Palo Alto Networks PCNSC Online Practice Questions and Exam Preparation

Palo Alto Networks PCNSC Online Questions & Answers

• Question 1:

  If an administrator wants to decrypt SMTP traffic and possesses the saver's certificate, which SSL decryption mode will allow the Palo Alto Networks NGFW to inspect traffic to the server?

  A. TLS Bidirectional Inspection
  B. SSL Inbound Inspection
  C. SSH Forward now proxy
  D. SMTP inbound Decryption
  C. SSH Forward now proxy

• Question 2:

  Which two types of security profiles are recommended to protect against known and unknown threats? (Choose two)

  A. Antivirus
  B. URL Filtering
  C. Anti-Spyware
  D. File Blocking
  A. Antivirus
  C. Anti-Spyware

• Question 3:

  What should an administrator consider when planning to revert Panorama to a pre-PAN-OS 8.1 version?

  A. When Panorama is reverted to an earlier PAN-OS release, variable used in template stacks will be removed authentically.
  B. Panorama cannot be reverted to an earlier PAN-OS release if variables are used in templates or stacks.
  C. An administrator must use the Expedition tool to adapt the configuration to the pre-pan-OS 8.1 state.
  D. Administrators need to manually update variable characters to those to used in pre-PAN-OS 8.1.
  B. Panorama cannot be reverted to an earlier PAN-OS release if variables are used in templates or stacks.

• Question 4:

  What feature should be used to decrypt and inspect inbound SSL traffic without having to install a certificate on the client devices?

  A. SSL Inbound Inspection
  B. SSL Outbound Inspection
  C. SSL Forward Proxy
  D. SSL Reverse Proxy
  D. SSL Reverse Proxy

• Question 5:

  TAC has requested a PCAP on your Panorama lo see why the DNS app is having intermittent issues resolving FODN What is the appropriate CLI command1*

  A. tcp dump snaplen 53 filter "tcp 53"
  B. tcpdump snaplen 0 filter "port 53"
  C. tcp dump snap-en 0 filter "app dns"
  D. tcpdump snaplen 53 filter "port 53"
  B. tcpdump snaplen 0 filter "port 53"

  ---

  Explanation/Reference:

  To capture a PCAP on your Panorama to troubleshoot DNS resolution issues, the appropriate CLI command is:

  tcpdump snaplen 0 filter "port 53"

  This command captures packets with no size limit (snaplen 0) and filters the traffic for port 53, which is used by DNS. This is the most straightforward and comprehensive way to capture all DNS traffic for analysis.

  References: Palo Alto Networks - Using tcpdump on PAN-OS: https://knowledgebase.paloaltonetworks.com Palo Alto Networks - Troubleshooting Network Connectivity Issues: https://docs.paloaltonetworks.com

• Question 6:

  VPN traffic intended for an administrator's Palo Alto Networks NGfW is being maliciously intercepted and retransmitted by the interceptor. When Creating a VPN tunnel, which protection profile cm be enabled to prevent this malicious behavior?

  A. zone Protection
  B. Web Application
  C. DoS Protection
  D. Replay
  A. zone Protection

• Question 7:

  Which method will dynamically register tags on the Palo Alto Networks NGFW?

  A. Restful API or the VMware API on the firewall or on the User.-D agent or the ready -only domain controller
  B. XML API or the VMware API on the firewall on the User-ID agent or the CLI
  C. Restful API or the VMware API on the firewall or on the User-ID Agent
  D. XML- API or lite VM Monitoring agent on the NGFW or on the User- ID agent
  D. XML- API or lite VM Monitoring agent on the NGFW or on the User- ID agent

• Question 8:

  Anadministrator using an enterprise PKI needs to establish a unique chain of trust to ensure mutual authentication between Panorama and the managed firewalls and Log Collectors. How would the administrator establish the chain of trust?

  A. Use custom certificates
  B. Enable LDAP or RADIUS integration
  C. Set up multi-factor authentication
  D. Configure strong password authentication
  A. Use custom certificates

  ---

  Explanation/Reference:

• Question 9:

  Which Panorama operational mode is necessary to manage a large number of firewalls and also act as a log collector?

  A. Management Only
  B. Log Collector Only
  C. Management and Log Collector
  D. Dedicated Log Collector
  C. Management and Log Collector

• Question 10:

  Which two benefits come from assigning a Decrypting Profile to a Decryption rule with a" NO Decrypt" action? (Choose two.)

  A. Block sessions with unsuspected cipher suites
  B. Block sessions with untrusted issuers
  C. Block credential phishing.
  D. Block sessions with client authentication
  E. Block sessions with expired certificates
  B. Block sessions with untrusted issuers
  E. Block sessions with expired certificates