Which two events trigger the operation of automatic commit recovery? (Choose two.)

when Panorama pushes a configuration

when a firewall performs a local commit

when an aggregate Ethernet interface component fails

when Panorama pushes a configuration

when a firewall HA pair fails over

when a firewall performs a local commit

A users traffic traversing a Palo Alto networks NGFW sometimes can reach http //www company comAt other times the session times out. At other times the session times out The NGFW has beenconfigured with a PBF rule that the user traffic matches when it goes to http://www.company.comgoes to http://www company comHow can the firewall be configured to automatically disable the PBF rule if the next hop goes down?

Create and add a monitor profile with an action of fail over in the PBF rule in question

Create and add a monitor profile with an action of wait recover in the PBF rule in question

Configure path monitoring for the next hop gateway on the default route in the virtual router

Enable and configure a link monitoring profile for the external interface of the firewall

The Aggregate Ethernet interface is showing down on a passive PA-7050 firewall of an active/passive HA pair. The HA Passive Link State is set to "Auto" under Device > High Availability > General > Active/Passive Settings. The AE interface is configured with LACP enabled and is up only on the active firewall.Why is the AE interface showing down on the passive firewall?

It does not perform pre-negotiation LACP unless "Enable in HA Passive State" is selected under the High Availability Options on the LACP tab of the AE Interface.

It does not participate in LACP negotiation unless Fast Failover is selected under the Enable LACP selection on the LACP tab of the AE Interface.

It participates in LACP negotiation when Fast is selected for Transmission Rate under the Enable LACP selection on the LACP tab of the AE Interface.

It performs pre-negotiation of LACP when the mode Passive is selected under the Enable LACP selection on the LACP tab of the AE Interface.

Refer to the exhibit. Based on the screenshots above what is the correct order in which the various rules are deployed to firewalls inside the DATACENTER_DG device group?

shared pre-rulesDATACENTER DG pre rulesrules configured locally on the firewallshared post-rulesDATACENTER_DG post-rulesDATACENTER.DG default rules

shared pre-rulesDATACENTER_DG pre-rulesrules configured locally on the firewallshared post-rulesDATACENTER.DG post-rulesshared default rules

shared pre-rulesDATACENTER_DG pre-rulesrules configured locally on the firewallDATACENTER_DG post-rulesshared post-rulesshared default rules

shared pre-rulesDATACENTER_DG pre-rulesrules configured locally on the firewallDATACENTER_DG post-rulesshared post-rulesDATACENTER_DG default rules

How can Panorama help with troubleshooting problems such as high CPU or resource exhaustion on a managed firewall?

Panorama provides information about system resources of the managed devices in the Managed Devices > Health menu

Firewalls send SNMP traps to Panorama when resource exhaustion is detected Panorama generates a system log and can send email alerts

Panorama provides visibility into all the system and traffic logs received from firewalls it does not offer any ability to see or monitor resource utilization on managed firewalls

Panorama monitors all firewalls using SNMP It generates a system log and can send email alerts when resource exhaustion is detected on a managed firewall

Panorama provides information about system resources of the managed devices in the Managed Devices > Health menu

Four configuration choices are listed, and each could be used to block access to a specific URL II you configured each choice to block the same URL, then which choice would be evaluated last in the processing order to block access to the URL1?

PAN-DB URL category in URL Filtering profile

Custom URL category in Security policy rule

Custom URL category in URL Filtering profile

After configuring HA in Active/Passive mode on a pair of firewalls the administrator gets a failed commit with the following details. What are two s for this type of issue? (Choose two)

The Backup Peer HA1 IP Address was not configured when the commit was issued

Either management or a data-plane interface is used as HA1-backup

The peer IP is not included in the permit list on Management Interface Settings

The Backup Peer HA1 IP Address was not configured when the commit was issued

Either management or a data-plane interface is used as HA1-backup

One of the firewalls has gone into the suspended state

A company with already deployed Palo Alto firewalls has purchased their first Panorama server. The security team has already configured all firewalls with the Panorama IP address and added all the firewall serial numbers in Panoram a.What are the next steps to migrate configuration from the firewalls to Panorama?

import Device Configuration to Panorama followed by Export or Push Device Config Bundle

Use API calls to retrieve the configuration directly from the managed devices

Export Named Configuration Snapshot on each firewall followed by Import Named Configuration Snapshot in Panorama

import Device Configuration to Panorama followed by Export or Push Device Config Bundle

Use the Firewall Migration plugin to retrieve the configuration directly from the managed devices

Review the screenshot of the Certificates page. An administrator tor a small LLC has created a series of certificates as shown, to use tor a planned Decryption roll out The administrator has also installed the sell-signed root certificate <n all client systems When testing, they noticed that every time a user visited an SSL site they received unsecured website warnings What is the cause of the unsecured website warnings.

