Before an administrator of a VM-500 can enable DoS and zone protection, what actions need to be taken?

Measure and monitor the CPU consumption of the firewall data plane to ensure that each firewall is properly sized to support DoS and zone protection

Create a zone protection profile with flood protection configured to defend an entire egress zone against SYN. ICMP ICMPv6, UDP. and other IP flood attacks

Add a WildFire subscription to activate DoS and zone protection features

Replace the hardware firewall because DoS and zone protection are not available with VM-Series systems

Where is information about packet buffer protection logged?

All entries are in the Alarms log

Alert entries are in the Alarms log. Entries for dropped traffic, discarded sessions, and blocked IP address are in the Threat log

All entries are in the System log

Alert entries are in the System log. Entries for dropped traffic, discarded sessions and blocked IP addresses are in the Threat log

All entries are in the Alarms log

Which statement is true regarding a Best Practice Assessment?

It shows how your current configuration compares to Palo Alto Networks recommendations

When guided by an authorized sales engineer, it helps determine the areas of greatest risk where you should focus prevention activities.

It provides a set of questionnaires that help uncover security risk prevention gaps across all areas of network and security architecture

A network administrator plans a Prisma Access deployment with three service connections, each with a BGP peering to a CPE. The administrator needs to minimize the BGP configuration and management overhead on on-prem network devices.What should the administrator implement?

summarized BGP routes before advertising

target service connection for traffic steering

summarized BGP routes before advertising

Which function is handled by the management plane (control plane) of a Palo Alto Networks firewall?

signature matching for content inspection

An organization wishes to roll out decryption but gets some resistance from engineering leadership regarding the guest network.What is a common obstacle for decrypting traffic from guest devices?

Guest devices may not trust the CA certificate used for the forward trust certificate.

Guest devices may not trust the CA certificate used for the forward untrust certificate.

Guests may use operating systems that can't be decrypted.

The organization has no legal authority to decrypt their traffic.

Guest devices may not trust the CA certificate used for the forward trust certificate.

An engineer needs to redistribute User-ID mappings from multiple data centers. Which data flow best describes redistribution of user mappings?

Domain Controller to User-ID agent

An engineer is configuring Packet Buffer Protection on ingress zones to protect from single-session DoS attacks Which sessions does Packet Buffer Protection apply to?

It applies to existing sessions and is global

It applies to existing sessions and is not global

It applies to new sessions and is global

It applies to new sessions and is not global

It applies to existing sessions and is global

The administrator for a small company has recently enabled decryption on their Palo Alto Networks firewall using a self-signed root certificate. They have also created a Forward Trust and Forward Untrust certificate and set them as suchThe admin has not yet installed the root certificate onto client systems What effect would this have on decryption functionality?

Decryption will function but users will see certificate warnings for each SSL site they visit

Decryption will function and there will be no effect to end users

Decryption will not function because self-signed root certificates are not supported

Decryption will not function until the certificate is installed on client systems

Decryption will function but users will see certificate warnings for each SSL site they visit

A firewall has Security policies from three sources

the firewall's device group as post-rulesHow will the rule order populate once pushed to the firewall?

shared device group policies as pre-rules

the firewall's device group as post-rulesHow will the rule order populate once pushed to the firewall?

shared device group policies, firewall device group policies. local policies.

firewall device group policies, local policies. shared device group policies

shared device group policies. local policies, firewall device group policies

local policies, firewall device group policies, shared device group policies

Which three use cases are valid reasons for requiring an Active/Active high availability deployment?(Choose three )

The environment requires real, full-time redundancy from both firewalls at all times

The environment requires that both firewalls maintain their own routing tables for faster dynamic routing protocol convergence

The environment requires that traffic be load-balanced across both firewalls to handle peak traffic spikes

The environment requires real, full-time redundancy from both firewalls at all times

The environment requires Layer 2 interfaces in the deployment

The environment requires that both firewalls maintain their own routing tables for faster dynamic routing protocol convergence

The environment requires that all configuration must be fully synchronized between both members of the HA pair

The environment requires that traffic be load-balanced across both firewalls to handle peak traffic spikes

An administrator is building Security rules within a device group to block traffic to and from malicious locations How should those rules be configured to ensure that they are evaluated with a high priority?

Create the appropriate rules with a Block action and apply them at the top of the Security Pre- Rules

Create the appropriate rules with a Block action and apply them at the top of the Default Rules

Create the appropriate rules with a Block action and apply them at the top of the Security Post- Rules.

Create the appropriate rules with a Block action and apply them at the top of the local firewall Security rules.

