Pass the Palo Alto Networks PCNSE Exam 2023 - Best PCNSE Preparation Material

Pass the Palo Alto Networks PCNSE Exam 2023 – Best PCNSE Preparation Material

Jonnie Karnath2023-03-27T01:47:37+00:00

The Palo Alto Networks PCNSE exam is a challenging test that requires a solid understanding of the subject matter. But with the right preparation materials, you can increase your chances of passing the exam on the first try. That’s where Certspot comes in with their latest PCNSE preparation material. Their PCNSE practice exam questions are carefully crafted to cover all the topics and concepts that you’ll need to know to pass the Palo Alto Networks Certified Network Security Engineer Exam exam. The material is updated regularly to ensure that it reflects any changes or updates to the exam. By studying Certspot PCNSE preparation material, you’ll be able to identify any knowledge gaps and focus your studying efforts on those areas. This will help you to study more effectively, ultimately leading to a better chance of passing the exam.

Page 1 of 10

1. A network security engineer configured IP multicast in the virtual router to support a new application. Users in different network segments are reporting that they are unable to access the application.

What must be enabled to allow an interface to forward multicast traffic?

IGMP

PIM

BFD

SSM

2. In the screenshot above which two pieces of information can be determined from the ACC configuration shown? (Choose two)

The Network Activity tab will display all applications, including FT

Threats with a severity of "high" are always listed at the top of the Threat Name list

Insecure-credentials, brute-force and protocol-anomaly are all a part of the vulnerability Threat Type

The ACC has been filtered to only show the FTP application

3. An engineer reviews high availability (HA) settings to understand a recent HA failover event. Review the screenshot below.

Which timer determines the frequency at which the HA peers exchange messages in the form of an ICMP (ping)

Hello Interval

Promotion Hold Time

Heartbeat Interval

Monitor Fail Hold Up Time

4. Given the screenshot, how did the firewall handle the traffic?

Traffic was allowed by policy but denied by profile as encrypted.

Traffic was allowed by policy but denied by profile as a threat.

Traffic was allowed by profile but denied by policy as a threat.

Traffic was allowed by policy but denied by profile as a nonstandard port.

5. Refer to the exhibit.

Using the above screenshot of the ACC, what is the best method to set a global filter, narrow down Blocked User Activity, and locate the user(s) that could be compromised by a botnet?

Click the hyperlink for the Zero Access.Gen threat.

Click the left arrow beside the Zero Access.Gen threat.

Click the source user with the highest threat count.

Click the hyperlink for the hotport threat Category.

6. An administrator discovers that a file blocked by the WildFire inline ML feature on the firewall is a false-positive action.

How can the administrator create an exception for this particular file?

Add partial hash and filename in the file section of the WildFire inline ML tab of the Antivirus profile.

Set the WildFire inline ML action to allow for that protocol on the Antivirus profile.

Add the related Threat ID in the Signature exceptions tab of the Antivirus profile.

Disable the WildFire profile on the related Security policy.

7. Given the following snippet of a WildFire submission log did the end-user get access to the requested information and why or why not?

Yes, because the action is set to alert

No, because this is an example from a defeated phishing attack

No, because the severity is high and the verdict is malicious.

Yes, because the action is set to allow.

8. While analyzing the Traffic log, you see that some entries show "unknown-tcp" in the Application column What best explains these occurrences?

A handshake took place, but no data packets were sent prior to the timeout.

A handshake took place; however, there were not enough packets to identify the application.

A handshake did take place, but the application could not be identified.

A handshake did not take place, and the application could not be identified.

9. Which three items must be configured to implement application override? (Choose three )

Custom app

Security policy rule

Application override policy rule

Decryption policy rule

Application filter

10. An administrator has configured a pair of firewalls using high availability in Active/Passive mode. Path Monitoring has been enabled with a Failure Condition of "any." A path group is configured with Failure Condition of "all" and contains a destination IP of 8.8.8.8 and 4.2.2.2 with a Ping Interval of 500ms and a Ping count of 3.

Which scenario will cause the Active firewall to fail over?

IP address 8.8.8.8 is unreachable for 1 second.

IP addresses 8.8.8.8 and 4.2.2.2 are unreachable for 1 second.

IP addresses 8.8.8.8 and 4.2.2.2 are unreachable for 2 seconds

IP address 4.2.2.2 is unreachable for 2 seconds.

