ExamGecko
Login
Home / Palo Alto Networks / PCNSE / List of questions
Ask Question

Palo Alto Networks PCNSE Practice Test - Questions Answers, Page 3

Add to Whishlist

List of questions

Question 21

Report Export Collapse

What are two common reasons to use a "No Decrypt" action to exclude traffic from SSL decryption?

(Choose two.)

the website matches a category that is not allowed for most users
the website matches a category that is not allowed for most users
the website matches a high-risk category
the website matches a high-risk category
the web server requires mutual authentication
the web server requires mutual authentication
the website matches a sensitive category
the website matches a sensitive category
Suggested answer: C, D
Explanation:

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/decryption/decryptionexclusions/palo-alto-networks-predefined-decryption-exclusions.htmlThe firewall provides a predefined SSL Decryption Exclusion list to exclude from decryptioncommonly used sites that break decryption because of technical reasons such as pinned certificatesand mutual authentication.

asked 23/09/2024
Frank van Hout
46 questions

Question 22

Report Export Collapse

An administrator has a PA-820 firewall with an active Threat Prevention subscription The administrator is considering adding a WildFire subscription.

How does adding the WildFire subscription improve the security posture of the organization1?

Protection against unknown malware can be provided in near real-time
Protection against unknown malware can be provided in near real-time
WildFire and Threat Prevention combine to provide the utmost security posture for the firewall
WildFire and Threat Prevention combine to provide the utmost security posture for the firewall
After 24 hours WildFire signatures are included in the antivirus update
After 24 hours WildFire signatures are included in the antivirus update
WildFire and Threat Prevention combine to minimize the attack surface
WildFire and Threat Prevention combine to minimize the attack surface
Suggested answer: A
Explanation:

Adding a WildFire subscription can improve the security posture of the organization by providing protection against unknown malware in near real-time. With a WildFire subscription, the firewall can forward various file types for WildFire analysis, and can retrieve WildFire signatures for newly- discovered malware as soon as they are generated by the WildFire public cloud or a private cloud appliance. This reduces the exposure window and prevents further infection by the same malware.Reference: https://docs.paloaltonetworks.com/wildfire/9-1/wildfire-admin/wildfire- overview/wildfire-subscription

asked 23/09/2024
David Brun
39 questions

Question 23

Report Export Collapse

What are two valid deployment options for Decryption Broker? (Choose two)

Transparent Bridge Security Chain
Transparent Bridge Security Chain
Layer 3 Security Chain
Layer 3 Security Chain
Layer 2 Security Chain
Layer 2 Security Chain
Transparent Mirror Security Chain
Transparent Mirror Security Chain
Suggested answer: A, B
Explanation:

https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/decryption/decryption- broker/decryption-broker-concepts

asked 23/09/2024
Jialu Wang
38 questions

Question 24

Report Export Collapse

An administrator needs to assign a specific DNS server to one firewall within a device group. Where would the administrator go to edit a template variable at the device level?

Variable CSV export under Panorama > templates
Variable CSV export under Panorama > templates
PDF Export under Panorama > templates
PDF Export under Panorama > templates
Manage variables under Panorama > templates
Manage variables under Panorama > templates
Managed Devices > Device Association
Managed Devices > Device Association
Suggested answer: C
Explanation:

To edit a template variable at the device level, you need to go to Manage variables under Panorama > templates. This allows you to override the default value of a variable for a specific device or device group. For example, you can assign a specific DNS server to one firewall within a device group by editing the ${dns-primary} variable for that device. Reference: https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/manage-firewalls/manage- templates/use-template-variables.html

asked 23/09/2024
christopher tenney
36 questions

Question 25

Report Export Collapse

A customer wants to set up a VLAN interface for a Layer 2 Ethernet port.

Which two mandatory options are used to configure a VLAN interface? (Choose two.)

