Brilliant PCNSE Updated Exam Questions Should Be The Best Way to Increase Success Rate

Regina2021-09-16T08:41:39+00:00

Prepare your PCNSE Palo Alto Networks Certified Network Security Engineer Exam by means of the brilliant PCNSE updated exam questions and take your exam with positivity. Brilliant PCNSE updated exam questions are written by the top experts according to the latest PCNSE exam contents. Getting the most updated PCNSE exam questions should be the best way to increase the success rate of PCNSE Palo Alto Networks Certified Network Security Engineer Exam. With all the assistance of ITExamShop study materials, you can pass your PCNSE exam with receiving high grades and be successful.

Check the PCNSE free questions of the updated exam questions first.

Page 1 of 6

1. In SSL Forward Proxy decryption, which two certificates can be used for certificate signing? (Choose two.)

wildcard server certificate

enterprise CA certificate

client certificate

server certificate

self-signed CA certificate

2. Use the image below If the firewall has the displayed link monitoring configuration what will cause a failover?

ethernet1/3 and ethernet1/6 going down

etheme!1/3 going down

ethernet1/6 going down

ethernet1/3 or ethernet1/6 going down

3. A variable name must start with which symbol?

4. An administrator has 750 firewalls. The administrator's central-management Panorama instance deploys dynamic updates to the firewalls.

The administrator notices that the dynamic updates from Panorama do not appear on some of the firewalls.

If Panorama pushes the configuration of a dynamic update schedule to managed firewalls, but the configuration does not appear what is the root cause?

Panorama has no connection to Palo Alto Networks update servers

Panorama does not have valid licenses to push the dynamic updates

No service route is configured on the firewalls to Palo Alto Networks update servers

Locally-defined dynamic update settings take precedence over the settings that Panorama pushed

5. In a Panorama template which three types of objects are configurable? (Choose three)

HIP objects

QoS profiles

interface management profiles

certificate profiles

security profiles

6. An organization is building a Bootstrap Package to deploy Palo Alto Networks VM-Series firewalls into their AWS tenant.

Which two statements are correct regarding the bootstrap package contents? (Choose two)

The /config /content and /software folders are mandatory while the /license and /plugin folders are optional

The bootstrap package is stored on an AFS share or a discrete container file bucket

The directory structure must include a /config /content, /software and /license folders

The init-cfg txt and bootstrap.xml files are both optional configuration items for the /config folder

The bootstrap xml file allows for automated deployment of VM-Senes firewalls with full network and policy configurations.

7. An engineer must configure the Decryption Broker feature

Which Decryption Broker security chain supports bi-directional traffic flow?

Layer 2 security chain

Layer 3 security chain

Transparent Bridge security chain

Transparent Proxy security chain

8. DRAG DROP

Match each SD-WAN configuration element to the description of that element.

9. Which two statements correctly identify the number of Decryption Broker security chains that are supported on a pair of decryption-forwarding interfaces'? (Choose two)

A single transparent bridge security chain is supported per pair of interfaces

L3 security chains support up to 32 security chains

L3 security chains support up to 64 security chains

A single transparent bridge security chain is supported per firewall

10. Which Panorama objects restrict administrative access to specific device-groups?

templates

admin roles

access domains

authentication profiles

Page 2 of 6

11. During SSL decryption which three factors affect resource consumption1? (Choose three)

TLS protocol version

transaction size

key exchange algorithm

applications that use non-standard ports

certificate issuer

12. In a firewall, which three decryption methods are valid? (Choose three)

SSL Inbound Inspection

SSL Outbound Proxyless Inspection

SSL Inbound Proxy

Decryption Mirror

SSH Proxy

13. Before you upgrade a Palo Alto Networks NGFW what must you do?

Make sure that the PAN-OS support contract is valid for at least another year

Export a device state of the firewall

Make sure that the firewall is running a version of antivirus software and a version of WildFire that support the licensed subscriptions.

Make sure that the firewall is running a supported version of the app + threat update

14. Which value in the Application column indicates UDP traffic that did not match an App-ID signature?

not-applicable

incomplete

unknown-ip

unknown-udp

15. An administrator cannot see any Traffic logs from the Palo Alto Networks NGFW in Panorama reports. The configuration problem seems to be on the firewall.

