Palo Alto Networks PCNSC Online Practice Questions and Exam Preparation

Palo Alto Networks PCNSC Online Questions & Answers

• Question 21:

  An administrator needs to optimize traffic to prefer business-critical applications over non-critical applications.

  QoS natively integrates with which feature to provide service quality?

  A. port inspection
  B. certification revocation
  C. Content-ID
  D. App-ID
  D. App-ID

• Question 22:

  A customer who has a multi-tenant environment needs the administrator to be restricted lo specific objects and policies in the virtual system within its tenant How can an administrators access be restricted?

  A. Define access domains for virtual systems in the environment
  B. Define an Admin Role Profile with Panorama enabling all access
  C. Define an access domain thatenables the device groups assigned to the admin
  D. Define an Admin Role Profile with a device group and template enabling all access
  A. Define access domains for virtual systems in the environment

  ---

  Explanation/Reference:

  To restrict an administrator's access to specific objects and policies in the virtual system within a multi-tenant environment, you should:

  Define access domains for virtual systems in the environment

  Access domains allow you to control administrator access to specific virtual systems, device groups, and templates. By defining access domains, you can restrict the administrator's permissions to only the relevant sections of the

  configuration, ensuring they can manage only the objects and policies within their assigned virtual systems.

  References:

  Palo Alto Networks - Admin Role Profiles and Access Domains:

  https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/administering-pan-os/admin-role-profiles-and-access-domains

  Palo Alto Networks - Multi-Tenancy in Virtual

  Systems:https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/firewall-administration/multi-tenancy

• Question 23:

  An administrator has been asked to configure active/active HA for a pair of Palo Alto Networks NGFWs. The firewalls use layer 3 interface to send traffic to a single gateway IP for the pair.

  Which configuration will enable this HA scenario?

  A. The firewall do not use floating IPs in active/active HA.
  B. The two firewalls will share a single floating IP and will use gratuitous ARP to share the floating IP.
  C. The firewalls will share the same interface IP address, and device 1 will use the floating IP if device 0 fails.
  D. Each firewall will have a separate floating IP. and priority will determine which firewall has the primary IP.
  D. Each firewall will have a separate floating IP. and priority will determine which firewall has the primary IP.

• Question 24:

  Which CLI command is used to simulate traffic goingthrough the firewall and determine which Security policy rule, NAT translation, static route, or PBF rule will be triggered by the traffic?

  A. check
  B. find
  C. test
  D. sim
  C. test

  ---

  Explanation/Reference:

• Question 25:

  Drag and Drop Identity the Stakeholder with their Role when planning a Firewall Panorama, and Cortex XDR Deployment

  Select and Place:

  

  

  ---

  Explanation/Reference:

  Security Engineer- Determines the security, logging, reporting requirements and manages the policy.

  System Administrator- Manages the software distribution method for the Cortex XDR Client.

  Security Operations Analyst- Manages the alerts and responds to threats identified on the network or endpoints.

  Network Engineer- Manages the routing, switching, and general device interconnectivity.

  When planning a deployment involving Firewall, Panorama, and Cortex XDR, each stakeholder plays a specific role:

  Security Engineer- This role involves defining and managing security policies, logging configurations, and reporting requirements to ensure compliance and optimal security posture. They are responsible for the overall security configuration

  and implementation.

• Question 26:

  A customer is adding a new site-to-site tunnel from a PaloAlto Networks NGFW to a third party with a policy based VPN peer After the initial configuration is completed and the changes are committed, phase 2 fails to establish

  Which two changes may be required to fix the issue? (Choose two)

  A. Verity that the certificate used tor authentication is installed.
  B. Verify that PFS is enabled on both ends
  C. Enable the NAT Traversal advanced option.
  D. Add proxy IDs to the iPsec tunnel configuration
  B. Verify that PFS is enabled on both ends
  D. Add proxy IDs to the iPsec tunnel configuration

  ---

  Explanation/Reference:

  When configuring a site-to-site VPN between a Palo Alto Networks Next-Generation Firewall (NGFW) and a third-party device with a policy-based VPN peer, Phase 2 failures can often be attributed to configuration mismatches or missing

  parameters. Here are the two changes that may be required to fix the issue:

  Verify that PFS is enabled on both ends : Perfect Forward Secrecy (PFS) is a method that ensures the security of cryptographic keys. Both ends of the VPN tunnel need to agree on whether PFS is used. If PFS is enabled on one side but not

  the other, Phase 2 will fail. Verify the PFS settings and ensure they are matched on both the Palo Alto firewall and the third-party VPN device. Add proxy IDs to the IPsec tunnel configuration : Proxy IDs (or traffic selectors) define the specific

  local and remote IP ranges that are allowed to communicate through the VPN tunnel.They are particularly crucial when dealing with policy- based VPNs. If the proxy IDs are not correctly configured, Phase 2 negotiations will fail. Add the

  appropriate proxy IDs to the IPsec tunnel configuration to match the policy-based VPN settings of the third-party device.

  References:

  Palo Alto Networks - Configuring Site-to-Site VPN Between Palo Alto Networks and a Third-Party Firewall:

  https://docs.paloaltonetworks.com

  Palo Alto Networks - VPN Configuration Guidelines:

  https://knowledgebase.paloaltonetworks.com

• Question 27:

  Which Captive Portal mode must be contoured to support MFA authentication?

  A. Single Sign-On
  B. Redirect
  C. Transparent
  D. NTLM
  B. Redirect

  ---

  Explanation/Reference:

• Question 28:

  A firewall that was previously connected lo a User-ID agent server now shows disconnected What is the likely cause?

  A. The server has stopped listening on port 2010
  B. The Domain Controller service account has been locked out
  C. The agent is not running
  D. The firewall was upgraded to a PAN-OS version that is not compatible with the agent version
  D. The firewall was upgraded to a PAN-OS version that is not compatible with the agent version

  ---

  Explanation/Reference:

  If a firewall that was previously connected to a User-ID agent server now shows disconnected, the likely cause is:

  The firewall was upgraded to a PAN-OS version that is not compatible with the agent version

  When a firewall is upgraded to a new version of PAN-OS, there can be compatibility issues with the existing User-ID agent if it is not updated accordingly. This can result in the firewall being unable to communicate with the User-ID agent,

  showing it as disconnected.

  References:

  Palo Alto Networks - User-ID Agent Compatibility:

  https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/user-id/user-id-agent

• Question 29:

  Which of the following is NOT a benefit of using App-ID?

  A. Identifies applications running on non-standard ports
  B. Blocks application traffic that uses dynamic ports
  C. Reduces the attack surface by allowing only required applications
  D. Ensures consistent bandwidth allocation for all applications
  D. Ensures consistent bandwidth allocation for all applications

• Question 30:

  During the packet flow process, which two processes are performed in application identification? (Choose two.)

  A. Application changed from content inspection
  B. session application identified
  C. pattern based application identification
  D. application override policy match
  B. session application identified
  D. application override policy match