Virtual router
Virtual router
Security zone
Security zone
ARP entries
ARP entries
Netflow Profile
Netflow Profile
Suggested answer: A, B
Explanation:

Reference: https://www.paloaltonetworks.com/documentation/80/pan-os/web-interfacehelp/network/network-interfaces/pa-7000-series- layer-2-interface#idd2bcaacc-54b9-4ec9-a1dd-8064499f5b9d

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRqCAKVLAN interface is not necessary but in this scenarion we assume it is. Create VLAN object, VLANinterface and VLAN Zone. Attach VLAN interface to VLAN object together with two L2 interfaces thenattach VLAN interface to virtual router. Without VLAN interface you can pass traffic betweeninterfaces on the same network and with VLAN interface you can route traffic to other networks.

asked 23/09/2024
Amy Sukkar
47 questions

Question 26

Report Export Collapse

A network administrator troubleshoots a VPN issue and suspects an IKE Crypto mismatch between peers. Where can the administrator find the corresponding logs after running a test command to initiate the VPN?

Configuration logs
Configuration logs
System logs
System logs
Traffic logs
Traffic logs
Tunnel Inspection logs
Tunnel Inspection logs
Suggested answer: B
Explanation:

According to the Palo Alto Networks documentation, "To view IKE and IPSec Crypto profiles in the logs, filter the System log for eventid equal to vpn (Monitor > Logs > System)." Reference:https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/vpn/set-up-site-to-site-vpn/set-up- ike-crypto-profiles.html

asked 23/09/2024
Elyse Martinez
46 questions

Question 27

Report Export Collapse

An administrator is using Panorama to manage me and suspects an IKE Crypto mismatch between peers, from the firewalls to Panoram a. However, pre-existing logs from the firewalls are not appearing in Panorama.

Which action should be taken to enable the firewalls to send their pre-existing logs to Panorama?

Export the log database.
Export the log database.
Use the import option to pull logs.
Use the import option to pull logs.
Use the ACC to consolidate the logs.
Use the ACC to consolidate the logs.
Use the scp logdb export command.
Use the scp logdb export command.
Suggested answer: A
Explanation:

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-cli-quick-start/use-the-cli/use-secure-copy-to-import-and-export-files/export-and-import-a-complete-log-database-logdb

asked 23/09/2024
HC KONG
45 questions

Question 28

Report Export Collapse

A firewall administrator is trying to identify active routes learned via BGP in the virtual router runtime stats within the GUI. Where can they find this information?

routes listed in the routing table with flags Oi
routes listed in the routing table with flags Oi
routes listed in the routing table with flags A?B
routes listed in the routing table with flags A?B
under the BGP Summary tab
under the BGP Summary tab
routes listed in the forwarding table with BGP in the Protocol column
routes listed in the forwarding table with BGP in the Protocol column
Suggested answer: B
Explanation:

Flags

A?BóActive and learned via BGP

A CóActive and a result of an internal interface (connected) - Destination = network

A HóActive and a result of an internal interface (connected) - Destination = Host only

A RóActive and learned via RIP

A SóActive and static

SóInactive (because this route has a higher metric) and static

O1óOSPF external type-1

O2óOSPF external type-2

OióOSPF intra-area

OoóOSPF inter-area

asked 23/09/2024
Matthew Wagner
36 questions

Question 29

Report Export Collapse

A bootstrap USB flash drive has been prepared using a Windows workstation to load the initial configuration of a Palo Alto Networks firewall that was previously being used in a lab. The USB flash drive was formatted using file system FAT32 and the initial configuration is stored in a file named initcfg txt. The firewall is currently running PAN-OS 10.0 and using a lab config The contents of init-cfg txi in the USB flash drive are as follows:

Palo Alto Networks PCNSE image Question 29 54266 09232024001219000000

The USB flash drive has been inserted in the firewalls' USB port, and the firewall has been restarted using command:> request resort system Upon restart, the firewall fails to begin the bootstrapping process. The failure is caused because

