Palo Alto Networks PCNSE Exam Dumps Updated (V20.02) Are Available For Learning

Eleanor2024-10-14T15:15:19+00:00

By Eleanor Palo Alto Networks, PCNSE

Palo Alto Networks PCNSE exam dumps of DumpsBase are constantly according to the latest information and exam objectives. So you can be confident that you are studying the most current materials with valid PCNSE exam questions and answers. There are 152 practice questions in the ITPrepare’s PCNSE dumps that are similar to those you will encounter on the actual exam. With ITPrepare PCNSE exam dumps V20.02, you can get a feel for the types of questions in the actual Palo Alto Networks Certified Network Security Engineer Exam. If you are planning to take the PCNSE exam, we highly recommend using our PCNSE dumps as a supplement to your study materials.

Try to read PCNSE free demo questions first before getting PCNSE exam dumps V20.20:

Page 1 of 8

1. In the screenshot above which two pieces of information can be determined from the ACC configuration shown? (Choose two)

The Network Activity tab will display all applications, including FT

Threats with a severity of "high" are always listed at the top of the Threat Name list

Insecure-credentials, brute-force and protocol-anomaly are all a part of the vulnerability Threat Type

The ACC has been filtered to only show the FTP application

2. PBF can address which two scenarios? (Select Two)

forwarding all traffic by using source port 78249 to a specific egress interface

providing application connectivity the primary circuit fails

enabling the firewall to bypass Layer 7 inspection

routing FTP to a backup ISP link to save bandwidth on the primary ISP link

3. What is considered the best practice with regards to zone protection?

Review DoS threat activity (ACC > Block Activity) and look for patterns of abuse

Use separate log-forwarding profiles to forward DoS and zone threshold event logs separately from other threat logs

If the levels of zone and DoS protection consume too many firewall resources, disable zone protection

Set the Alarm Rate threshold for event-log messages to high severity or critical severity

4. An administrator has configured the Palo Alto Networks NGFW’s management interface to connect to the internet through a dedicated path that does not traverse back through the NGFW itself.

Which configuration setting or step will allow the firewall to get automatic application signature updates?

A scheduler will need to be configured for application signatures.

A Security policy rule will need to be configured to allow the update requests from the firewall to the update servers.

A Threat Prevention license will need to be installed.

A service route will need to be configured.

5. A company with already deployed Palo Alto firewalls has purchased their first Panorama server. The security team has already configured all firewalls with the Panorama IP address and added all the firewall serial numbers in Panorama.

What are the next steps to migrate configuration from the firewalls to Panorama?

Use API calls to retrieve the configuration directly from the managed devices

Export Named Configuration Snapshot on each firewall followed by Import Named Configuration Snapshot in Panorama

import Device Configuration to Panorama followed by Export or Push Device Config Bundle

Use the Firewall Migration plugin to retrieve the configuration directly from the managed devices

6. Your company occupies one floor in a single building. You have two Active Directory domain controllers on a single network. The firewall's management-plane resources are lightly utilized.

Given the size of this environment, which User-ID collection method is sufficient?

Citrix terminal server agent deployed on the network

Windows-based agent deployed on each domain controller

PAN-OS integrated agent deployed on the firewall

a syslog listener

7. A network engineer has discovered that asymmetric routing is causing a Palo Alto Networks firewall to drop traffic. The network architecture cannot be changed to correct this.

Which two actions can be taken on the firewall to allow the dropped traffic permanently? (Choose two.)

Navigate to Network > Zone Protection Click Add Select Packet Based Attack Protection > TCP/IP Drop Set "Reject Non-syn-TCP" to No Set "Asymmetric Path" to Bypass

> set session tcp-reject-non-syn no

Navigate to Network > Zone Protection Click Add Select Packet Based Attack Protection > TCP/IP Drop Set "Reject Non-syn-TCP" to Global Set "Asymmetric Path" to Global

# set deviceconfig setting session tcp-reject-non-syn no

8. Given the following snippet of a WildFire submission log. did the end-user get access to the requested information and why or why not?

Yes. because the action is set to "allow ''

No because WildFire categorized a file with the verdict "malicious"

Yes because the action is set to "alert"

No because WildFire classified the seventy as "high."