Page 2 of 10

11. Which source is the most reliable for collecting User-ID user mapping?

GlobalProtect

Microsoft Active Directory

Microsoft Exchange

Syslog Listener

12. Which three items are import considerations during SD-WAN configuration planning? (Choose three.)

link requirements

the name of the ISP

IP Addresses

branch and hub locations

13. An engineer has been tasked with reviewing traffic logs to find applications the firewall is unable to identify with App-ID.

Why would the application field display as incomplete?

The client sent a TCP segment with the PUSH flag set.

The TCP connection was terminated without identifying any application data.

There is insufficient application data after the TCP connection was established.

The TCP connection did not fully establish.

14. Why would a traffic log list an application as "not-applicable”?

The firewall denied the traffic before the application match could be performed.

The TCP connection terminated without identifying any application data

There was not enough application data after the TCP connection was established

The application is not a known Palo Alto Networks App-I

15. An engineer is deploying multiple firewalls with common configuration in Panorama.

What are two benefits of using nested device groups? (Choose two.)

Inherit settings from the Shared group

Inherit IPSec crypto profiles

Inherit all Security policy rules and objects

Inherit parent Security policy rules and objects

16. DRAG DROP

Match the terms to their corresponding definitions

17. What can be used to create dynamic address groups?

dynamic address

region objects

tags

FODN addresses

18. A firewall administrator requires an A/P HA pair to fail over more quickly due to critical business application uptime requirements.

What is the correct setting?

Change the HA timer profile to "aggressive" or customize the settings in advanced profile.

Change the HA timer profile to "fast".

Change the HA timer profile to "user-defined" and manually set the timers.

Change the HA timer profile to "quick" and customize in advanced profile.

19. A network engineer troubleshoots a VPN Phase 2 mismatch and decides that PFS (Perfect Forward Secrecy) needs to be enabled.

What action should the engineer take?

Add an authentication algorithm in the IPSec Crypto profile.

Enable PFS under the IPSec Tunnel advanced options.

Select the appropriate DH Group under the IPSec Crypto profile.

Enable PFS under the IKE gateway advanced options

20. An administrator would like to determine which action the firewall will take for a specific CVE.

Given the screenshot below, where should the administrator navigate to view this information?

The profile rule action

CVE column

Exceptions lab

The profile rule threat name

Page 3 of 10

21. A super user is tasked with creating administrator accounts for three contractors. For compliance purposes, all three contractors will be working with different device-groups m their hierarchy to deploy policies and objects.

Which type of role-based access is most appropriate for this project?

Create a Dynamic Admin with the Panorama Administrator role.

Create a Device Group and Template Admin.

Create a Custom Panorama Admin.

Create a Dynamic Read only superuser

22. The following objects and policies are defined in a device group hierarchy

A. Address Objects

-Shared Address1

-Shared Address2

-Branch Address1

Policies

-Shared Policy1

-Branch Policy1

B. Address Objects

-Shared Address1

-Shared Address2

-Branch Address1

-DC Address1

Policies

-Shared Policy1

-Shared Policy2

-Branch Policy1

C.

Address Objects

-Shared Address 1

-Branch Address2

Policies -Shared Polic1

-Branch Policy 1

D)

Address Objects

-Shared Address 1

-Shared Address 2

-Branch Address 1

Policies

-Shared Policy 1

-Shared Policy 2

-Branch Policy 1

A. Option A

B. Option B

C. Option C

D. Option D

23. You need to allow users to access the office-suite applications of their choice.

How should you configure the firewall to allow access to any office-suite application?

Create an Application Group and add Office 365, Evernote Google Docs and Libre Office

Create an Application Group and add business-systems to it.

Create an Application Filter and name it Office Programs, then filter it on the office programs subcategory.

Create an Application Filter and name it Office Programs then filter on the business-systems category.

24. An existing NGFW customer requires direct interne! access offload locally at each site and iPSec connectivity to all branches over public internet. One requirement is mat no new SD-WAN hardware be introduced to the environment.

What is the best solution for the customer?

