Where is Palo Alto Networks Device Telemetry data stored on a firewall with a device certificate installed?

On Palo Alto Networks Update Servers

A company is deploying User-ID in their network. The firewall learn needs to have the ability to see and choose from a list of usernames and user groups directly inside the Panorama policies when creating new security rules How can this be achieved?

By configuring User-ID group mapping in Panorama > User Identification

By configuring Data Redistribution Client in Panorama > Data Redistribution

By configuring User-ID source device in Panorama > Managed Devices

By configuring User-ID group mapping in Panorama > User Identification

By configuring Master Device in Panorama > Device Groups

After importing a pre-configured firewall configuration to Panorama, what step is required to ensure a commit/push is successful without duplicating local configurations?

Perform the Export or push Device Config Bundle to the newly managed firewall.

Ensure Force Template Values is checked when pushing configuration.

Push the Template first, then push Device Group to the newly managed firewal.

Perform the Export or push Device Config Bundle to the newly managed firewall.

Push the Device Group first, then push Template to the newly managed firewall

An engineer creates a set of rules in a Device Group (Panorama) to permit traffic to various services for a specific LDAP user group.What needs to be configured to ensure Panorama can retrieve user and group information for use in these rules?

A service route to the LDAP server

A User-ID agent on the LDAP server

An engineer is tasked with configuring SSL forward proxy for traffic going to external sites.Which of the following statements is consistent with SSL decryption best practices?

The forward untrust certificate should be signed by a certificate authority that is trusted by the clients.

The forward trust certificate should not be stored on an HSM.

The forward untrust certificate should be signed by a certificate authority that is trusted by the clients.

Check both the Forward Trust and Forward Untrust boxes when adding a certificate for use with SSL decryption

The forward untrust certificate should not be signed by a Trusted Root CA

An engineer discovers the management interface is not routable to the User-ID agent What configuration is needed to allow the firewall to communicate to the User-ID agent?

Create a custom service route for the UID Agent

Create a NAT policy for the User-ID agent server

Add a Policy Based Forwarding (PBF) policy to the User-ID agent IP

Create a custom service route for the UID Agent

Add a static route to the virtual router

Which GlobalProtect gateway selling is required to enable split-tunneling by access route, destination domain, and application?

No Direct Access to local networks

A firewall administrator is investigating high packet buffer utilization in the company firewall. After looking at the threat logs and seeing many flood attacks coming from a single source that are dropped a by the firewall, the administrator decides to enable packet butter protection to protect against similar attacks.The administrator enables packet buffer protection globally in the firewall but still sees a high packet buffer utilization rate.What else should the administrator do to stop packet buffers from being overflowed?

Enable packet buffer protection for the affected zones.

Add the default Vulnerability Protection profile to all security rules that allow traffic from outside.

Enable packet buffer protection for the affected zones.

Add a Zone Protection profile to the affected zones.

Apply DOS profile to security rules allow traffic from outside.

Which CLI command displays the physical media that are connected to ethernet1/8?

> show system state filter-pretty sys.sl.p8.phy

> show system state filter-pretty sys.si.p8.stats

> show system state filter-pretty sys.sl.p8.phy

> show system state filter-pretty sys.sl.p8.med

An engineer must configure the Decryption Broker feature. To which router must the engineer assign the decryption forwarding interfaces that are used in Decryption Broker security chain?

The virtual router that routes the traffic that the Decryption Broker security chain inspects.

A virtual router that has no additional interfaces for passing data-type traffic and no other configured routes than those used for the security chain.

The default virtual router. If there is no default virtual router , the engineer must create one during setup.

A virtual router that is configured with at least one dynamic routing protocol and has at least one entry in the RIB

The virtual router that routes the traffic that the Decryption Broker security chain inspects.

Where can a service route be configured for a specific destination IP?

