An engineer is configuring a firewall with three interfaces:* MGT connects to a switch with internet access.* Ethernet1/1 connects to an edge router.* Ethernet1/2 connects to a visualization network.The engineer needs to configure dynamic updates to use a dataplane interface for internet traffic. What should be configured in Setup > Services > Service Route Configurationto allow this traffic?

Set DNS and Palo Alto Networks Services to use the ethernet1/1 source interface.

Set DNS and Palo Alto Networks Services to use the ethernet1/2 source interface.

Set DNS and Palo Alto Networks Services to use the MGT source interface.

Set DDNS and Palo Alto Networks Services to use the MGT source interface

An administrator is using Panorama to manage multiple firewalls. After upgrading all devices to the latest PAN-OS software, the administrator enables log forwarding from the firewalls to Panorama.However, pre-existing logs from the firewalls are not appearing in Panorama.Which action should be taken to enable the firewalls to send their pre-existing logs to Panorama?

Use the import option to pull logs.

Use the scp logdb export command.

Use the ACC to consolidate the logs.

An engineer configures a specific service route in an environment with multiple virtual systems instead of using the inherited global service route configuration.What type of service route can be used for this configuration?

IPv6 Source or Destination Address

Destination-Based Service Route

A firewall engineer creates a NAT rule to translate IP address 1.1.1.10 to 192.168.1.10. The engineer also plans to enable DNS rewrite so that the firewall rewrites the IPv4 address in a DNS response based on the original destination IP address and translated destination IP address configured for the rule. The engineer wants the firewall to rewrite a DNS response of 1.1.1.10 to 192.168.1.10.What should the engineer do to complete the configuration?

Enable DNS rewrite under the destination address translation in the Translated Packet section of the NAT rule with the direction Forward.

Create a U-Turn NAT to translate the destination IP address 192.168.1.10 to 1.1.1.10 with the destination port equal to UDP/53.

Enable DNS rewrite under the destination address translation in the Translated Packet section of the NAT rule with the direction Forward.

Enable DNS rewrite under the destination address translation in the Translated Packet section of the NAT rule with the direction Reverse.

Create a U-Turn NAT to translate the destination IP address 1.1.1.10 to 192.168.1.10 with the destination port equal to UDP/53.

After switching to a different WAN connection, users have reported that various websites will not load, and timeouts are occurring. The web servers work fine from other locations.The firewall engineer discovers that some return traffic from these web servers is not reaching the users behind the firewall. The engineer later concludes that the maximum transmission unit (MTU) on an upstream router interface is set to 1400 bytes.The engineer reviews the following CLI output for ethernet1/1. Which setting should be modified on ethernet1/1 to remedy this problem?

Adjust the TCP maximum segment size (MSS) value. *

Lower the interface MTU value below 1500.

Enable the Ignore IPv4 Don't Fragment (DF) setting.

Change the subnet mask from /23 to /24.

Adjust the TCP maximum segment size (MSS) value. *

What is the best description of the Cluster Synchronization Timeout (min)?

The maximum time that the local firewall waits before going to Active state when another cluster member is preventing the cluster from fully synchronizing

The time that a passive or active-secondary firewall will wait before taking over as the active or active-primary firewall

The timeframe within which the firewall must receive keepalives from a cluster member to know that the cluster member is functional

The maximum interval between hello packets that are sent to verify that the HA functionality on the other firewall is operational

What can the Log Forwarding built-in action with tagging be used to accomplish?

Block the destination IP addresses of selected unwanted traffic.

Block the source zones of selected unwanted traffic.

Block the destination IP addresses of selected unwanted traffic.

Forward selected logs to the Azure Security Center.

Block the destination zones of selected unwanted traffic.

Which three statements accurately describe Decryption Mirror? (Choose three.)

Use of Decryption Mirror might enable malicious users with administrative access to the firewall to harvest sensitive information that is submitted via an encrypted channel

Decryption, storage, inspection, and use of SSL traffic are regulated in certain countries.

You should consult with your corporate counsel before activating and using Decryption Mirror in a production environment.

Decryption Mirror requires a tap interface on the firewall

Use of Decryption Mirror might enable malicious users with administrative access to the firewall to harvest sensitive information that is submitted via an encrypted channel

Only management consent is required to use the Decryption Mirror feature.

Decryption, storage, inspection, and use of SSL traffic are regulated in certain countries.

You should consult with your corporate counsel before activating and using Decryption Mirror in a production environment.

A network security engineer needs to enable Zone Protection in an environment that makes use of Cisco TrustSec Layer 2 protectionsWhat should the engineer configure within a Zone Protection profile to ensure that the TrustSec packets are identified and actions are taken upon them?

TCP Fast Open in the Strip TCP options

Stream ID in the IP Option Drop options

Record Route in IP Option Drop options

An administrator has been tasked with configuring decryption policies,Which decryption best practice should they consider?

Consider the local, legal, and regulatory implications and how they affect which traffic can be decrypted.

Decrypt all traffic that traverses the firewall so that it can be scanned for threats.

