Palo Alto Networks PCNSC Online Practice Questions and Exam Preparation

Palo Alto Networks PCNSC Online Questions & Answers

• Question 1:

  Which Palo Alto Networks feature allows you to create dynamic security policies based on the behavior of the devices in your network?

  A. Behavioral Threat Detection
  B. Cortex XDR
  C. App-ID
  D. Dynamic Address Groups
  D. Dynamic Address Groups

• Question 2:

  In an HA (High Availability) setup, what is the purpose of the HA3 link?

  A. Synchronize session state information
  B. Synchronize configuration changes
  C. Exchange heartbeats between the devices
  D. Transmit HA control traffic
  A. Synchronize session state information

• Question 3:

  A customer has a pair of Panorama HA appliances tunning local log collectors and wants to have log redundancy on logs forwarded from firewalls Which two configuration options fulfill the customer's requirement for log redundancy? (Choose two)

  A. Panorama operational mode needs to be Dedicated Log Collector
  B. Log redundancy must be enabled per Collector Group
  C. A Collector Group must contain at least two Log Collectors
  D. Panorama configured in HA provides log redundancy
  B. Log redundancy must be enabled per Collector Group
  C. A Collector Group must contain at least two Log Collectors

  ---

  explanation:

  Explanation/Reference:

  To fulfill the customer's requirement for log redundancy on logs forwarded from firewalls in a Panorama HA setup, the following configuration options are necessary:

  Log redundancy must be enabled per Collector Group : This ensures that logs are redundantly stored across multiple log collectors within the same collector group. A Collector Group must contain at least two Log Collectors : For log

  redundancy to work, there must be at least two log collectors in the collector group so that if one log collector fails, the other can continue to collect logs.

  These configurations ensure that log data is replicated across multiple log collectors, providing redundancy and resilience in the event of a failure.

  References:

  Palo Alto Networks - Configure Log Forwarding and Redundancy:

  https://docs.paloaltonetworks.com/panorama/10-0/panorama-admin/manage-log-collection/configure-log-forwarding-and-redundancy

  Palo Alto Networks - Panorama High Availability:

  https://docs.paloaltonetworks.com/panorama/10-0/panorama-admin/set-up-panorama/set-up-high-availability

• Question 4:

  Which of the following must be enabled to use Threat Prevention features such as Anti-Virus and Anti-Spyware on a firewall?

  A. Security Profiles
  B. WildFire Subscription
  C. URL Filtering
  D. GlobalProtect Subscription
  A. Security Profiles

• Question 5:

  Which touting configuration should you recommend lo a customer who wishes lo actively use multiple pathways to the same destination?

  A. OSPF
  B. ECMP
  C. BGP
  D. RlPv2
  B. ECMP

  ---

  explanation:

  Explanation/Reference:

  For a customer who wishes to actively use multiple pathways to the same destination, the recommended routing configuration is:

  ECMP (Equal-Cost Multi-Path)

  ECMP allows the use of multiple paths to the same destination with equal cost metrics, enabling load balancing and redundancy. It is suitable for scenarios where multiple pathways are desired for traffic distribution and fault tolerance.

  References:

  Palo Alto Networks - ECMP Overview:

  https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-networking-admin/ecmp

  Palo Alto Networks - Configuring ECMP:

  https://knowledgebase.paloaltonetworks.com

• Question 6:

  Examine the configured Security policy rule Which day one/Iron Skillet Security Profile Group is used to secure the traffic that is permitted through this rule?

  Name: Permit Users to Servers Location: Shared Tags: none Zone: LAN-User-Zone Address: any User: any Profile: any Zone: Server-Zone Address: any Application: includetftp,ssl,web-browsing Service: application-default Action: Allow Profile: none

  A. Inbound
  B. Outbound
  C. Internal
  D. Detautl
  C. Internal

  ---

  explanation:

  Explanation/Reference:

  The security policy rule shown in the image is configured to permit traffic from a source zone LAN-User-Zone to a destination zone Server-Zone. The applications allowed includetftp,ssl, and web-browsing, and the action is allow. According to Iron Skillet day one configurations, which provide best practice security profiles for immediate deployment, the relevant security profile group used to secure internal traffic like this is the Internal profile group. Iron Skillet provides predefined configuration templates including security profile groups like Internal, External, and others to quickly secure traffic according to typical deployment scenarios.

