Updated PCNSE Exam Questions [2022] Pass PCNSE Certification Exam Successfully

Regina2022-02-08T08:26:08+00:00

Updated PCNSE exam questions of ITExamShop help you clear Palo Alto Networks Certified Network Security Engineer Exam successfully. The most updated PCNSE exam questions are based on the actual PCNSE exam objectives and test topics, containing actual PCNSE exam questions and precise answers. By preparing for PCNSE Palo Alto Networks Certified Network Security Engineer Exam, you can choose the greatest and the most updated Palo Alto Networks PCNSE exam questions as the preparation materials of ITExamShop because the real study materials have been verified by the top experts. We ensure that you can pass PCNSE certification exam successfullty in the first attempt.

Checking Updated PCNSE Exam Qestions Is Recommended, You Can Read PCNSE Free Questions Below:

Page 1 of 4

1. What are three valid qualifiers for a Decryption Policy Rule match? (Choose three)

Destination Zone

App-ID

Custom URL Category

User-ID

Source Interface

2. An administrator is considering upgrading the Palo Alto Networks NGFW and central management Panorama version

What is considered best practice for this scenario?

Perform the Panorama and firewall upgrades simultaneously

Upgrade the firewall first wait at least 24 hours and then upgrade the Panorama version

Upgrade Panorama to a version at or above the target firewall version

Export the device state perform the update, and then import the device state

3. While troubleshooting an SSL Forward Proxy decryption issue which PAN-OS CLI command would you use to check the details of the end-entity certificate that is signed by the Forward Trust Certificate or Forward Untrust Certificate?

show system setting ssl-decrypt certs

show systea setting ssl-decrypt certificate-cache

show systen setting ssl-decrypt certificate

debug dataplane show ssl-decrypt ssl-stats

4. DRAG DROP

Match each GlobalProtect component to the purpose of that component

5. Which CLI command displays the physical media that are connected to ethernetl/8?

> show system state filter-pretty sys.si.p8.stats

> show interface ethernetl/8

> show system state filter-pretty sys.sl.p8.phy

> show system state filter-pretty sys.si.p8.med

6. An engineer must configure a new SSL decryption deployment

Which profile or certificate is required before any traffic that matches an SSL decryption rule is decrypted?

There must be a certificate with both the Forward Trust option and Forward Untrust option selected

A Decryption profile must be attached to the Decryption policy that the traffic matches

A Decryption profile must be attached to the Security policy that the traffic matches

There must be a certificate with only the Forward Trust option selected

7. What are two characteristic types that can be defined for a variable? (Choose two )

zone

FQDN

path group

IP netmask

8. 1.Topic 1, Main Questions NEW

The SSL Forward Proxy decryption policy is configured. The following four certificate authority (CA) certificates are installed on the firewall.

An end-user visits the untrusted website https //www firewall-do-not-trust-website com

Which certificate authority (CA) certificate will be used to sign the untrusted webserver certificate?

Forward-Untrust-Certificate

Forward-Trust-Certificate

Firewall-CA

Firewall-Trusted-Root-CA

9. A standalone firewall with local objects and policies needs to be migrated into Panorama.

What procedure should you use so Panorama is fully managing the firewall?

Use the "import Panorama configuration snapshot" operation, then perform a device-group commit push with "include device and network templates"

Use the "import device configuration to Panorama" operation, then "export or push device config bundle" to push the configuration

Use the "import Panorama configuration snapshot" operation, then "export or push device config bundle" to push the configuration

Use the "import device configuration to Panorama" operation, then perform a device-group commit push with "include device and network templates"

10. A remote administrator needs firewall access on an untrusted interface.

Which two components are required on the firewall to configure certificate-based administrator authentication to the web Ul? (Choose two)

client certificate

certificate profile

certificate authority (CA) certificate

server certificate

Page 2 of 4

11. DRAG DROP

Below are the steps in the workflow for creating a Best Practice Assessment in a firewall and Panorama configuration Place the steps in order.

12. An administrator needs to troubleshoot a User-ID deployment. The administrator believes that there is an issue related to LDAP authentication. The administrator wants to create a packet capture on the management plane

Which CLI command should the administrator use to obtain the packet capture for validating the configuration?

