Home / Palo Alto Networks / PCNSE

Question list

List of questions

Question 1

(0)

DRAG DROP Match each type of DoS attack to an example of that type of attack.

Question 2

(0)

DRAG DROP Below are the steps in the workflow for creating a Best Practice Assessment in a firewall and Panorama configuration. Place the steps in order.

Question 3

(0)

When using certificate authentication for firewall administration, which method is used for authorization?

Question 4

(0)

A network administrator wants to use a certificate for the SSL/TLS Service Profile. Which type of certificate should the administrator use?

Question 5

(0)

Using multiple templates in a stack to manage many firewalls provides which two advantages? (Choose two.)

Question 6

(0)

A network security engineer is attempting to peer a virtual router on a PAN-OS firewall with an external router using the BGP protocol. The peer relationship is not establishing. What command could

Question 7

(0)

A network security engineer must implement Quality of Service policies to ensure specific levels of delivery guarantees for various applications in the environment They want to ensure that they know

Question 8

(0)

Which statement regarding HA timer settings is true?

Question 9

(0)

When you navigate to Network: > GlobalProtect > Portals > Method section, which three options are available? (Choose three )

Question 10

(0)

An engineer must configure the Decryption Broker feature Which Decryption Broker security chain supports bi-directional traffic flow?

Question 292 - PCNSE discussion

When an engineer configures an active/active high availability pair, which two links can they use?

(Choose two)

HSCI-C

Console Backup

HA3

HA2 backup

Suggested answer: C, D

Explanation:

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/high-availability/set-up-activeactiveha/prerequisites-for-activeactive-ha

According to the Palo Alto Networks documentation1, an active/active high availability pair requires four links to communicate and synchronize state information: HA1, HA2, HA3, and HSCI. HA1 and HA2 are the same as in active/passive mode, where HA1 is used for control plane synchronization and HA2 is used for data plane synchronization. However, in active/active mode, there are two additional links:

HA3: This link is used for session setup synchronization between the two firewalls. It allows the firewalls to share information about new sessions that they create, so that they can forward packets for the same session if needed.

HSCI: This link is used for session owner synchronization between the two firewalls. It allows the firewalls to determine which firewall is responsible for processing packets for a given session.

Both HA3 and HSCI links can use either a dedicated interface or a subinterface. Therefore, the correct answer is C and D.

The other options are not valid links for an active/active high availability pair:

HSCI-C: This option is not a valid link name. HSCI stands for High-Speed Chassis Interconnect, which is a physical cable that connects two firewalls in a chassis-based system. It is not related to active/active high availability.

Console Backup: This option is not a valid link name. Console backup is a feature that allows accessing the console port of a firewall remotely through another firewall in an HA pair. It is not related to active/active high availability.

Reference: 1: https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/high-availability/set-upactiveactive-ha/configure-activeactive-ha

Show Answer

asked 23/09/2024

Mitchell Mansfield

28 questions

Your answer: A B C D

0 comments

Sorted by