An engineer is configuring secure web access (HTTPS) to a Palo Alto Networks firewall for management.Which profile should be configured to ensure that management access via web browsers is encrypted with a trusted certificate?

An SSL/TLS Service profile with a certificate assigned.

An Interface Management profile with HTTP and HTTPS enabled.

A Certificate profile with a trusted root CA.

An Authentication profile with the allow list of users.

A new firewall has the Threat Prevention subscription, but the Antivirus does not appear in Dynamic Updates.What must occur to have Antivirus signatures update?

Install the Application and Threats updates first, then refresh the Dynamic Updates.

An Antivirus license is needed first, then a Security profile for Antivirus needs to be created.

An Antivirus license must be obtained before Dynamic Updates can be downloaded or installed.

An Advanced Threat Prevention license is required to see the Dynamic Updates for Antivirus.

Install the Application and Threats updates first, then refresh the Dynamic Updates.

An existing log forwarding profile is currently configured to forward all threat logs to Panorama. The firewall engineer wants to add syslog as an additional log forwarding method. The requirement is to forward only medium or higher severity threat logs to syslog. Forwarding to Panorama must not be changed.Which set of actions should the engineer take to achieve this goal?

1. Open the current log forwarding profile. 2. Add a new match list for threat log type. 3. Define the filter. 4. Select the syslog forward method.

1- Open the current log forwarding profile. 2. Open the existing match list for threat log type. 3. Define the filter. 4. Select the syslog forward method.

1. Create a new log forwarding profile. 2. Add a new match list for threat log type. 3. Define the filter. 4. Select the Panorama and syslog forward methods.

1. Open the current log forwarding profile. 2. Add a new match list for threat log type. 3. Define the filter. 4. Select the syslog forward method.

1. Create a new log forwarding profile. 2. Add a new match list for threat log type. 3. Define the filter. 4. Select the syslog forward method.

An administrator is tasked to provide secure access to applications running on a server in the company's on-premises datacenter.What must the administrator consider as they prepare to configure the decryption policy?

Obtain or generate the server certificate and private key from the datacenter server.

Ensure HA3 interfaces are configured in a HA pair environment to sync decrypted sessions.

Obtain or generate the server certificate and private key from the datacenter server.

Obtain or generate the self-signed certificate with private key in the firewall

Obtain or generate the forward trust and forward untrust certificate from the datacenter server.

An administrator configures HA on a customer's Palo Alto Networks firewalls with path monitoring by using the default configuration values.What are the default values for ping interval and ping count before a failover is triggered?

Ping interval of 200 ms and ping count of 10 failed pings

Ping interval of 200 ms and ping count of three failed pings

Ping interval of 5000 ms and ping count of 10 failed pings

Ping interval of 200 ms and ping count of 10 failed pings

Ping interval of 5000 ms and ping count of three failed pings

An administrator is troubleshooting intermittent connectivity problems with a user's GlobalProtect connection. Packet captures at the firewall reveal missing UDP packets, suggesting potential packet loss on the connection. The administrator aims to resolve the issue by enforcing an SSL tunnel over TCP specifically for this user.What configuration change is necessary to implement this troubleshooting solution for the user?

Enable SSL tunnel over TCP in a new agent configuration for the specific user.

Enable SSL tunnel within the GlobalProtect gateway remote user's settings.

Modify the user's client to prioritize UDP traffic for GlobalProtect.

Enable SSL tunnel over TCP in a new agent configuration for the specific user.

Increase the user's VPN bandwidth allocation in the GlobalProtect settings.

What type of NAT is required to configure transparent proxy?

Destination translation with Dynamic IP

Source translation with Dynamic IP and Port

Destination translation with Static IP

Source translation with Static IP

Destination translation with Dynamic IP

What should an engineer consider when setting up the DNS proxy for web proxy?

A secondary DNS server in the DNS proxy is optional, and configuration commit to the firewall will succeed with only one DNS server.

A maximum of two FQDNs can be mapped to an IP address in the static entries for DNS proxy.

DNS timeout for web proxy can be configured manually, and it should be set to the highest value possible.

Adjust the UDP queries for the DNS proxy to allow both DNS servers to be tried within 20 seconds.

A firewall administrator has configured User-ID and deployed GlobalProtect, but there is no User-ID showing in the traffic logs.How can the administrator ensure that User-IDs are populated in the traffic logs?