9. Which log type would provide information about traffic blocked by a Zone Protection profile?

Data Filtering

IP-Tag

Traffic

Threat

10. Which CLI command is used to determine how much disk space is allocated to logs?

show logging-status

show system info

debug log-receiver show

show system logdfo-quota

Page 2 of 8

11. An administrator allocates bandwidth to a Prisma Access Remote Networks compute location with three remote networks.

What is the minimum amount of bandwidth the administrator could configure at the compute location?

90Mbps

300 Mbps

75Mbps

50Mbps

12. The manager of the network security team has asked you to help configure the company's Security Profiles according to Palo Alto Networks best practice As part of that effort, the manager has assigned you the Vulnerability Protection profile for the internet gateway firewall.

Which action and packet-capture setting for items of high severity and critical severity best matches Palo Alto Networks best practice?

action 'reset-both' and packet capture 'extended-capture'

action 'default' and packet capture 'single-packet'

action 'reset-both' and packet capture 'single-packet'

action 'reset-server' and packet capture 'disable'

13. An administrator creates a custom application containing Layer 7 signatures. The latest application and threat dynamic update is downloaded to the same firewall. The update contains an application that matches the same traffic signatures as the custom application.

Which application will be used to identify traffic traversing the firewall?

Custom application

Unknown application

Incomplete application

Downloaded application

14. An internal system is not functioning. The firewall administrator has determined that the incorrect egress interface is being used. After looking at the configuration, the administrator believes that the firewall is not using a static route.

What are two reasons why the firewall might not use a static route? (Choose two.)

no install on the route

duplicate static route

path monitoring on the static route

disabling of the static route

15. An engineer needs to permit XML API access to a firewall for automation on a network segment that is routed through a Layer 3 subinterface on a Palo Alto Networks firewall. However, this network segment cannot access the dedicated management interface due to the Security policy.

Without changing the existing access to the management interface, how can the engineer fulfill this request?

Specify the subinterface as a management interface in Setup > Device > Interfaces.

Enable HTTPS in an Interface Management profile on the subinterface.

Add the network segment's IP range to the Permitted IP Addresses list

Configure a service route for HTTP to use the subinterface

16. Before an administrator of a VM-500 can enable DoS and zone protection, what actions need to be taken?

Measure and monitor the CPU consumption of the firewall data plane to ensure that each firewall is properly sized to support DoS and zone protection

Create a zone protection profile with flood protection configured to defend an entire egress zone against SY

ICMP ICMPv6, UD

and other IP flood attacks

Add a WildFire subscription to activate DoS and zone protection features

Replace the hardware firewall because DoS and zone protection are not available with VM-Series systems

17. An administrator has a PA-820 firewall with an active Threat Prevention subscription The administrator is considering adding a WildFire subscription.

How does adding the WildFire subscription improve the security posture of the organization1?

Protection against unknown malware can be provided in near real-time

WildFire and Threat Prevention combine to provide the utmost security posture for the firewall

After 24 hours WildFire signatures are included in the antivirus update

WildFire and Threat Prevention combine to minimize the attack surface

18. Which statement about High Availability timer settings is true?

Use the Moderate timer for typical failover timer settings.

Use the Critical timer for taster failover timer settings.

Use the Recommended timer tor faster failover timer settings.

Use the Aggressive timer for taster failover timer settings

19. DRAG DROP

An engineer is troubleshooting traffic routing through the virtual router. The firewall uses multiple routing protocols, and the engineer is trying to determine routing priority.

Match the default Administrative Distances for each routing protocol.

20. Which three items are import considerations during SD-WAN configuration planning? (Choose three.)

link requirements

the name of the ISP

IP Addresses

branch and hub locations

Page 3 of 8

21. Which statement accurately describes service routes and virtual systems?

Virtual systems that do not have specific service routes configured inherit the global service and service route settings for the firewall.

Virtual systems can only use one interface for all global service and service routes of the firewall.

Virtual systems cannot have dedicated service routes configured; and virtual systems always use the global service and service route settings for the firewall.

The interface must be used for traffic to the required external services.