Which settings, if configured incorrectly, most likely would stop only Traffic logs from being sent from the NGFW to Panorama?

A)

Option A

Option B

Option C

Option D

16. An engineer must configure a new SSL decryption deployment

Which profile or certificate is required before any traffic that matches an SSL decryption rule is decrypted?

There must be a certificate with both the Forward Trust option and Forward Untrust option selected

A Decryption profile must be attached to the Decryption policy that the traffic matches

A Decryption profile must be attached to the Security policy that the traffic matches

There must be a certificate with only the Forward Trust option selected

17. A company needs to preconfigure firewalls to be sent to remote sites with the least amount of preconfiguration Once deployed each firewall must establish secure tunnels back to multiple regional data centers to include the future regional data centers

Which VPN preconfigured configuration would adapt to changes when deployed to the future site?

IPsec tunnels using IKEv2

PPTP tunnels

GlobalProtect satellite

GlobalProtect client

18. Given the following snippet of a WildFire submission log. did the end-user get access to the requested information and why or why not?

Yes. because the action is set to "allow ''

No because WildFire categorized a file with the verdict "malicious"

Yes because the action is set to "alert"

No because WildFire classified the seventy as "high."

19. When you import the configuration of an HA pair into Panorama, how do you prevent the import from affecting ongoing traffic?

Disable HA

Disable the HA2 link

Disable config sync

Set the passive link state to 'shutdown.-

20. Which User-ID mapping method should be used in a high-security environment where all IP address-to-user mappings should always be explicitly known?

PAN-OS integrated User-ID agent

LDAP Server Profile configuration

GlobalProtect

Windows-based User-ID agent

Page 3 of 6

21. What are three valid qualifiers for a Decryption Policy Rule match? (Choose three)

Destination Zone

App-ID

Custom URL Category

User-ID

Source Interface

22. An engineer is planning an SSL decryption implementation

Which of the following statements is a best practice for SSL decryption?

Obtain an enterprise CA-signed certificate for the Forward Trust certificate

Obtain a certificate from a publicly trusted root CA for the Forward Trust certificate

Use an enterprise CA-signed certificate for the Forward Untrust certificate

Use the same Forward Trust certificate on all firewalls in the network

23. An administrator plans to deploy 15 firewalls to act as GlobalProtect gateways around the world Panorama will manage the firewalls.

The firewalls will provide access to mobile users and act as edge locations to on-premises infrastructure. The administrator wants to scale the configuration out quickly and wants all of the firewalls to use the same template configuration.

Which two solutions can the administrator use to scale this configuration? (Choose two.)

variables

template stacks

collector groups

virtual systems

24. What are two common reasons to use a "No Decrypt" action to exclude traffic from SSL decryption? (Choose two.)

the website matches a category that is not allowed for most users

the website matches a high-risk category

the web server requires mutual authentication

the website matches a sensitive category

25. Which action disables Zero Touch Provisioning (ZTP) functionality on a ZTP firewall during the onboarding process?

performing a local firewall commit

removing the firewall as a managed device in Panorama

performing a factory reset of the firewall

removing the Panorama serial number from the ZTP service

26. An administrator needs to gather information about the CPU utilization on both the management plane and the data plane

Where does the administrator view the desired data?

Monitor > Utilization

Resources Widget on the Dashboard

Support > Resources

Application Command and Control Center

27. Given the following configuration, which route is used for destination 10.10.0.4?

Route 4

Route 3

Route 1

Route 3

28. An administrator needs to troubleshoot a User-ID deployment. The administrator believes that there is an issue related to LDAP authentication. The administrator wants to create a packet capture on the management plane

Which CLI command should the administrator use to obtain the packet capture for validating the configuration?