Enable User-ID on the expected trusted zones.

Create a Group Mapping for the GlobalProtect Group.

Enable Captive Portal on the expected source interfaces.

Add the users to the proper Dynamic User Group.

Enable User-ID on the expected trusted zones.

A decryption policy has been created with an action of 'No Decryption.' The decryption profile is configured in alignment to best practices.What protections does this policy provide to the enterprise?

It enhances security by actively blocking access to potentially insecure sites with expired certificates or untrusted issuers.

It allows for complete visibility into certificate data, ensuring secure connections to all websites.

It ensures that the firewall checks its certificate store, enabling sessions with trusted self-signed certificates even when an alternative trust anchor exists.

It encrypts all certificate information to maintain privacy and compliance with local regulations.

It enhances security by actively blocking access to potentially insecure sites with expired certificates or untrusted issuers.

An administrator plans to install the Windows User-ID agent on a domain member system.What is a best practice for choosing where to install the User-ID agent?

In close proximity to the servers it will be monitoring

On the same RODC that is used for credential detection

In close proximity to the firewall it will be providing User-ID to

In close proximity to the servers it will be monitoring

On the DC holding the Schema Master FSMO role

A company uses GlobalProtect for its VPN and wants to allow access to users who have only an endpoint solution installed. Which sequence of configuration steps will allow access only for hosts that have antivirus or anti-spyware enabled?

Create Security Profiles for Antivirus and Anti-Spyware. Create Security Profile Group that includes the Antivirus and Anti-Spyware profile. Enable GlobalProtect Gateway Agent to collect HIP Data Collection. Create a Security policy that has the Profile Setting. Profile Type selected to Group. Enable GlobalProtect Portal Agent for HIP Notification.

Create a HIP object with Anti-Malware enabled and Real Time Protection set to yes. * Create a HIP Profile that matches the HIP object criteria. Enable GlobalProtect Portal Agent to collect HIP Data Collection. Create a Security policy that matches source HIP profile. Enable GlobalProtect Gateway Agent for HIP Notification.

Create Security Profiles for Antivirus and Anti-Spyware. Create Security Profile Group that includes the Antivirus and Anti-Spyware profiles. Enable GlobalProtect Portal Agent to collect HIP Data Collection. Create a Security policy that matches source device object. Enable GlobalProtect Gateway Agent for HIP Notification.

Create a HIP object with Anti-Malware enabled and Real Time Protection set to yes. Create a HIP Profile that matches the HIP object criteria. Enable GlobalProtect Gateway Agent to collect HIP Data Collection. Create a Security policy that matches source device object. Enable GlobalProtect Portal Agent for HIP Notification.

Create Security Profiles for Antivirus and Anti-Spyware. Create Security Profile Group that includes the Antivirus and Anti-Spyware profile. Enable GlobalProtect Gateway Agent to collect HIP Data Collection. Create a Security policy that has the Profile Setting. Profile Type selected to Group. Enable GlobalProtect Portal Agent for HIP Notification.

An administrator configures a preemptive active-passive high availability (HA) pair of firewalls and configures the HA election settings on firewall-02 with a device priority value of 100, and firewall-01 with a device priority value of 90.When firewall-01 is rebooted, is there any action taken by the firewalls?

Yes - Firewall-02 takes over as the active-primary firewall; firewall-01 takes over as the active-primary member after it becomes functional.

No - Neither firewall takes any action because firewall-01 cannot be rebooted when configured with device priority of 90.

No - Neither firewall takes any action because firewall-02 is already the active-primary member.

Yes - Firewall-02 takes over as the active-primary firewall; firewall-01 takes over as the active-primary member after it becomes functional.

Yes - Firewall-02 takes over as the active-primary firewall; firewall-02 remains the active-primary member after firewall-01 becomes functional.

A standalone firewall with local objects and policies needs to be migrated into Panorama. What procedure should you use so Panorama is fully managing the firewall?

Use the 'import device configuration to Panorama' operation, commit to Panorama, then perform a device-group commit push with 'include device and network templates'.

Use the 'import device configuration to Panorama' operation, commit to Panorama, then 'export or push device config bundle' to push the configuration.

Use the 'import Panorama configuration snapshot' operation, commit to Panorama, then 'export or push device config bundle' to push the configuration.

Use the 'import device configuration to Panorama' operation, commit to Panorama, then perform a device-group commit push with 'include device and network templates'.

