Given the screenshot, how did the firewall handle the traffic?

Traffic was allowed by policy but denied by profile as a threat

Traffic was allowed by policy but denied by profile as encrypted.

Traffic was allowed by policy but denied by profile as a threat

Traffic was allowed by profile but denied by policy as a threat.

Traffic was allowed by policy but denied by profile as a nonstandard port.

An administrator is receiving complaints about application performance degradation. After checking the ACC. the administrator observes that there Is an excessive amount of SSL trafficWhich three elements should the administrator configure to address this issue? (Choose three.)

QoS on the ingress Interface for the traffic flows

A QoS profile defining traffic classes

QoS on the egress interface for the traffic flows

QoS on the ingress Interface for the traffic flows

An Application Override policy for the SSL traffic

A QoS policy for each application ID

A QoS profile defining traffic classes

QoS on the egress interface for the traffic flows

A network administrator wants to deploy SSL Forward Proxy decryption. What two attributes should a forward trust certificate have? (Choose two.)

A certificate authority (CA) certificate

A Security policy rule is configured with a Vulnerability Protection Profile and an action of "Deny." Which action will this configuration cause on the matched traffic?

The "Deny" action will supersede the per-severity defined actions defined in the associated Vulnerability Protection Profile It will cause the firewall to deny the matched sessions.Any configured Security Profiles have no effect if the Security policy rule action is set to "Deny"

The Profile Settings section will be grayed out when the Action is set to "Deny"

It will cause the firewall to skip this Security policy rule. A warning will be displayed during a commit

The configuration will allow the matched session unless a vulnerability signature is detected.

The "Deny" action will supersede the per-severity defined actions defined in the associated Vulnerability Protection Profile It will cause the firewall to deny the matched sessions.Any configured Security Profiles have no effect if the Security policy rule action is set to "Deny"

An engineer has discovered that certain real-time traffic is being treated as best effort due to it exceeding defined bandwidth Which QoS setting should the engineer adjust?

QoS interface: Egress Guaranteed

An administrator has two pairs of firewalls within the same subnet. Both pairs of firewalls have been configured to use High Availability mode with Active/Passive. The ARP tables for upstream routes display the same MAC address being shared for some of these firewalls.What can be configured on one pair of firewalls to modify the MAC addresses so they are no longer in conflict?

Change the Group IDs in the High Availability settings to be different from the other firewall pair on the same subnet.

Configure a floating IP between the firewall pairs.

Change the Group IDs in the High Availability settings to be different from the other firewall pair on the same subnet.

Change the interface type on the interfaces that have conflicting MAC addresses from L3 to VLAN.

On one pair of firewalls, run the CLI command: set network interface vlan arp.

How can an administrator use the Panorama device-deployment option to update the apps and threat version of an HA pair of managed firewalls?

Choose the download and install action for both members of the HA pair in the Schedule object.

Configure the firewall's assigned template to download the content updates.

Choose the download and install action for both members of the HA pair in the Schedule object.

Switch context to the firewalls to start the download and install process.

Download the apps to the primary; no further action is required.

A firewall administrator requires an A/P HA pair to fail over more quickly due to critical business application uptime requirements.What is the correct setting?

Change the HA timer profile to "aggressive" or customize the settings in advanced profile.

Change the HA timer profile to "fast".

Change the HA timer profile to "user-defined" and manually set the timers.

Change the HA timer profile to "quick" and customize in advanced profile.

An administrator Just enabled HA Heartbeat Backup on two devices However, the status on tie firewall's dashboard is showing as down High Availability.What could an administrator do to troubleshoot the issue?

Check peer IP address In the permit list In Device > Setup > Management > Interfaces > Management Interface Settings

Goto Device > High Availability> General > HA Pair Settings > Setup and configuring the peer IP for heartbeat backup

Check peer IP address In the permit list In Device > Setup > Management > Interfaces > Management Interface Settings

Go to Device > High Availability > HA Communications> General> and check the Heartbeat Backup under Election Settings

Check peer IP address for heartbeat backup to Device > High Availability > HA Communications > Packet Forwarding settings.

A company has configured GlobalProtect to allow their users to work from home. A decrease in performance for remote workers has been reported during peak-use hours.Which two steps are likely to mitigate the issue? (Choose TWO)

Block traffic that is not work-related

Create a Tunnel Inspection policy

A network security administrator wants to configure SSL inbound inspection.Which three components are necessary for inspecting the HTTPS traffic as it enters the firewall?(Choose three.)

The web server's security certificate with the private key

The client's security certificate with the private key

What steps should a user take to increase the NAT oversubscription rate from the default platform setting?

Navigate to Device > Setup > Session Settings > NAT Oversubscription Rate

Navigate to Device > Setup > TCP Settings > NAT Oversubscription Rate

Navigate to Policies > NAT > Destination Address Translation > Dynamic IP (with session distribution)

Navigate to Policies > NAT > Source Address Translation > Dynamic IP (with session distribution)

Navigate to Device > Setup > Session Settings > NAT Oversubscription Rate

A network administrator is trying to prevent domain username and password submissions to phishing sites on some allowed URL categories Which set of steps does the administrator need to take in the URL Filtering profile to prevent credential phishing on the firewall?