> ftp export mgmt-pcap from mgmt.pcap to <FTP host>

> scp export mgmt-pcap from mgmt.pcap to {usernameQhost:path>

> scp export pcap-mgmt from pcap.mgiat to (username@host:path)

> scp export pcap from pcap to (usernameQhost:path)

29. When you configure a Layer 3 interface what is one mandatory step?

Configure Security profiles, which need to be attached to each Layer 3 interface

Configure Interface Management profiles which need to be attached to each Layer 3 interface

Configure virtual routers to route the traffic for each Layer 3 interface

Configure service routes to route the traffic for each Layer 3 interface

30. Which three statements accurately describe Decryption Mirror? (Choose three.)

Decryption Mirror requires a tap interface on the firewall

Decryption, storage, inspection and use of SSL traffic are regulated in certain countries

Only management consent is required to use the Decryption Mirror feature

You should consult with your corporate counsel before activating and using Decryption Mirror in a production environment

Use of Decryption Mirror might enable malicious users with administrative access to the firewall to harvest sensitive information that is submitted via an encrypted channel

Page 4 of 6

31. The SSL Forward Proxy decryption policy is configured. The following four certificate authority (CA) certificates are installed on the firewall.

An end-user visits the untrusted website https //www firewall-do-not-trust-website com

Which certificate authority (CA) certificate will be used to sign the untrusted webserver certificate?

Forward-Untrust-Certificate

Forward-Trust-Certificate

Firewall-CA

Firewall-Trusted-Root-CA

32. An administrator has a PA-820 firewall with an active Threat Prevention subscription. The administrator is considering adding a WildFire subscription

How does adding the WildFire subscription improve the security posture of the organization1?

Protection against unknown malware can be provided in near real-time

WildFire and Threat Prevention combine to provide the utmost security posture for the firewall

After 24 hours WildFire signatures are included in the antivirus update

WildFire and Threat Prevention combine to minimize the attack surface

33. A network administrator wants to use a certificate for the SSL/TLS Service Profile.

Which type of certificate should the administrator use?

certificate authority (CA) certificate

client certificate

machine certificate

server certificate

34. PBF can address which two scenarios? (Select Two)

forwarding all traffic by using source port 78249 to a specific egress interface

providing application connectivity the primary circuit fails

enabling the firewall to bypass Layer 7 inspection

routing FTP to a backup ISP link to save bandwidth on the primary ISP link

35. A firewall is configured with SSL Forward Proxy decryption and has the following four enterprise certificate authorities (Cas)

i. Enterprise-Trusted-CA; which is verified as Forward Trust Certificate (The CA is also installed in the trusted store of the end-user browser and system)

ii. Enterpnse-Untrusted-CA, which is verified as Forward Untrust Certificate

iii. Enterprise-lntermediate-CA

iv. Enterprise-Root-CA which is verified only as Trusted Root CA

An end-user visits https //www example-website com/ with a server certificate Common Name (CN) www example-website com. The firewall does the SSL Forward Proxy decryption for the website and the server certificate is not trusted by the firewall

The end-user's browser will show that the certificate for www example-website com was issued by which of the following?

Enterprise-Untrusted-CA which is a self-signed CA

Enterprise-Trusted-CA which is a self-signed CA

Enterprise-lntermediate-CA which was. in turn, issued by Enterprise-Root-CA

Enterprise-Root-CA which is a self-signed CA

36. Refer to the exhibit.

Which certificate can be used as the Forward Trust certificate?

Domain Sub-CA

Domain-Root-Cert

Certificate from Default Trusted Certificate Authorities

Forward-Trust

37. Which CLI command displays the physical media that are connected to ethernetl/8?

> show system state filter-pretty sys.si.p8.stats

> show interface ethernetl/8

> show system state filter-pretty sys.sl.p8.phy

> show system state filter-pretty sys.si.p8.med

38. DRAG DROP

Match each GlobalProtect component to the purpose of that component

39. An internal system is not functioning. The firewall administrator has determined that the incorrect egress interface is being used After looking at the configuration, the administrator believes that the firewall is not using a static route

What are two reasons why the firewall might not use a static route"? (Choose two.)

no install on the route

duplicate static route

path monitoring on the static route

disabling of the static route

40. DRAG DROP

Match each type of DoS attack to an example of that type of attack

Page 5 of 6

41. DRAG DROP

Place the steps in the WildFire process workflow in their correct order.

42. DRAG DROP

Below are the steps in the workflow for creating a Best Practice Assessment in a firewall and Panorama configuration Place the steps in order.

