Which statement explains the difference between using the PAN-OS integrated User-ID agent and the standalone User-ID agent when using Active Directory for user-to-IP mapping?

The standalone User-ID agent consumes fewer resources on the NGFW's management CPU

The PAN-OS integrated User-ID agent must be a member of the Active Directory domain

The PAN-OS integrated User-ID agent consumes fewer resources on the NGFW's management CPU

The standalone User-ID agent consumes fewer resources on the NGFW's management CPU

The standalone User-ID agent must run directly on the domain controller server

Which sessions does Packet Buffer Protection apply to when used on ingress zones to protect against single-session DoS attacks?

Existing sessions and is not global

Existing sessions and is global

A customer wants to enhance the protection provided by their Palo Alto Networks NGFW deployment to cover public-facing company-owned domains from misconfigurations that point records to third-party sources. Which two actions should the network administrator perform to achieve this goal? (Choose two)

Verify the NGFWs have the Advanced DNS Security and Advanced URL Filtering licenses installed and validated

Create or update an Anti-Spyware profile, go to the DNS Policies / DNS Zone Misconfiguration section, then add the domains to be protected

Verify the NGFWs have the Advanced DNS Security and Advanced Threat Prevention licenses installed and validated

Create or update a Vulnerability Protection profile to the DNS Policies / DNS Zone Misconfiguration section, then add the domains to be protected

Verify the NGFWs have the Advanced DNS Security and Advanced URL Filtering licenses installed and validated

Create or update an Anti-Spyware profile, go to the DNS Policies / DNS Zone Misconfiguration section, then add the domains to be protected

Users are intermittently being cut off from local resources whenever they connect to GlobalProtect. After researching, it is determined that this is caused by an incorrect setting on one of the NGFWs. Which action will resolve this issue?

Change the 'GlobalProtect Gateway -> Agent -> Client Settings -> Split Tunnel -> No direct access to local network' setting to 'off'

Change the 'GlobalProtect Gateway -> Agent -> Network Services -> Split Tunnel -> No direct access to local network' setting to 'off'

Change the 'GlobalProtect Portal -> Satellite -> Gateways -> No direct access to local network' setting to 'off'

Change the 'GlobalProtect Gateway -> Agent -> Client Settings -> Split Tunnel -> No direct access to local network' setting to 'off'

Change the 'GlobalProtect Portal -> Agent -> App -> Split Tunnel -> No direct access to local network' setting to 'off'

During a routine security audit, the risk and compliance team notices a series of WildFire logs that contain a 'malicious' verdict and the action 'allow.' Upon further inspection, the team confirms that these same threats are automatically blocked by the firewalls the following day. How can the existing configuration be adjusted to ensure that new threats are blocked within minutes instead of having to wait until the following day?

Configure the appropriate actions in the Antivirus security profile

Confirm the file types and direction are configured correctly in the WildFire analysis profile

Configure the appropriate actions in the Antivirus security profile

Configure the appropriate actions in the File Blocking profile

Confirm the file size limits are configured correctly in the WildFire general settings

Which action can be taken to immediately remediate the issue of application traffic with a valid use case triggering the decryption log message, 'Received fatal alert UnknownCA from client'?

Add the certificate CN to the SSL Decryption Exclusion List to allow traffic without decryption

Enable certificate revocation checking to deny access to sites with revoked certificates

Add the certificate CN to the SSL Decryption Exclusion List to allow traffic without decryption

Check for expired certificates and take appropriate actions to block or allow access based on business needs

Contact the site administrator with the expired certificate to request updates or renewal

An enterprise network security team is deploying VM-Series firewalls in a multi-cloud environment. Some firewalls are deployed in VMware NSX-V, while others are in AWS, and all are centrally managed using Panorama with the appropriate plugins installed. The team wants to streamline policy management by organizing the firewalls into device groups in which the AWS-based firewalls act as a parent device group, while the NSX-V firewalls are configured as a child device group to inherit Security policies. However, after configuring the device group hierarchy and attempting to push configurations, the team receives errors, and policy inheritance is not functioning as expected. What is the most likely cause of this issue?