Choose the URL categories in the User Credential Submission column and set action to block Select the User credential Detection tab and select Use Domain Credential Filter Commit

Choose the URL categories on Site Access column and set action to block Click the User credential Detection tab and select IP User Mapping Commit

Choose the URL categories in the User Credential Submission column and set action to block Select the User credential Detection tab and select use IP User Mapping Commit

Choose the URL categories in the User Credential Submission column and set action to block Select the URL filtering settings and enable Domain Credential Filter Commit

Choose the URL categories in the User Credential Submission column and set action to block Select the User credential Detection tab and select Use Domain Credential Filter Commit

An engineer is deploying multiple firewalls with common configuration in Panorama.What are two benefits of using nested device groups? (Choose two.)

Inherit parent Security policy rules and objects

Inherit settings from the Shared group

Inherit all Security policy rules and objects

Inherit parent Security policy rules and objects

A security engineer received multiple reports of an IPSec VPN tunnel going down the night before.The engineer couldn't find any events related to VPN under system togs.What is the likely cause?

The Tunnel Monitor is not configured.

Dead Peer Detection is not enabled.

Tunnel Inspection settings are misconfigured.

The Tunnel Monitor is not configured.

The log quota for GTP and Tunnel needs to be adjusted

How should an administrator enable the Advance Routing Engine on a Palo Alto Networks firewall?

Enable Advanced Routing in Network > Virtual Routers > Router Settings > General, then commit and reboot.

Enable Advanced Routing Engine in Device > Setup > Session > Session Settings, then commit and reboot.

Enable Advanced Routing in Network > Virtual Routers > Redistribution Profiles and then commit.

Enable Advanced Routing in Network > Virtual Routers > Router Settings > General, then commit and reboot.

Enable Advanced Routing in General Settings of Device > Setup > Management, then commit and reboot

A firewall engineer creates a new App-ID report under Monitor > Reports > Application Reports > New Application to monitor new applications on the network and better assess any Security policy updates the engineer might want to make.How does the firewall identify the New App-ID characteristic?

It matches to the New App-IDs in the most recently installed content releases.

It matches to the New App-IDs downloaded in the last 30 days.

It matches to the New App-IDs downloaded in the last 90 days

It matches to the New App-IDs installed since the last time the firewall was rebooted

It matches to the New App-IDs in the most recently installed content releases.

An organization conducts research on the benefits of leveraging the Web Proxy feature of PAN-OS 11.0.What are two benefits of using an explicit proxy method versus a transparent proxy method?(Choose two.)

Explicit proxy allows for easier troubleshooting, since the client browser is aware of the existence of the proxy.

Explicit proxy supports interception of traffic using non-standard HTTPS ports.

No client configuration is required for explicit proxy, which simplifies the deployment complexity.

Explicit proxy allows for easier troubleshooting, since the client browser is aware of the existence of the proxy.

Explicit proxy supports interception of traffic using non-standard HTTPS ports.

It supports the X-Authenticated-User (XAU) header, which contains the authenticated username in the outgoing request

What is the best definition of the Heartbeat Interval?

The interval in milliseconds between hello packets

The frequency at which the HA peers check link or path availability

The frequency at which the HA peers exchange ping

The interval during which the firewall will remain active following a link monitor failure

An administrator wants to configure the Palo Alto Networks Windows User-ID agent to map IP addresses to usernames. The company uses four Microsoft Active Directory servers and two Microsoft Exchange servers, which can provide logs for login events.All six servers have IP addresses assigned from the following subnet: 192.168 28.32/27. The Microsoft Active Directory servers reside in 192.168.28.32/28. and the Microsoft Exchange servers resideL in 192.168.28 48/28 What information does the administrator need to provide in the User Identification > Discovery section?

The IP-address and corresponding server type (Microsoft Active Directory or Microsoft Exchange) for each of the six servers

Network 192 168.28.32/28 with server type Microsoft Active Directory and network 192.168.28.48/28 with server type Microsoft Exchange

Network 192 168 28.32/27 with server type Microsoft

One IP address of a Microsoft Active Directory server and "Auto Discover" enabled to automatically obtain all five of the other servers

A network engineer troubleshoots a VPN Phase 2 mismatch and decides that PFS (Perfect Forward Secrecy) needs to be enabled.What action should the engineer take?

Select the appropriate DH Group under the IPSec Crypto profile.

Add an authentication algorithm in the IPSec Crypto profile.

Enable PFS under the IPSec Tunnel advanced options.

Select the appropriate DH Group under the IPSec Crypto profile.

Enable PFS under the IKE gateway advanced options

A super user is tasked with creating administrator accounts for three contractors. For compliance purposes, all three contractors will be working with different device-groups m their hierarchy to deploy policies and objects.Which type of role-based access is most appropriate for this project?

Create a Device Group and Template Admin.

Create a Dynamic Admin with the Panorama Administrator role.

Create a Device Group and Template Admin.

Create a Custom Panorama Admin.

Create a Dynamic Read only superuser

An engineer receives reports from users that applications are not working and that websites are only partially loading in an asymmetric environment. After investigating, the engineer observes the flow_tcp_non_syn_drop counter increasing in the show counters global output.Which troubleshooting command should the engineer use to work around this issue?

set deviceconfig setting session tcp-reject-non-syn no

set deviceconfig setting tcp asymmetric-path drop

set deviceconfig setting session tcp-reject-non-syn no

set session tcp-reject-non-syn yes

set deviceconfig setting tcp asymmetric-path bypass

Palo Alto Networks PCNSE Practice Test 6 - Free Online Exam Questions 201-240

A network engineer is troubleshooting a VPN and wants to verify whether the decapsulation/encapsulation counters are increasing. Which CLI command should the engineer run?

Become a Premium Member for full access

Unlock Premium Member

Palo Alto Networks PCNSE Practice Test 6

Question

Palo Alto Networks PCNSE Practice Tests

Practice Tests