Unique Top-selling PCNSE Exams - New 2023 Palo Alto Networks Pratice Exam
PCNSE PAN-OS Dumps PCNSE Exam for Full Questions - Exam Study Guide
NEW QUESTION 107
Based on the following image,
what is the correct path of root, intermediate, and end-user certificate?
- A. Palo Alto Networks > Symantec > VeriSign
- B. Symantec > VeriSign > Palo Alto Networks
- C. VeriSign > Palo Alto Networks > Symantec
- D. VeriSign > Symantec > Palo Alto Networks
Answer: B
NEW QUESTION 108
Which Captive Portal mode must be configured to support MFA authentication?
- A. Redirect
- B. NTLM
- C. Single Sign-On
- D. Transparent
Answer: A
Explanation:
Reference:
https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/authentication/configure-multi-factor-authentication
NEW QUESTION 109
Refer to exhibit.
An organization has Palo Alto Networks NGFWs that send logs to remote monitoring and security management platforms. The network team has reported excessive traffic on the corporate WAN.
How could the Palo Alto Networks NGFW administrator reduce WAN traffic while maintaining support for all existing monitoring/ security platforms?
- A. Forward logs from firewalls only to Panorama and have Panorama forward logs to other external services.
- B. Any configuration on an M-500 would address the insufficient bandwidth concerns.
- C. Configure log compression and optimization features on all remote firewalls.
- D. Forward logs from external sources to Panorama for correlation, and from Panorama send them to the NGFW.
Answer: A
Explanation:
https://docs.paloaltonetworks.com/panorama/8-1/panorama-admin/panorama-overview/centralized-logging-and-reporting
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClKFCA0
"When this has to be done over a WAN link with bandwidth limitation, it is necessary to consider reducing the number of log streams that are sent over the link" "With this configuration, firewalls will forward logs to Panorama, assuming that log forwarding was configured correctly on the firewall. The logs are forwarded to the syslog server, thus reducing the number of log streams significantly."
NEW QUESTION 110
An engineer needs to collect User-ID mappings from the company's existing proxies.
What two methods can be used to pull this data from third party proxies? (Choose two.)
- A. Syslog
- B. XFF Headers
- C. Server Monitoring
- D. Client probing
Answer: A,B
NEW QUESTION 111
What are three reasons for excluding a site from SSL decryption? (Choose three.)
- A. certificate pinning
- B. unsupported ciphers
- C. unsupported browser version
- D. the website is not present in English
- E. mutual authentication
Answer: A,B,E
Explanation:
Reasons that sites break decryption technically include pinned certificates, client authentication, incomplete certificate chains, and unsupported ciphers. https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/decryption/decryption-exclusions/exclude-a-server-from-decryption.html
NEW QUESTION 112
An administrator just submitted a newly found piece of spyware for WildFire analysis. The spyware passively monitors behavior without the user's knowledge.
What is the expected verdict from WildFire?
- A. Malware
- B. Gray ware
- C. Spyware
- D. Phishing
Answer: B
Explanation:
Wildfire verdictions are as follow
1-Begnin 2-Greyware 3-Mallicious 4-Phishing
https://www.paloaltonetworks.com/documentation/80/wildfire/wf_admin/wildfire-overview/wildfire-concepts/verdicts
NEW QUESTION 113
When overriding a template configuration locally on a firewall, what should you consider?
- A. Panorama will lose visibility into the overridden configuration
- B. Panorama will update the template with the overridden value
- C. The firewall template will show that it is out of sync within Panorama
- D. Only Panorama can revert the override
Answer: A
Explanation:
Based on my knowledge out-of-sync message appear on Panorama only was perform a commit to Panorama but not pushed to the NGFW.
https://live.paloaltonetworks.com/t5/general-topics/reason-for-out-of-sync-message-in- panorama/td-p/328292 The override setting are not visible (known) by Panorama. The config are pushed only from Panorama to NGFW.
NEW QUESTION 114
Which User-ID mapping method should be used in a high-security environment where all IP address-to-user mappings should always be explicitly known?
- A. Windows-based User-ID agent
- B. PAN-OS integrated User-ID agent
- C. GlobalProtect
- D. LDAP Server Profile configuration
Answer: C
NEW QUESTION 115
An administrator has been asked to create 100 virtual firewalls in a local, on-premise lab environment (not in "the cloud"). Bootstrapping is the most expedient way to perform this task.
