Home / Palo Alto Networks / PCNSE

Palo Alto Networks PCNSE Practice Test - Questions Answers, Page 19

Question list

List of questions

Question 181

(0)

A network security administrator wants to begin inspecting bulk user HTTPS traffic flows egressingout of the internet edge firewall. Which certificate is the best choice to configure as an SSL Forwa

Question 182

(0)

During a laptop-replacement project, remote users must be able to establish a GlobalProtect VPN connection to the corporate network before logging in to their new Windows 10 endpoints. The new lapt

Question 183

(0)

The decision to upgrade to PAN-OS 10.2 has been approved. The engineer begins the process by upgrading the Panorama servers, but gets an error when trying to install. When performing an upgrade on

Question 184

(0)

An engineer needs to collect User-ID mappings from the company's existing proxies. What two methods can be used to pull this data from third party proxies? (Choose two.)

Question 185

(0)

Refer to the exhibit. Using the above screenshot of the ACC, what is the best method to set a global filter, narrow down Blocked User Activity, and locate the user(s) that could be compromised by

Question 186

(0)

An administrator creates an application-based security policy rule and commits the change to the firewall. Which two methods should be used to identify the dependent applications for the respective

Question 187

(0)

What happens when an A/P firewall cluster synchronizes IPsec tunnel security associations (SAs)?

Question 188

(0)

An engineer is designing a deployment of multi-vsys firewalls. What must be taken into consideration when designing the device group structure?

Question 189

(0)

An administrator creates a custom application containing Layer 7 signatures. The latest application and threat dynamic update is downloaded to the same firewall. The update contains an application t

Question 190

(0)

What happens, by default, when the GlobalProtect app fails to establish an IPSec tunnel to the GlobalProtect gateway?

Question 181

A network security administrator wants to begin inspecting bulk user HTTPS traffic flows egressingout of the internet edge firewall. Which certificate is the best choice to configure as an SSL ForwardTrust certificate?

A self-signed Certificate Authority certificate generated by the firewall

A Machine Certificate for the firewall signed by the organization's PKI

A web server certificate signed by the organization's PKI

A subordinate Certificate Authority certificate signed by the organization's PKI

Show Answer Comment (0)

Question 182

During a laptop-replacement project, remote users must be able to establish a GlobalProtect VPN connection to the corporate network before logging in to their new Windows 10 endpoints.

The new laptops have the 5.2.10 GlobalProtect Agent installed, so the administrator chooses to use the Connect Before Logon feature to solve this issue.

What must be configured to enable the Connect Before Logon feature?

The GlobalProtect Portal Agent App Settings Connect Method to Pre-logon then On-demand.

Registry keys on the Windows system.

X-Auth Support in the GlobalProtect Gateway Tunnel Settings.

The Certificate profile in the GlobalProtect Portal Authentication Settings.

Show Answer Comment (0)

Question 183

The decision to upgrade to PAN-OS 10.2 has been approved. The engineer begins the process by upgrading the Panorama servers, but gets an error when trying to install.

When performing an upgrade on Panorama to PAN-OS 10.2, what is the potential cause of a failed install?

Management only mode

Expired certificates

Outdated plugins

GlobalProtect agent version

Show Answer Comment (0)

Question 184

An engineer needs to collect User-ID mappings from the company's existing proxies.

What two methods can be used to pull this data from third party proxies? (Choose two.)

Syslog

XFF Headers

Client probing

Server Monitoring

Show Answer Comment (0)

Question 185

Refer to the exhibit.

Using the above screenshot of the ACC, what is the best method to set a global filter, narrow down Blocked User Activity, and locate the user(s) that could be compromised by a botnet?

Click the hyperlink for the Zero Access.Gen threat.

Click the left arrow beside the Zero Access.Gen threat.

Click the source user with the highest threat count.

Click the hyperlink for the hotport threat Category.

Show Answer Comment (0)

Question 186

An administrator creates an application-based security policy rule and commits the change to the firewall. Which two methods should be used to identify the dependent applications for the respective rule? (Choose two.)

Use the show predefined xpath <value> command and review the output.

Review the App Dependency application list from the Commit Status view.

Open the security policy rule and review the Depends On application list.

Reference another application group containing similar applications.

Show Answer Comment (0)

Question 187

What happens when an A/P firewall cluster synchronizes IPsec tunnel security associations (SAs)?

Phase 1 and Phase 2 SAs are synchronized over HA3 links.

Phase 1 SAs are synchronized over HA1 links.

Phase 2 SAs are synchronized over HA2 links.

Phase 1 and Phase 2 SAs are synchronized over HA2 links.

Show Answer Comment (0)

Question 188

An engineer is designing a deployment of multi-vsys firewalls.

What must be taken into consideration when designing the device group structure?

Multiple vsys and firewalls can be assigned to a device group, and a multi-vsys firewall must have all its vsys in a single device group.

Only one vsys or one firewall can be assigned to a device group, except for a multi-vsys firewall, which must have all its vsys in a single device group.

Multiple vsys and firewalls can be assigned to a device group, and a multi-vsys firewall can have each vsys in a different device group.

Only one vsys or one firewall can be assigned to a device group, and a multi-vsys firewall can have each vsys in a different device group.

Show Answer Comment (0)

Question 189

An administrator creates a custom application containing Layer 7 signatures. The latest application and threat dynamic update is downloaded to the same firewall. The update contains an application that matches the same traffic signatures as the custom application.

Which application will be used to identify traffic traversing the firewall?

Custom application

Unknown application

Incomplete application

Downloaded application

Show Answer Comment (0)