Dive into a world where certification dreams become reality, propelled by the unparalleled depth of PCNSE dumps. As you navigate through the labyrinth of information, the PCNSE dumps light up your path with insightful practice questions. PDFs offer a serene oasis of structured knowledge, while the VCE format feels like an exciting journey of interactive learning. Together with a study guide, the PCNSE dumps transform challenges into stepping stones. Our faith in this transformative experience is so deep-rooted that we offer a 100% Pass Guarantee, like a compass guiding you home.
[Hot Arrival] Experience exam excellence with the gratis PCNSE PDF and Exam Questions, backed by a success guarantee
Question 1:
An engineer needs to permit XML API access to a firewall for automation on a network segment that is routed through a Layer 3 subinterface on a Palo Alto Networks firewall. However this network segment cannot access the dedicated management interface due to the Security policy.
Without changing the existing access to the management interface how can the engineer fulfill this request?
A. Enable HTTPS in an Interface Management profile on the subinterface
B. Add the network segment\’s IP range to the Permitted IP Addresses list
C. Specify the subinterface as a management interface in Setup > Device > Interfaces
D. Configure a service route for HTTP to use the subinterface
Correct Answer: A
Question 2:
As a best practice, logging at session start should be used in which case?
A. On all Allow rules
B. While troubleshooting
C. Only when log at session end is enabled
D. Only on Deny rules
Correct Answer: B
Logging at session start should be used as a best practice while troubleshooting. Logging at session start allows the administrator to see the logs for sessions that are initiated but not completed, such as sessions that are dropped or blocked by the firewall. This can help the administrator to identify and resolve issues with network connectivity or firewall configuration. Logging at session start should not be used for normal operations because it generates more logs and consumes more resources on the firewall. Option A is incorrect because logging at session start should not be used on all Allow rules. Logging at session end is sufficient for Allow rules because it provides information about the completed sessions, such as bytes and packets transferred, application, user, and threat information. Option C is incorrect because logging at session start can be used independently of logging at session end. Logging at session start and logging at session end are not mutually exclusive options. Option D is incorrect because logging at session start should not be used only on Deny rules. Logging at session end is sufficient for Deny rules because it provides information about the denied sessions, such as source and destination IP addresses, ports, and protocol.
Question 3:
A network design change requires an existing firewall to start accessing Palo Alto Updates from a data plane interface address instead of the management interface. Which configuration setting needs to be modified?
A. Service route
B. Default route
C. Management profile
D. Authentication profile
Correct Answer: A
Question 4:
An auditor is evaluating the configuration of Panorama and notices a discrep-ancy between the Panorama template and the local firewall configuration.
When overriding the firewall configuration pushed from Panorama, what should you consider?
A. The modification will not be visible in Panorama.
B. The firewall template will show that it is out of sync within Panorama.
C. Panorama will update the template with the overridden value.
D. Only Panorama can revert the override.
Correct Answer: A
When overriding the firewall configuration pushed from Panorama, the modification will not be visible in Panorama. The firewall will show an override icon next to the modified setting and will display a warning message that the local
configuration differs from Panorama. The override icon will also appear on Panorama next to the firewall name in the Device Groups and Templates tabs. The other options are not correct. The firewall template will not show that it is out of
sync within Panorama, because the template itself is not modified. Panorama will not update the template with the overridden value, because the template is read-only on the firewall. The override can be reverted either from Panorama or from
the firewall.
References:
https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/firewall-administration/manage-configuration/override-a-template-setting https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/firewall-administration/manage-configuration/
revert-an-overridden-template-setting
Question 5:
If an administrator wants to decrypt SMTP traffic and possesses the server\’s certificate, which SSL decryption mode will allow the Palo Alto Networks NGFW to inspect traffic to the server?
A. TLS Bidirectional Inspection
B. SSL Inbound Inspection
C. SSH Forward Proxy
D. SMTP Inbound Decryption
Correct Answer: B
Reference: https://www.paloaltonetworks.com/documentation/71/pan-os/pan- os/decryption/configure-ssl-inbound-inspection
1.
SSL Forward Proxy – Inside to Outside (To the the internet)
2.
SSL Inbound Proxy – Outside to Inside (usually towards a hosted webserver in your net)
3.
SSH Forward Proxy – As is states, for SSH traffic. The important one to remember for this type of decryption is that no certs are required.
Question 6:
A firewall engineer creates a new App-ID report under Monitor > Reports > Application Reports > New Application to monitor new applications on the network and better assess any Security policy updates the engineer might want to make.
How does the firewall identify the New App-ID characteristic?