Configure a remote network on PAN-OS

Upgrade to a PAN-OS SD-WAN subscription

Deploy Prisma SD-WAN with Prisma Access

Configure policy-based forwarding

25. When using SSH keys for CLI authentication for firewall administration, which method is used for authorization?

Local

LDAP

Kerberos

Radius

26. Which CLI command is used to determine how much disk space is allocated to logs?

show logging-status

show system info

debug log-receiver show

show system logdfo-quota

27. When you navigate to Network: > GlobalProtect > Portals > Method section, which three options are available? (Choose three)

user-logon (always on)

pre-logon then on-demand

on-demand (manual user initiated connection)

post-logon (always on)

certificate-logon

28. A user at an external system with the IP address 65.124.57.5 queries the DNS server at 4. 2.2.2 for the IP address of the web server, www,xyz.com. The DNS server returns an address of 172.16.15.1

In order to reach Ire web server, which Security rule and NAT rule must be configured on the firewall?

Option A

Option B

Option C

Option D

29. When using certificate authentication for firewall administration, which method is used for authorization?

Radius

LDAP

Kerberos

Local

30. A firewall administrator wants to have visibility on one segment of the company network. The traffic on the segment is routed on the Backbone switch. The administrator is planning to apply Security rules on segment X after getting the visibility.

There is already a PAN-OS firewall used in L3 mode as an internet gateway, and there are enough system resources to get extra traffic on the firewall. The administrator needs to complete this operation with minimum service interruptions and without making any IP changes.

What is the best option for the administrator to take?

Configure the TAP interface for segment X on the firewall.

Configure vwire interfaces for segment X on the firewall.

Configure a Layer 3 interface for segment X on the firewall.

Configure a new vsys for segment X on the firewall.

Page 4 of 10

31. An engineer discovers the management interface is not routable to the User-ID agent.

What configuration is needed to allow the firewall to communicate to the User-ID agent?

Create a NAT policy for the User-ID agent server

Add a Policy Based Forwarding (PBF) policy to the User-ID agent IP

Create a custom service route for the UID Agent

Add a static route to the virtual router

32. An organization conducts research on the benefits of leveraging the Web Proxy feature of PAN-OS 11.0.

What are two benefits of using an explicit proxy method versus a transparent proxy

method? (Choose two.)

No client configuration is required for explicit proxy, which simplifies the deployment complexity.

Explicit proxy allows for easier troubleshooting, since the client browser is aware of the existence of the proxy.

Explicit proxy supports interception of traffic using non-standard HTTPS ports.

It supports the X-Authenticated-User (XAU) header, which contains the authenticated username in the outgoing request

33. A company is looking to increase redundancy in their network.

Which interface type could help accomplish this?

Layer 2

Virtual wire

Tap

Aggregate ethernet

34. Where can an administrator see both the management-plane and data-plane CPU utilization in the WebUI?

System Resources widget

System Logs widget

Session Browser

General Information widget

35. Which three actions can Panorama perform when deploying PAN-OS images to its managed devices? (Choose three.)

upload-only

upload and install and reboot

verify and install

upload and install

install and reboot

36. An engineer wants to configure aggregate interfaces to increase bandwidth and redundancy between the firewall and switch.

Which statement is correct about the configuration of the interfaces assigned to an aggregate interface group?

They can have a different bandwidth.

They can have a different interface type such as Layer 3 or Layer 2.

They can have a different interface type from an aggregate interface group.

They can have different hardware media such as the ability to mix fiber optic and copper.

37. What steps should a user take to increase the NAT oversubscription rate from the default platform setting?

Navigate to Device > Setup > TCP Settings > NAT Oversubscription Rate

Navigate to Policies > NAT > Destination Address Translation > Dynamic IP (with session distribution)

Navigate to Policies > NAT > Source Address Translation > Dynamic IP (with session distribution)

Navigate to Device > Setup > Session Settings > NAT Oversubscription Rate

38. An administrator creates an application-based security policy rule and commits the change to the firewall.

Which two methods should be used to identify the dependent applications for the respective rule? (Choose two.)

Use the show predefined xpath <value> command and review the output.

Review the App Dependency application list from the Commit Status view.

Open the security policy rule and review the Depends On application list.

Reference another application group containing similar applications.

39. An administrator is building Security rules within a device group to block traffic to and from malicious locations

How should those rules be configured to ensure that they are evaluated with a high priority?

