An administrator connected a new fiber cable and transceiver to interface Ethernetl/l on a Palo Alto Networks firewall. However, the link does not seem to be coming up.If an administrator were to troubleshoot, how would they confirm the transceiver type, tx-power, rxpower, vendor name, and part number via the CLI?

show system state filter ethernet1/1

show system state filter sw.dev.interface.config

show system state filter-pretty sys.s1.*

show system state filter ethernet1/1

Which two factors should be considered when sizing a decryption firewall de-ployment? (Choose two.)

Number of security zones in decryption policies

Which operation will impact the performance of the management plane?

Generating a SaaS Application report

Enabling packet buffer protection

Which three items must be configured to implement application override? (Choose three )

Application override policy rule

After implementing a new NGFW, a firewall engineer sees a VoIP traffic issue going through the firewall After troubleshooting the engineer finds that the firewall performs NAT on the voice packets payload and opens dynamic pinholes for media portsWhat can the engineer do to solve the VoIP traffic issue?

Disable ALG under SIP application

Disable ALG under H.323 application

Increase the TCP timeout under H.323 application

Increase the TCP timeout under SIP application

Disable ALG under SIP application

An administrator receives the following error message:"IKE phase-2 negotiation failed when processing Proxy ID. Received local id 192.168 33 33/24 type IPv4 address protocol 0 port 0, received remote id 172.16 33.33/24 type IPv4 address protocol 0 port 0."How should the administrator identify the root cause of this error message?

Check whether the VPN peer on one end is set up correctly using policy-based VPN

In the IKE Gateway configuration, verify that the IP address for each VPN peer is accurate

Verify that the IP addresses can be pinged and that routing issues are not causing the connection failure

Check whether the VPN peer on one end is set up correctly using policy-based VPN

In the IPSec Crypto profile configuration, verify that PFS is either enabled on both VPN peers or disabled on both VPN peers.

Based on the graphic which statement accurately describes the output shown in the Server Monitoring panel?

The User-ID agent is connected to a domain controller labeled lab-client

The host lab-client has been found by a domain controller

The host lab-client has been found by the User-ID agent.

The User-ID aaent is connected to the firewall labeled lab-client

To ensure that a Security policy has the highest priority, how should an administrator configure a Security policy in the device group hierarchy?

Add the policy in the shared device group as a pre-rule

Add the policy to the target device group and apply a master device to the device group.

Reference the targeted device's templates in the target device group.

Clone the security policy and add it to the other device groups.

Add the policy in the shared device group as a pre-rule

Given the following snippet of a WildFire submission log did the end-user get access to the requested information and why or why not?

Yes, because the action is set to allow.

Yes, because the action is set to alert

No, because this is an example from a defeated phishing attack

No, because the severity is high and the verdict is malicious.

Yes, because the action is set to allow.

Which new PAN-OS 11.0 feature supports Pv6 traffic?

DHCPv6 Client with Prefix Delegation

Information Security is enforcing group-based policies by using security-event monitoring on Windows User-ID agents for IP-to-User mapping in the network. During the rollout, Information Security identified a gap for users authenticating to their VPN and wireless networks. Root cause analysis showed that users were authenticating via RADIUS and that authentication events were not captured on the domain controllers that were being monitored Information Security found that authentication events existed on the Identity Management solution (IDM). There did not appear to be direct integration between PAN-OS and the IDM solutionHow can Information Security extract and learn iP-to-user mapping information from authentication events for VPN and wireless users?

Configure the User-ID XML API on PAN-OS firewalls to pull the authentication events directly from the IDM solution

Add domain controllers that might be missing to perform security-event monitoring for VPN and wireless users.

Configure the integrated User-ID agent on PAN-OS to accept Syslog messages over TLS.

Configure the User-ID XML API on PAN-OS firewalls to pull the authentication events directly from the IDM solution

Configure the Windows User-ID agents to monitor the VPN concentrators and wireless controllers for IP-to-User mapping.

A company has recently migrated their branch office's PA-220S to a centralized Panorama. This Panorama manages a number of PA-7000 Series and PA-5200 Series devices All device group and template configuration is managed solely within PanoramaThey notice that commit times have drastically increased for the PA-220S after the migrationWhat can they do to reduce commit times?

Disable "Share Unused Address and Service Objects with Devices" in Panorama Settings.

Update the apps and threat version using device-deployment

Perform a device group push using the "merge with device candidate config" option

Use "export or push device config bundle" to ensure that the firewall is integrated with the Panorama config.

Why would a traffic log list an application as "not-applicable"?

The firewall denied the traffic before the application match could be performed.

The TCP connection terminated without identifying any application data

There was not enough application data after the TCP connection was established

The application is not a known Palo Alto Networks App-ID.

A network administrator configured a site-to-site VPN tunnel where the peer device will act as initiator None of the peer addresses are knownWhat can the administrator configure to establish the VPN connection?

