How to pass Palo Alto Networks PCNSE exam with the help of dumps?

Question # 1

Which three actions can Panorama perform when deploying PAN-OS images to itsmanaged devices? (Choose three.)

A. upload-only
B. install and reboot
C. upload and install
D. upload and install and reboot
E. verify and install

Show Answer

Question # 2

Which statement regarding HA timer settings is true?

A. Use the Recommended profile for typical failover timer settings
B. Use the Moderate profile for typical failover timer settings
C. Use the Aggressive profile for slower failover timer settings.
D. Use the Critical profile for faster failover timer settings.

Show Answer

Question # 3

With the default TCP and UDP settings on the firewall, what will be the identified application in the following session?

A. Incomplete
B. unknown-tcp
C. Insufficient-data
D. not-applicable

Show Answer

Question # 4

An administrator has two pairs of firewalls within the same subnet. Both pairs of firewallshave been configured to use High Availability mode with Active/Passive. The ARP tablesfor upstream routes display the same MAC address being shared for some of thesefirewalls.What can be configured on one pair of firewalls to modify the MAC addresses so they areno longer in conflict?

A. Configure a floating IP between the firewall pairs.
B. Change the Group IDs in the High Availability settings to be different from the otherfirewall pair on the same subnet.
C. Change the interface type on the interfaces that have conflicting MAC addresses fromL3 to VLAN.
D. On one pair of firewalls, run the CLI command: set network interface vlan arp.

Show Answer

Question # 5

Which User-ID mapping method should be used in a high-security environment where all IPaddress-to-user mappings should always be explicitly known?

A. PAN-OS integrated User-ID agent
B. GlobalProtect
C. Windows-based User-ID agent
D. LDAP Server Profile configuration

Show Answer

Question # 6

What can be used as an Action when creating a Policy-Based Forwarding (PBF) policy?

A. Deny
B. Discard
C. Allow
D. Next VR

Show Answer

Question # 7

Which three items must be configured to implement application override? (Choose three )

A. Custom app
B. Security policy rule
C. Application override policy rule
D. Decryption policy rule
E. Application filter

Show Answer

Question # 8

A company has recently migrated their branch office's PA-220S to a centralized Panorama.This Panorama manages a number of PA-7000 Series and PA-5200 Series devices Alldevice group and template configuration is managed solely within PanoramaThey notice that commit times have drastically increased for the PA-220S after themigrationWhat can they do to reduce commit times?

A. Disable "Share Unused Address and Service Objects with Devices" in PanoramaSettings.
B. Update the apps and threat version using device-deployment
C. Perform a device group push using the "merge with device candidate config" option
D. Use "export or push device config bundle" to ensure that the firewall is integrated withthe Panorama config.

Show Answer

Question # 9

Which two profiles should be configured when sharing tags from threat logs with a remote User-ID agent? (Choose two.)

A. Log Ingestion
B. HTTP
C. Log Forwarding
D. LDAP

Show Answer

Question # 10

An engineer reviews high availability (HA) settings to understand a recent HA failoverevent. Review the screenshot below. Which timer determines the frequency at which the HA peers exchange messages in theform of an ICMP (ping)

A. Hello Interval
B. Promotion Hold Time
C. Heartbeat Interval
D. Monitor Fail Hold Up Time

Show Answer

Question # 11

A network administrator is trying to prevent domain username and password submissionsto phishing sites on some allowed URL categoriesWhich set of steps does the administrator need to take in the URL Filtering profile toprevent credential phishing on the firewall?

A. Choose the URL categories in the User Credential Submission column and set action toblock Select the User credential Detection tab and select Use Domain Credential FilterCommit
B. Choose the URL categories in the User Credential Submission column and set action toblock Select the User credential Detection tab and select use IP User Mapping Commit
C. Choose the URL categories on Site Access column and set action to block Click theUser credential Detection tab and select IP User Mapping Commit
D. Choose the URL categories in the User Credential Submission column and set action toblock Select the URL filtering settings and enable Domain Credential Filter Commit

Show Answer

Question # 12

Where can a service route be configured for a specific destination IP?