The forward trust certificate has not been signed by the set-singed root CA certificate

The self-signed CA certificate has the same CN as the forward trust and untrust certificates

The forward untrust certificate has not been signed by the self-singed root CA certificate

The forward trust certificate has not been installed in client systems

Which statement about High Availability timer settings is true?

Use the Critical timer for taster failover timer settings.

Use the Moderate timer for typical failover timer settings.

Use the Critical timer for taster failover timer settings.

Use the Recommended timer for faster failover timer settings.

Use the Aggressive timer for taster failover timer settings

What are two best practices for incorporating new and modified App-IDs? (Choose two)

Configure a security policy rule to allow new App-lDs that might have network-wide impact

Study the release notes and install new App-IDs if they are determined to have low impact

Configure a security policy rule to allow new App-lDs that might have network-wide impact

Study the release notes and install new App-IDs if they are determined to have low impact

Perform a Best Practice Assessment to evaluate the impact or the new or modified App-IDs

Run the latest PAN-OS version in a supported release tree to have the best performance for the new App-IDs

An engineer has been given approval to upgrade their environment 10 PAN-OS 10 2 The environment consists of both physical and virtual firewalls a virtual Panorama HA pair, and virtual log collectors What is the recommended order when upgrading to PAN-OS 10.2?

Upgrade Panorama, upgrade the log collectors, upgrade the firewalls

Upgrade the firewalls upgrade log collectors, upgrade Panorama

Upgrade the firewalls upgrade Panorama, upgrade the log collectors

Upgrade the log collectors, upgrade the firewalls, upgrade Panorama

Which benefit do policy rule UUlDs provide?

An audit trail across a policy's lifespan

Functionality for scheduling policy actions

The use of user IP mapping and groups in policies

Cloning of policies between device-groups

A network security administrator wants to begin inspecting bulk user HTTPS traffic flows egressingout of the internet edge firewall. Which certificate is the best choice to configure as an SSL ForwardTrust certificate?

A subordinate Certificate Authority certificate signed by the organization's PKI

A self-signed Certificate Authority certificate generated by the firewall

A Machine Certificate for the firewall signed by the organization's PKI

A web server certificate signed by the organization's PKI

A subordinate Certificate Authority certificate signed by the organization's PKI

During a laptop-replacement project, remote users must be able to establish a GlobalProtect VPN connection to the corporate network before logging in to their new Windows 10 endpoints.The new laptops have the 5.2.10 GlobalProtect Agent installed, so the administrator chooses to use the Connect Before Logon feature to solve this issue.What must be configured to enable the Connect Before Logon feature?

Registry keys on the Windows system.

The GlobalProtect Portal Agent App Settings Connect Method to Pre-logon then On-demand.

Registry keys on the Windows system.

X-Auth Support in the GlobalProtect Gateway Tunnel Settings.

The Certificate profile in the GlobalProtect Portal Authentication Settings.

Refer to the exhibit. Using the above screenshot of the ACC, what is the best method to set a global filter, narrow down Blocked User Activity, and locate the user(s) that could be compromised by a botnet?

Click the left arrow beside the Zero Access.Gen threat.

Click the hyperlink for the Zero Access.Gen threat.

Click the left arrow beside the Zero Access.Gen threat.

Click the source user with the highest threat count.

Click the hyperlink for the hotport threat Category.

An administrator creates an application-based security policy rule and commits the change to the firewall. Which two methods should be used to identify the dependent applications for the respective rule? (Choose two.)

Review the App Dependency application list from the Commit Status view.

Open the security policy rule and review the Depends On application list.

Use the show predefined xpath <value> command and review the output.

Review the App Dependency application list from the Commit Status view.

Open the security policy rule and review the Depends On application list.

Reference another application group containing similar applications.

What happens when an A/P firewall cluster synchronizes IPsec tunnel security associations (SAs)?

Phase 2 SAs are synchronized over HA2 links.

Phase 1 and Phase 2 SAs are synchronized over HA3 links.

Phase 1 SAs are synchronized over HA1 links.

Phase 2 SAs are synchronized over HA2 links.

Phase 1 and Phase 2 SAs are synchronized over HA2 links.

An engineer is designing a deployment of multi-vsys firewalls.What must be taken into consideration when designing the device group structure?

Multiple vsys and firewalls can be assigned to a device group, and a multi-vsys firewall can have each vsys in a different device group.

Multiple vsys and firewalls can be assigned to a device group, and a multi-vsys firewall must have all its vsys in a single device group.

Only one vsys or one firewall can be assigned to a device group, except for a multi-vsys firewall, which must have all its vsys in a single device group.