  References:

  Palo Alto Networks - Iron Skillet Documentation:

  https://github.com/PaloAltoNetworks/iron-skillet

• Question 7:

  Which three steps must an administrator perform to load only address objects from a PAN-OS saved configuration file into a VM-3C0 firewall that is in production? (Choose three)

  A. use the device configuration import in Panorama
  B. Import named configuration snapshot through the web interface
  C. load the config in the web interface and commit
  D. enter the configuration mode from the CLI
  E. use load config partial command
  C. load the config in the web interface and commit
  D. enter the configuration mode from the CLI
  E. use load config partial command

  ---

  explanation:

  Explanation/Reference:

  To load only address objects from a PAN-OS saved configuration file into a VM-300 firewall that is in production, the administrator must follow these three steps:

  Enter the configuration mode from the CLI : This step is necessary to prepare the firewall to accept the new configuration.

  Use the load config partial command : This command allows the administrator to load only specific parts of the configuration, such as address objects, from a saved configuration file without overwriting the entire configuration. The command

  syntax typically looks like this:load config partial from mode merge exclude everything but address objects. Import named configuration snapshot through the web interface : This involves importing the configuration

  snapshot that contains the address objects through the web interface, but only after ensuring that the specific address objects are targeted and not the entire configuration.

  References:

  Palo Alto Networks - PAN-OS CLI Quick Start:

  https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-cli-quick-start

  Palo Alto Networks - How to Use the Partial Configuration Load Feature:

  https://knowledgebase.paloaltonetworks.com

• Question 8:

  Which CLI command is used to verify the high availability state of a Palo Alto Networks firewall?

  A. show high-availability state
  B. show ha state
  C. show ha status
  D. show high-availability status
  C. show ha status

• Question 9:

  Which log type would you consult to diagnose why a specific URL is being blocked?

  A. Threat log
  B. URL Filtering log
  C. Traffic log
  D. Data Filtering log
  B. URL Filtering log

• Question 10:

  A customer's Palo Alto Networks NGFW currently has only one security policy allowing all traffic They have identified that this is a substantial security risk and have heard that the Expedition tool can help them extract security policies from an "allow any" rule

  What should the consultant say about Expedition?

  A. Expedition cannot parse log files and therefore cannot be used for this purpose
  B. By using the Machine Learning feature Expedition can parse the traffic log files related to the polcy and extract security rules for matching traffic
  C. Live firewall traffic can be viewed on Expedition when connected to a firewall, and Expedition can automatically create and push policies to the firewall
  D. The log files can be viewed on Expedition, and right-clicking a log entry gives the option to create security policy from the log entry.
  B. By using the Machine Learning feature Expedition can parse the traffic log files related to the polcy and extract security rules for matching traffic

  ---

  explanation:

  Explanation/Reference:

  The Expedition tool can help the customer extract security policies from an "allow any" rule by using its Machine Learning feature:

  By using the Machine Learning feature, Expedition can parse the traffic log files related to the policy and extract security rules for matching traffic

  Expedition can analyze traffic log files and apply machine learning algorithms to suggest security policies that match the observed traffic patterns. This helps in creating a more secure and granular policy set from a broad "allow any" rule.

  References:

  Palo Alto Networks - Expedition Documentation:

  https://live.paloaltonetworks.com/t5/expedition-migration-tool/ct-p/migration_tool

  Palo Alto Networks - Using Machine Learning in Expedition:

  https://live.paloaltonetworks.com/t5/expedition-articles/expedition-machine-learning-overview/ta-p/260401