A. Use Netw ork > Virtual Routers, select the Virtual Router > Static Routes > IPv4
B. Use Device > Setup > Services > Services
C. Use Device > Setup > Services > Service Route Configuration > Customize >Destination
D. Use Device > Setup > Services > Service Route Configuration > Customize > IPv4

Show Answer

Question # 13

Refer to the exhibit. Based on the screenshots above what is the correct order in which the various rules aredeployed to firewalls inside the DATACENTER_DG device group?

A.shared pre-rulesDATACENTER DG pre rulesrules configured locally on the firewallshared post-rulesDATACENTER_DG post-rulesDATACENTER.DG default rules
B.shared pre-rulesDATACENTER_DG pre-rulesrules configured locally on the firewallshared post-rulesDATACENTER.DG post-rulesshared default rules
C.shared pre-rulesDATACENTER_DG pre-rulesrules configured locally on the firewallDATACENTER_DG post-rulesshared post-rulesshared default rules
D.shared pre-rulesDATACENTER_DG pre-rulesrules configured locally on the firewallDATACENTER_DG post-rulesshared post-rules DATACENTER_DG default rules

Show Answer

Question # 14

After importing a pre-configured firewall configuration to Panorama, what step is required toensure a commit/push is successful without duplicating local configurations?

A. Ensure Force Template Values is checked when pushing configuration.
B. Push the Template first, then push Device Group to the newly managed firewall.
C. Perform the Export or push Device Config Bundle to the newly managed firewall.
D. Push the Device Group first, then push Template to the newly managed firewall

Show Answer

Question # 15

What is the best definition of the Heartbeat Interval?

A. The interval in milliseconds between hello packets
B. The frequency at which the HA peers check link or path availability
C. The frequency at which the HA peers exchange ping
D. The interval during which the firewall will remain active following a link monitor failure

Show Answer

Question # 16

An administrator has been tasked with configuring decryption policies,Which decryption best practice should they consider?

A. Consider the local, legal, and regulatory implications and how they affect which traffic can be decrypted.
B. Decrypt all traffic that traverses the firewall so that it can be scanned for threats.
C. Place firewalls where administrators can opt to bypass the firewall when needed.
D. Create forward proxy decryption rules without Decryption profiles for unsanctionedapplications.

Show Answer

Question # 17

Which type of zone will allow different virtual systems to communicate with each other?

A. Tap
B. External
C. Virtual Wire
D. Tunnel

Show Answer

Question # 18

Which statement is correct given the following message from the PanGPA log on theGlobalProtect app?Failed to connect to server at port:47 67

A. The PanGPS process failed to connect to the PanGPA process on port 4767
B. The GlobalProtect app failed to connect to the GlobalProtect Portal on port 4767
C. The PanGPA process failed to connect to the PanGPS process on port 4767
D. The GlobalProtect app failed to connect to the GlobalProtect Gateway on port 4767

Show Answer

Question # 19

Which GlobalProtect gateway selling is required to enable split-tunneling by access route, destination domain, and application?

A. No Direct Access to local networks
B. Tunnel mode
C. iPSec mode
D. Satellite mode

Show Answer

Question # 20

An administrator would like to determine which action the firewall will take for a specificCVE. Given the screenshot below, where should the administrator navigate to view this information?

A. The profile rule action
B. CVE column
C. Exceptions lab
D. The profile rule threat name

Show Answer

Question # 21

An administrator notices that an interface configuration has been overridden locally on afirewall. They require all configuration to be managed from Panorama and overrides are notallowed.What is one way the administrator can meet this requirement?

A. Perform a commit force from the CLI of the firewall.
B. Perform a template commit push from Panorama using the "Force Template Values"option.
C. Perform a device-group commit push from Panorama using the "Include Device andNetwork Templates" option.
D. Reload the running configuration and perform a Firewall local commit.

Show Answer

Question # 22

During the implementation of SSL Forward Proxy decryption, an administrator imports thecompany's Enterprise Root CA and Intermediate CA certificates onto the firewall. Thecompany's Root and Intermediate CA certificates are also distributed to trusted devicesusing Group Policy and GlobalProtect. Additional device certificates and/or Subordinatecertificates requiring an Enterprise CA chain of trust are signed by the company'sIntermediate CA.Which method should the administrator use when creating Forward Trust and ForwardUntrust certificates on the firewall for use with decryption?