> ftp export mgmt-pcap from mgmt.pcap to <FTP host>

> scp export mgmt-pcap from mgmt.pcap to {usernameQhost:path>

> scp export pcap-mgmt from pcap.mgiat to (username@host:path)

> scp export pcap from pcap to (usernameQhost:path)

13. When setting up a security profile which three items can you use? (Choose three )

Wildfire analysis

anti-ransom ware

antivirus

URL filtering

decryption profile

14. What happens when en A P firewall cluster synchronies IPsec tunnel secunty associations (SAs)?

Phase 2 SAs are synchronized over HA2 finks

Phase 1 and Phase 2 SAs are synchronized over HA2 links

Phase 1 SAs are synchronized over HA1 links

Phase 1 and Phase 2 SAs are synchronized over HA3 links

15. In a firewall, which three decryption methods are valid? (Choose three )

SSL Inbound Inspection

SSL Outbound Proxyless Inspection

SSL Inbound Proxy

Decryption Mirror

SSH Proxy

16. Using multiple templates in a stack to manage many firewalls provides which two advantages? (Choose two.)

inherit address-objects from templates

define a common standard template configuration for firewalls

standardize server profiles and authentication configuration across all stacks

standardize log-forwarding profiles for security polices across all stacks

17. DRAG DROP

Match each type of DoS attack to an example of that type of attack

18. Which type of interface does a firewall use to forward decrypted traffic to a security chain for inspection?

Layer 2

Tap

Layer 3

Decryption Mirror

19. Before you upgrade a Palo Alto Networks NGFW, what must you do?

Make sure that the PAN-OS support contract is valid for at least another year

Export a device state of the firewall

Make sure that the firewall is running a version of antivirus software and a version of WildFire that support the licensed subscriptions.

Make sure that the firewall is running a supported version of the app + threat update

20. A superuser is tasked with creating administrator accounts for three contractors For compliance purposes, all three contractors will be working with different device-groups in their hierarchy to deploy policies and objects.

Which type of role-based access is most appropriate for this project?

Create a Dynamic Admin with the Panorama Administrator role

Create a Custom Panorama Admin

Create a Device Group and Template Admin

Create a Dynamic Read only superuser

Page 3 of 4

21. A firewall is configured with SSL Forward Proxy decryption and has the following four enterprise certificate authorities (Cas)

i. Enterprise-Trusted-CA; which is verified as Forward Trust Certificate (The CA is also installed in the trusted store of the end-user browser and system)

ii. Enterpnse-Untrusted-CA, which is verified as Forward Untrust Certificate

iii. Enterprise-lntermediate-CA

iv. Enterprise-Root-CA which is verified only as Trusted Root CA

An end-user visits https //www example-website com/ with a server certificate Common Name (CN) www example-website com. The firewall does the SSL Forward Proxy decryption for the website and the server certificate is not trusted by the firewall

The end-user's browser will show that the certificate for www.example-website.com was issued by which of the following?

Enterprise-Untrusted-CA which is a self-signed CA

Enterprise-Trusted-CA which is a self-signed CA

Enterprise-lntermediate-CA which was. in turn, issued by Enterprise-Root-CA

Enterprise-Root-CA which is a self-signed CA

22. Which statement is true regarding a Best Practice Assessment?

It shows how your current configuration compares to Palo Alto Networks recommendations

It runs only on firewalls

When guided by an authorized sales engineer, it helps determine the areas of greatest risk where you should focus prevention activities.

It provides a set of questionnaires that help uncover security risk prevention gaps across all areas of network and security architecture

23. A customer is replacing their legacy remote access VPN solution. The current solution is in place to secure internet egress and provide access to resources located in the main datacenter for the connected clients.

Prisma Access has been selected to replace the current remote access VPN solution.

During onboarding the following options and licenses were selected and enabled

What must be configured on Prisma Access to provide connectivity to the resources in the datacenter?

Configure a mobile user gateway in the region closest to the datacenter to enable connectivity to the datacenter

Configure a remote network to provide connectivity to the datacenter

Configure Dynamic Routing to provide connectivity to the datacenter

Configure a service connection to provide connectivity to the datacenter

24. SSL Forward Proxy decryption is configured but the firewall uses Untrusted-CA to sign the website https //www important-website com certificate End-users are receiving me "security certificate is not trusted is warning Without SSL decryption the web browser shows that the website certificate is trusted and signed by a well-known certificate chain Well-Known-lntermediate and Well-Known-Root-CA.

