[Nov 26, 2024] Valid PCNSE Test Answers & PCNSE Exam PDF
Valid PCNSE PAN-OS PCNSE Dumps Ensure Your Passing
The PCNSE certification is highly respected in the cybersecurity industry and is recognized as a benchmark of excellence in network security. Palo Alto Networks Certified Network Security Engineer Exam certification demonstrates that the holder has the expertise and skills needed to secure networks against advanced cyber threats. It is used by many organizations as a requirement for job positions in cybersecurity, and by individuals who want to prove their expertise to potential clients or employers.
NEW QUESTION # 61
The web server is configured to listen for HTTP traffic on port 8080. The clients access the web server using the IP address 1.1.1.100 on TCP Port 80. The destination NAT rule is configured to translate both IP address and report to 10.1.1.100 on TCP Port 8080.
Which NAT and security rules must be configured on the firewall? (Choose two)
- A. A security policy with a source of any from untrust-I3 zone to a destination of 1.1.100 in dmz-I3 zone using web-browsing application.
- B. A NAT rule with a source of any from untrust-I3 zone to a destination of 1.1.1.100 in untrust-I3 zone using service-http service.
- C. A security policy with a source of any from untrust-I3 Zone to a destination of 10.1.1.100 in dmz-I3 zone using web-browsing application
- D. A NAT rule with a source of any from untrust-I3 zone to a destination of 10.1.1.100 in dmz-zone using service-http service.
Answer: A,D
NEW QUESTION # 62
Which URL Filtering Security Profile action logs the URL Filtering category to the URL Filtering log?
- A. Alert
- B. Log
- C. Allow
- D. Default
Answer: A
Explanation:
https://www.paloaltonetworks.com/documentation/70/pan-os/pan-os/url-filtering/url-filtering- profile-actions
NEW QUESTION # 63 
Review the images. A firewall policy that permits web traffic includes the global-logs policy is depicted What is the result of traffic that matches the "Alert - Threats" Profile Match List?
- A. The source address of SMTP traffic that matches a threat is automatically tagged as BadGuys for 180 minutes.
- B. The source address of traffic that matches a threat is automatically blocked as BadGuys for 180 minutes.
- C. The source address of traffic that matches a threat is automatically tagged as BadGuys for 180 minutes.
- D. The source address of SMTP traffic that matches a threat is automatically blocked as BadGuys for 180 minutes.
Answer: C
NEW QUESTION # 64
Which two benefits come from assigning a Decryption Profile to a Decryption policy rule with a "No Decrypt" action? (Choose two.)
- A. Block sessions with unsupported cipher suites
- B. Block credential phishing
- C. Block sessions with expired certificates
- D. Block sessions with untrusted issuers
- E. Block sessions with client authentication
Answer: C,D
Explanation:
https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/decryption/configure-decryption-exceptions Block sessions based on certificate status, including blocking sessions with expired certificates, untrusted issuers, unknown certificate status, certificate status check timeouts, and certificate extensions. Block sessions with unsupported versions and cipher suites, and that require using client authentication. <-- this req client Auth, which is not stated Block sessions if the resources to perform decryption are not available or if a hardware security module is not available to sign certificates. Define the protocol versions and key exchange, encryption, and authentication algorithms allowed for SSL Forward Proxy and SSL Inbound Inspection traffic in the SSL Protocol Settings.
NEW QUESTION # 65
What is the best definition of the Heartbeat Interval?
- A. The interval in milliseconds between hello packets
- B. The frequency at which the HA peers exchange ping
- C. The interval during which the firewall will remain active following a link monitor failure
- D. The frequency at which the HA peers check link or path availability
Answer: B
Explanation:
"A "heartbeat-interval" CLI command was added to the election settings for HA, this interval has a 1000ms minimum for all Palo Alto Networks platforms and is an ICMP ping to the other device through the HA control link." https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClMaCAK
NEW QUESTION # 66
Decrypted packets from the website https://www.microsoft.com will appear as which application and service within the Traffic log?