Multiple vsys and firewalls can be assigned to a device group, and a multi-vsys firewall can have each vsys in a different device group.

Only one vsys or one firewall can be assigned to a device group, and a multi-vsys firewall can have each vsys in a different device group.

What happens, by default, when the GlobalProtect app fails to establish an IPSec tunnel to the GlobalProtect gateway?

It tries to establish a tunnel to the GlobalProtect gateway using SSL/TLS.

It stops the tunnel-establishment processing to the GlobalProtect gateway immediately.

It tries to establish a tunnel to the GlobalProtect gateway using SSL/TLS.

It keeps trying to establish an IPSec tunnel to the GlobalProtect gateway.

It tries to establish a tunnel to the GlobalProtect portal using SSL/TLS.

An engineer wants to configure aggregate interfaces to increase bandwidth and redundancy between the firewall and switch. Which statement is correct about the configuration of the interfaces assigned to an aggregate interface group?

They can have different hardware media such as the ability to mix fiber optic and copper.

They can have a different bandwidth.

They can have a different interface type such as Layer 3 or Layer 2.

They can have a different interface type from an aggregate interface group.

They can have different hardware media such as the ability to mix fiber optic and copper.

What is a key step in implementing WildFire best practices?

Ensure that a Threat Prevention subscription is active.

In a mission-critical network, increase the WildFire size limits to the maximum value.

Configure the firewall to retrieve content updates every minute.

In a security-first network, set the WildFire size limits to the minimum value.

Ensure that a Threat Prevention subscription is active.

An administrator is attempting to create policies for deployment of a device group and template stack. When creating the policies, the zone drop-down list does not include the required zone.What can the administrator do to correct this issue?

Add the template as a reference template in the device group.

Enable "Share Unused Address and Service Objects with Devices" in Panorama settings.

Add a firewall to both the device group and the template.

Specify the target device as the master device in the device group.

Add the template as a reference template in the device group.

Review the images. A firewall policy that permits web traffic includes the What is the result of traffic that matches the "Alert - Threats" Profile Match List?

The source address of traffic that matches a threat is automatically tagged as BadGuys for 180 minutes.

The source address of SMTP traffic that matches a threat is automatically blocked as BadGuys for 180 minutes.

The source address of traffic that matches a threat is automatically blocked as BadGuys for 180 minutes.

The source address of traffic that matches a threat is automatically tagged as BadGuys for 180 minutes.

The source address of SMTP traffic that matches a threat is automatically tagged as BadGuys for 180 minutes.

A system administrator runs a port scan using the company tool as part of vulnerability check. The administrator finds that the scan is identified as a threat and is dropped by the firewall. After further investigating the logs, the administrator finds that the scan is dropped in the Threat Logs.What should the administrator do to allow the tool to scan through the firewall?

Add the tool IP address to the reconnaissance protection source address exclusion in the Zone Protection profile.

Remove the Zone Protection profile from the zone setting.

Add the tool IP address to the reconnaissance protection source address exclusion in the Zone Protection profile.

Add the tool IP address to the reconnaissance protection source address exclusion in the DoS Protection profile.

Change the TCP port scan action from Block to Alert in the Zone Protection profile.

An administrator has 750 firewalls. The administrator's central-management Panorama instance deploys dynamic updates to the firewalls. The administrator notices that the dynamic updates from Panorama do not appear on some of the firewalls.If Panorama pushes the configuration of a dynamic update schedule to managed firewalls, but the configuration does not appear, what is the root cause?

Locally-defined dynamic update settings take precedence over the settings that Panorama pushed.

Panorama does not have valid licenses to push the dynamic updates.

Panorama has no connection to Palo Alto Networks update servers.

No service route is configured on the firewalls to Palo Alto Networks update servers.

Locally-defined dynamic update settings take precedence over the settings that Panorama pushed.

An administrator wants to grant read-only access to all firewall settings, except administrator accounts, to a new-hire colleague in the IT department.Which dynamic role does the administrator assign to the new-hire colleague?

Device administrator (read-only)

System administrator (read-only)

Firewall administrator (read-only)

Which feature checks Panorama connectivity status after a commit?

Device monitoring data under Panorama settings

What is the dependency for users to access services that require authentication?

A Security policy allowing users to access those services

An Authentication profile that includes those services

Disabling the authentication timeout

An authentication sequence that includes those services

A Security policy allowing users to access those services

Palo Alto Networks PCNSE Practice Test 5 - Free Online Exam Questions 161-200

An administrator has left a firewall to use the default port for all management services. Which three functions are performed by the dataplane?

Become a Premium Member for full access

Unlock Premium Member

Palo Alto Networks PCNSE Practice Test 5

Question

Palo Alto Networks PCNSE Practice Tests

Practice Tests