Palo Alto Networks Certified Network Security Engineer Exam PCNSE PDF Test Questions

Regina2021-08-10T03:00:14+00:00

PCNSE Palo Alto Networks Certified Network Security Engineer Exam is the engineer level which validates that engineers cancorrectly deploy Palo Alto Networks Next-Generation Firewalls while leveraging therest of the platform. Get PCNSE pdf test questions from ITExamShop to prepare for Palo Alto Networks Certified Network Security Engineer Exam now. We have updated PCNSE practice test with the actual questions and answers, instant download the PCNSE pdf file to learn all the questions and answers to make sure you can pass Palo Alto Networks Certified Network Security Engineer Exam smoothly.

Before Downloading PCNSE Questions File, Choose To Read PCNSE Free Questions First

Page 1 of 6

1. How can a candidate or running configuration be copied to a host external from Panorama?

Commit a running configuration.

Save a configuration snapshot.

Save a candidate configuration.

Export a named configuration snapshot.

2. Which log file can be used to identify SSL decryption failures?

Configuration

Threats

ACC

Traffic

3. A customer wants to set up a site-to-site VPN using tunnel interfaces?

Which two formats are correct for naming tunnel interfaces? (Choose two.)

Vpn-tunnel.1024

vpn-tunne.1

tunnel 1025

tunnel. 1

4. If an administrator wants to decrypt SMTP traffic and possesses the server’s certificate, which SSL decryption mode will allow the Palo Alto Networks NGFW to inspect traffic to the server?

TLS Bidirectional Inspection

SSL Inbound Inspection

SSH Forward Proxy

SMTP Inbound Decryption

5. A customer has an application that is being identified as unknown-top for one of their custom PostgreSQL database connections.

Which two configuration options can be used to correctly categorize their custom database application? (Choose two.)

Application Override policy.

Security policy to identify the custom application.

Custom application.

Custom Service object.

6. Which operation will impact the performance of the management plane?

WildFire Submissions

DoS Protection

decrypting SSL Sessions

Generating a SaaS Application Report.

7. Which protection feature is available only in a Zone Protection Profile?

SYN Flood Protection using SYN Flood Cookies

ICMP Flood Protection

Port Scan Protection

UDP Flood Protections

8. Which two features does PAN-OS® software use to identify applications? (Choose two)

port number

session number

transaction characteristics

application layer payload

9. Which method will dynamically register tags on the Palo Alto Networks NGFW?

Restful API or the VMWare API on the firewall or on the User-ID agent or the read-only domain controller (RODC)

Restful API or the VMware API on the firewall or on the User-ID agent

XML-API or the VMware API on the firewall or on the User-ID agent or the CLI

XML API or the VM Monitoring agent on the NGFW or on the User-ID agent

10. To more easily reuse templates and template slacks, you can create term plate variables in place of firewall-specific and appliance-specific IP literals in your configurations

Which one is the correct configuration?

@Panorama

#Pancrama

&Panorama

$Panorama

Page 2 of 6

11. When backing up and saving configuration files, what is achieved using only the firewall and is not available in Panorama?

Load named configuration snapshot

Load configuration version

Save candidate config

Export device state

12. An administrator needs to upgrade a Palo Alto Networks NGFW to the most current version of PAN-OS® software. The firewall has internet connectivity through an Ethernet interface, but no internet connectivity from the management interface. The Security policy has the default security rules and a rule that allows all web-browsing traffic from any to any zone.

What must the administrator configure so that the PAN-OS® software can be upgraded?

Security policy rule

CRL

Service route

Scheduler

13. An administrator needs to upgrade an NGFW to the most current version of PAN-OS®

software.

The following is occurring:

• Firewall has Internet connectivity through e1/1.

• Default security rules and security rules allowing all SSL and web-browsing traffic to and from any zone.

• Service route is configured, sourcing update traffic from e1/1.

• A communication error appears in the System logs when updates are performed.

• Download does not complete.

What must be configured to enable the firewall to download the current version of PAN-OS software?

DNS settings for the firewall to use for resolution

scheduler for timed downloads of PAN-OS software

static route pointing application PaloAlto-updates to the update servers

Security policy rule allowing PaloAlto-updates as the application

14. Which version of GlobalProtect supports split tunneling based on destination domain, client process, and HTTP/HTTPS video streaming application?

GlobalProtect version 4.0 with PAN-OS 8.1

GlobalProtect version 4.1 with PAN-OS 8.1

GlobalProtect version 4.1 with PAN-OS 8.0

GlobalProtect version 4.0 with PAN-OS 8.0

15. Which three steps will reduce the CPU utilization on the management plane? (Choose three.)

Disable SNMP on the management interface.