Create the appropriate rules with a Block action and apply them at the top of the Default Rules

Create the appropriate rules with a Block action and apply them at the top of the Security Post-Rules.

Create the appropriate rules with a Block action and apply them at the top of the local firewall Security rules.

Create the appropriate rules with a Block action and apply them at the top of the Security Pre-Rules

40. A network security administrator has been tasked with deploying User-ID in their organization.

What are three valid methods of collecting User-ID information in a network? (Choose three.)

Windows User-ID agent

GlobalProtect

XMLAPI

External dynamic list

Dynamic user groups

Page 5 of 10

41. A remote administrator needs firewall access on an untrusted interface.

Which two components are required on the firewall to configure certificate-based administrator authentication to the web Ul? (Choose two)

client certificate

certificate profile

certificate authority (CA) certificate

server certificate

42. An engineer must configure a new SSL decryption deployment.

Which profile or certificate is required before any traffic that matches an SSL decryption rule is decrypted?

There must be a certificate with both the Forward Trust option and Forward Untrust option selected.

A Decryption profile must be attached to the Security policy that the traffic matches.

A Decryption profile must be attached to the Decryption policy that the traffic matches.

There must be a certificate with only the Forward Trust option selected.

43. An administrator Just enabled HA Heartbeat Backup on two devices However, the status on tie firewall's dashboard is showing as down High Availability.

What could an administrator do to troubleshoot the issue?

Go to Device > High Availability> General > HA Pair Settings > Setup and configuring the peer IP for heartbeat backup

Check peer IP address In the permit list In Device > Setup > Management > Interfaces > Management Interface Settings

Go to Device > High Availability > HA Communications> General> and check the Heartbeat Backup under Election Settings

Check peer IP address for heartbeat backup to Device > High Availability > HA Communications > Packet Forwarding settings.

44. An administrator needs to assign a specific DNS server to one firewall within a device group.

Where would the administrator go to edit a template variable at the device level?

Variable CSV export under Panorama > templates

PDF Export under Panorama > templates

Manage variables under Panorama > templates

Managed Devices > Device Association

45. Review the information below. A firewall engineer creates a U-NAT rule to allow users in the trust zone access to a server in the same zone by using an external, public NAT IP for that server.

Given the rule below, what change should be made to make sure the NAT works as expected?

Change destination NAT zone to Trust_L3.

Change destination translation to Dynamic IP (with session distribution) using firewall ethI/2 address.

Change Source NAT zone to Untrust_L3.

Add source Translation to translate original source IP to the firewall eth1/2 interface translation.

46. A network security engineer must implement Quality of Service policies to ensure specific levels of delivery guarantees for various applications in the environment They want to ensure that they know as much as they can about QoS before deploying.

Which statement about the QoS feature is correct?

QoS is only supported on firewalls that have a single virtual system configured

QoS can be used in conjunction with SSL decryption

QoS is only supported on hardware firewalls

QoS can be used on firewalls with multiple virtual systems configured

47. A company wants to install a PA-3060 firewall between two core switches on a VLAN trunk link. They need to assign each VLAN to its own zone and to assign untagged (native) traffic to its own zone which options differentiates multiple VLAN into separate zones?

Create V-Wire objects with two V-Wire interfaces and define a range of "0-4096 in the "Tag Allowed" field of the V-Wire object.

Create V-Wire objects with two V-Wire subinterfaces and assign only a single VLAN ID to the Tag Allowed" field of the V-Wire object. Repeat for every additional VLAN and use a VLAN ID of 0 for untagged traffic. Assign each interface/sub interface to a unique zone.

Create Layer 3 subinterfaces that are each assigned to a single VLAN ID and a common virtual router. The physical Layer 3 interface would handle untagged traffic. Assign each interface/subinterface t

unique zone. Do not assign any interface an IP address.

Create VLAN objects for each VLAN and assign VLAN interfaces matching each VLAN I

Repeat for every additional VLAN and use a VLAN ID of 0 for untagged traffic. Assign each interface/sub interface to a unique zone.

48. Which statement accurately describes service routes and virtual systems?

Virtual systems that do not have specific service routes configured inherit the global service and service route settings for the firewall.

Virtual systems can only use one interface for all global service and service routes of the firewall.

Virtual systems cannot have dedicated service routes configured; and virtual systems always use the global service and service route settings for the firewall.

