Updated Palo Alto Networks PCNSE Exam Dumps - Best PCNSE Study Guide For Learning

Updated Palo Alto Networks PCNSE Exam Dumps – Best PCNSE Study Guide For Learning

Eleanor2024-10-14T15:25:13+00:00

By Eleanor Palo Alto Networks, PCNSE

To all, ITPrepare updates the dumps regularly to make sure you have the latest study guide, including PCNSE exam dumps. The updated Palo Alto Networks PCNSE exam dumps from ITPrepare are the best study guide for learning. You can download the PCNSE exam dumps pdf to start learning the PCNSE exam questions and answers well. The PCNSE exam dumps are an exact reproduction of the genuine Palo Alto Networks Certified Network Security Engineer Exam, enabling you to master the PCNSE exam questions on the initial go.

Palo Alto Networks PCNSE Free Dumps Questions Are Below For Reading

Page 1 of 6

1. What can be used to create dynamic address groups?

dynamic address

region objects

tags

FODN addresses

2. Which configuration task is best for reducing load on the management plane?

Disable logging on the default deny rule

Enable session logging at start

Disable pre-defined reports

Set the URL filtering action to send alerts

3. Which configuration is backed up using the Scheduled Config Export feature in Panorama?

Panorama running configuration

Panorama candidate configuration

Panorama candidate configuration and candidate configuration of all managed devices

Panorama running configuration and running configuration of all managed devices

4. When configuring forward error correction (FEC) for PAN-OS SD-WAN, an administrator would turn on the feature inside which type of SD-WAN profile?

Certificate profile

Path Quality profile

SD-WAN Interface profile

Traffic Distribution profile

5. You have upgraded your Panorama and Log Collectors lo 10.2 x. Before upgrading your firewalls using Panorama, what do you need do?

Refresh your licenses with Palo Alto Network Support - Panorama/Licenses/Retrieve License Keys from License Server.

Re-associate the firewalls in Panorama/Managed Devices/Summary.

Commit and Push the configurations to the firewalls.

Refresh the Mastor Key in Panorama/Master Key and Diagnostic

6. A customer is replacing their legacy remote access VPN solution. The current solution is in place to secure only internet egress for the connected clients Prisma Access has been selected to replace the current remote access VPN solution.

During onboarding the following options and licenses were selected and enabled

- Prisma Access for Remote Networks 300Mbps

- Prisma Access for Mobile Users 1500 Users

- Cortex Data Lake 2TB

- Trusted Zones trust

- Untrusted Zones untrust

- Parent Device Group shared

How can you configure Prisma Access to provide the same level of access as the current VPN solution?

Configure mobile users with trust-to-untrust Security policy rules to allow the desired traffic outbound to the internet

Configure mobile users with a service connection and trust-to-trust Security policy rules to allow the desired traffic outbound to the internet

Configure remote networks with a service connection and trust-to-untrust Security policy rules to allow the desired traffic outbound to the internet

Configure remote networks with trust-to-trust Security policy rules to allow the desired traffic outbound to the internet

7. An administrator is building Security rules within a device group to block traffic to and from malicious locations

How should those rules be configured to ensure that they are evaluated with a high priority?

Create the appropriate rules with a Block action and apply them at the top of the Default Rules

Create the appropriate rules with a Block action and apply them at the top of the Security Post-Rules.

Create the appropriate rules with a Block action and apply them at the top of the local firewall Security rules.

Create the appropriate rules with a Block action and apply them at the top of the Security Pre-Rules

8. A firewall should be advertising the static route 10.2.0.0/24 Into OSPF. The configuration on the neighbor is correct, but the route is not in the neighbor's routing table.

Which two configurations should you check on the firewall? (Choose two.)

In the OSFP configuration, ensure that the correct redistribution profile is selected in the OSPF Export Rules section.

Within the redistribution profile ensure that Redist is selected.

Ensure that the OSPF neighbor state Is "2-Way."

In the redistribution profile check that the source type is set to "ospf."