Application override of SSL application.

Disable logging at session start in Security policies.

Disable predefined reports.

Reduce the traffic being decrypted by the firewall.

16. A client has a sensitive application server in their data center and is particularly concerned about resource exhaustion because of distributed denial-of-service attacks.

How can the Palo Alto Networks NGFW be configured to specifically protect this server against resource exhaustion originating from multiple IP addresses (DDoS attack)?

Define a custom App-ID to ensure that only legitimate application traffic reaches the server.

Add a Vulnerability Protection Profile to block the attack.

Add QoS Profiles to throttle incoming requests.

Add a DoS Protection Profile with defined session count.

17. A Palo Alto Networks NGFW just submitted a file to WildFire for analysis. Assume a 5-minute window for analysis. The firewall is configured to check for verdicts every 5 minutes.

How quickly will the firewall receive back a verdict?

More than 15 minutes

5 minutes

10 to 15 minutes

5 to 10 minutes

18. Which PAN-OS® policy must you configure to force a user to provide additional credentials before he is allowed to access an internal application that contains highly-sensitive business data?

Security policy

Decryption policy

Authentication policy

Application Override policy

19. Which three authentication factors does PAN-OS® software support for MFA (Choose three.)

Push

Pull

Okta Adaptive

Voice

SMS

20. An administrator just submitted a newly found piece of spyware for WildFire analysis. The spyware passively monitors behavior without the user’s knowledge.

What is the expected verdict from WildFire?

Grayware

Malware

Spyware

Phishing

Page 3 of 6

21. In the following image from Panorama, why are some values shown in red?

sg2 session count is the lowest compared to the other managed devices.

us3 has a logging rate that deviates from the administrator-configured thresholds.

uk3 has a logging rate that deviates from the seven-day calculated baseline.

sg2 has misconfigured session thresholds.

22. Exhibit:

What will be the egress interface if the traffic’s ingress interface is ethernet1/6 sourcing from 192.168.111.3 and to the destination 10.46.41.113 during the time shown in the image?

ethernet1/7

ethernet1/5

ethernet1/6

ethernet1/3

23. A bootstrap USB flash drive has been prepared using a Windows workstation to load the initial configuration of a Palo Alto Networks firewall that was previously being used in a lab. The USB flash drive was formatted using file system FAT32 and the initial configuration is stored in a file named init-cfg txt. The firewall is currently running PAN-OS 10.0 and using a lab config.

The contents of init-cfg txi in the USB flash drive are as follows:

The USB flash drive has been inserted in the firewalls' USB port, and the firewall has been restarted using command:> request resort system Upon restart, the firewall fails to begin the bootstrapping process. The failure is caused because

Firewall must be m factory default state or have all private data deleted for bootstrapping

The hostname is a required parameter, but it is missing in imt-cfg txt

The USB must be formatted using the ext3 file system, FAT32 is not supported

PANOS version must be 91.x at a minimum but the firewall is running 10.0.x

The bootstrap.xml file is a required file but it is missing

24. An administrator sees several inbound sessions identified as unknown-tcp in the Traffic logs. The administrator determines that these sessions are form external users accessing the company’s proprietary accounting application. The administrator wants to reliably identify this traffic as their accounting application and to scan this traffic for threats.

Which option would achieve this result?

Create a custom App-ID and enable scanning on the advanced tab.

Create an Application Override policy.

Create a custom App-ID and use the “ordered conditions” check box.

Create an Application Override policy and custom threat signature for the application.

25. Which CLI command can be used to export the tcpdump capture?

scp export tcpdump from mgmt.pcap to <username@host:path>

scp extract mgmt-pcap from mgmt.pcap to <username@host:path>

scp export mgmt-pcap from mgmt.pcap to <username@host:path>

download mgmt.-pcap

26. A web server is hosted in the DMZ and the server is configured to listen for incoming connections on TCP port 443. A Security policies rules allowing access from the Trust zone to the DMZ zone needs to be configured to allow web-browsing access. The web server hosts its contents over HTTP(S). Traffic from Trust to DMZ is being decrypted with a Forward Proxy rule.

Which combination of service and application, and order of Security policy rules, needs to be configured to allow cleartext web- browsing traffic to this server on tcp/443.