Which option describes deployment of a bootstrap package in an on-premise virtual environment?
- A. Use config-drive on a USB stick.
- B. Use a virtual CD-ROM with an ISO.
- C. Create and attach a virtual hard disk (VHD).
- D. Use an S3 bucket with an ISO.
Answer: B
NEW QUESTION 116
Which is the maximum number of samples that can be submitted to WildFire per day, based on a WildFire subscription?
- A. 10,000
- B. 5,000
- C. 15,000
- D. 7,500
Answer: A
NEW QUESTION 117
A company wants to install a PA-3060 firewall between two core switches on a VLAN trunk link. They need to assign each VLAN to its own zone and assign untagged (native) traffic to its own zone.
Which option differentiates multiple VLANs into separate zones?
- A. Create VLAN objects for each VLAN and assign VLAN interfaces matching each VLAN ID. Repeat for every additional VLAN and use a VLAN ID of 0 for untagged traffic. Assign each interface/subinterface to a unique zone.
- B. Create V-Wire objects with two V-Wire interfaces and define a range of "0-4096" in the "Tag Allowed" field of the V-Wire object.
- C. Create Layer 3 subinterfaces that are each assigned to a single VLAN ID and a common virtual router.
The physical Layer 3 interface would handle untagged traffic. Assign each interface/subinterface to a unique zone. Do not assign any interface an IP address. - D. Create V-Wire objects with two V-Wire subinterfaces and assign only a single VLAN ID to the "Tag Allowed" field of the V-Wire object. Repeat for every additional VLAN and use a VLAN ID of 0 for untagged traffic. Assign each interface/subinterface to a unique zone.
Answer: C
NEW QUESTION 118
Refer to the exhibit.
Which certificates can be used as a Forwarded Trust certificate?
- A. Certificate from Default Trust Certificate Authorities
- B. Forward_Trust
- C. Domain Sub-CA
- D. Domain-Root-Cert
Answer: C
NEW QUESTION 119
A company needs to preconfigure firewalls to be sent to remote sites with the least amount of reconfiguration. Once deployed, each firewall must establish secure tunnels back to multiple regional data centers to include the future regional data centers.
Which VPN configuration would adapt to changes when deployed to the future site?
- A. Preconfigured GlobalProtect satellite
- B. Preconfigured PPTP Tunnels
- C. Preconfigured PIsec tunnels
- D. Preconfigured GlobalProtect client
Answer: A
Explanation:
GlobalProtect Satellite
--A Palo Alto Networks firewall at a remote site that establishes IPSec tunnels with the gateway(s) at your corporate office(s) for secure access to centralized resources. Configuration on the satellite firewall is minimal, enabling you to quickly and easily scale your VPN as you add new sites.
https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/large-scale-vpn-lsvpn/lsvpn- overview.html
NEW QUESTION 120
Which PAN-OS policy must you configure to force a user to provide additional credentials before he is allowed to access an internal application that contains highly-sensitive business data?
- A. Application Override policy
- B. Authentication policy
- C. Security policy
- D. Decryption policy
Answer: B
Explanation:
Authentication policy enables you to authenticate end users before they can access services and applications. Whenever a user requests a service or application (such as by visiting a web page), the firewall evaluates Authentication policy. Based on the matching Authentication policy rule, the firewall then prompts the user to authenticate using one or more methods (factors), such as login and password, Voice, SMS, Push, or One-time Password (OTP) authentication
https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/authentication/authentication-policy
NEW QUESTION 121
View the GlobalProtect configuration screen capture.
What is the purpose of this configuration?
- A. It enables a client to perform a reverse DNS lookup on 192.168.10.1 to detect that it is an internal client.
- B. It forces the firewall to perform a dynamic DNS update, which adds the internal gateway's hostname and IP address to the DNS server.
- C. It forces an internal client to connect to an internal gateway at IP address 192.168.10.1.
- D. It configures the tunnel address of all internal clients to an IP address range starting at 192.168.10.1.
Answer: C
Explanation:
Reference:
https://www.paloaltonetworks.com/documentation/80/globalprotect/globalprotect-admin-guide/globalprotect-por the-globalprotect-client-authentication-configurations/define-the-globalprotect-agent-configurations
"Select this option to allow the GlobalProtect agent to determine if it is inside the enterprise network.