Create the appropriate rules with a Block action and apply them at the top of the Security Pre- Rules

An engineer is configuring SSL Inbound Inspection for public access to a company's application.Which certificate(s) need to be installed on the firewall to ensure that inspection is performed successfully?

Intermediate CA (s) and End-entity certificate

Self-signed CA and End-entity certificate

Self-signed certificate with exportable private key

Intermediate CA (s) and End-entity certificate

A firewall administrator needs to be able to inspect inbound HTTPS traffic on servers hosted in theirDMZ to prevent the hosted service from being exploited. Which combination of features can allowPAN-OS to detect exploit traffic in a session with TLS encapsulation?

Vulnerability Protection profile and a Decryption policy

Decryption policy and a Data Filtering profile

a WildFire profile and a File Blocking profile

Vulnerability Protection profile and a Decryption policy

a Vulnerability Protection profile and a QoS policy

Which two statements correctly describe Session 380280? (Choose two.)

The session went through SSL decryption processing.

The application has been identified as web-browsing.

The session went through SSL decryption processing.

The session has ended with the end-reason unknown.

The application has been identified as web-browsing.

The session did not go through SSL decryption processing.

While analyzing the Traffic log, you see that some entries show "unknown-tcp" in the Application column What best explains these occurrences?

A handshake did take place, but the application could not be identified.

A handshake took place, but no data packets were sent prior to the timeout.

A handshake took place; however, there were not enough packets to identify the application.

A handshake did take place, but the application could not be identified.

A handshake did not take place, and the application could not be identified.

A firewall should be advertising the static route 10.2.0.0/24 Into OSPF. The configuration on the neighbor is correct, but the route is not in the neighbor's routing table.Which two configurations should you check on the firewall? (Choose two.)

In the OSFP configuration, ensure that the correct redistribution profile is selected in the OSPF Export Rules section.

Within the redistribution profile ensure that Redist is selected.

In the OSFP configuration, ensure that the correct redistribution profile is selected in the OSPF Export Rules section.

Within the redistribution profile ensure that Redist is selected.

Ensure that the OSPF neighbor state Is "2-Way."

In the redistribution profile check that the source type is set to "ospf."

Which statement best describes the Automated Commit Recovery feature?

It performs a connectivity check between the firewall and Panorama after every configuration commit on the firewall. It reverts the configuration changes on the firewall if the check fails.

It restores the running configuration on a firewall and Panorama if the last configuration commit fails.

It performs a connectivity check between the firewall and Panorama after every configuration commit on the firewall. It reverts the configuration changes on the firewall and on Panorama if the check fails.

It restores the running configuration on a firewall if the last configuration commit fails.

A firewall administrator wants to avoid overflowing the company syslog server with traffic logs.What should the administrator do to prevent the forwarding of DNS traffic logs to syslog?

Go to the Log Forwarding profile used to forward traffic logs to syslog. Then, under traffic logs match list, create a new filter with application not equal to DNS.

Disable logging on security rules allowing DNS.

Go to the Log Forwarding profile used to forward traffic logs to syslog. Then, under traffic logs match list, create a new filter with application not equal to DNS.

Create a security rule to deny DNS traffic with the syslog server in the destination

Go to the Log Forwarding profile used to forward traffic logs to syslog. Then, under traffic logs match list, create a new filter with application equal to DNS.

An engineer is planning an SSL decryption implementationWhich of the following statements is a best practice for SSL decryption?

Obtain an enterprise CA-signed certificate for the Forward Trust certificate.

Use the same Forward Trust certificate on all firewalls in the network.

Obtain a certificate from a publicly trusted root CA for the Forward Trust certificate.

Obtain an enterprise CA-signed certificate for the Forward Trust certificate.

Use an enterprise CA-signed certificate for the Forward Untrust certificate.

During the implementation of SSL Forward Proxy decryption, an administrator imports the company's Enterprise Root CA and Intermediate CA certificates onto the firewall. The company's Root and Intermediate CA certificates are also distributed to trusted devices using Group Policy and GlobalProtect. Additional device certificates and/or Subordinate certificates requiring an Enterprise CA chain of trust are signed by the company's Intermediate CA.Which method should the administrator use when creating Forward Trust and Forward Untrust certificates on the firewall for use with decryption?

Generate a CA certificate for Forward Trust and a self-signed CA for Forward Untrust.

Generate a single subordinate CA certificate for both Forward Trust and Forward Untrust.

Generate a CA certificate for Forward Trust and a self-signed CA for Forward Untrust.

Generate a single self-signed CA certificate for Forward Trust and another for Forward Untrust

Generate two subordinate CA certificates, one for Forward Trust and one for Forward Untrust.