The interface must be used for traffic to the required external services.

49. Which three options does Panorama offer for deploying dynamic updates to its managed devices? (Choose three.)

Verify

Schedules

Install from file

Check dependencies

Revert content

50. When an engineer configures an active/active high availability pair, which two links can they use? (Choose two)

HSCI-C

Console Backup

HA3

HA2 backup

Page 6 of 10

51. What is the best definition of the Heartbeat Interval?

The interval in milliseconds between hello packets

The frequency at which the HA peers check link or path availability

The frequency at which the HA peers exchange ping

The interval during which the firewall will remain active following a link monitor failure

52. A firewall administrator is trying to identify active routes learned via BGP in the virtual router runtime stats within the GUI. Where can they find this information?

Routes listed in the routing table with flags Oi

Routes listed in the routing table with flags A?B

Under the BGP Summary tab

Routes listed in the forwarding table with BGP in the Protocol column

53. Four configuration choices are listed, and each could be used to block access to a specific URL II you configured each choice to block the same URL, then which choice would be evaluated last in the processing order to block access to the URL1?

PAN-DB URL category in URL Filtering profile

Custom URL category in Security policy rule

Custom URL category in URL Filtering profile

EDL in URL Filtering profile

54. An administrator wants to grant read-only access to all firewall settings, except administrator accounts, to a new-hire colleague in the IT department.

Which dynamic role does the administrator assign to the new-hire colleague?

Device administrator (read-only)

System administrator (read-only)

Firewall administrator (read-only)

Superuser (read-only)

55. A company wants to add threat prevention to the network without redesigning the network routing.

What are two best practice deployment modes for the firewall? (Choose two.)

VirtualWire

Layer3

TAP

Layer2

56. Before an administrator of a VM-500 can enable DoS and zone protection, what actions need to be taken?

Measure and monitor the CPU consumption of the firewall data plane to ensure that each firewall is properly sized to support DoS and zone protection

Create a zone protection profile with flood protection configured to defend an entire egress zone against SY

ICMP ICMPv6, UD

and other IP flood attacks

Add a WildFire subscription to activate DoS and zone protection features

Replace the hardware firewall because DoS and zone protection are not available with VM-Series systems

57. DRAG DROP

Match each GlobalProtect component to the purpose of that component

58. An engineer troubleshooting a VPN issue needs to manually initiate a VPN tunnel from the CLI.

Which CLI command can the engineer use?

test vpn flow

test vpn Ike―sa

test vpn tunnel

test vpn gateway

59. An administrator wants multiple web servers In the DMZ to receive connections initiated from the internet. Traffic destined for 206.15.22.9 port 80/TCP needs to be forwarded to the server at 10.1.1.22.

Based on the image, which NAT rule will forward web-browsing traffic correctly?

A)

Option

60. Which configuration task is best for reducing load on the management plane?

Disable logging on the default deny rule

Enable session logging at start

Disable pre-defined reports

Set the URL filtering action to send alerts

Page 7 of 10

61. A company has configured a URL Filtering profile with override action on their firewall.

Which two profiles are needed to complete the configuration? (Choose two)

SSL/TLS Service

HTTP Server

Decryption

Interface Management

62. An engineer must configure the Decryption Broker feature. To which router must the engineer assign the decryption forwarding interfaces that are used in Decryption Broker security chain?

A virtual router that has no additional interfaces for passing data-type traffic and no other configured routes than those used for the security chain.

The default virtual router. If there is no default virtual router , the engineer must create one during setup.

A virtual router that is configured with at least one dynamic routing protocol and has at least one entry in the RIB

The virtual router that routes the traffic that the Decryption Broker security chain inspects.

63. Where is Palo Alto Networks Device Telemetry data stored on a firewall with a device certificate installed?

Cortex Data Lake

Panorama

On Palo Alto Networks Update Servers

M600 Log Collectors

64. What are two valid deployment options for Decryption Broker? (Choose two)

Transparent Bridge Security Chain

Layer 3 Security Chain

Layer 2 Security Chain

Transparent Mirror Security Chain

65. An organization is interested in migrating from their existing web proxy architecture to the Web Proxy feature of their PAN-OS 11.0 firewalls. Currently. HTTP and SSL requests contain the c IP address of the web server and the client browser is redirected to the proxy

Which PAN-OS proxy method should be configured to maintain this type of traffic flow?