Use the 'import Panorama configuration snapshot' operation, commit to Panorama, then perform a device-group commit push with 'include device and network templates'.

Certain services in a customer implementation are not working, including Palo Alto Networks Dynamic version updates.Which CLI command can the firewall administrator use to verify if the service routes were correctly installed and that they are active in the Management Plane?

show routing route type service-route

debug dataplane Internal vif route 250

show routing route type service-route

show routing route type management

debug dataplane internal vif route 255

What action does a firewall take when a Decryption profile allows unsupported modes and unsupported traffic with TLS 1.2 protocol traverses the firewall?

It automatically adds the server to the SSL Decryption Exclusion list.

It blocks all communication with the server indefinitely.

It downgrades the protocol to ensure compatibility.

It automatically adds the server to the SSL Decryption Exclusion list.

It generates an decryption error message but allows the traffic to continue decryption.

An internal audit team has requested additional information to be included inside traffic logs forwarded from Palo Alto Networks firewalls to an internal syslog server.Where can the firewall engineer define the data to be added into each forwarded log?

Custom Log Format within Device > Server Profiles > Syslog

Built-in Actions within Objects > Log Forwarding Profile

Logging and Reporting Settings within Device > Setup > Management

Data Patterns within Objects > Custom Objects

Certain services in a customer implementation are not working, including Palo Alto Networks Dynamic version updates. Which CLI command can the firewall administrator use to verify if the service routes were correctly installed and that they are active in the Management Plane?

debug dataplane internal vif route 250

debug dataplane internal vif route 255

show routing route type management

debug dataplane internal vif route 250

show routing route type service-route

A firewall engineer is investigating high dataplane CPU utilization. To decrease the load on this CPU, what should be reduced?

The amount of decrypted traffic

The timeout value for admin sessions

The number of mapped User-ID groups

The number of permitted IP addresses on the management interface

An administrator wants to add User-ID information for their Citrix MetaFrame Presentation Server (MPS) users.Which option should the administrator use?

Terminal Server Agent for User Mapping

PAN-OS Integrated User-ID Agent

What must be taken into consideration when preparing a log forwarding design for all of a customer's deployed Palo Alto Networks firewalls?

Traffic and threat logs will not be forwarded unless the relevant Log Forwarding profile is attached to the security rules

The logs will not contain the names of the identified applications unless the 'Enable enhanced application logging' option is selected

Traffic and threat logs will not be forwarded unless the relevant Log Forwarding profile is attached to the security rules

App-ID engine will not identify any application traffic unless the 'Enable enhanced application logging' option is selected

Traffic and threat logs will not be forwarded unless the relevant Log Forwarding profile is selected in 'Logging and Reporting Settings'

An auditor is evaluating the configuration of Panorama and notices a discrepancy between the Panorama template and the local firewall configuration. When overriding the firewall configuration pushed from Panorama, what should you consider?

The firewall template will show that it is out of sync within Panorama

Only Panorama can revert the override

The modification will not be visible in Panorama

Panorama will update the template with the overridden value

Panorama is being used to upgrade the PAN-OS version on a pair of firewalls in an active/passive high availability (HA) configuration. The Palo Alto Networks best practice upgrade steps have been completed in Panorama (Panorama upgraded, backups made, content updates, and disabling 'Preemptive' pushed), and the firewalls are ready for upgrade. What is the next best step to minimize downtime and ensure a smooth transition?

Upgrade only the passive peer first, reboot it, restore HA functionality, and then upgrade the active peer

Upgrade both HA peers at the same time using Panorama's 'Group HA Peers' option to ensure version consistency

Suspend the active firewall, upgrade it first, and reboot to verify it comes back online before upgrading the passive peer

Perform the upgrade on the active firewall first while keeping the passive peer online to maintain failover capability

Upgrade only the passive peer first, reboot it, restore HA functionality, and then upgrade the active peer

Users have reported an issue when they are trying to access a server on your network. The requests aren't taking the expected route. You discover that there are two different static routes on the firewall for the server. What is used to determine which route has priority?