Rule #1: application: web-browsing; service: application-default; action: allow Rule #2: application: ssl; service: application-default; action: allow

Rule #1: application: web-browsing; service: service-https; action: allow Rule #2: application: ssl; service: application-default; action: allow

Rule # 1: application: ssl; service: application-default; action: allow Rule #2: application: web-browsing; service: application-default; action: allow

Rule #1: application: web-browsing; service: service-http; action: allow Rule #2: application: ssl; service: application-default; action: allow

27. A session in the Traffic log is reporting the application as “incomplete.” What does “incomplete” mean?

The three-way TCP handshake was observed, but the application could not be identified.

The three-way TCP handshake did not complete.

The traffic is coming across UDP, and the application could not be identified.

Data was received but was instantly discarded because of a Deny policy was applied before App-ID could be applied.

28. Updates to dynamic user group membership are automatic therefore using dynamic user groups instead of static group objects allows you to:

respond to changes in user behavior or potential threats using manual policy changes

respond to changes in user behavior or potential threats without automatic policy changes

respond to changes in user behavior and confirmed threats with manual policy changes

respond to changes in user behavior or potential threats without manual policy changes

29. Which CLI command is used to simulate traffic going through the firewall and determine which Security policy rule, NAT translation, static route, or PBF rule will be triggered by the traffic?

check

find

test

sim

30. Which User-ID method should be configured to map IP addresses to usernames for users connected through a terminal server?

port mapping

server monitoring

client probing

XFF headers

Page 4 of 6

31. An administrator has left a firewall to use the default port for all management services.

Which three functions are performed by the dataplane? (Choose three.)

WildFire updates

NAT

NTP

antivirus

File blocking

32. An administrator has been asked to configure active/active HA for a pair of Palo Alto Networks NGFWs. The firewall use Layer 3 interfaces to send traffic to a single gateway IP for the pair.

Which configuration will enable this HA scenario?

The two firewalls will share a single floating IP and will use gratuitous ARP to share the floating I

Each firewall will have a separate floating IP, and priority will determine which firewall has the primary I

The firewalls do not use floating IPs in active/active H

The firewalls will share the same interface IP address, and device 1 will use the floating IP if device 0 fails.

33. Where can an administrator see both the management plane and data plane CPU utilization in the WebUI?

System log

CPU Utilization widget

Resources widget

System Utilization log

34. Which option is part of the content inspection process?

Packet forwarding process

SSL Proxy re-encrypt

IPsec tunnel encryption

Packet egress process

35. Which CLI command enables an administrator to view details about the firewall including uptime, PAN-OS® version, and serial number?

debug system details

show session info

show system info

show system details

36. Which three file types can be forwarded to WildFire for analysis as a part of the basic WildFire service? (Choose three.)

.dll

.exe

.src

.apk

.pdf

.jar

37. Which method does an administrator use to integrate all non-native MFA platforms in PAN-OS® software?

Okta

DUO

RADIUS

PingID

38. An administrator is defining protection settings on the Palo Alto Networks NGFW to guard against resource exhaustion.

When platform utilization is considered, which steps must the administrator take to configure and apply packet buffer protection?

Enable and configure the Packet Buffer protection thresholds.Enable Packet Buffer Protection per ingress zone.

Enable and then configure Packet Buffer thresholdsEnable Interface Buffer protection.

Create and Apply Zone Protection Profiles in all ingress zones.Enable Packet Buffer Protection per ingress zone.

Configure and apply Zone Protection Profiles for all egress zones.Enable Packet Buffer Protection pre egress zone.

Enable per-vsys Session Threshold alerts and triggers for Packet Buffer Limits.Enable Zone Buffer Protection per zone.

39. Which three options are supported in HA Lite? (Choose three.)

Virtual link

Active/passive deployment

Synchronization of IPsec security associations

Configuration synchronization

Session synchronization

40. An administrator needs to optimize traffic to prefer business-critical applications over non-critical applications.

QoS natively integrates with which feature to provide service quality?

Port Inspection

Certificate revocation

Content-ID

App-ID

Page 5 of 6

41. How can an administrator configure the NGFW to automatically quarantine a device using GlobalProtect?

by adding the device's Host ID to a quarantine list and configure GlobalProtect to prevent users from connecting to the GlobalProtect gateway from a quarantined device

by using secunty policies, log forwarding profiles, and log settings.

by exporting the list of quarantined devices to a pdf or csv file by selecting PDF/CSV at the bottom of the Device Quarantine page and leveraging the approbate XSOAR playbook

There is no native auto-quarantine feature so a custom script would need to be leveraged.

42. Which two benefits come from assigning a Decryption Profile to a Decryption policy rule with a “No Decrypt” action? (Choose two.)

Block sessions with expired certificates

Block sessions with client authentication

Block sessions with unsupported cipher suites

Block sessions with untrusted issuers

Block credential phishing

43. Which event will happen if an administrator uses an Application Override Policy?

Threat-ID processing time is decreased.