9. Before an administrator of a VM-500 can enable DoS and zone protection, what actions need to be taken?

Measure and monitor the CPU consumption of the firewall data plane to ensure that each firewall is properly sized to support DoS and zone protection

Create a zone protection profile with flood protection configured to defend an entire egress zone against SY

ICMP ICMPv6, UD

and other IP flood attacks

Add a WildFire subscription to activate DoS and zone protection features

Replace the hardware firewall because DoS and zone protection are not available with VM-Series systems

10. The manager of the network security team has asked you to help configure the company's Security Profiles according to Palo Alto Networks best practice. As part of that effort, the manager has assigned you the Vulnerability Protection profile for the internet gateway firewall.

Which action and packet-capture setting for items of high severity and critical severity best matches Palo Alto Networks best practice?

action 'reset-both' and packet capture 'extended-capture'

action 'default' and packet capture 'single-packet'

action 'reset-both' and packet capture 'single-packet'

action 'reset-server' and packet capture 'disable'

Page 2 of 6

11. Before an administrator of a VM-500 can enable DoS and zone protection, what actions need to be taken?

Measure and monitor the CPU consumption of the firewall data plane to ensure that each firewall is properly sized to support DoS and zone protection

Create a zone protection profile with flood protection configured to defend an entire egress zone against SY

ICMP ICMPv6, UD

and other IP flood attacks

Add a WildFire subscription to activate DoS and zone protection features

Replace the hardware firewall because DoS and zone protection are not available with VM-Series systems

12. A network engineer has discovered that asymmetric routing is causing a Palo Alto Networks firewall to drop traffic. The network architecture cannot be changed to correct this.

Which two actions can be taken on the firewall to allow the dropped traffic permanently? (Choose two.)

Navigate to Network > Zone Protection Click Add Select Packet Based Attack Protection > TCP/IP Drop Set "Reject Non-syn-TCP" to No Set "Asymmetric Path" to Bypass

> set session tcp-reject-non-syn no

Navigate to Network > Zone Protection Click Add Select Packet Based Attack Protection > TCP/IP Drop Set "Reject Non-syn-TCP" to Global Set "Asymmetric Path" to Global

# set deviceconfig setting session tcp-reject-non-syn no

13. Which three actions can Panorama perform when deploying PAN-OS images to its managed devices? (Choose three.)

upload-only

upload and install and reboot

verify and install

upload and install

install and reboot

14. 1.An enterprise information Security team has deployed policies based on AD groups to restrict user access to critical infrastructure systems However a recent phisning campaign against the organization has prompted Information Security to look for more controls that can secure access to critical assets For users that need to access these systems Information Security wants to use PAN-OS multi-factor authentication (MFA) integration to enforce MFA.

What should the enterprise do to use PAN-OS MFA1?

Configure a Captive Porta1 authentication policy that uses an authentication profile that references a RADIUS profile

Create an authentication profile and assign another authentication factor to be used by a Captive Portal authentication policy

Configure a Captive Portal authentication policy that uses an authentication sequence

Use a Credential Phishing agent to detect prevent and mitigate credential phishing campaigns

15. An administrator wants multiple web servers In the DMZ to receive connections initiated from the internet. Traffic destined for 206.15.22.9 port 80/TCP needs to be forwarded to the server at 10.1.1.22.

Based on the image, which NAT rule will forward web-browsing traffic correctly?

A)

Option

16. the firewall's device group as post-rules

How will the rule order populate once pushed to the firewall?

shared device group policies, firewall device group policies. local policies.

firewall device group policies, local policies. shared device group policies

shared device group policies. local policies, firewall device group policies

local policies, firewall device group policies, shared device group policies

17. Which GlobalProtect component must be configured to enable Clientless VPN?

GlobalProtect satellite

GlobalProtect app

GlobalProtect portal

GlobalProtect gateway

18. Which three use cases are valid reasons for requiring an Active/Active high availability deployment? (Choose three.)

The environment requires real, full-time redundancy from both firewalls at all times

The environment requires Layer 2 interfaces in the deployment

The environment requires that both firewalls maintain their own routing tables for faster dynamic routing protocol convergence

The environment requires that all configuration must be fully synchronized between both members of the HA pair

The environment requires that traffic be load-balanced across both firewalls to handle peak traffic spikes

19. When you navigate to Network: > GlobalProtect > Portals > Method section, which three options are available? (Choose three)

user-logon (always on)

pre-logon then on-demand

on-demand (manual user initiated connection)

post-logon (always on)

certificate-logon

20. A firewall administrator needs to be able to inspect inbound HTTPS traffic on servers hosted in their DMZ to prevent the hosted service from being exploited.