- A. web-browsing and 80
We know that SSL decryption is supposed to give us visibility of traffic that would otherwise be encrypted. Therefore, we'd expect decrypted traffic to be identified as the underlying applications, such as web-browsing, facebook-base or other, but not as SSL. - B. web-browsing and 443
- C. SSL and 443
- D. SSL and 80
Answer: B
NEW QUESTION # 67
Which processing order will be enabled when a Panorama administrator selects the setting "Objects defined in ancestors will take higher precedence?"
- A. Ancestor objects will have precedence over other ancestor objects.
- B. Ancestor objects will have precedence over descendant objects.
- C. Descendant objects will take precedence over other descendant objects.
- D. Descendant objects will take precedence over ancestor objects.
Answer: B
NEW QUESTION # 68
Which profile generates a packet threat type found in threat logs?
- A. Antivirus
- B. Zone Protection
- C. Anti-Spyware
- D. WildFire
Answer: C
NEW QUESTION # 69
An administrator deploys PA-500 NGFWs as an active/passive high availability pair. The devices are not participating in dynamic routing and preemption is disabled.
What must be verified to upgrade the firewalls to the most recent version of PAN-OS software?
- A. Application and Threats update package
- B. Anti virus update package
- C. User-ID agent
- D. Wildfire update package
Answer: A
Explanation:
Dependencies : Before upgrade, make sure the firewall is running a version of app + threat (content version) that meets the minimum requirement of the new PAN-OS Upgrade.
Reference:
https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-new-features/upgrade-to-pan-os-90/upgrade-the-firewall-to-pan-os-90/upgrade-an-ha-firewall-pair-to-pan-os-90.html#idab14f5f2-f662-4e5c-ba5b-2cc35993e2ec
NEW QUESTION # 70
Which server platforms can be monitored when a company is deploying User-ID through server monitoring in an environment with diverse directory services?
- A. Red Hat Linux, Microsoft Exchange, and Microsoft Terminal Server
- B. Red Hat Linux, Microsoft Active Directory, and Microsoft Exchange
- C. Novell eDirectory, Microsoft Terminal Server, and Microsoft Active Directory
- D. Novell eDirectory, Microsoft Exchange, and Microsoft Active Directory
Answer: B
Explanation:
When deploying User-ID in environments with diverse directory services, Palo Alto Networks firewalls have the capability to monitor several types of servers to gather user mapping information. Among the options provided:
C: Red Hat Linux, Microsoft Active Directory, and Microsoft Exchange:
* Red Hat Linux: Palo Alto Networks User-ID can monitor Linux systems to gather user information, typically by integrating with services like syslog or by using an agent that reads user login events.
* Microsoft Active Directory: This is one of the most common sources for User-ID, as Active Directory is widely used for user management and authentication. User-ID can directly integrate with Active Directory to read security event logs, capturing user login and logout events.
* Microsoft Exchange: While not directly monitored for user login events, Microsoft Exchange can be a source of IP-to-user mapping information, especially for users accessing email services. This can be achieved by parsing Exchange logs for client access information.
These platforms can provide valuable data for User-ID, enabling the firewall to apply policies based on user identity across diverse network environments.
NEW QUESTION # 71
What is the purpose of the firewall decryption broker?
- A. reduce SSL traffic to a weaker cipher before sending it to a security chain of inspection tools.
- B. force decryption of previously unknown cipher suites
- C. decrypt SSL traffic and then send it as cleartext to a security chain of inspection tools.
- D. inspect traffic within IPsec tunnels
Answer: C
Explanation:
https://www.paloaltonetworks.com/documentation/81/pan-os/newfeaturesguide/decryption- features/decryption-broker
NEW QUESTION # 72
Which authentication source requires the installation of Palo Alto Networks software, other than PAN-OS 7x, to obtain a username-to-IP-address mapping?
- A. Microsoft Terminal Services
- B. Palo Alto Networks Captive Portal
- C. Aerohive Wireless Access Point
- D. Microsoft Active Directory
Answer: A
NEW QUESTION # 73
Refer to the exhibit.
Which certificates can be used as a Forward Trust certificate?
- A. Forward_Trust
- B. Certificate from Default Trust Certificate Authorities
- C. Domain-Root-Cert
- D. Domain Sub-CA
Answer: B
NEW QUESTION # 74
What does SSL decryption require to establish a firewall as a trusted third party and to establish trust between a client and server to secure an SSL/TLS connection?