A. Generate a single subordinate CA certificate for both Forward Trust and ForwardUntrust.
B. Generate a CA certificate for Forward Trust and a self-signed CA for Forward Untrust.
C. Generate a single self-signed CA certificate for Forward Trust and another for ForwardUntrust
D. Generate two subordinate CA certificates, one for Forward Trust and one for ForwardUntrust.

Show Answer

Question # 23

An administrator receives the following error message:"IKE phase-2 negotiation failed when processing Proxy ID. Received local id 192.168 3333/24 type IPv4 address protocol 0 port 0, received remote id 172.16 33.33/24 type IPv4address protocol 0 port 0."How should the administrator identify the root cause of this error message?

A. In the IKE Gateway configuration, verify that the IP address for each VPN peer isaccurate
B. Verify that the IP addresses can be pinged and that routing issues are not causing theconnection failure
C. Check whether the VPN peer on one end is set up correctly using policy-based VPN
D. In the IPSec Crypto profile configuration, verify that PFS is either enabled on both VPNpeers or disabled on both VPN peers.

Show Answer

Question # 24

Which two policy components are required to block traffic in real time using a dynamic usergroup (DUG)? (Choose two.)

A. A Deny policy for the tagged traffic
B. An Allow policy for the initial traffic
C. A Decryption policy to decrypt the traffic and see the tag
D. A Deny policy with the "tag" App-ID to block the tagged traffic

Show Answer

Question # 25

After implementing a new NGFW, a firewall engineer sees a VoIP traffic issue goingthrough the firewall After troubleshooting the engineer finds that the firewall performs NATon the voice packets payload and opens dynamic pinholes for media portsWhat can the engineer do to solve the VoIP traffic issue?

A. Disable ALG under H.323 application
B. Increase the TCP timeout under H.323 application
C. Increase the TCP timeout under SIP application
D. Disable ALG under SIP application

Show Answer

Question # 26

A company has configured GlobalProtect to allow their users to work from home. Adecrease in performance for remote workers has been reported during peak-use hours.Which two steps are likely to mitigate the issue? (Choose TWO)

A. Exclude video traffic
B. Enable decryption
C. Block traffic that is not work-related
D. Create a Tunnel Inspection policy

Show Answer

Question # 27

Which operation will impact the performance of the management plane?

A. Decrypting SSL sessions
B. Generating a SaaS Application report
C. Enabling DoS protection
D. Enabling packet buffer protection

Show Answer

Question # 28

Which three external authentication services can the firewall use to authenticate adminsinto the Palo Alto Networks NGFW without creating administrator account on the firewall?(Choose three.)

A. RADIUS
B. TACACS+
C. Kerberos
D. LDAP
E. SAML

Show Answer

Question # 29

An organization is interested in migrating from their existing web proxy architecture to theWeb Proxy feature of their PAN-OS 11.0 firewalls. Currently. HTTP and SSL requestscontain the c IP address of the web server and the client browser is redirected to the proxyWhich PAN-OS proxy method should be configured to maintain this type of traffic flow?

A. DNS proxy
B. Explicit proxy
C. SSL forward proxy
D. Transparent proxy

Show Answer

Question # 30

When an engineer configures an active/active high availability pair, which two links canthey use? (Choose two)

A. HSCI-C
B. Console Backup
C. HA3
D. HA2 backup

Show Answer

Question # 31

A network security administrator wants to inspect HTTPS traffic from users as it egressesthrough a firewall to the Internet/Untrust zone from trusted network zones.The security admin wishes to ensure that if users are presented with invalid or untrustedsecurity certificates, the user will see an untrusted certificate warning.What is the best choice for an SSL Forward Untrust certificate?

A. A web server certificate signed by the organization's PKI
B. A self-signed certificate generated on the firewall
C. A subordinate Certificate Authority certificate signed by the organization's PKI
D. A web server certificate signed by an external Certificate Authority

Show Answer

Question # 32

Which new PAN-OS 11.0 feature supports IPv6 traffic?