43. An organization has recently migrated its infrastructure and configuration to NGFWs, for which Panorama manages the devices. The organization is coming from a L2-L4 firewall vendor, but wants to use App-ID while identifying policies that are no longer needed

Which Panorama tool can help this organization?

Config Audit

Policy Optimizer

Application Groups

Test Policy Match

44. A traffic log might list an application as "not-applicable" for which two reasons'? (Choose two)

0 The firewall did not install the session

The TCP connection terminated without identifying any application data

The firewall dropped a TCP SYN packet

There was not enough application data after the TCP connection was established

45. When setting up a security profile which three items can you use? (Choose three)

Wildfire analysis

anti-ransom ware

antivirus

URL filtering

decryption profile

46. A firewall should be advertising the static route 10 2 0 0/24 into OSPF. The configuration on the neighbor is correct but the route is not in the neighbor's routing table

Which two configurations should you check on the firewall'? (Choose two)

Within the redistribution profile ensure that Redist is selected

In the redistribution profile check that the source type is set to "ospf"

In the OSFP configuration ensure that the correct redistribution profile is selected in the OSPF Export Rules section

Ensure that the OSPF neighbor state is "2-Way"

47. The following objects and policies are defined in a device group hierarchy

C)

Address Objects

-Shared Address 1

-Branch Address2

Policies -Shared Polic1

l -Branch Policyl

D)

Address Objects

-Shared Addressl

-Shared Address2

-Branch Addressl

Policies -Shared Policyl

-Shared Policy2

-Branch Policyl

Option A

Option B

Option C

Option D

48. What are two characteristic types that can be defined for a variable? (Choose two)

zone

FQDN

path group

IP netmask

49. When an in-band data port is set up to provide access to required services, what is required for an interface that is assigned to service routes?

The interface must be used for traffic to the required services

You must enable DoS and zone protection

You must set the interface to Layer 2 Layer 3. or virtual wire

You must use a static IP address

50. What does SSL decryption require to establish a firewall as a trusted third party and to establish trust between a client and server to secure an SSL/TLS connection?

link state

stateful firewall connection

certificates

profiles

Page 6 of 6

51. When you configure an active/active high availability pair which two links can you use? (Choose two)

HA2 backup

HA3

Console Backup

HSCI-C

52. In a security-first network what is the recommended threshold value for content updates to be dynamically updated?

1 to 4 hours

6 to 12 hours

24 hours

36 hours

53. Which rule type controls end user SSL traffic to external websites?

SSL Outbound Proxyless Inspection

SSL Forward Proxy

SSL Inbound Inspection

SSH Proxy

54. An administrator is considering upgrading the Palo Alto Networks NGFW and central management Panorama version

What is considered best practice for this scenario?

Perform the Panorama and firewall upgrades simultaneously

Upgrade the firewall first wait at least 24 hours and then upgrade the Panorama version

Upgrade Panorama to a version at or above the target firewall version

Export the device state perform the update, and then import the device state

55. When overriding a template configuration locally on a firewall, what should you consider?

Only Panorama can revert the override

Panorama will lose visibility into the overridden configuration

Panorama will update the template with the overridden value

The firewall template will show that it is out of sync within Panorama

56. As a best practice, which URL category should you target first for SSL decryption?

Online Storage and Backup

High Risk

Health and Medicine

Financial Services

57. Which configuration task is best for reducing load on the management plane?

Disable logging on the default deny rule

Enable session logging at start

Disable pre-defined reports

Set the URL filtering action to send alerts

58. The UDP-4501 protocol-port is used between which two GlobalProtect components?

GlobalProtect app and GlobalProtect gateway

GlobalProtect portal and GlobalProtect gateway

GlobalProtect app and GlobalProtect satellite

GlobalProtect app and GlobalProtect portal

59. Which statement accurately describes service routes and virtual systems?

Virtual systems can only use one interface for all global service and service routes of the firewall

The interface must be used for traffic to the required external services

Virtual systems that do not have specific service routes configured inherit the global service and service route settings for the firewall

Virtual systems cannot have dedicated service routes configured: and virtual systems always use the global service and service route settings for the firewall

60. DRAG DROP

Please match the terms to their corresponding definitions.