- A. link state
- B. certificates
- C. profiles
- D. stateful firewall connection
Answer: B
Explanation:
Explanation
https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/decryption/decryption-overview.html#:~:text=SSL%
NEW QUESTION # 75
While troubleshooting an SSL Forward Proxy decryption issue which PAN-OS CLI command would you use to check the details of the end-entity certificate that is signed by the Forward Trust Certificate or Forward Untrust Certificate?
- A. debug dataplane show ssl-decrypt ssl-stats
- B. show systen setting ssl-decrypt certificate
- C. show systea setting ssl-decrypt certificate-cache
- D. show system setting ssl-decrypt certs
Answer: B
NEW QUESTION # 76
An administrator is building Security rules within a device group to block traffic to and from malicious locations.
How should those rules be configured to ensure that they are evaluated with a high priority?
- A. Create the appropriate rules with a Block action and apply them at the top of the Security Post- Rules.
- B. Create the appropriate rules with a Block action and apply them at the top of the Security Pre- Rules
- C. Create the appropriate rules with a Block action and apply them at the top of the local firewall Security rules.
- D. Create the appropriate rules with a Block action and apply them at the top of the Default Rules
Answer: D
NEW QUESTION # 77
Which method does an administrator use to integrate all non-native MFA platforms in PAN-OS® software?
- A. DUO
- B. PingID
- C. RADIUS
- D. Okta
Answer: C
Explanation:
https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/authentication/authentication-types/multi-factor-authentication
For end-user authentication via Authentication Policy, the firewall directly integrates with several MFA platforms (Duo v2, Okta Adaptive, PingID, and RSA SecurID), as well as integrating through RADIUS or SAML for all other MFA platforms.
NEW QUESTION # 78
Which DoS protection mechanism detects and prevents session exhaustion attacks?
- A. Resource Protection
- B. TCP Port Scan Protection
- C. Packet Based Attack Protection
- D. Flood Protection
Answer: A
Explanation:
https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/zone-protection-and-dos- protection/zone-defense/dos-protection-profiles-and-policy-rules/dos-protection- profiles#ida42d52fa-3366-4695-bb4a-d39ebf3b6a5f
NEW QUESTION # 79
An engineer is configuring a template in Panorama which will contain settings that need to be applied to all firewalls in production.
Which three parts of a template an engineer can configure? (Choose three.)
- A. NTP Server Address
- B. Antivirus Profile
- C. Authentication Profile
- D. Dynamic Address Groups
- E. Service Route Configuration
Answer: A,C,E
Explanation:
NTP Server Address D. Service Route Configuration Short Explanation of Correct Answer Only: These parts of a template can be configured on Panorama1. An antivirus profile and an authentication profile are not parts of a template, but parts of a device group2. Reference: 1: https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/manage-firewalls/manage-templates-and-template-stacks/templates-and-template-stacks-overview 2: https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/manage-firewalls/manage-device-groups/device-group-overview
NEW QUESTION # 80
A network engineer is troubleshooting a VPN and wants to verify whether the decapsulation/encapsulation counters are increasing.
Which CLI command should the engineer run?
- A. Show vpn flow name <tunnel name>
- B. Show vpn tunnel name | match encap
- C. Show running tunnel flow lookup
- D. Show vpn ipsec-sa tunnel <tunnel name>
Answer: A
Explanation:
Check if encapsulation and decapsulation bytes are increasing. If the firewall is passing traffic, then both values should be increasing.
> show vpn flow name <tunnel.id/tunnel.name> | match bytes
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClivCAC
NEW QUESTION # 81
Which conditions must be met when provisioning a high availability (HA) cluster? (Choose two.)
- A. Panorama must be used to manage HA cluster members.
- B. Dedicated HA communication interfaces for the cluster must be used over HSCI interfaces
- C. HA cluster members must be the same firewall model and run the same PAN-OS version.
- D. HA cluster members must share the same zone names.
Answer: B,C
NEW QUESTION # 82
A Security policy rule is configured with a Vulnerability Protection Profile and an action of "Deny." Which action will this configuration cause on the matched traffic?