Place firewalls where administrators can opt to bypass the firewall when needed.

Create forward proxy decryption rules without Decryption profiles for unsanctioned applications.

When you import the configuration of an HA pair into Panorama, how do you prevent the import from affecting ongoing traffic?

Set the passive link state to shutdown'.

An engineer is troubleshooting a traffic-routing issue.What is the correct packet-flow sequence?

PBF > Static route > Security policy enforcement

PBF > Zone Protection Profiles > Packet Buffer Protection

PBF > Static route > Security policy enforcement

NAT > Security policy enforcement > OSPF

A consultant advises a client on designing an explicit Web Proxy deployment on PAN-OS 11 0 The client currently uses RADIUS authentication in their environmentWhich two pieces of information should the consultant provide regarding Web Proxy authentication? (Choose two.)

Kerberos or SAML authentication need to be configured

RADIUS is not supported for explicit or transparent Web Proxy

Kerberos or SAML authentication need to be configured

LDAP or TACACS+ authentication need to be configured

RADIUS is only supported for a transparent Web Proxy.

RADIUS is not supported for explicit or transparent Web Proxy

A root cause analysis investigation into a recent security incident reveals that several decryption rules have been disabled. The security team wants to generate email alerts when decryption rules are changed.How should email log forwarding be configured to achieve this goal?

With the relevant system log filter inside Device > Log Settings

With the relevant configuration log filter inside Device > Log Settings

With the relevant system log filter inside Objects > Log Forwarding

With the relevant system log filter inside Device > Log Settings

With the relevant configuration log filter inside Objects > Log Forwarding

A firewall administrator is configuring an IPSec tunnel between Site A and Site B. The Site A firewall uses a DHCP assigned address on the outside interface of the firewall, and the Site B firewall uses a static IP address assigned to the outside interface of the firewall. However, the use of dynamic peering is not working.Refer to the two sets of configuration settings provided. Which two changes will allow the configurations to work? (Choose two.)Site A configuration:

Disable passive mode on Site A firewall

Match IKE version on both firewalls.

Enable NAT Traversal on Site B firewall

Configure Local Identification on Site firewall

Disable passive mode on Site A firewall

Match IKE version on both firewalls.

A firewall administrator configures the HIP profiles on the edge firewall where GlobalProtect is enabled, and adds the profiles to security rules. The administrator wants to redistribute the HIP reports to the data center firewalls to apply the same access restrictions using HIP profiles. However, the administrator can only see the HIP match logs on the edge firewall but not on the data center firewallWhat are two reasons why the administrator is not seeing HIP match logs on the data center firewall? (Choose two.)

HIP profiles are configured but not added to security rules in the data center firewall.

User ID is not enabled in the Zone where the users are coming from in the data center firewall.

Log Forwarding Profile is configured but not added to security rules in the data center firewall.

HIP profiles are configured but not added to security rules in the data center firewall.

User ID is not enabled in the Zone where the users are coming from in the data center firewall.

HIP Match log forwarding is not configured under Log Settings in the device tab.

Why are external zones required to be configured on a Palo Alto Networks NGFW in an environment with multiple virtual systems?

To allow traffic between zones in different virtual systems while the traffic is leaving the appliance

To allow traffic between zones in different virtual systems without the traffic leaving the appliance

To allow traffic between zones in different virtual systems while the traffic is leaving the appliance

External zones are required because the same external zone can be used on different virtual systems

Multiple external zones are required in each virtual system to allow the communications between virtual systems

Given the following snippet of a WildFire submission log, did the end user successfully download a file?

No, because the action for the wildfire-virus is 'reset-both.'

No, because the URL generated an alert.

Yes, because both the web-browsing application and the flash file have the 'alert' action.

Yes, because the final action is set to 'allow.''

No, because the action for the wildfire-virus is 'reset-both.'

An engineer troubleshoots a high availability (HA) link that is unreliable.Where can the engineer view what time the interface went down?

Device > High Availability > Active/Passive Settings

Dashboard > Widgets > High Availability

An engineer troubleshoots a Panorama-managed firewall that is unable to reach the DNS servers configured via a global template. As a troubleshooting step, the engineer needs to configure a local DNS server in place of the template value.Which two actions can be taken to ensure that only the specific firewall is affected during this process? (Choose two )

Configure the DNS server locally on the firewall.

Override the DNS server on the template stack.

Configure the DNS server locally on the firewall.

Change the DNS server on the global template.

Override the DNS server on the template stack.

Configure a service route for DNS on a different interface.

Palo Alto Networks PCNSE Practice Test 9 - Free Online Exam Questions 321-360

Based on the screenshots above, and with no configuration inside the Template Stack itself, what access will the device permit on its Management port?

Palo Alto Networks PCNSE image Question 321 54558 09232024001220000000

Become a Premium Member for full access

Unlock Premium Member

Palo Alto Networks PCNSE Practice Test 9

Question

Palo Alto Networks PCNSE Practice Tests

Practice Tests