The Palo Alto Networks NGFW stops App-ID processing at Layer 4.

The application name assigned to the traffic by the security rule is written to the Traffic log.

App-ID processing time is increased.

44. Which logs enable a firewall administrator to determine whether a session was decrypted?

Correlated Event

Traffic

Decryption

Security Policy

45. A web server is hosted in the DMZ, and the server is configured to listen for incoming connections only on TCP port 8080. A Security policy rule allowing access from the Trust zone to the DMZ zone need to be configured to enable we browsing access to the server.

Which application and service need to be configured to allow only cleartext web-browsing traffic to thins server on tcp/8080.

application: web-browsing; service: application-default

application: web-browsing; service: service-https

application: ssl; service: any

application: web-browsing; service: (custom with destination TCP port 8080)

46. SAML SLO is supported for which two firewall features? (Choose two.)

GlobalProtect Portal

CaptivePortal

WebUI

CLI

47. During the packet flow process, which two processes are performed in application identification? (Choose two.)

Pattern based application identification

Application override policy match

Application changed from content inspection

Session application identified.

48. An administrator has been asked to configure a Palo Alto Networks NGFW to provide protection against external hosts attempting to exploit a flaw in an operating system on an internal system.

Which Security Profile type will prevent this attack?

Vulnerability Protection

Anti-Spyware

URL Filtering

Antivirus

49. An administrator has been asked to configure active/passive HA for a pair of Palo Alto Networks NGFWs. The administrator assigns priority 100 to the active firewall.

Which priority is correct for the passive firewall?

255

50. In a virtual router, which object contains all potential routes?

MIB

RIB

SIP

FIB

Page 6 of 6

51. When configuring a GlobalProtect Portal, what is the purpose of specifying an Authentication Profile?

To enable Gateway authentication to the Portal

To enable Portal authentication to the Gateway

To enable user authentication to the Portal

To enable client machine authentication to the Portal

52. Which administrative authentication method supports authorization by an external service?

Certificates

LDAP

RADIUS

SSH keys

53. To protect your firewall and network from single source denial of service (DoS) attacks that can overwhelm its packet buffer and cause legitimate traffic to drop, you can configure.

BGP (Border Gateway Protocol)

PBP (Packet Buffer Protection)

PGP (Packet Gateway Protocol)

PBP (Protocol Based Protection)

54. The firewall determines if a packet is the first packet of a new session or if a packet is part of an existing session using which kind of match?

6-tuple match: Source IP Address, Destination IP Address, Source port, Destination Port, Protocol, and Source Security Zone

5-tuple match: Source IP Address, Destination IP Address, Source port, Destination Port, Protocol

7-tuple match: Source IP Address, Destination IP Address, Source port, Destination Port, Source User, URL Category, and Source Security Zone

9-tuple match: Source IP Address, Destination IP Address, Source port, Destination Port, Source User, Source Security Zone, Destination Security Zone, Application, and URL Category

55. A global corporate office has a large-scale network with only one User-ID agent, which creates a bottleneck near the User-ID agent server.

Which solution in PAN-OS® software would help in this case?

application override

Virtual Wire mode

content inspection

redistribution of user mappings

56. Which is not a valid reason for receiving a decrypt-cert-validation error?

Unsupported HSM

Unknown certificate status

Client authentication

Untrusted issuer

57. A client is concerned about resource exhaustion because of denial-of-service attacks against their DNS servers.

Which option will protect the individual servers?

Enable packet buffer protection on the Zone Protection Profile.

Apply an Anti-Spyware Profile with DNS sinkholing.

Use the DNS App-ID with application-default.

Apply a classified DoS Protection Profile.

58. Which feature prevents the submission of corporate login information into website forms?

Data filtering

User-ID

File blocking

Credential phishing prevention

59. What are the two behavior differences between Highlight Unused Rules and the Rule Usage Hit counter when a firewall is rebooted? (Choose two.)

Rule Usage Hit counter will not be reset

Highlight Unused Rules will highlight all rules.

Highlight Unused Rules will highlight zero rules.

Rule Usage Hit counter will reset.

60. Which three user authentication services can be modified to provide the Palo Alto Networks NGFW with both usernames and role names? (Choose three.)

TACACS+

Kerberos

PAP

LDAP

SAML

RADIUS

Welcome To Choose Required IT Certification Exams Online

Palo Alto Networks Certified Network Security Engineer Exam PCNSE PDF Test Questions

Before Downloading PCNSE Questions File, Choose To Read PCNSE Free Questions First

Author