Which combination of features can allow PAN-OS to detect exploit traffic in a session with TLS encapsulation?

Decryption policy and a Data Filtering profile

a WildFire profile and a File Blocking profile

Vulnerability Protection profile and a Decryption policy

a Vulnerability Protection profile and a QoS policy

Page 3 of 6

21. SAML SLO is supported for which two firewall features? (Choose two.)

GlobalProtect Portal

CaptivePortal

WebUI

CLI

22. A web server is hosted in the DMZ and the server is configured to listen for incoming connections on TCP port 443 A Security policies rules allowing access from the Trust zone to the DMZ zone needs to be configured to allow web-browsing access. The web server hosts its contents over HTTP(S). Traffic from Trust to DMZ is being decrypted with a Forward Proxy rule.

Which combination of service and application, and order of Security policy rules, needs to be configured to allow cJeartext web-browsing traffic to this server on tcp/443?

Rule #1 application: web-browsing; service application-default; action: allow Rule #2 application: ssl; service: application-default; action: allow

Rule #1: application; web-browsing; service: service-https; action: allow Rule #2 application: ssl; service: application-default, action: allow

Rule #1: application: web-browsing; service: service-http; action: allow Rule #2: application: ssl; service: application-default; action: allow

Rule tf1 application: ssl; service: application-default; action: allow Rule #2 application; web-browsing; service application-default; action: allow

23. An engineer is planning an SSL decryption implementation

Which of the following statements is a best practice for SSL decryption?

Use the same Forward Trust certificate on all firewalls in the network.

Obtain a certificate from a publicly trusted root CA for the Forward Trust certificate.

Obtain an enterprise CA-signed certificate for the Forward Trust certificate.

Use an enterprise CA-signed certificate for the Forward Untrust certificate.

24. Using multiple templates in a stack to manage many firewalls provides which two advantages? (Choose two.)

inherit address-objects from templates

define a common standard template configuration for firewalls

standardize server profiles and authentication configuration across all stacks

standardize log-forwarding profiles for security polices across all stacks

25. A bootstrap USB flash drive has been prepared using a Windows workstation to load the initial configuration of a Palo Alto Networks firewall that was previously being used in a lab. The USB flash drive was formatted using file system FAT32 and the initial configuration is stored in a file named init-cfg txt. The firewall is currently running PAN-OS 10.0 and using a lab config.

The contents of init-cfg txi in the USB flash drive are as follows:

The USB flash drive has been inserted in the firewalls' USB port, and the firewall has been restarted using command:> request resort system Upon restart, the firewall fails to begin the bootstrapping process. The failure is caused because

Firewall must be in factory default state or have all private data deleted for bootstrapping

The hostname is a required parameter, but it is missing in init-cfg txt

The USB must be formatted using the ext3 file system, FAT32 is not supported

PANOS version must be 91.x at a minimum but the firewall is running 10.0.x

The bootstrap.xml file is a required file but it is missing

26. An engineer is pushing configuration from Panorama lo a managed firewall.

What happens when the pushed Panorama configuration has Address Object names that duplicate the Address Objects already configured on the firewall?

The firewall rejects the pushed configuration, and the commit fails.

The firewall renames the duplicate local objects with "-1" at the end signifying they are clones; it will update the references to the objects accordingly and fully commit the pushed configuration.

The firewall fully commits all of the pushed configuration and overwrites its locally configured objects

The firewall ignores only the pushed objects that have the same name as the locally configured objects, and it will commit the rest of the pushed configuration.

27. Which statement best describes the Automated Commit Recovery feature?

It performs a connectivity check between the firewall and Panorama after every configuration commit on the firewall. It reverts the configuration changes on the firewall if the check fails.

It restores the running configuration on a firewall and Panorama if the last configuration commit fails.

It performs a connectivity check between the firewall and Panorama after every configuration commit on the firewall. It reverts the configuration changes on the firewall and on Panorama if the check fails.

It restores the running configuration on a firewall if the last configuration commit fails.