Use Device > Setup > Services > Service Route Configuration > Customize > Destination

Use Network > Virtual Routers, select the Virtual Router > Static Routes > IPv4

Use Device > Setup > Services > Services

Use Device > Setup > Services > Service Route Configuration > Customize > Destination

Use Device > Setup > Services > Service Route Configuration > Customize > IPv4

A firewall administrator wants to have visibility on one segment of the company network. The traffic on the segment is routed on the Backbone switch. The administrator is planning to apply Security rules on segment X after getting the visibility.There is already a PAN-OS firewall used in L3 mode as an internet gateway, and there are enough system resources to get extra traffic on the firewall. The administrator needs to complete this operation with minimum service interruptions and without making any IP changes.What is the best option for the administrator to take?

Configure the TAP interface for segment X on the firewall.

Configure vwire interfaces for segment X on the firewall.

Configure a Layer 3 interface for segment X on the firewall.

Configure a new vsys for segment X on the firewall.

Refer to the exhibit. An organization has Palo Alto Networks NGFWs that send logs to remote monitoring and security management platforms. The network team has reported excessive traffic on the corporate WAN.How could the Palo Alto Networks NGFW administrator reduce WAN traffic while maintaining support for all the existing monitoring/security platforms?

Forward logs from firewalls only to Panorama and have Panorama forward logs to other external services

Configure log compression and optimization features on all remote firewalls

Any configuration on an M-500 would address the insufficient bandwidth concerns

Forward logs from external sources to Panorama for correlation, and from Panorama send them to the NGFW

An ISP manages a Palo Alto Networks firewall with multiple virtual systems for its tenants.Where on this firewall can the ISP configure unique service routes for different tenants?

Setup > Services > Virtual Systems > Set Location > Service Route Configuration > Customize

Setup > Services > Virtual Systems > Set Location > Service Route Configuration > Inherit GlobalService Route Configuration

Setup > Services > Global > Service Route Configuration > Customize

Setup > Services > Virtual Systems > Set Location > Service Route Configuration > Customize

Setup > Services > Global > Service Route Configuration > Use Management Interface for all

In the New App Viewer under Policy Optimizer, what does the compare option for a specific rule allow an administrator to compare?

Applications configured in the rule with applications seen from traffic matching the same rule

The running configuration with the candidate configuration of the firewall

Applications configured in the rule with their dependencies

Applications configured in the rule with applications seen from traffic matching the same rule

The security rule with any other security rule selected

An engineer is tasked with deploying SSL Forward Proxy decryption for their organization.What should they review with their leadership before implementation?

Legal compliance regulations and acceptable usage policies

Browser-supported cipher documentation

Cipher documentation supported by the endpoint operating system

URL risk-based category distinctions

Legal compliance regulations and acceptable usage policies

As a best practice, logging at session start should be used in which case?

Only when log at session end is enabled

An auditor is evaluating the configuration of Panorama and notices a discrep-ancy between the Panorama template and the local firewall configuration.When overriding the firewall configuration pushed from Panorama, what should you consider?

The modification will not be visible in Panorama.

The firewall template will show that it is out of sync within Panorama.

Panorama will update the template with the overridden value.

Only Panorama can revert the override.

An administrator needs to gather information about the firewall CPU utiliza-tion on both the management plane and the data plane.Where does the administrator view the desired data?

System Resources Widget on the Dashboard

Application Command and Control Center

System Resources Widget on the Dashboard

Palo Alto Networks PCNSE Practice Test 7 - Free Online Exam Questions 241-280

In an existing deployment, an administrator with numerous firewalls and Panorama does not see any WildFire logs in Panoram a. Each firewall has an active WildFire subscription On each firewall. WildFire togs are available.

This issue is occurring because forwarding of which type of logs from the firewalls to Panorama is missing?

Become a Premium Member for full access

Unlock Premium Member

Palo Alto Networks PCNSE Practice Test 7

Question

Drag and Drop

Hot Area

Palo Alto Networks PCNSE Practice Tests

Practice Tests