Firewall must be in factory default state or have all private data deleted for bootstrapping
Firewall must be in factory default state or have all private data deleted for bootstrapping
The hostname is a required parameter, but it is missing in init-cfg txt
The hostname is a required parameter, but it is missing in init-cfg txt
The USB must be formatted using the ext3 file system, FAT32 is not supported
The USB must be formatted using the ext3 file system, FAT32 is not supported
PANOS version must be 91.x at a minimum but the firewall is running 10.0.x
PANOS version must be 91.x at a minimum but the firewall is running 10.0.x
The bootstrap.xml file is a required file but it is missing
The bootstrap.xml file is a required file but it is missing
Suggested answer: C
Explanation:

https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/firewall-administration/bootstrap-the-firewall/bootstrap-a-firewall-using-a-usb-flash-drive.html#id8378007f-d6e5-4f2d-84a4-5d50b0b3ad7d

asked 23/09/2024
JR Gee
35 questions

Question 30

Report Export Collapse

A network security engineer wants to prevent resource-consumption issues on the firewall.

Which strategy is consistent with decryption best practices to ensure consistent performance?

Use RSA in a Decryption profile tor higher-priority and higher-risk traffic, and use less processorintensive decryption methods for lower-risk traffic
Use RSA in a Decryption profile tor higher-priority and higher-risk traffic, and use less processorintensive decryption methods for lower-risk traffic
Use PFS in a Decryption profile for higher-priority and higher-risk traffic, and use less processorintensive decryption methods for tower-risk traffic
Use PFS in a Decryption profile for higher-priority and higher-risk traffic, and use less processorintensive decryption methods for tower-risk traffic
Use Decryption profiles to downgrade processor-intensive ciphers to ciphers that are less processor-intensive
Use Decryption profiles to downgrade processor-intensive ciphers to ciphers that are less processor-intensive
Use Decryption profiles to drop traffic that uses processor-intensive ciphers
Use Decryption profiles to drop traffic that uses processor-intensive ciphers
Suggested answer: C
Explanation:

According to the Palo Alto Networks documentation, "Decryption Profiles define the cipher suite settings the firewall accepts so you can protect against vulnerable, weak protocols and algorithms.You can also use Decryption Profiles to downgrade processor-intensive ciphers to ciphers that areless processor-intensive." Reference: https://docs.paloaltonetworks.com/best-practices/10-2/decryption-best-practices/decryption-best-practices/data-center-decryption-profile.html

asked 23/09/2024
Marcelo Oliveira
43 questions
Total 499 questions
Go to page: of 50
Search
Open VPLUS File
Convert VPLUS to PDF

Related questions

Before an administrator of a VM-500 can enable DoS and zone protection, what actions need to be taken?
Phase two of a VPN will not establish a connection. The peer is using a policy-based VPN configuration. What part of the configuration should the engineer verify'?
During the process of developing a decryption strategy and evaluating which websites are required for corporate users to access, several sites have been identified that cannot be decrypted due to technical reasons. In this case, the technical reason is unsupported ciphers. Traffic to these sites will therefore be blocked if decrypted How should the engineer proceed?
If a URL is in multiple custom URL categories with different actions, which action will take priority?
What is a correct statement regarding administrative authentication using external services with a local authorization method?
You are auditing the work of a co-worker and need to verify that they have matched the Palo Alto Networks Best Practices for Anti-Spyware Profiles. For which three severity levels should single-packet captures be enabled to meet the Best Practice standard? (Choose three.)
An administrator configures a site-to-site IPsec VPN tunnel between a PA-850 and an external customer on their policy-based VPN devices. What should an administrator configure to route interesting traffic through the VPN tunnel?
A company requires that a specific set of ciphers be used when remotely managing their Palo Alto Networks appliances. Which profile should be configured in order to achieve this?
When you navigate to Network: > GlobalProtect > Portals > Method section, which three options are available? (Choose three )
When you import the configuration of an HA pair into Panorama, how do you prevent the import from affecting ongoing traffic?