DNS proxy

Explicit proxy

SSL forward proxy

Transparent proxy

66. A prospect is eager to conduct a Security Lifecycle Review (SLR) with the aid of the Palo Alto Networks NGFW.

Which interface type is best suited to provide the raw data for an SLR from the network in a way that is minimally invasive?

Layer 3

Virtual Wire

Tap

Layer 2

67. An engineer manages a high availability network and requires fast failover of the routing protocols. The engineer decides to implement BFD.

Which three dynamic routing protocols support BFD? (Choose three.)

OSPF

RIP

BGP

IGRP

OSPFv3 virtual link

68. A remote administrator needs access to the firewall on an untrust interface.

Which three options would you configure on an Interface Management profile to secure management

access? (Choose three.)

Permitted IP Addresses

SSH

https

User-ID

HTTP

69. An administrator has two pairs of firewalls within the same subnet. Both pairs of firewalls have been configured to use High Availability mode with Active/Passive. The ARP tables for upstream routes display the same MAC address being shared for some of these firewalls.

What can be configured on one pair of firewalls to modify the MAC addresses so they are no longer in conflict?

Configure a floating IP between the firewall pairs.

Change the Group IDs in the High Availability settings to be different from the other firewall pair on the same subnet.

Change the interface type on the interfaces that have conflicting MAC addresses from L3 to VLA

On one pair of firewalls, run the CLI command: set network interface vlan arp.

70. An administrator device-group commit push is tailing due to a new URL category

How should the administrator correct this issue?

verify that the URL seed Tile has been downloaded and activated on the firewall

change the new category action to alert" and push the configuration again

update the Firewall Apps and Threat version to match the version of Panorama

ensure that the firewall can communicate with the URL cloud

Page 8 of 10

71. What would allow a network security administrator to authenticate and identify a user with a new BYOD-type device that is not joined to the corporate domain'?

a Security policy with 'known-user" selected in the Source User field

an Authentication policy with 'unknown' selected in the Source User field

a Security policy with 'unknown' selected in the Source User field

an Authentication policy with 'known-user' selected in the Source User field

72. An engineer needs to configure SSL Forward Proxy to decrypt traffic on a PA-5260. The engineer uses a forward trust certificate from the enterprise PKI that expires December 31, 2025.

The validity date on the PA-generated certificate is taken from what?

The trusted certificate

The server certificate

The untrusted certificate

The root CA

73. A network security engineer wants to prevent resource-consumption issues on the firewall.

Which strategy is consistent with decryption best practices to ensure consistent performance?

Use RSA in a Decryption profile tor higher-priority and higher-risk traffic, and use less processor-intensive decryption methods for lower-risk traffic

Use PFS in a Decryption profile for higher-priority and higher-risk traffic, and use less processor-intensive decryption methods for tower-risk traffic

Use Decryption profiles to downgrade processor-intensive ciphers to ciphers that are less processor-intensive

Use Decryption profiles to drop traffic that uses processor-intensive ciphers

74. A client wants to detect the use of weak and manufacturer-default passwords for loT devices.

Which option will help the customer?

Configure a Data Filtering profile with alert mode.

Configure an Antivirus profile with alert mode.

Configure a Vulnerability Protection profile with alert mode

Configure an Anti-Spyware profile with alert mode.

75. What is the best description of the HA4 Keep-Alive Threshold (ms)?

the maximum interval between hello packets that are sent to verify that the HA functionality on the other firewall is operational.

The time that a passive or active-secondary firewall will wait before taking over as the active or active-primary firewall

the timeframe within which the firewall must receive keepalives from a cluster member to know that the cluster member is functional.

The timeframe that the local firewall wait before going to Active state when another cluster member is preventing the cluster from fully synchronizing.

76. View the screenshots.

A QoS profile and policy rules are configured as shown.

Based on this information, which two statements are correct? (Choose two.)

DNS has a higher priority and more bandwidth than SS

Google-video has a higher priority and more bandwidth than WebEx.

SMTP has a higher priority but lower bandwidth than Zoom.

Facetime has a higher priority but lower bandwidth than Zoom.

77. An administrator can not see any Traffic logs from the Palo Alto Networks NGFW in Panorama reports. The configuration problem seems to be on the firewall.