28. Which statement accurately describes service routes and virtual systems?

Virtual systems that do not have specific service routes configured inherit the global service and service route settings for the firewall.

Virtual systems can only use one interface for all global service and service routes of the firewall.

Virtual systems cannot have dedicated service routes configured; and virtual systems always use the global service and service route settings for the firewall.

The interface must be used for traffic to the required external services.

29. Which CLI command is used to determine how much disk space is allocated to logs?

show logging-status

show system info

debug log-receiver show

show system logdfo-quota

30. A network security engineer must implement Quality of Service policies to ensure specific levels of delivery guarantees for various applications in the environment They want to ensure that they know as much as they can about QoS before deploying.

Which statement about the QoS feature is correct?

QoS is only supported on firewalls that have a single virtual system configured

QoS can be used in conjunction with SSL decryption

QoS is only supported on hardware firewalls

QoS can be used on firewalls with multiple virtual systems configured

Page 4 of 6

31. While analyzing the Traffic log, you see that some entries show "unknown-tcp" in the Application column.

What best explains these occurrences?

A handshake took place, but no data packets were sent prior to the timeout.

A handshake took place; however, there were not enough packets to identify the application.

A handshake did take place, but the application could not be identified.

A handshake did not take place, and the application could not be identified.

32. You need to allow users to access the office-suite applications of their choice.

How should you configure the firewall to allow access to any office-suite application?

Create an Application Group and add Office 365, Evernote Google Docs and Libre Office

Create an Application Group and add business-systems to it.

Create an Application Filter and name it Office Programs, then filter it on the office programs subcategory.

Create an Application Filter and name it Office Programs then filter on the business-systems category.

33. When using certificate authentication for firewall administration, which method is used for authorization?

Radius

LDAP

Kerberos

Local

34. An administrator has configured a pair of firewalls using high availability in Active/Passive mode. Link and Path Monitoring Is enabled with the Failure Condition set to "any." There is one link group configured containing member interfaces ethernet1/1 and ethernet1/2 with a Group Failure Condition set to "all."

Which HA state will the Active firewall go into if ethernet1/1 link goes down due to a failure?

Non-functional

Passive

Active-Secondary

Active

35. Cortex XDR notifies an administrator about grayware on the endpoints. There are no entries about grayware in any of the logs of the corresponding firewall.

Which setting can the administrator configure on the firewall to log grayware verdicts?

within the log forwarding profile attached to the Security policy rule

within the log settings option in the Device tab

in WildFire General Settings, select "Report Grayware Files"

in Threat General Settings, select "Report Grayware Files"

36. The Aggregate Ethernet interface is showing down on a passive PA-7050 firewall of an active/passive HA pair. The HA Passive Link State is set to "Auto" under Device > High Availability > General > Active/Passive Settings. The AE interface is configured with LACP enabled and is up only on the active firewall.

Why is the AE interface showing down on the passive firewall?

It does not perform pre-negotiation LACP unless "Enable in HA Passive State" is selected under the High Availability Options on the LACP tab of the AE Interface.

It does not participate in LACP negotiation unless Fast Failover is selected under the Enable LACP selection on the LACP tab of the AE Interface.

It participates in LACP negotiation when Fast is selected for Transmission Rate under the Enable LACP selection on the LACP tab of the AE Interface.

It performs pre-negotiation of LACP when the mode Passive is selected under the Enable LACP selection on the LACP tab of the AE Interface.

37. In SSL Forward Proxy decryption, which two certificates can be used for certificate signing? (Choose two.)

wildcard server certificate

enterprise CA certificate

client certificate

server certificate

self-signed CA certificate

38. Which three items are import considerations during SD-WAN configuration planning? (Choose three.)

link requirements

the name of the ISP

IP Addresses

branch and hub locations

39. Your company occupies one floor in a single building. You have two Active Directory domain controllers on a single network. The firewall's management-plane resources are lightly utilized.

Given the size of this environment, which User-ID collection method is sufficient?

Citrix terminal server agent deployed on the network

Windows-based agent deployed on each domain controller

PAN-OS integrated agent deployed on the firewall

a syslog listener

40. You have upgraded Panorama to 10.2 and need to upgrade six Log Collectors.

When upgrading Log Collectors to 10.2, you must do what?

