Which Panorama feature protects logs against data loss if a Panorama server fails?

Panorama Collector Group with Log Redundancy ensures that no logs are lost if a server fails inside the Collector Group.

Panorama HA automatically ensures that no logs are lost if a server fails inside the HA Cluster.

Panorama Collector Group with Log Redundancy ensures that no logs are lost if a server fails inside the Collector Group.

Panorama HA with Log Redundancy ensures that no logs are lost if a server fails inside the HA Cluster.

Panorama Collector Group automatically ensures that no logs are lost if a server fails inside the Collector Group

An administrator is seeing one of the firewalls in a HA active/passive pair moved to 'suspended" state due to Non-functional loop. Which three actions will help the administrator troubleshool this issue? (Choose three.)

Use the CLI command show high-availability flap-statistics

Check the HA Link Monitoring interface cables.

Check the High Availability > Link and Path Monitoring settings.

Use the CLI command show high-availability flap-statistics

Check the HA Link Monitoring interface cables.

Check the High Availability > Link and Path Monitoring settings.

Check High Availability > Active/Passive Settings > Passive Link State

Check the High Availability > HA Communications > Packet Forwarding settings.

Which User-ID mapping method should be used in a high-security environment where all IP addressto- user mappings should always be explicitly known?

PAN-OS integrated User-ID agent

LDAP Server Profile configuration

A firewall administrator has been tasked with ensuring that all Panorama configuration is committed and pushed to the devices at the end of the day at a certain time. How can they achieve this?

Use the Scheduled Config Push to schedule Commit to Panorama and also Push to Devices.

Use the Scheduled Config Export to schedule Commit to Panorama and also Push to Devices.

Use the Scheduled Config Push to schedule Push lo Devices and separately schedule an API call to commit all Panorama changes.

Use the Scheduled Config Export to schedule Push to Devices and separately schedule an API call to commit all Panorama changes.

Use the Scheduled Config Push to schedule Commit to Panorama and also Push to Devices.

Which statement accurately describes service routes and virtual systems?

Virtual systems that do not have specific service routes configured inherit the global service and service route settings for the firewall.

Virtual systems can only use one interface for all global service and service routes of the firewall.

Virtual systems cannot have dedicated service routes configured; and virtual systems always use the global service and service route settings for the firewall.

The interface must be used for traffic to the required external services.

You have upgraded Panorama to 10.2 and need to upgrade six Log Collectors. When upgrading Log Collectors to 10.2, you must do what?

Upgrade all the Log Collectors at the same time.

Upgrade the Log Collectors one at a time.

Add Panorama Administrators to each Managed Collector.

Add a Global Authentication Profile to each Managed Collector.

Upgrade all the Log Collectors at the same time.

Which configuration is backed up using the Scheduled Config Export feature in Panorama?

Panorama running configuration and running configuration of all managed devices

Panorama candidate configuration

Panorama candidate configuration and candidate configuration of all managed devices

Panorama running configuration and running configuration of all managed devices

Cortex XDR notifies an administrator about grayware on the endpoints. There are no entries about grayware in any of the logs of the corresponding firewall. Which setting can the administrator configure on the firewall to log grayware verdicts?

in WildFire General Settings, select "Report Grayware Files"

within the log forwarding profile attached to the Security policy rule

within the log settings option in the Device tab

in WildFire General Settings, select "Report Grayware Files"

in Threat General Settings, select "Report Grayware Files"

You have upgraded your Panorama and Log Collectors lo 10.2 x. Before upgrading your firewalls using Panorama, what do you need do?

Commit and Push the configurations to the firewalls.

Refresh your licenses with Palo Alto Network Support - Panorama/Licenses/Retrieve License Keys from License Server.

Re-associate the firewalls in Panorama/Managed Devices/Summary.

Commit and Push the configurations to the firewalls.

Refresh the Mastor Key in Panorama/Master Key and Diagnostic

A network engineer has discovered that asymmetric routing is causing a Palo Alto Networks firewall to drop traffic. The network architecture cannot be changed to correct this.Which two actions can be taken on the firewall to allow the dropped traffic permanently? (Choose two.)

Navigate to Network > Zone Protection Click AddSelect Packet Based Attack Protection > TCP/IP Drop Set "Reject Non-syn-TCP" to No Set "Asymmetric Path" to Bypass

# set deviceconfig setting session tcp-reject-non-syn no

Navigate to Network > Zone Protection Click AddSelect Packet Based Attack Protection > TCP/IP Drop Set "Reject Non-syn-TCP" to No Set "Asymmetric Path" to Bypass

> set session tcp-reject-non-syn no

Navigate to Network > Zone Protection Click AddSelect Packet Based Attack Protection > TCP/IP Drop Set "Reject Non-syn-TCP" to Global Set "Asymmetric Path" to Global

# set deviceconfig setting session tcp-reject-non-syn no

An engineer has been tasked with reviewing traffic logs to find applications the firewall is unable to identify with App-ID. Why would the application field display as incomplete?

The TCP connection did not fully establish.

The client sent a TCP segment with the PUSH flag set.

The TCP connection was terminated without identifying any application data.

There is insufficient application data after the TCP connection was established.

The TCP connection did not fully establish.

An engineer is pushing configuration from Panorama lo a managed firewall.What happens when the pushed Panorama configuration has Address Object names that duplicate the Address Objects already configured on the firewall?

The firewall rejects the pushed configuration, and the commit fails.