This option applies only to endpoints that are configured to communicate with internal gateways.When the user attempts to log in, the agent does a reverse DNS lookup of an internal host using the specified Hostname to the specified IP Address. The host serves as a reference point that is reachable if the endpoint is inside the enterprise network. If the agent finds the host, the endpoint is inside the network and the agent connects to an internal gateway; if the agent fails to find the internal host, the endpoint is outside the network and the agent establishes a tunnel to one of the external gateways"
NEW QUESTION 122
Which two subscriptions are available when configuring panorama to push dynamic updates to connected devices? (Choose two.)
- A. Content-ID
- B. Applications and Threats
- C. Antivirus
- D. User-ID
Answer: B,C
Explanation:
Reference: https://www.paloaltonetworks.com/documentation/71/pan-os/web-interface- help/device/device-dynamic-updates
NEW QUESTION 123
How does Panorama prompt VMWare NSX to quarantine an infected VM?
- A. Syslog Sewer Profile
- B. SNMP Server Profile
- C. Email Server Profile
- D. HTTP Server Profile
Answer: A
NEW QUESTION 124
Several offices are connected with VPNs using static IPV4 routes.
An administrator has been tasked with implementing OSPF to replace static routing.
Which step is required to accoumplish this goal?
- A. Create new VPN zones at each site to terminate each VPN connection
- B. Enable OSPFv3 on each tunnel interface and use Area ID 0.0.0.0
- C. Assign an IP address on each tunnel interface at each site
- D. Assign OSPF Area ID 0.0.0.0 to all Ethernet and tunnel interfaces
Answer: D
NEW QUESTION 125
What can be used to create dynamic address groups?
- A. dynamic address
- B. FODN addresses
- C. region objects
- D. tags
Answer: D
NEW QUESTION 126
If the firewall has the link monitoring configuration, what will cause a failover?
- A. ethernet1/3 and ethernet1/6 going down
- B. ethernet1/3 or Ethernet1/6 going down
- C. ethernet1/6 going down
- D. ethernet1/3 going down
Answer: A
NEW QUESTION 127
A customer has an application that is being identified as unknown-top for one of their custom PostgreSQL database connections. Which two configuration options can be used to correctly categorize their custom database application? (Choose two.)
- A. Application Override policy.
- B. Custom Service object.
- C. Custom application.
- D. Security policy to identify the custom application.
Answer: A,C
Explanation:
Explanation
Unlike the App-ID engine, which inspects application packet contents for unique signature elements, the Application Override policy's matching conditions are limited to header-based data only. Traffic matched by an Application Override policy is identified by the App-ID entered in the Application entry box.Choices are limited to applications currently in the App-ID database.Because this traffic bypasses all Layer 7 inspection, the resulting security is that of a Layer-4 firewall. Thus, this traffic should be trusted without the need for Content-ID inspection. The resulting application assignment can be used in other firewall functions such as Security policy and QoS.Use CasesThree primary uses cases for Application Override Policy are:
To identify "Unknown" App-IDs with a different or custom application signature To re-identify an existing application signature To bypass the Signature Match Engine (within the SP3 architecture) to improve processing timesA discussion of typical uses of application override and specific implementation examples is here:https://live.paloaltonetworks.com/t5/Learning-Articles/Tips-amp-Tricks-How-to-Create-an-Application- Ov
NEW QUESTION 128
Refer to the exhibit.
Which will be the egress interface if the traffic's ingress interface is ethernet1/7 sourcing from
192.168.111.3 and to the destination 10.46.41.113?
- A. ethernet1/7
- B. ethernet1/3
- C. ethernet1/6
- D. ethernet1/5
Answer: D
NEW QUESTION 129
An administrator needs firewall access on a trusted interface. Which two components are required to configure certificate based, secure authentication to the web Ul? (Choose two )
- A. SSH Service Profile
- B. server certificate
- C. SSL/TLS Service Profile
- D. certificate profile
Answer: A,D
NEW QUESTION 130
......
Best way to practice test for Palo Alto Networks PCNSE: https://www.troytecdumps.com/PCNSE-troytec-exam-dumps.html
PCNSE Dump Ready - Exam Questions and Answers: https://drive.google.com/open?id=1ywQhIeAhW0g2MAYHPXDeZK7HRtpiJOF3