- A. The "Deny" action will supersede the per-severity defined actions defined in the associated Vulnerability Protection Profile It will cause the firewall to deny the matched sessions.
Any configured Security Profiles have no effect if the Security policy rule action is set to "Deny" - B. The Profile Settings section will be grayed out when the Action is set to "Deny"
- C. It will cause the firewall to skip this Security policy rule. A warning will be displayed during a commit
- D. The configuration will allow the matched session unless a vulnerability signature is detected.
Answer: A
Explanation:
Explanation
https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/policy/security-profiles.html
First note in above link states:
"Security profiles are not used in the match criteria of a traffic flow.
The security profile is applied to scan traffic after the application or category is allowed by the security policy."
The first thing the firewall checks per it's flow is the security policy match and action.
The Security Profile never gets checked if a match happens on a policy set to deny that match.
NEW QUESTION # 83
To ensure that a Security policy has the highest priority, how should an administrator configure a Security policy in the device group hierarchy?
- A. Add the policy to the target device group and apply a master device to the device group.
- B. Reference the targeted device's templates in the target device group.
- C. Add the policy in the shared device group as a pre-rule
- D. Clone the security policy and add it to the other device groups.
Answer: C
Explanation:
According to the Palo Alto Networks documentation1, the shared device group is a special device group that contains policies and objects that apply to all firewalls managed by Panorama. The policies in the shared device group can be configured as pre-rules or post-rules, which determine their priority relative to the policies in other device groups. Pre-rules have higher priority than the policies in other device groups, while post-rules have lower priority. Therefore, to ensure that a Security policy has the highest priority, the administrator should configure it in the shared device group as a pre-rule. Therefore, the correct answer is D.
The other options are not relevant or effective for ensuring that a Security policy has the highest priority:
Add the policy to the target device group and apply a master device to the device group: This option would add the policy to a specific device group, which is a subset of firewalls managed by Panorama. The policy would only apply to the firewalls in that device group, not to all firewalls. Moreover, applying a master device to the device group does not affect the priority of the policy, but only allows synchronizing configuration changes across devices in the same device group2.
Reference the targeted device's templates in the target device group: This option would reference the templates that contain network and device settings for the targeted devices in the target device group. It does not affect the Security policy or its priority, but only allows applying consistent configuration settings across devices in the same device group3.
Clone the security policy and add it to the other device groups: This option would create copies of the security policy and add them to different device groups. However, this would not ensure that the policy has the highest priority, because it would still depend on whether it is configured as a pre-rule or a post-rule within each device group. Moreover, this option would create redundant and potentially conflicting policies across different device groups.
NEW QUESTION # 84
To more easily reuse templates and template slacks , you can create term plate variables in place of firewall-specific and appliance-specific IP literals in your configurations Which one is the correct configuration?
- A. @Panorama
- B. &Panorama
- C. #Pancrama
- D. $Panorama
Answer: D
Explanation:
Create a template and template stack using a variable name for an object. Variable names must start with the dollar sign ( "$" ) symbol. For example, you could use $Panorama as a variable for the Panorama IP address that you want to configure on multiple managed firewalls and appliances
https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-new-features/panorama-features/configuration-reusability-for-templates-and-template-stacks.html
NEW QUESTION # 85
Refer to the exhibit.
Which certificates can be used as a Forwarded Trust certificate?
- A. Forward_Trust
- B. Certificate from Default Trust Certificate Authorities
- C. Domain Sub-CA
- D. Domain-Root-Cert
Answer: C
Explanation:
The SSL Forward Proxy certificate must be a trusted CA certificate with private key. In order to use this cert as a Forward Proxy certificate, you must open the certificate and select the checkbox to enable it as a Forward Trust Certificate. See the following doc, Step 2 number 5: https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/decryption/configure-ssl-forward-proxy.html
NEW QUESTION # 86
......
PCNSE Dumps Real Exam Questions Test Engine Dumps Training: https://www.prep4surereview.com/PCNSE-latest-braindumps.html
PCNSE exam dumps and online Test Engine: https://drive.google.com/open?id=1F7jplPF2gMaGz318s2o9nrhq5OsKCC0k