A. It matches to the New App-IDs downloaded in the last 30 days.
B. It matches to the New App-IDs downloaded in the last 90 days
C. It matches to the New App-IDs installed since the last time the firewall was rebooted
D. It matches to the New App-IDs in the most recently installed content releases.
Correct Answer: D
When creating a new App-ID report under Monitor > Reports > Application Reports > New Application, the firewall identifies new applications based on the New App- IDs in the most recently installed content releases. The New App-IDs are the application signatures that have been added in the latest content release, which can be found under Objects > Security Profiles > Application. This allows the engineer to monitor any new applications that have been added to the firewall\’s database and evaluate whether to allow or block them with a Security policy update.
Question 7:
The manager of the network security team has asked you to help configure the company\’s Security Profiles according to Palo Alto Networks best practice As part of that effort, the manager has assigned you the Vulnerability Protection profile for the internet gateway firewall.
Which action and packet-capture setting for items of high severity and critical severity best matches Palo Alto Networks best practice\’?
A. action \’reset-both\’ and packet capture \’extended-capture\’
B. action \’default\’ and packet capture \’single-packet\’
C. action \’reset-both\’ and packet capture \’single-packet\’
D. action \’reset-server\’ and packet capture \’disable\’
Correct Answer: C
https://docs.paloaltonetworks.com/best-practices/10-2/internet-gateway-best- practices/best-practice-internet-gateway-security-policy/create-best-practice-security-profiles
“Enable extended-capture for critical, high, and medium severity events and single-packet capture for low severity events. ” https://docs.paloaltonetworks.com/pan-os/9-1/pan-os- web-interface-help/objects/objects-security-profilesvulnerability-protection
Question 8:
A customer wants to spin their session load equally across two SD-WAN-enabled interfaces. Where would you configure this setting?
A. Path Quality profile
B. ECMP setting on virtual router
C. Traffic Dtstnbution profile
D. SD-WAN Interface profile
Correct Answer: C
Question 9:
Which Security policy rule will allow an admin to block facebook chat but allow Facebook in general?
A. Deny application facebook-chat before allowing application facebook
B. Deny application facebook on top
C. Allow application facebook on top
D. Allow application facebook before denying application facebook-chat
Correct Answer: A
Reference: https://live.paloaltonetworks.com/t5/Configuration-Articles/Failed-to-Block- Facebook-Chat-Consistently/ta-p/115673
Question 10:
An administrator has users accessing network resources through Citrix XenApp 7 x. Which User-ID mapping solution will map multiple users who are using Citrix to connect to the network and access resources?
A. Client Probing
B. Terminal Services agent
C. GlobalProtect
D. Syslog Monitoring
Correct Answer: B
https://docs.paloaltonetworks.com/pan-os/7-1/pan-os-admin/user-id/map-ip-addresses-to-users
Question 11:
Click the Exhibit button
An administrator has noticed a large increase in bittorrent activity. The administrator wants to determine where the traffic is going on the company. What would be the administrator\’s next step?
A. Right-Click on the bittorrent link and select Value from the context menu
B. Create a global filter for bittorrent traffic and then view Traffic logs.
C. Create local filter for bittorrent traffic and then view Traffic logs.
D. Click on the bittorrent application link to view network activity
Correct Answer: D
Question 12:
An organization conducts research on the benefits of leveraging the Web Proxy feature of PAN-OS 11.0. What are two benefits of using an explicit proxy method versus a transparent proxy method? (Choose two.)
A. No client configuration is required for explicit proxy, which simplifies the deployment complexity.
B. Explicit proxy allows for easier troubleshooting, since the client browser is aware of the existence of the proxy.
C. Explicit proxy supports interception of traffic using non-standard HTTPS ports.
D. It supports the X-Authenticated-User (XAU) header, which contains the authenticated username in the outgoing request
Correct Answer: BD
Question 13:
When you navigate to Network: > GlobalProtect > Portals > Method section, which three options are available? (Choose three )
A. user-logon (always on)
B. pre-logon then on-demand
C. on-demand (manual user initiated connection)
D. post-logon (always on)
E. certificate-logon
Correct Answer: ABC
Question 14:
Which CLI command enables an administrator to check the CPU utilization of the dataplane?
A. show running resource-monitor
B. debug data-plane dp-cpu
C. show system resources
D. debug running resources
Correct Answer: A
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClXwCAK https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CluDCAS
Question 15:
A company has a pair of Palo Alto Networks firewalls configured as an Acitve/Passive High Availability (HA) pair. What allows the firewall administrator to determine the last date a failover event occurred?
A. From the CLI issue use the show System log
B. Apply the filter subtype eq ha to the System log
C. Apply the filter subtype eq ha to the configuration log
D. Check the status of the High Availability widget on the Dashboard of the GUI
Correct Answer: B