appliances must be patched to the target PAN-OS version before updating the firewalls.

Only Panorama and Dedicated Log Collectorss must be patched to the target PAN-OS version before updating the firewalls

Panorama, Dedicated Log Collectors and WildFire appliances must be patched to the target PAN-OS version before updating the firewalls.

Panorama, Dedicated Log Collectors and WildFire appliances must have the target PAN-OS version downloaded, after which the order of patching does not matter.

Only Panorama must be patched to the PAN-OS version before updating the firewalls

What are three prerequisites to enable Credential Phishing Prevention over SSL? (Choose three

Create a decryption policy rule.

Configure a URL profile to block the phishing category.

Create a decryption policy rule.

A new application server 192.168.197.40 has been deployed in the DMZ. There are no public IP addresses available resulting in the server sharing MAT IP 198 51 100 B8 with another OMZ serve that uses IP address 192 168 19? 60 Firewall security and NAT rules have been configured The application team has confirmed mat the new server is able to establish a secure connection to an external database with IP address 203.0.113.40. The database team reports that they are unable to establish a secure connection to 196 51 100 88 from 203.0.113.40 However it confirm a successful prig test to 198 51 100 88 Referring to the MAT configuration and traffic logs provided how can the firewall engineer resolve the situation and ensure inbound and outbound connections work concurrently for both DMZ servers?

Configure separate source NAT and destination NAT rules for the two DMZ servers without using the bidirectional option.

Replace the two NAT rules with a single rule that has both DMZ servers as 'Source Address.' both external servers as 'Destination Address.' and Source Translation remaining as is with bidirectional option enabled

Sharing a single NAT IP is possible for outbound connectivity not for inbound, therefore, a new public IP address must be obtained for the new DMZ server and used in the NAT rule 6 DMZ server 2.

Configure separate source NAT and destination NAT rules for the two DMZ servers without using the bidirectional option.

Move the NAT rule 6 DMZ server 2 above NAT rule 5 DMZ server 1.

Which statement accurately describes how web proxy is run on a firewall with multiple virtual systems?

It can run on a single virtual system and multiple virtual systems.

It can run on multiple virtual systems without issue.

It can run only on a single virtual system.

It can run only on a virtual system with an alias named 'web proxy.

A company wants to use GlobalProtect as its remote access VPN solution.Which GlobalProtect features require a Gateway license?

Single or multiple internal gateways

An administrator is troubleshooting application traffic that has a valid business use case, and observes the following decryption log message: 'Received fatal alert UnknownCA from client.'How should the administrator remediate this issue?

Add the server's hostname to the SSL Decryption Exclusion List to allow traffic without decryption.

Contact the site administrator with the expired certificate to request updates or renewal.

Enable certificate revocation checking to deny access to sites with revoked certificates.

Add the server's hostname to the SSL Decryption Exclusion List to allow traffic without decryption.

Check for expired certificates and take appropriate actions to block or allow access based on business needs.

After configuring an IPSec tunnel, how should a firewall administrator initiate the IKE phase 1 to see if it will come up?

test vpn ike-sa gateway <gateway_name>

test vpn ipsec-sa tunnel <tunnel_name>

show vpn ipsec-sa tunnel <tunnel_name>

test vpn ike-sa gateway <gateway_name>

While troubleshooting an issue, a firewall administrator performs a packet capture with a specific filter. The administrator sees drops for packets with a source IP address of 10.1.1.1.How can the administrator further investigate these packet drops by looking at the global counters for this packet capture filter?

> show counter global filter packet-filter yes delta yes

> show counter global filter severity drop

> debug dataplane packet-diag set capture stage drop

> show counter global filter delta yes I match 10.1.1.1

An engineer configures a destination NAT policy to allow inbound access to an internal server in the DMZ. The NAT policy is configured with the following values:- Source zone: Outside and source IP address 1.2.2.2- Destination zone: Outside and destination IP address 2.2.2.1The destination NAT policy translates IP address 2.2.2.1 to the real IP address 10.10.10.1 in the DMZ zone.Which destination IP address and zone should the engineer use to configure the security policy?