Upgrade the Log Collectors one at a time.

Add Panorama Administrators to each Managed Collector.

Add a Global Authentication Profile to each Managed Collector.

Upgrade all the Log Collectors at the same time.

Page 5 of 6

41. An administrator wants to enable WildFire inline machine learning.

Which three file types does WildFire inline ML analyze? (Choose three.)

MS Office

ELF

APK

VBscripts

Powershell scripts

42. When an in-band data port is set up to provide access to required services, what is required for an interface that is assigned to service routes?

The interface must be used for traffic to the required services

You must enable DoS and zone protection

You must set the interface to Layer 2 Layer 3. or virtual wire

You must use a static IP address

43. What is the best description of the HA4 Keep-Alive Threshold (ms)?

the maximum interval between hello packets that are sent to verify that the HA functionality on the other firewall is operational.

The time that a passive or active-secondary firewall will wait before taking over as the active or active-primary firewall

the timeframe within which the firewall must receive keepalives from a cluster member to know that the cluster member is functional.

The timeframe that the local firewall wait before going to Active state when another cluster member is preventing the cluster from fully synchronizing.

44. A network-security engineer attempted to configure a bootstrap package on Microsoft Azure, but the virtual machine provisioning process failed. In reviewing the bootstrap package, the engineer only had the following directories: /config, /license and /software

Why did the bootstrap process fail for the VM-Series firewall in Azure?

All public cloud deployments require the /plugins folder to support proper firewall native integrations

The /content folder is missing from the bootstrap package

The VM-Series firewall was not pre-registered in Panorama and prevented the bootstrap process from successfully completing

The /config or /software folders were missing mandatory files to successfully bootstrap

45. What is the best description of the HA4 Keep-Alive Threshold (ms)?

the maximum interval between hello packets that are sent to verify that the HA functionality on the other firewall is operational.

The time that a passive or active-secondary firewall will wait before taking over as the active or active-primary firewall

the timeframe within which the firewall must receive keepalives from a cluster member to know that the cluster member is functional.

The timeframe that the local firewall wait before going to Active state when another cluster member is preventing the cluster from fully synchronizing.

46. What are three reasons for excluding a site from SSL decryption? (Choose three.)

the website is not present in English

unsupported ciphers

certificate pinning

unsupported browser version

mutual authentication

47. What can an engineer use with GlobalProtect to distribute user-specific client certificates to each GlobalProtect user?

Certificate profile

SSL/TLS Service profile

OCSP Responder

SCEP

48. A network security engineer wants to prevent resource-consumption issues on the firewall.

Which strategy is consistent with decryption best practices to ensure consistent performance?

Use RSA in a Decryption profile tor higher-priority and higher-risk traffic, and use less processor-intensive decryption methods for lower-risk traffic

Use PFS in a Decryption profile for higher-priority and higher-risk traffic, and use less processor-intensive decryption methods for tower-risk traffic

Use Decryption profiles to downgrade processor-intensive ciphers to ciphers that are less processor-intensive

Use Decryption profiles to drop traffic that uses processor-intensive ciphers

49. Which statement regarding HA timer settings is true?

Use the Recommended profile for typical failover timer settings

Use the Moderate profile for typical failover timer settings

Use the Aggressive profile for slower failover timer settings.

Use the Critical profile for faster failover timer settings.

50. What happens when an A/P firewall cluster synchronies IPsec tunnel security associations (SAs)?

Phase 2 SAs are synchronized over HA2 links

Phase 1 and Phase 2 SAs are synchronized over HA2 links

Phase 1 SAs are synchronized over HA1 links

Phase 1 and Phase 2 SAs are synchronized over HA3 links

Page 6 of 6

51. Which Panorama mode should be used so that all logs are sent to, and only stored in. Cortex Data Lake?

Legacy

Log Collector

Panorama

Management Only

Updated Palo Alto Networks PCNSE Exam Dumps – Best PCNSE Study Guide For Learning

Updated Palo Alto Networks PCNSE Exam Dumps – Best PCNSE Study Guide For Learning

Palo Alto Networks PCNSE Free Dumps Questions Are Below For Reading

Share this post

Author

Related Posts