Which settings, if configured incorrectly, most likely would stop only Traffic logs from being sent from the NGFW to Panorama?

A)

Option A

Option B

Option C

Option D

78. An engineer needs to redistribute User-ID mappings from multiple data centers.

Which data flow best describes redistribution of user mappings?

Domain Controller to User-ID agent

User-ID agent to Panorama

User-ID agent to firewall

firewall to firewall

79. An engineer is configuring a firewall with three interfaces:

• MGT connects to a switch with internet access.

• Ethernet1/1 connects to an edge router.

• Ethernet1/2 connects to a visualization network.

The engineer needs to configure dynamic updates to use a dataplane interface for internet traffic.

What should be configured in Setup > Services > Service Route Configuration to allow this traffic?

Set DNS and Palo Alto Networks Services to use the ethernet1/1 source interface.

Set DNS and Palo Alto Networks Services to use the ethernet1/2 source interface.

Set DNS and Palo Alto Networks Services to use the MGT source interface.

Set DDNS and Palo Alto Networks Services to use the MGT source interface.

80. A network administrator plans a Prisma Access deployment with three service connections, each with a BGP peering to a CPE. The administrator needs to minimize the BGP configuration and management overhead on on-prem network devices.

What should the administrator implement?

target service connection for traffic steering

summarized BGP routes before advertising

hot potato routing

default routing

Page 9 of 10

81. Your company occupies one floor in a single building. You have two Active Directory domain controllers on a single network. The firewall's management-plane resources are lightly utilized.

Given the size of this environment, which User-ID collection method is sufficient?

Citrix terminal server agent deployed on the network

Windows-based agent deployed on each domain controller

PAN-OS integrated agent deployed on the firewall

a syslog listener

82. A customer is replacing their legacy remote access VPN solution The current solution is in place to secure only internet egress for the connected clients Prisma Access has been selected to replace the current remote access VPN solution During onboarding the following options and licenses were selected and enabled

- Prisma Access for Remote Networks 300Mbps

- Prisma Access for Mobile Users 1500 Users

- Cortex Data Lake 2TB

- Trusted Zones trust

- Untrusted Zones untrust

- Parent Device Group shared

How can you configure Prisma Access to provide the same level of access as the current VPN solution?

Configure mobile users with trust-to-untrust Security policy rules to allow the desired traffic outbound to the internet

Configure mobile users with a service connection and trust-to-trust Security policy rules to allow the desired traffic outbound to the internet

Configure remote networks with a service connection and trust-to-untrust Security policy rules to allow the desired traffic outbound to the internet

Configure remote networks with trust-to-trust Security policy rules to allow the desired traffic outbound to the internet

83. A network administrator is trying to prevent domain username and password submissions to phishing sites on some allowed URL categories

Which set of steps does the administrator need to take in the URL Filtering profile to prevent credential phishing on the firewall?

Choose the URL categories on Site Access column and set action to block Click the User credential Detection tab and select IP User Mapping Commit

Choose the URL categories in the User Credential Submission column and set action to block Select the User credential Detection tab and select use IP User Mapping Commit

Choose the URL categories in the User Credential Submission column and set action to block Select the URL filtering settings and enable Domain Credential Filter Commit

Choose the URL categories in the User Credential Submission column and set action to block Select the User credential Detection tab and select Use Domain Credential Filter Commit

84. An administrator wants to configure the Palo Alto Networks Windows User-ID agent to map IP addresses to usernames. The company uses four Microsoft Active Directory servers and two Microsoft Exchange servers, which can provide logs for login events.

All six servers have IP addresses assigned from the following subnet: 192.168 28.32/27. The Microsoft Active Directory servers reside in 192.168.28.32/28. and the Microsoft Exchange servers resideL in 192.168.28 48/28

What information does the administrator need to provide in the User Identification > Discovery section?

The IP-address and corresponding server type (Microsoft Active Directory or Microsoft Exchange) for each of the six servers

Network 192 168.28.32/28 with server type Microsoft Active Directory and network 192.168.28.48/28 with server type Microsoft Exchange

Network 192 168 28.32/27 with server type Microsoft

One IP address of a Microsoft Active Directory server and "Auto Discover" enabled to automatically obtain all five of the other servers

85. What is a key step in implementing WildFire best practices?

In a mission-critical network, increase the WildFire size limits to the maximum value.