A. DHCPv6 Client with Prefix Delegation
B. OSPF
C. DHCP Server
D. IKEv1

Show Answer

Question # 33

An engineer is deploying multiple firewalls with common configuration in Panorama.What are two benefits of using nested device groups? (Choose two.)

A. Inherit settings from the Shared group
B. Inherit IPSec crypto profiles
C. Inherit all Security policy rules and objects
D. Inherit parent Security policy rules and objects

Show Answer

Question # 34

Based on the screenshots above, and with no configuration inside the Template Stackitself, what access will the device permit on its Management port?

A. The firewall will allow HTTP Telnet, HTTPS, SSH, and Ping from IP addresses definedas $permitted-subnet-1.
B. The firewall will allow HTTP Telnet, HTTPS, SSH, and Ping from IP addresses definedas $permitted-subnet-2.
C. The firewall will allow HTTP, Telnet, SNMP, HTTPS, SSH and Ping from IP addressesdefined as $permitted-subnet-1 and $permitted-subnet-2.
D. The firewall will allow HTTP, Telnet, HTTPS, SSH, and Ping from IP addresses definedas $permitted-subnet-1 and $permitted-subnet-2.

Show Answer

Question # 35

An engineer configures SSL decryption in order to have more visibility to the internal users'traffic when it is regressing the firewall.Which three types of interfaces support SSL Forward Proxy? (Choose three.)

A. High availability (HA)
B. Layer 3
C. Layer 2
D. Tap
E. Virtual Wire

Show Answer

Question # 36

Refer to the exhibit. Using the above screenshot of the ACC, what is the best method to set a global filter,narrow down Blocked User Activity, and locate the user(s) that could be compromised by abotnet?

A. Click the hyperlink for the Zero Access.Gen threat.
B. Click the left arrow beside the Zero Access.Gen threat.
C. Click the source user with the highest threat count.
D. Click the hyperlink for the hotport threat Category.

Show Answer

Question # 37

What type of address object would be useful for internal devices where the addressingstructure assigns meaning to certain bits in the address, as illustrated in the diagram?

A. IP Netmask
B. IP Wildcard Mask
C. IP Address
D. IP Range

Show Answer

Question # 38

A network security administrator has been tasked with deploying User-ID in theirorganization.What are three valid methods of collecting User-ID information in a network? (Choosethree.)

A. Windows User-ID agent
B. GlobalProtect
C. XMLAPI
D. External dynamic list
E. Dynamic user groups

Show Answer

Question # 39

Phase two of a VPN will not establish a connection. The peer is using a policy-based VPNconfiguration.What part of the configuration should the engineer verify?

A. IKE Crypto Profile
B. Security policy
C. Proxy-IDs
D. PAN-OS versions

Show Answer

Question # 40

Which Panorama feature protects logs against data loss if a Panorama server fails?

A. Panorama HA automatically ensures that no logs are lost if a server fails inside the HACluster.
B. Panorama Collector Group with Log Redundancy ensures that no logs are lost if aserver fails inside the Collector Group.
C. Panorama HA with Log Redundancy ensures that no logs are lost if a server fails inside the HA Cluster.
D. Panorama Collector Group automatically ensures that no logs are lost if a server failsinside the Collector Group

Show Answer

Question # 41

A firewall engineer creates a destination static NAT rule to allow traffic from the internet toa webserver hosted behind the edge firewall. The pre-NAT IP address of the server is153.6 12.10, and the post-NAT IP address is 192.168.10.10. Refer to the routing andinterfaces information below. What should the NAT rule destination zone be set to?

A. None
B. Outside
C. DMZ
D. Inside

Show Answer

Question # 42

An engineer manages a high availability network and requires fast failover of the routingprotocols. The engineer decides to implement BFD.Which three dynamic routing protocols support BFD? (Choose three.)

A. OSPF
B. RIP
C. BGP
D. IGRP
E. OSPFv3 virtual link

Show Answer

Question # 43

Which three options does Panorama offer for deploying dynamic updates to its manageddevices? (Choose three.)