How would an administrator configure a Bidirectional Forwarding Detection profile for BGP after enabling the Advance Routing Engine run on PAN-OS 10.2?

create a BFD profile under Network > Routing > Routing Profiles > BFD and then select the BFD profile under Network > Virtual Router > BGP > General > Global BFD Profile

create a BFD profile under Network > Network Profiles > BFD Profile and then select the BFD profile under Network > Virtual Router > BGP > BFD

create a BFD profile under Network > Routing > Routing Profiles > BFD and then select the BFD profile under Network > Virtual Router > BGP > General > Global BFD Profile

create a BFD profile under Network > Routing > Routing Profiles > BFD and then select the BFD profile under Network > Routing > Logical Routers > BGP > General > Global BFD Profile

create a BFD profile under Network > Network Profiles > BFD Profile and then select the BFD profile under Network > Routing > Logical Routers > BGP > BFD

An administrator has configured a pair of firewalls using high availability in Active/Passive mode.Path Monitoring has been enabled with a Failure Condition of "any." A path group is configured with Failure Condition of "all" and contains a destination IP of 8.8.8.8 and 4.2.2.2 with a Ping Interval of 500ms and a Ping count of 3.Which scenario will cause the Active firewall to fail over?

IP addresses 8.8.8.8 and 4.2.2.2 are unreachable for 2 seconds

IP address 8.8.8.8 is unreachable for 1 second.

IP addresses 8.8.8.8 and 4.2.2.2 are unreachable for 1 second.

IP addresses 8.8.8.8 and 4.2.2.2 are unreachable for 2 seconds

IP address 4.2.2.2 is unreachable for 2 seconds.

A client wants to detect the use of weak and manufacturer-default passwords for loT devices. Which option will help the customer?

Configure a Vulnerability Protection profile with alert mode

Configure a Data Filtering profile with alert mode.

Configure an Antivirus profile with alert mode.

Configure a Vulnerability Protection profile with alert mode

Configure an Anti-Spyware profile with alert mode.

A firewall administrator notices that many Host Sweep scan attacks are being allowed through the firewall sourced from the outside zone. What should the firewall administrator do to mitigate this type of attack?

Create a Zone Protection profile, enable reconnaissance protection, set action to Block, and apply it to the outside zone.

Create a DOS Protection profile with SYN Flood protection enabled and apply it to all rules allowing traffic from the outside zone

Enable packet buffer protection in the outside zone.

Create a Security rule to deny all ICMP traffic from the outside zone.

Create a Zone Protection profile, enable reconnaissance protection, set action to Block, and apply it to the outside zone.

An engineer needs to permit XML API access to a firewall for automation on a network segment that is routed through a Layer 3 subinterface on a Palo Alto Networks firewall. However, this network segment cannot access the dedicated management interface due to the Security policy.Without changing the existing access to the management interface, how can the engineer fulfill this request?

Enable HTTPS in an Interface Management profile on the subinterface.

Specify the subinterface as a management interface in Setup > Device > Interfaces.

Enable HTTPS in an Interface Management profile on the subinterface.

Add the network segment's IP range to the Permitted IP Addresses list

Configure a service route for HTTP to use the subinterface

An engineer needs to see how many existing SSL decryption sessions are traversing a firewall What command should be used?

debug dataplane pool statistics I match proxy

show dataplane pool statistics I match proxy

debug dataplane pool statistics I match proxy

Which steps should an engineer take to forward system logs to email?

Create a new email profile under Device > server profiles: then navigate to Device > Log Settings > System and add the email profile under email.

Create a new email profile under Device > server profiles; then navigate to Objects > Log Forwarding profile > set log type to system and the add email profile.

Enable log forwarding under the email profile in the Objects tab.

Create a new email profile under Device > server profiles: then navigate to Device > Log Settings > System and add the email profile under email.

Enable log forwarding under the email profile in the Device tab.

Palo Alto Networks PCNSE Practice Test 3 - Free Online Exam Prep & Questions

Question 1 / 40

An administrator has configured the Palo Alto Networks NGFW's management interface to connect to the internet through a dedicated path that does not traverse back through the NGFW itself.

Which configuration setting or step will allow the firewall to get automatic application signature updates?

A scheduler will need to be configured for application signatures.

A Security policy rule will need to be configured to allow the update requests from the firewall to the update servers.

A Threat Prevention license will need to be installed.

A service route will need to be configured.

Comment (0)

Palo Alto Networks PCNSE Practice Test 3

Question

Palo Alto Networks PCNSE Practice Tests

Practice Tests