The route with the lowest administrative distance

Bidirectional Forwarding Detection

The route with the highest administrative distance

A customer requires that virtual systems with separate virtual routers can communicate with one another within a Palo Alto Networks firewall. In addition to confirming Security policies, which three configurations will accomplish this goal? (Choose three)

External zones with the virtual systems added

Route added with next hop next-vr by using the VR configured in the virtual system

Layer 3 zones for the virtual systems that need to communicate

Route added with next hop set to 'none' and using the interface of the virtual systems that need to communicate

External zones with the virtual systems added

Route added with next hop next-vr by using the VR configured in the virtual system

Layer 3 zones for the virtual systems that need to communicate

A firewall architect is attempting to install a new Palo Alto Networks NGFW. The company has previously had issues moving all administrative functions onto a data plane interface to meet the design limitations of the environment. The architect is able to access the device for HTTPS and SSH; however, the NGFW can neither validate licensing nor get updates. Which action taken by the architect will resolve this issue?

Validate that all upstream devices will allow and properly route the outbound traffic to the external destinations needed

Create a service route that sets the source interface to the data plane interface in question

Validate that all upstream devices will allow and properly route the outbound traffic to the external destinations needed

Create a loopback from the management interface to the data plane interface, then make a service route from the management interface to the data plane interface

Enable OCSP for the data plane interface so the firewall will create a certificate with the data plane interface's IP

A company CISO updates the business Security policy to identify vulnerable assets and services and deploy protection for quantum-related attacks. As a part of this update, the firewall team is reviewing the cryptography used by any devices they manage. The firewall architect is reviewing the Palo Alto Networks NGFWs for their VPN tunnel configurations. It is noted in the review that the NGFWs are running PAN-OS 11.2. Which two NGFW settings could the firewall architect recommend to deploy protections per the new policy? (Choose two)

IKEv2 with Post-Quantum Pre-shared Keys

IKEv1 only to deactivate the use of public key encryption

IKEv2 with Post-Quantum Pre-shared Keys

How can a firewall be set up to automatically block users as soon as they are found to exhibit malicious behavior via a threat log?

Configure a dynamic user group for the users to be blocked with the tag 'malicious.' Add a Log Forwarding profile to the other policies, which adds the 'malicious' tag to these users when logs are generated in the threat log. Create policies to block traffic from this user group.

Configure a dynamic address group for the addresses to be blocked with the tag 'malicious.' Add a Log Forwarding profile to the other policies, which adds the 'malicious' tag to these addresses when logs are generated in the threat log. Under Device > User Identification > Trusted Source Address, add the condition 'NOT malicious.'

Configure a dynamic user group for the users to be blocked with the tag 'malicious.' Add a Log Forwarding profile to the other policies, which adds the 'malicious' tag to these users when logs are generated in the threat log. Create policies to block traffic from this user group.

Configure the appropriate security profiles for Antivirus, Anti-Spyware, and Vulnerability Prevention, create signature policies for the relevant signatures and/or severities. Under the 'Actions' tab in 'Signature Policies,' select 'block-user.'

A firewall engineer is migrating port-based rules to application-based rules by using the Policy Optimizer. The engineer needs to ensure that the new application-based rules are future-proofed, and that they will continue to match if the existing signatures for a specific application are expanded with new child applications. Which action will meet the requirement while ensuring that traffic unrelated to the specific application is not matched?

Add the relevant container application when creating cloned rules

Create a custom application and define it by the correct TCP and UDP ports

Create an application filter based on the existing application category and risk

Add specific applications that are seen when creating cloned rules

Add the relevant container application when creating cloned rules

The vulnerability protection profile of an on-premises Palo Alto Networks firewall is triggering on a common Threat ID, and it has been determined to be a false positive. The issue causes an outage of a critical service. When the vulnerability protection profile is opened to add the exception, the Threat ID is missing. Which action will most efficiently find and implement the exception?

Select 'Show all signatures' within the vulnerability protection profile under 'Exceptions'

Review high-severity system logs to identify why the threat is missing in 'Vulnerability Profile Exceptions'

Select 'Show all signatures' within the vulnerability protection profile under 'Exceptions'

Review traffic logs to add the exception from there

Palo Alto Networks PCNSE Practice Test 12 - Free Online Exam Questions 441-480

A company has a PA-3220 NGFW at the edge of its network and wants to use active directory groups in its Security policy rules. There are 1500 groups in its active directory. An engineer has been provided 800 active directory groups to be used in the Security policy rules.

What is the engineer's next step?

Become a Premium Member for full access

Unlock Premium Member

Palo Alto Networks PCNSE Practice Test 12

Question

Palo Alto Networks PCNSE Practice Tests

Practice Tests