A. Check dependencies
B. Schedules
C. Verify
D. Revert content
E. Install

Show Answer

Question # 44

Refer to the diagram. Users at an internal system want to ssh to the SSH server The serveris configured to respond only to the ssh requests coming from IP 172.16.16.1.In order to reach the SSH server only from the Trust zone, which Security rule and NAT rule must be configured on the firewall?

A. NAT Rule:Source Zone: Trust -Source IP: Any -Destination Zone: Server -Destination IP: 172.16.15.10 -Source Translation: Static IP / 172.16.15.1Security Rule:Source Zone: Trust -Source IP: Any -Destination Zone: Trust -Destination IP: 172.16.15.10 -Application: ssh
B. NAT Rule:Source Zone: Trust -Source IP: 192.168.15.0/24 -Destination Zone: Trust -Destination IP: 192.168.15.1 -Destination Translation: Static IP / 172.16.15.10Security Rule:Source Zone: Trust -Source IP: 192.168.15.0/24 -Destination Zone: Server -Destination IP: 172.16.15.10 -Application: ssh
C. NAT Rule:Source Zone: Trust -Source IP: Any -Destination Zone: Trust -Destination IP: 192.168.15.1 -Destination Translation: Static IP /172.16.15.10Security Rule:Source Zone: Trust -Source IP: Any -Destination Zone: Server -Destination IP: 172.16.15.10 -Application: ssh
D. NAT Rule:Source Zone: Trust -Source IP: Any -Destination Zone: Server -Destination IP: 172.16.15.10 -Source Translation: dynamic-ip-and-port / ethernet1/4Security Rule:Source Zone: Trust -Source IP: Any -Destination Zone: Server -Destination IP: 172.16.15.10 -Application: ssh

Show Answer

Question # 45

A security engineer needs firewall management access on a trusted interface.Which three settings are required on an SSL/TLS Service Profile to provide secure Web UIauthentication? (Choose three.)

A. Minimum TLS version
B. Certificate
C. Encryption Algorithm
D. Maximum TLS version
E. Authentication Algorithm

Show Answer

Question # 46

A network administrator wants to deploy SSL Forward Proxy decryption. What twoattributes should a forward trust certificate have? (Choose two.)

A. A subject alternative name
B. A private key
C. A server certificate
D. A certificate authority (CA) certificate

Show Answer

Question # 47

Why would a traffic log list an application as "not-applicable”?

A. The firewall denied the traffic before the application match could be performed.
B. The TCP connection terminated without identifying any application data
C. There was not enough application data after the TCP connection was established
D. The application is not a known Palo Alto Networks App-ID.

Show Answer

Question # 48

What are three tasks that cannot be configured from Panorama by using a template stack? (Choose three.)

A. Change the firewall management IP address
B. Configure a device block list
C. Add administrator accounts
D. Rename a vsys on a multi-vsys firewall
E. Enable operational modes such as normal mode, multi-vsys mode, or FIPS-CC mode

Show Answer

Question # 49

An administrator needs to identify which NAT policy is being used for internet traffic.From the Monitor tab of the firewall GUI, how can the administrator identify which NATpolicy is in use for a traffic flow?

A. Click Session Browser and review the session details.
B. Click Traffic view and review the information in the detailed log view.
C. Click Traffic view; ensure that the Source or Destination NAT columns are included andreview the information in the detailed log view.
D. Click App Scope > Network Monitor and filter the report for NAT rules.

Show Answer

Question # 50

An engineer is configuring a firewall with three interfaces:• MGT connects to a switch with internet access.• Ethernet1/1 connects to an edge router.• Ethernet1/2 connects to a visualization network.The engineer needs to configure dynamic updates to use a dataplane interface for internettraffic. What should be configured in Setup > Services > Service Route Configuration toallow this traffic?

A. Set DNS and Palo Alto Networks Services to use the ethernet1/1 source interface
B. Set DNS and Palo Alto Networks Services to use the ethernet1/2 source interface.
C. Set DNS and Palo Alto Networks Services to use the MGT source interface.
D. Set DDNS and Palo Alto Networks Services to use the MGT source interface.

Show Answer