The firewall renames the duplicate local objects with "-1" at the end signifying they are clones; it will update the references to the objects accordingly and fully commit the pushed configuration.

The firewall fully commits all of the pushed configuration and overwrites its locally configured objects

The firewall ignores only the pushed objects that have the same name as the locally configured objects, and it will commit the rest of the pushed configuration.

What is a correct statement regarding administrative authentication using external services with a local authorization method?

The administrative accounts you define locally on the firewall serve as references to the accounts defined on an external authentication server.

Prior to PAN-OS 10.2. an administrator used the firewall to manage role assignments, but access domains have not been supported by this method.

Starting with PAN-OS 10.2. an administrator needs to configure Cloud Identity Engine to use external authentication services for administrative authentication.

The administrative accounts you define locally on the firewall serve as references to the accounts defined on an external authentication server.

The administrative accounts you define on an external authentication server serve as references to the accounts defined locally on the firewall.

An engineer is tasked with enabling SSL decryption across the environment. What are three valid parameters of an SSL Decryption policy? (Choose three.)

source and destination IP addresses

A firewall administrator has been tasked with ensuring that all Panorama-managed firewalls forward traffic logs to Panoram a. In which section is this configured?

Device Groups > Objects > Log Forwarding

Templates > Device > Log Settings

An administrator discovers that a file blocked by the WildFire inline ML feature on the firewall is a false-positive action. How can the administrator create an exception for this particular file?

Add partial hash and filename in the file section of the WildFire inline ML tab of the Antivirus profile.

Set the WildFire inline ML action to allow for that protocol on the Antivirus profile.

Add the related Threat ID in the Signature exceptions tab of the Antivirus profile.

Disable the WildFire profile on the related Security policy.

A web server is hosted in the DMZ and the server is configured to listen for incoming connections on TCP port 443 A Security policies rules allowing access from the Trust zone to the DMZ zone needs to be configured to allow web-browsing access. The web server hosts its contents over HTTP(S). Traffic from Trust to DMZ is being decrypted with a Forward Proxy rule.Which combination of service and application, and order of Security policy rules, needs to be configured to allow cJeartext web-browsing traffic to this server on tcp/443?

Rule #1: application; web-browsing; service: service-https; action: allow Rule #2 application: ssl;service: application-default, action: allow

Rule #1 application: web-browsing; service application-default; action: allow Rule #2- application: ssl; service: application-default; action: allow

Rule #1: application; web-browsing; service: service-https; action: allow Rule #2 application: ssl;service: application-default, action: allow

Rule #1: application: web-browsing; service: service-http; action: allow Rule #2: application: ssl;service: application-default; action: allow

Rule tf1 application: ssl; service: application-default; action: allow Rule #2 application; webbrowsing; service application-default; action: allow

The firewall identifies a popular application as an unKnown-tcp.Which two options are available to identify the application? (Choose two.)

Submit an App-ID request to Palo Alto Networks.

Create a custom object for the application server.

Create a Security policy to identify the custom application.

An administrator is required to create an application-based Security policy rule to allow Evernote.The Evernote application implicitly uses SSL and web browsing. What is the minimum the administrator needs to configure in the Security rule to allow only Evernote?

Add only the Evernote application to the Security policy rule.

Add the Evernote application to the Security policy rule, then add a second Security policy rule containing both HTTP and SSL.

Add the HTTP, SSL, and Evernote applications to the same Security policy

Add only the Evernote application to the Security policy rule.

Create an Application Override using TCP ports 443 and 80.

Your company occupies one floor in a single building. You have two Active Directory domain controllers on a single network. The firewall's management-plane resources are lightly utilized.Given the size of this environment, which User-ID collection method is sufficient?

PAN-OS integrated agent deployed on the firewall

Citrix terminal server agent deployed on the network

Windows-based agent deployed on each domain controller

PAN-OS integrated agent deployed on the firewall

An engineer needs to permit XML API access to a firewall for automation on a network segment that is routed through a Layer 3 sub interface on a Palo Alto Networks firewall. However this network segment cannot access the dedicated management interface due to the Security policy Without changing the existing access to the management interface how can the engineer fulfill this request?

Enable HTTPS in an Interface Management profile on the sub interface

Add the network segment's IP range to the Permitted IP Addresses list

Specify the subinterface as a management interface in Setup > Device > Interfaces

Cnfigure a service route for HTTP to use the subinterface

A Panorama administrator configures a new zone and uses the zone in a new Security policy.After the administrator commits the configuration to Panorama, which device-group commit push operation should the administrator use to ensure that the push is successful?

include device and network templates

specify the template as a reference template

include device and network templates

A network administrator configured a site-to-site VPN tunnel where the peer device will act as initiator None of the peer addresses are known What can the administrator configure to establish the VPN connection1?

Use the Dynamic IP address type

Set up certificate authentication

Use the Dynamic IP address type

Configure the peer address as an FQDN

Palo Alto Networks PCNSE Practice Test 4 - Free Online Exam Prep & Questions

A network security administrator has an environment with multiple forms of authentication. There is a network access control system in place that authenticates and restricts access for wireless users, multiple Windows domain controllers, and an MDM solution for company-provided smartphones. All of these devices have their authentication events logged.

Given the information, what is the best choice for deploying User-ID to ensure maximum coverage?

Become a Premium Member for full access

Unlock Premium Member

Palo Alto Networks PCNSE Practice Test 4

Question

Palo Alto Networks PCNSE Practice Tests

Practice Tests