22. Before an administrator of a VM-500 can enable DoS and zone protection, what actions need to be taken?

Measure and monitor the CPU consumption of the firewall data plane to ensure that each firewall is properly sized to support DoS and zone protection

Create a zone protection profile with flood protection configured to defend an entire egress zone against SY

ICMP ICMPv6, UD

and other IP flood attacks

Add a WildFire subscription to activate DoS and zone protection features

Replace the hardware firewall because DoS and zone protection are not available with VM-Series systems

23. An administrator needs to build Security rules in a Device Group that allow traffic to specific users and groups defined in Active Directory

What must be configured in order to select users and groups for those rules from Panorama?

The Security rules must be targeted to a firewall in the device group and have Group Mapping configured

A master device with Group Mapping configured must be set in the device group where the Security rules are configured

User-ID Redistribution must be configured on Panorama to ensure that all firewalls have the same mappings

A User-ID Certificate profile must be configured on Panorama

24. Refer to the exhibit.

Based on the screenshots above what is the correct order in which the various rules are deployed to firewalls inside the DATACENTER_DG device group?

shared pre-rules DATACENTER DG pre rules rules configured locally on the firewall shared post-rules DATACENTER_DG post-rules DATACENTE

DG default rules

shared pre-rules DATACENTER_DG pre-rules rules configured locally on the firewall shared post-rules DATACENTE

DG post-rules shared default rules

shared pre-rules DATACENTER_DG pre-rules rules configured locally on the firewall DATACENTER_DG post-rules shared post-rules shared default rules

shared pre-rules DATACENTER_DG pre-rules rules configured locally on the firewall DATACENTER_DG post-rules shared post-rules DATACENTER_DG default rules

25. Which three use cases are valid reasons for requiring an Active/Active high availability deployment? (Choose three.)

The environment requires real, full-time redundancy from both firewalls at all times

The environment requires Layer 2 interfaces in the deployment

The environment requires that both firewalls maintain their own routing tables for faster dynamic routing protocol convergence

The environment requires that all configuration must be fully synchronized between both members of the HA pair

The environment requires that traffic be load-balanced across both firewalls to handle peak traffic spikes

26. During the implementation of SSL Forward Proxy decryption, an administrator imports the company's Enterprise Root CA and Intermediate CA certificates onto the firewall. The company's Root and Intermediate CA certificates are also distributed to trusted devices using Group Policy and GlobalProtect. Additional device certificates and/or Subordinate certificates requiring an Enterprise CA chain of trust are signed by the company's Intermediate CA.

Which method should the administrator use when creating Forward Trust and Forward Untrust certificates on the firewall for use with decryption?

Generate a single subordinate CA certificate for both Forward Trust and Forward Untrust.

Generate a CA certificate for Forward Trust and a self-signed CA for Forward Untrust.

Generate a single self-signed CA certificate for Forward Trust and another for Forward Untrust

Generate two subordinate CA certificates, one for Forward Trust and one for Forward Untrust.

27. The Aggregate Ethernet interface is showing down on a passive PA-7050 firewall of an active/passive HA pair. The HA Passive Link State is set to "Auto" under Device > High Availability > General > Active/Passive Settings. The AE interface is configured with LACP enabled and is up only on the active firewall.

Why is the AE interface showing down on the passive firewall?

It does not perform pre-negotiation LACP unless "Enable in HA Passive State" is selected under the High Availability Options on the LACP tab of the AE Interface.

It does not participate in LACP negotiation unless Fast Failover is selected under the Enable LACP selection on the LACP tab of the AE Interface.

It participates in LACP negotiation when Fast is selected for Transmission Rate under the Enable LACP selection on the LACP tab of the AE Interface.

It performs pre-negotiation of LACP when the mode Passive is selected under the Enable LACP selection on the LACP tab of the AE Interface.

28. A network-security engineer attempted to configure a bootstrap package on Microsoft Azure, but the virtual machine provisioning process failed. In reviewing the bootstrap package, the engineer only had the following directories: /config, /license and /software

Why did the bootstrap process fail for the VM-Series firewall in Azure?

All public cloud deployments require the /plugins folder to support proper firewall native integrations

The /content folder is missing from the bootstrap package

The VM-Series firewall was not pre-registered in Panorama and prevented the bootstrap process from successfully completing

The /config or /software folders were missing mandatory files to successfully bootstrap

29. An engineer is configuring Packet Buffer Protection on ingress zones to protect from single-session DoS attacks Which sessions does Packet Buffer Protection apply to?