Configure the firewall to retrieve content updates every minute.

In a security-first network, set the WildFire size limits to the minimum value.

Ensure that a Threat Prevention subscription is active.

86. A customer wants to set up a VLAN interface for a Layer 2 Ethernet port.

Which two mandatory options are used to configure a VLAN interface? (Choose two.)

Virtual router

Security zone

ARP entries

Netflow Profile

87. An engineer is configuring SSL Inbound Inspection for public access to a company's application.

Which certificate(s) need to be installed on the firewall to ensure that inspection is performed successfully?

Self-signed CA and End-entity certificate

Root CA and Intermediate CA(s)

Self-signed certificate with exportable private key

Intermediate CA (s) and End-entity certificate

88. Which Panorama feature protects logs against data loss if a Panorama server fails?

Panorama HA automatically ensures that no logs are lost if a server fails inside the HA Cluster.

Panorama Collector Group with Log Redundancy ensures that no logs are lost if a server fails inside the Collector Group.

Panorama HA with Log Redundancy ensures that no logs are lost if a server fails inside the HA Cluster.

Panorama Collector Group automatically ensures that no logs are lost if a server fails inside the Collector Group

89. SSL Forward Proxy decryption is configured but the firewall uses Untrusted-CA to sign the website https //www important-website com certificate End-users are receiving me "security certificate is not trusted is warning Without SSL decryption the web browser shows that the website certificate is trusted and signed by a well-known certificate chain Well-Known-lntermediate and Well-Known-Root- CA.

The network security administrator who represents the customer requires the following two behaviors when SSL Forward Proxy is enabled:

1 End-users must not get the warning for the https://www.very-important-website.com website.

2 End-users should get the warning for any other untrusted website

Which approach meets the two customer requirements?

Navigate to Device > Certificate Management > Certificates > Device Certificates import Well-Known-lntermediate-CA and Well-Known-Root-CA select the Trusted Root CA checkbox and commit the configuration

Install the Well-Known-lntermediate-CA and Well-Known-Root-CA certificates on all end-user systems m the user and local computer stores

Navigate to Device > Certificate Management - Certificates s Default Trusted Certificate Authorities import Well-Known-intermediate-CA and Well-Known-Root-CA select the Trusted Root CA check box and commit the configuration

Clear the Forward Untrust Certificate check box on the Untrusted-CA certificate and commit the configuration

90. An administrator is seeing one of the firewalls in a HA active/passive pair moved to 'suspended" state due to Non-functional loop.

Which three actions will help the administrator troubleshool this issue? (Choose three.)

Use the CLI command show high-availability flap-statistics

Check the HA Link Monitoring interface cables.

Check the High Availability > Link and Path Monitoring settings.

Check High Availability > Active/Passive Settings > Passive Link State

Check the High Availability > HA Communications > Packet Forwarding settings.

Page 10 of 10

91. An engineer is tasked with enabling SSL decryption across the environment.

What are three valid parameters of an SSL Decryption policy? (Choose three.)

URL categories

source users

source and destination IP addresses

App-ID

GlobalProtect HIP

92. A network security administrator wants to begin inspecting bulk user HTTPS traffic flows egressing out of the internet edge firewall.

Which certificate is the best choice to configure as an SSL Forward Trust certificate?

A self-signed Certificate Authority certificate generated by the firewall

A Machine Certificate for the firewall signed by the organization's PKI

A web server certificate signed by the organization's PKI

A subordinate Certificate Authority certificate signed by the organization's PKI

93. An administrator is troubleshooting why video traffic is not being properly classified.

If this traffic does not match any QoS classes, what default class is assigned?

Facebook Twitter LinkedIn Google + Email

Pass the Palo Alto Networks PCNSE Exam 2023 – Best PCNSE Preparation Material

Pass the Palo Alto Networks PCNSE Exam 2023 – Best PCNSE Preparation Material

Author

LEAVE A COMMENT Cancel reply

Related Posts

Latest Palo Alto Networks PCSAE Practice Exam Questions

Best Exam Practice Material for Palo Alto Networks PCCSE Exam Q&A

Palo Alto Networks Palo Alto Networks Certifications PCNSA Free Dumps 2023

Palo Alto Networks PCSFE Certification Sample Questions