Use the Dynamic IP address type.

Set up certificate authentication.

Use the Dynamic IP address type.

Configure the peer address as an FQDN.

What are three tasks that cannot be configured from Panorama by using a template stack? (Choose three.)

Change the firewall management IP address

Enable operational modes such as normal mode, multi-vsys mode, or FIPS-CC mode

Change the firewall management IP address

Rename a vsys on a multi-vsys firewall

Enable operational modes such as normal mode, multi-vsys mode, or FIPS-CC mode

An engineer must configure a new SSL decryption deployment.Which profile or certificate is required before any traffic that matches an SSL decryption rule is decrypted?

A Decryption profile must be attached to the Decryption policy that the traffic matches.

There must be a certificate with both the Forward Trust option and Forward Untrust option selected.

A Decryption profile must be attached to the Security policy that the traffic matches.

A Decryption profile must be attached to the Decryption policy that the traffic matches.

There must be a certificate with only the Forward Trust option selected.

An administrator notices that an interface configuration has been overridden locally on a firewall. They require all configuration to be managed from Panorama and overrides are not allowed.What is one way the administrator can meet this requirement?

Perform a template commit push from Panorama using the 'Force Template Values' option.

Perform a commit force from the CLI of the firewall.

Perform a template commit push from Panorama using the 'Force Template Values' option.

Perform a device-group commit push from Panorama using the 'Include Device and Network Templates' option.

Reload the running configuration and perform a Firewall local commit

A firewall engineer reviews the PAN-OS GlobalProtect application and sees that it implicitly uses web-browsing and depends on SSL.When creating a new rule, what is needed to allow the application to resolve dependencies?

Add SSL application to the same rule.

Add SSL and web-browsing applications to the same rule.

Add web-browsing application to the same rule.

Add SSL application to the same rule.

SSL and web-browsing must both be explicitly allowed

An administrator has configured OSPF with Advanced Routing enabled on a Palo Alto Networks firewall running PAN-OS 10.2. After OSPF was configured, the administratornoticed that OSPF routes were not being learned.Which two actions could an administrator take to troubleshoot this issue? (Choose two.)

Run the CLI command show advanced-routing ospf neighbor

In the WebUl, view the Runtime Stats in the virtual router.

Run the CLI command show advanced-routing ospf neighbor

In the WebUl, view the Runtime Stats in the logical router.

In the WebUl, view the Runtime Stats in the virtual router.

Look for configuration problems in Network > virtual router > OSPF

Review the information below. A firewall engineer creates a U-NAT rule to allow users in the trust zone access to a server in the same zone by using an external,public NAT IP for that server.Given the rule below, what change should be made to make sure the NAT works as expected?

Add source Translation to translate original source IP to the firewall eth1/2 interface translation.

Change destination NAT zone to Trust_L3.

Change destination translation to Dynamic IP (with session distribution) using firewall ethI/2 address.

Change Source NAT zone to Untrust_L3.

Add source Translation to translate original source IP to the firewall eth1/2 interface translation.

An administrator needs to identify which NAT policy is being used for internet traffic.From the Monitor tab of the firewall GUI, how can the administrator identify which NAT policy is in use for a traffic flow?

Click Traffic view; ensure that the Source or Destination NAT columns are included and review the information in the detailed log view.

Click Session Browser and review the session details.

Click Traffic view and review the information in the detailed log view.

Click Traffic view; ensure that the Source or Destination NAT columns are included and review the information in the detailed log view.

Click App Scope > Network Monitor and filter the report for NAT rules

Which two policy components are required to block traffic in real time using a dynamic user group (DUG)? (Choose two.)

A Deny policy for the tagged traffic

An Allow policy for the initial traffic

A Deny policy for the tagged traffic

An Allow policy for the initial traffic

A Decryption policy to decrypt the traffic and see the tag

A Deny policy with the 'tag' App-ID to block the tagged traffic

A network security administrator wants to inspect HTTPS traffic from users as it egresses through a firewall to the Internet/Untrust zone from trusted network zones.The security admin wishes to ensure that if users are presented with invalid or untrusted security certificates, the user will see an untrusted certificate warning.What is the best choice for an SSL Forward Untrust certificate?

A self-signed certificate generated on the firewall

A web server certificate signed by the organization's PKI

A self-signed certificate generated on the firewall

A subordinate Certificate Authority certificate signed by the organization's PKI

A web server certificate signed by an external Certificate Authority

Palo Alto Networks PCNSE Practice Test 8 - Free Online Exam Questions 281-320

An administrator has purchased WildFire subscriptions for 90 firewalls globally.

What should the administrator consider with regards to the WildFire infra-structure?

Become a Premium Member for full access

Unlock Premium Member

Palo Alto Networks PCNSE Practice Test 8

Question

Palo Alto Networks PCNSE Practice Tests

Practice Tests