It applies to existing sessions and is not global

It applies to new sessions and is global

It applies to new sessions and is not global

It applies to existing sessions and is global

30. A firewall administrator has been tasked with ensuring that all Panorama-managed firewalls forward traffic logs to Panorama. In which section is this configured?

Panorama > Managed Devices

Monitor > Logs > Traffic

Device Groups > Objects > Log Forwarding

Templates > Device > Log Settings

Page 4 of 8

31. Which three firewall multi-factor authentication factors are supported by PAN-OS? (Choose three)

SSH key

User logon

Short message service

One-Time Password

Push

32. Which two actions would be part of an automatic solution that would block sites with untrusted certificates without enabling SSL Forward Proxy? (Choose two.)

Create a no-decrypt Decryption Policy rule.

Configure an EDL to pull IP addresses of known sites resolved from a CR

Create a Dynamic Address Group for untrusted sites

Create a Security Policy rule with vulnerability Security Profile attached.

Enable the “Block sessions with untrusted issuers” setting.

33. A network security administrator has an environment with multiple forms of authentication. There is a network access control system in place that authenticates and restricts access for wireless users, multiple Windows domain controllers, and an MDM solution for company-provided smartphones. All of these devices have their authentication events logged.

Given the information, what is the best choice for deploying User-ID to ensure maximum coverage?

Syslog listener

agentless User-ID with redistribution

standalone User-ID agent

captive portal

34. An engineer needs to see how many existing SSL decryption sessions are traversing a firewall

What command should be used?

show dataplane pool statistics I match proxy

debug dataplane pool statistics I match proxy

debug sessions I match proxy

show sessions all

35. An engineer is bootstrapping a VM-Series Firewall Other than the 'config folder, which three directories are mandatory as part of the bootstrap package directory structure? (Choose three.)

/software

/opt

/license

/content

/plugins

36. A network security engineer is attempting to peer a virtual router on a PAN-OS firewall with an external router using the BGP protocol. The peer relationship is not establishing.

What command could the engineer run to see the current state of the BGP state between the two devices?

show routing protocol bgp state

show routing protocol bgp peer

show routing protocol bgp summary

show routing protocol bgp rib-out

37. Before you upgrade a Palo Alto Networks NGFW, what must you do?

Make sure that the PAN-OS support contract is valid for at least another year

Export a device state of the firewall

Make sure that the firewall is running a version of antivirus software and a version of WildFire that support the licensed subscriptions.

Make sure that the firewall is running a supported version of the app + threat update

38. What is the function of a service route?

The service route is the method required to use the firewall's management plane to provide services to applications

The service packets enter the firewall on the port assigned from the external service. The server sends its response to the configured destination interface and destination IP address

The service packets exit the firewall on the port assigned for the external service. The server sends its response to the configured source interface and source IP address

Service routes provide access to external services such as DNS servers external authentication servers or Palo Alto Networks services like the Customer Support Portal

39. A company wants to install a PA-3060 firewall between two core switches on a VLAN trunk link. They need to assign each VLAN to its own zone and to assign untagged (native) traffic to its own zone which options differentiates multiple VLAN into separate zones?

Create V-Wire objects with two V-Wire interfaces and define a range of "0-4096 in the "Tag Allowed" field of the V-Wire object.

Create V-Wire objects with two V-Wire subinterfaces and assign only a single VLAN ID to the Tag Allowed" field of the V-Wire object. Repeat for every additional VLAN and use a VLAN ID of 0 for untagged traffic. Assign each interface/sub interface to a unique zone.

Create Layer 3 subinterfaces that are each assigned to a single VLAN ID and a common virtual router. The physical Layer 3 interface would handle untagged traffic. Assign each interface/subinterface t

unique zone. Do not assign any interface an IP address.

Create VLAN objects for each VLAN and assign VLAN interfaces matching each VLAN I

Repeat for every additional VLAN and use a VLAN ID of 0 for untagged traffic. Assign each interface/sub interface to a unique zone.