Destination Zone DMZ, Destination IP address 2.2.2.1

Destination Zone Outside. Destination IP address 2.2.2.1

Destination Zone DMZ, Destination IP address 10.10.10.1

Destination Zone DMZ, Destination IP address 2.2.2.1

Destination Zone Outside. Destination IP address 10.10.10.1

When configuring explicit proxy on a firewall, which interface should be selected under the Listening interface option?

ingress for the outgoing traffic to the internet

Which three sessions are created by a NGFW for web proxy? (Choose three.)

A session for DNS proxy to DNS servers

A session for proxy to web server

A session for DNS proxy to DNS servers

A session for proxy to web server

A session for proxy to authentication server

A session for web server to client

A firewall engineer at a company is researching the Device Telemetry feature of PAN-OS. Which two aspects of the feature require further action for the company to remain compliant with local laws regarding privacy and data storage? (Choose two.)

Telemetry feature is automatically enabled during PAN-OS installation.

Telemetry feature is using Traffic logs and packet captures to collect data.

Telemetry feature is automatically enabled during PAN-OS installation.

Telemetry data is uploaded into Strata Logging Service.

Telemetry feature is using Traffic logs and packet captures to collect data.

Telemetry data is shared in real time with Palo Alto Networks.

In which two scenarios would it be necessary to use Proxy IDs when configuring site-to-site VPN Tunnels? (Choose two.)

Firewalls which support policy-based VPNs.

The remote device is a non-Palo Alto Networks firewall.

Firewalls which support policy-based VPNs.

The remote device is a non-Palo Alto Networks firewall.

Firewalls which support route-based VPNs.

The remote device is a Palo Alto Networks firewall.

Review the screenshots. What is the most likely reason for this decryption error log?

Entrust is not a trusted root certificate authority (CA).

The Certificate fingerprint could not be found.

The client expected a certificate from a different CA than the one provided.

The client received a CA certificate that has expired or is not valid.

Entrust is not a trusted root certificate authority (CA).

A network engineer troubleshoots a VPN Phase 2 mismatch and decides that PFS (Perfect Forward Secrecy) needs to be enabled. What action should the engineer take?

Enable PFS under the IPSec Tunnel advanced options.

Enable PFS under the IKE gateway advanced options.

Enable PFS under the IPSec Tunnel advanced options.

Add an authentication algorithm in the IPSec Crypto profile.

Select the appropriate DH Group under the IPSec Crypto profile.

A security engineer is informed that the vulnerability protection profile of their on-premises Palo Alto Networks firewall is triggering on a common Threat ID, and which has been determined to be a false positive. The engineer is asked to resolve the issue as soon as possible because it is causing an outage for a critical service The engineer opens the vulnerability protection profile to add the exception, but the Threat ID is missing.Which action is the most operationally efficient for the security engineer to find and implement the exception?

Select 'Show all signatures' within the Vulnerability Protection Profile under 'Exceptions'.

Review high severity system logs to identify why the threat is missing in Vulnerability Profile Exceptions.

Review traffic logs to add the exception from there.

Select 'Show all signatures' within the Vulnerability Protection Profile under 'Exceptions'.

Palo Alto Networks PCNSE Practice Test 11 - Free Online Exam Questions 401-440

A firewall engineer supports a mission-critical network that has zero tolerance for application downtime. A best-practice action taken by the engineer is configure an applications and Threats update schedule with a new App-ID threshold of 48 hours. Which two additional best-practice guideline actions should be taken with regard to dynamic updates? (Choose two.)

Become a Premium Member for full access

Unlock Premium Member

Palo Alto Networks PCNSE Practice Test 11

Question

Palo Alto Networks PCNSE Practice Tests

Practice Tests