The network security administrator who represents the customer requires the following two behaviors when SSL Forward Proxy is enabled:

1 End-users must not get the warning for the https://www.very-important-website.com website.

2 End-users should get the warning for any other untrusted website

Which approach meets the two customer requirements?

Navigate to Device > Certificate Management > Certificates > Device Certificates import Well-Known-lntermediate-CA and Well-Known-Root-CA select the Trusted Root CA checkbox and commit the configuration

Install the Well-Known-lntermediate-CA and Well-Known-Root-CA certificates on all end-user systems m the user and local computer stores

Navigate to Device > Certificate Management - Certificates s Default Trusted Certificate Authorities import Well-Known-intermediate-CA and Well-Known-Root-CA select the Trusted Root CA check box and commit the configuration

Clear the Forward Untrust Certificate check box on the Untrusted-CA certificate and commit the configuration

25. in an HA failover scenario what occurs when sessions match an SSL Forward Proxy Decryption policy?

HA Sync does not occur the existing session is transferred to the active firewall.

HA Sync does not occur the firewall drops the session.

HA Sync occurs the session is sent to testpath

HA Sync occurs the firewall allows the session Put does not decrypt the session.

26. Which statement accurately describes service routes and virtual systems?

Virtual systems can only use one interface for all global service and service routes of the firewall

The interface must be used for traffic to the required external services

Virtual systems that do not have specific service routes configured inherit the global service and service route settings for the firewall

Virtual systems cannot have dedicated service routes configured: and virtual systems always use the global service and service route settings for the firewall

27. An organization is building a Bootstrap Package to deploy Palo Alto Networks VM-Series firewalls into their AWS tenant.

Which two statements are correct regarding the bootstrap package contents? (Choose two)

The /config /content and /software folders are mandatory while the /license and /plugin folders are optional

The bootstrap package is stored on an AFS share or a discrete container file bucket

The directory structure must include a /config /content, /software and /license folders

The init-cfg txt and bootstrap.xml files are both optional configuration items for the /config folder

The bootstrap xml file allows for automated deployment of VM-Senes firewalls with full network and policy configurations.

28. What are two valid deployment options for Decryption Broker? (Choose two)

Transparent Bridge Security Chain

Layer 3 Security Chain

Layer 2 Security Chain

Transparent Mirror Security Chain

29. Refer to the diagram.

An administrator needs to create an address object that will be useable by the NYC. MA, CA and WA device groups

Where will the object need to be created within the device-group hierarchy?

Americas

East

West

30. An internal system is not functioning. The firewall administrator has determined that the incorrect egress interface is being used. After looking at the configuration, the administrator believes that the firewall is not using a static route.

What are two reasons why the firewall might not use a static route? (Choose two.)

no install on the route

duplicate static route

path monitoring on the static route

disabling of the static route

Page 4 of 4

31. An administrator needs to implement an NGFW between their DMZ and Core network EIGRP Routing between the two environments is required.

Which interface type would support this business requirement?

Layer 3 interfaces but configuring EIGRP on the attached virtual router

Virtual Wire interfaces to permit EIGRP routing to remain between the Core and DMZ

Layer 3 or Aggregate Ethernet interfaces but configuring EIGRP on subinterfaces only

Tunnel interfaces to terminate EIGRP routing on an IPsec tunnel {with the GlobalProtect License to support LSVPN and EIGRP protocols)

32. Given the following configuration, which route is used for destination 10.10.0.4?

Route 4

Route 3

Route 1

Route 3

33. An administrator has 750 firewalls. The administrator's central-management Panorama instance deploys dynamic updates to the firewalls.

The administrator notices that the dynamic updates from Panorama do not appear on some of the firewalls.

If Panorama pushes the configuration of a dynamic update schedule to managed firewalls, but the configuration does not appear what is the root cause?

Panorama has no connection to Palo Alto Networks update servers

Panorama does not have valid licenses to push the dynamic updates

No service route is configured on the firewalls to Palo Alto Networks update servers

Locally-defined dynamic update settings take precedence over the settings that Panorama pushed

34. in a template you can configure which two objects? (Choose two.)

SD WAN path quality profile

application group

IPsec tunnel

Monitor profile

35. What does SSL decryption require to establish a firewall as a trusted third party and to establish trust between a client and server to secure an SSL/TLS connection?

link state

stateful firewall connection

certificates

profiles