40. Which function is handled by the management plane (control plane) of a Palo Alto Networks firewall?

signature matching for content inspection

IPSec tunnel standup

Quality of Service

logging

Page 5 of 8

41. Where is information about packet buffer protection logged?

Alert entries are in the Alarms log. Entries for dropped traffic, discarded sessions, and blocked IP address are in the Threat log

All entries are in the System log

Alert entries are in the System log. Entries for dropped traffic, discarded sessions and blocked IP addresses are in the Threat log

All entries are in the Alarms log

42. A network administrator wants to use a certificate for the SSL/TLS Service Profile.

Which type of certificate should the administrator use?

certificate authority (CA) certificate

client certificate

machine certificate

server certificate

43. Which two statements correctly describe Session 380280? (Choose two.)

The session went through SSL decryption processing.

The session has ended with the end-reason unknown.

The application has been identified as web-browsing.

The session did not go through SSL decryption processing.

44. Which data flow describes redistribution of user mappings?

User-ID agent to firewall

firewall to firewall

Domain Controller to User-ID agent

User-ID agent to Panorama

45. What best describes the HA Promotion Hold Time?

the time that is recommended to avoid an HA failover due to the occasional flapping of neighboring devices

the time that is recommended to avoid a failover when both firewalls experience the same link/path monitor failure simultaneously

the time that the passive firewall will wait before taking over as the active firewall after communications with the HA peer have been lost

the time that a passive firewall with a low device priority will wait before taking over as the active firewall if the firewall is operational again

46. View the screenshots.

A QoS profile and policy rules are configured as shown.

Based on this information, which two statements are correct? (Choose two.)

DNS has a higher priority and more bandwidth than SS

Google-video has a higher priority and more bandwidth than WebEx.

SMTP has a higher priority but lower bandwidth than Zoom.

Facetime has a higher priority but lower bandwidth than Zoom.

47. A network security engineer wants to prevent resource-consumption issues on the firewall.

Which strategy is consistent with decryption best practices to ensure consistent performance?

Use RSA in a Decryption profile tor higher-priority and higher-risk traffic, and use less processor-intensive decryption methods for lower-risk traffic

Use PFS in a Decryption profile for higher-priority and higher-risk traffic, and use less processor-intensive decryption methods for tower-risk traffic

Use Decryption profiles to downgrade processor-intensive ciphers to ciphers that are less processor-intensive

Use Decryption profiles to drop traffic that uses processor-intensive ciphers

48. An administrator can not see any Traffic logs from the Palo Alto Networks NGFW in Panorama reports. The configuration problem seems to be on the firewall.

Which settings, if configured incorrectly, most likely would stop only Traffic logs from being sent from the NGFW to Panorama?

A)

Option A

Option B

Option C

Option D

49. An engineer needs to redistribute User-ID mappings from multiple data centers.

Which data flow best describes redistribution of user mappings?

Domain Controller to User-ID agent

User-ID agent to Panorama

User-ID agent to firewall

firewall to firewall

50. An organization wishes to roll out decryption but gets some resistance from engineering leadership regarding the guest network.

What is a common obstacle for decrypting traffic from guest devices?

Guest devices may not trust the CA certificate used for the forward untrust certificate.

Guests may use operating systems that can't be decrypted.

The organization has no legal authority to decrypt their traffic.

Guest devices may not trust the CA certificate used for the forward trust certificate.

Page 6 of 8

51. A network administrator troubleshoots a VPN issue and suspects an IKE Crypto mismatch between peers. Where can the administrator find the corresponding logs after running a test command to initiate the VPN?

Configuration logs

System logs

Traffic logs

Tunnel Inspection logs

52. A standalone firewall with local objects and policies needs to be migrated into Panorama.

What procedure should you use so Panorama is fully managing the firewall?

Use the "import Panorama configuration snapshot" operation, then perform a device-group commit push with "include device and network templates"

Use the "import device configuration to Panorama" operation, then "export or push device config bundle" to push the configuration

Use the "import Panorama configuration snapshot" operation, then "export or push device config bundle" to push the configuration

Use the "import device configuration to Panorama" operation, then perform a device-group commit push with "include device and network templates"

53. An administrator wants to enable WildFire inline machine learning.

Which three file types does WildFire inline ML analyze? (Choose three.)