Panorama does not support policy inheritance across device groups containing firewalls deployed in different hypervisors when using multiple plugins

Panorama must use the same plugin version numbers for both AWS and NSX-V environments before device group inheritance can function properly

Panorama requires the objects to be overridden in the child device group before firewalls in different hypervisors can inherit Security policies

Panorama by default does not allow different hypervisors in parent/child device groups, but this can be overridden with the command 'set device-group allow-multi-hypervisor enable'

Panorama does not support policy inheritance across device groups containing firewalls deployed in different hypervisors when using multiple plugins

An organization uses the User-ID agent to control access to sensitive internal resources. A firewall engineer adds Security policies to ensure only User A has access to a specific resource. User A was able to access the resource without issue before the updated policies, but now is having intermittent connectivity issues. What is the most likely resolution to this issue?

Add the subnets of both the user machine and the resource to the 'Include List' in the User-ID agent configuration

Add service accounts running on that machine to the 'Ignore User List' in the User-ID agent setup

Remove the identity redistribution rules synced from Cloud Identity Engine from the User-ID agent configuration

Remove the rate-limiting rule that is assigned to User A access from the User-ID agent configuration

Add the subnets of both the user machine and the resource to the 'Include List' in the User-ID agent configuration

What is the benefit of the Artificial Intelligence Operations (AIOps) Plugin for Panorama?

It proactively enforces best practices by validating new commits and advising if a policy needs work before pushing it to Panorama

It automatically pushes the configuration to Panorama after strengthening the overall security posture

It proactively enforces best practices by validating new commits and advising if a policy needs work before pushing it to Panorama

The AIOps plugin in Panorama auto-corrects the security rules that failed the Best Practice Assessment

The AIOps plugin in Panorama retroactively checks the policy changes during the commits

Which two actions can the administrative role called 'vsysadmin' perform? (Choose two)

Commit changes made to the candidate configuration of the assigned vsys

Create and edit Security policies and security profiles for only the assigned vsys

Configure resource limits for the NGFW system

Commit changes made to the candidate configuration of the assigned vsys

Create and edit Security policies and security profiles for only the assigned vsys

Configure interfaces and subinterfaces that exist in the assigned vsys

A firewall architect is attempting to install a new Palo Alto Networks NGFW. The company has previously had issues moving all administrative functions onto a data plane interface to meet the design limitations of the environment. The architect is able to access the device for HTTPS and SSH; however, the NGFW can neither validate licensing nor get updates. Which action taken by the architect will resolve this issue?

Validate that all upstream devices will allow and properly route the outbound traffic to the external destinations needed

Create a service route that sets the source interface to the data plane interface in question

Validate that all upstream devices will allow and properly route the outbound traffic to the external destinations needed

Create a loopback from the management interface to the data plane interface, then make a service route from the management interface to the data plane interface

Enable OCSP for the data plane interface so the firewall will create a certificate with the data plane interface's IP

How is Perfect Forward Secrecy (PFS) enabled when troubleshooting a VPN Phase 2 mismatch?

Enable PFS under the IKE Gateway advanced options

Enable PFS under the IPsec Tunnel advanced options

Select the appropriate DH Group under the IPsec Crypto profile

Add an authentication algorithm in the IPsec Crypto profile

How can a firewall engineer bypass App-ID and content inspection features on a Palo Alto Networks firewall when troubleshooting?

Create a custom application, define its properties, then create an application override and reference the custom application

Create a custom application, define its properties and signatures, and ensure all scanning options in the 'Advanced' tab are unchecked

Create a custom application, define its properties, then create an application override and reference the custom application

Create a new security rule specifically for the affected traffic, but do not reference any Security Profiles inside the rule

Create a new security rule specifically for the affected traffic, and select 'Disable Server Response Inspection'

Palo Alto Networks PCNSE Practice Test 13 - Free Online Exam Questions 481-499

Which configuration change will improve network reliability and ensure minimal disruption during tunnel failures?

Become a Premium Member for full access

Unlock Premium Member

Palo Alto Networks PCNSE Practice Test 13

Question

Palo Alto Networks PCNSE Practice Tests

Practice Tests