MS Office

ELF

APK

VBscripts

Powershell scripts

54. DRAG DROP

Match each GlobalProtect component to the purpose of that component

55. What are two best practices for incorporating new and modified App-IDs? (Choose two)

Configure a security policy rule to allow new App-lDs that might have network-wide impact

Study the release notes and install new App-IDs if they are determined to have low impact

Perform a Best Practice Assessment to evaluate the impact or the new or modified App-IDs

Run the latest PAN-OS version in a supported release tree to have the best performance for the new App-IDs

56. An existing NGFW customer requires direct interne! access offload locally at each site and iPSec connectivity to all branches over public internet. One requirement is mat no new SD-WAN hardware be introduced to the environment.

What is the best solution for the customer?

Configure a remote network on PAN-OS

Upgrade to a PAN-OS SD-WAN subscription

Deploy Prisma SD-WAN with Prisma Access

Configure policy-based forwarding

57. the firewall's device group as post-rules

How will the rule order populate once pushed to the firewall?

shared device group policies, firewall device group policies. local policies.

firewall device group policies, local policies. shared device group policies

shared device group policies. local policies, firewall device group policies

local policies, firewall device group policies, shared device group policies

58. When configuring forward error correction (FEC) for PAN-OS SD-WAN, an administrator would turn on the feature inside which type of SD-WAN profile?

Certificate profile

Path Quality profile

SD-WAN Interface profile

Traffic Distribution profile

59. DRAG DROP

Place the steps in the WildFire process workflow in their correct order.

60. Which statement is true regarding a Best Practice Assessment?

It shows how your current configuration compares to Palo Alto Networks recommendations

It runs only on firewalls

When guided by an authorized sales engineer, it helps determine the areas of greatest risk where you should focus prevention activities.

It provides a set of questionnaires that help uncover security risk prevention gaps across all areas of network and security architecture

Page 7 of 8

61. SSL Forward Proxy decryption is configured but the firewall uses Untrusted-CA to sign the website https //www important-website com certificate End-users are receiving me "security certificate is not trusted is warning Without SSL decryption the web browser shows that the website certificate is trusted and signed by a well-known certificate chain Well-Known-lntermediate and Well-Known-Root- CA.

The network security administrator who represents the customer requires the following two behaviors when SSL Forward Proxy is enabled:

1 End-users must not get the warning for the https://www.very-important-website.com website.

2 End-users should get the warning for any other untrusted website

Which approach meets the two customer requirements?

Navigate to Device > Certificate Management > Certificates > Device Certificates import Well-Known-lntermediate-CA and Well-Known-Root-CA select the Trusted Root CA checkbox and commit the configuration

Install the Well-Known-lntermediate-CA and Well-Known-Root-CA certificates on all end-user systems m the user and local computer stores

Navigate to Device > Certificate Management - Certificates s Default Trusted Certificate Authorities import Well-Known-intermediate-CA and Well-Known-Root-CA select the Trusted Root CA check box and commit the configuration

Clear the Forward Untrust Certificate check box on the Untrusted-CA certificate and commit the configuration

62. Which statement regarding HA timer settings is true?

Use the Recommended profile for typical failover timer settings

Use the Moderate profile for typical failover timer settings

Use the Aggressive profile for slower failover timer settings.

Use the Critical profile for faster failover timer settings.

63. A client wants to detect the use of weak and manufacturer-default passwords for loT devices.

Which option will help the customer?

Configure a Data Filtering profile with alert mode.

Configure an Antivirus profile with alert mode.

Configure a Vulnerability Protection profile with alert mode

Configure an Anti-Spyware profile with alert mode.

64. An administrator is required to create an application-based Security policy rule to allow Evernote. The Evernote application implicitly uses SSL and web browsing.

What is the minimum the administrator needs to configure in the Security rule to allow only Evernote?

Add the Evernote application to the Security policy rule, then add a second Security policy rule containing both HTTP and SS

Add the HTTP, SSL, and Evernote applications to the same Security policy

Add only the Evernote application to the Security policy rule.

Create an Application Override using TCP ports 443 and 80.

65. An engineer is creating a template and wants to use variables to standardize the configuration across a large number of devices Which Mo variable types can be defined? (Choose two.)

Path group

Zone

IP netmask

FQDN

66. An engineer wants to configure aggregate interfaces to increase bandwidth and redundancy between the firewall and switch.

Which statement is correct about the configuration of the interfaces assigned to an aggregate interface group?

They can have a different bandwidth.

They can have a different interface type such as Layer 3 or Layer 2.

They can have a different interface type from an aggregate interface group.

They can have different hardware media such as the ability to mix fiber optic and copper.

67. A firewall should be advertising the static route 10.2.0.0/24 Into OSPF. The configuration on the neighbor is correct, but the route is not in the neighbor's routing table.

Which two configurations should you check on the firewall? (Choose two.)

In the OSFP configuration, ensure that the correct redistribution profile is selected in the OSPF Export Rules section.

Within the redistribution profile ensure that Redist is selected.

Ensure that the OSPF neighbor state Is "2-Way."

In the redistribution profile check that the source type is set to "ospf."

68. What is the best description of the HA4 Keep-Alive Threshold (ms)?

the maximum interval between hello packets that are sent to verify that the HA functionality on the other firewall is operational.

The time that a passive or active-secondary firewall will wait before taking over as the active or active-primary firewall

the timeframe within which the firewall must receive keepalives from a cluster member to know that the cluster member is functional.

The timeframe that the local firewall wait before going to Active state when another cluster member is preventing the cluster from fully synchronizing.

69. 1.While analyzing the Traffic log, you see that some entries show "unknown-tcp" in the Application column What best explains these occurrences?

A handshake took place, but no data packets were sent prior to the timeout.

A handshake took place; however, there were not enough packets to identify the application.

A handshake did take place, but the application could not be identified.

A handshake did not take place, and the application could not be identified.

70. Review the screenshot of the Certificates page.

An administrator tor a small LLC has created a series of certificates as shown, to use tor a planned Decryption roll out The administrator has also installed the sell-signed root certificate <n all client systems When testing, they noticed that every time a user visited an SSL site they received unsecured website warnings What is the cause of the unsecured website warnings.

The forward trust certificate has not been signed by the set-singed root CA certificate

The self-signed CA certificate has the same CN as the forward trust and untrust certificates

The forward untrust certificate has not been signed by the self-singed root CA certificate

The forward trust certificate has not been installed in client systems

Page 8 of 8

71. A web server is hosted in the DMZ and the server is configured to listen for incoming connections on TCP port 443 A Security policies rules allowing access from the Trust zone to the DMZ zone needs to be configured to allow web-browsing access. The web server hosts its contents over HTTP(S). Traffic from Trust to DMZ is being decrypted with a Forward Proxy rule.

Which combination of service and application, and order of Security policy rules, needs to be configured to allow cJeartext web-browsing traffic to this server on tcp/443?

Rule #1 application: web-browsing; service application-default; action: allow Rule #2- application: ssl; service: application-default; action: allow

Rule #1: application; web-browsing; service: service-https; action: allow Rule #2 application: ssl; service: application-default, action: allow

Rule #1: application: web-browsing; service: service-http; action: allow Rule #2: application: ssl; service: application-default; action: allow

Rule tf1 application: ssl; service: application-default; action: allow Rule #2 application; web-browsing; service application-default; action: allow

72. An administrator has 750 firewalls. The administrator's central-management Panorama instance deploys dynamic updates to the firewalls. The administrator notices that the dynamic updates from Panorama do not appear on some of the firewalls.

If Panorama pushes the configuration of a dynamic update schedule to managed firewalls, but the configuration does not appear, what is the root cause?

Panorama does not have valid licenses to push the dynamic updates.

Panorama has no connection to Palo Alto Networks update servers.

No service route is configured on the firewalls to Palo Alto Networks update servers.

Locally-defined dynamic update settings take precedence over the settings that Panorama pushed.

73. What are two common reasons to use a "No Decrypt" action to exclude traffic from SSL decryption? (Choose two.)

the website matches a category that is not allowed for most users

the website matches a high-risk category

the web server requires mutual authentication

the website matches a sensitive category

74. An administrator needs firewall access on a trusted interface.

Which two components are required to configure certificate based, secure authentication to the web Ul? (Choose two)

certificate profile

server certificate

SSH Service Profile

SSL/TLS Service Profile

Palo Alto Networks PCNSE Exam Dumps Updated (V20.02) Are Available For Learning

Palo Alto Networks PCNSE Exam Dumps Updated (V20.02) Are Available For Learning

Try to read PCNSE free demo questions first before getting PCNSE exam dumps V20.20:

Share this post

Author

Related Posts