Palo Alto Networks PCNSC Online Practice Questions and Exam Preparation

Palo Alto Networks PCNSC Online Questions & Answers

• Question 31:

  What is the default port used by the Terminal Services agent to communicate with a firewall?

  A. 5007
  B. 5009
  C. 443
  D. 636
  A. 5007

  ---

  Explanation/Reference:

  The default port used by the Terminal Services agent to communicate with a Palo Alto Networks firewall is5007. The Terminal Services agent (TS agent) integrates with Microsoft Terminal Services to associate user information with sessions,

  enabling User-ID to accurately map user identities to security policies.

  Reference:

  Palo Alto Networks Terminal Services Agent Documentation.

• Question 32:

  Which touting configuration should you recommend lo a customer who wishes lo actively use multiple pathways to the same destination?

  A. OSPF
  B. ECMP
  C. BGP
  D. RlPv2
  B. ECMP

  ---

  Explanation/Reference:

  For a customer who wishes to actively use multiple pathways to the same destination, the recommended routing configuration is:

  ECMP (Equal-Cost Multi-Path)

  ECMP allows the use of multiple paths to the same destination with equal cost metrics, enabling load balancing and redundancy. It is suitable for scenarios where multiple pathways are desired for traffic distribution and fault tolerance.

  References:

  Palo Alto Networks - ECMP Overview:

  https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-networking-admin/ecmp

  Palo Alto Networks - Configuring ECMP:

  https://knowledgebase.paloaltonetworks.com

• Question 33:

  Drag and Drop

  Match the App-ID adoption task with its order in the process.

  Select and Place:

  

  

  ---

  Explanation/Reference:

  To match the App-ID adoption task with its order in the process, follow these steps:

  Perform a like-for-like (Layer 3/4) migration from the legacy firewall to the Palo Alto Networks NGFW.

  This is the initial step to ensure that the Palo Alto Networks NGFW is in place and functioning with the existing security policies.

  Capture, retain, and verify that all traffic has been logged for a period of time.

  This step involves enabling logging and monitoring traffic to understand the application usage and to ensure that all traffic is being logged.

  Clone the legacy rules and add application information to the intended application-based rules.

  This step involves creating copies of the existing rules and enhancing them with application-specific information using App-ID.

  Verify that no traffic is hitting the legacy rules.

  After creating application-based rules, ensure that traffic is now hitting these new rules instead of the legacy rules. This indicates that the transition to App-ID based policies is successful.

  Remove the legacy rules.

  Once it is confirmed that no traffic is hitting the legacy rules and the new App-ID based rules are effectively managing the traffic, the legacy rules can be safely removed.

  Order in Process:

  Perform a like-for-like (Layer 3/4) migration from the legacy firewall to the Palo Alto Networks NGFW.

  Capture, retain, and verify that all traffic has been logged for a period of time.

  Clone the legacy rules and add application information to the intended application-based rules.

  Verify that no traffic is hitting the legacy rules.

  Remove the legacy rules.

  References:

  Palo Alto Networks - App-ID Best Practices:

  https://docs.paloaltonetworks.com/best-practices

  Palo Alto Networks - Migration from Legacy Firewalls:

  https://docs.paloaltonetworks.com/migration

• Question 34:

  Which version of Global Protect supports split tunneling based on destination domain, client process, and HTTP/HTTPs video streaming application?

  A. Glovbalprotect version 4.0 with PAn-OS 8.0
  B. Glovbalprotect version 4.1 with PAn-OS 8.1
  C. Glovbalprotect version 4.0 with PAn-OS 8.1
  D. Glovbalprotect version 4.1 with PAn-OS 8.0
  C. Glovbalprotect version 4.0 with PAn-OS 8.1

• Question 35:

  Which of the following must be enabled to use Threat Prevention features such as Anti-Virus and Anti-Spyware on a firewall?

  A. Security Profiles
  B. WildFire Subscription
  C. URL Filtering
  D. GlobalProtect Subscription
  A. Security Profiles

• Question 36:

  A customer's Palo Alto Networks NGFW currently has only one security policy allowing all traffic They have identified that this is a substantial security risk and have heard that the Expedition tool can help them extract security policies from an "allow any" rule

  What should the consultant say about Expedition?

  A. Expedition cannot parse log files and therefore cannot be used for this purpose
  B. By using the Machine Learning feature Expedition can parse the traffic log files related to the polcy and extract security rules for matching traffic
  C. Live firewall traffic can be viewed on Expedition when connected to a firewall, and Expedition can automatically create and push policies to the firewall
  D. The log files can be viewed on Expedition, and right-clicking a log entry gives the option to create security policy from the log entry.
  B. By using the Machine Learning feature Expedition can parse the traffic log files related to the polcy and extract security rules for matching traffic

  ---

  Explanation/Reference:

  The Expedition tool can help the customer extract security policies from an "allow any" rule by using its Machine Learning feature:

  By using the Machine Learning feature, Expedition can parse the traffic log files related to the policy and extract security rules for matching traffic

  Expedition can analyze traffic log files and apply machine learning algorithms to suggest security policies that match the observed traffic patterns. This helps in creating a more secure and granular policy set from a broad "allow any" rule.

  References:

  Palo Alto Networks - Expedition Documentation:

  https://live.paloaltonetworks.com/t5/expedition-migration-tool/ct-p/migration_tool

  Palo Alto Networks - Using Machine Learning in Expedition:

  https://live.paloaltonetworks.com/t5/expedition-articles/expedition-machine-learning-overview/ta-p/260401

• Question 37:

  In an HA (High Availability) setup, what is the purpose of the HA3 link?

  A. Synchronize session state information
  B. Synchronize configuration changes
  C. Exchange heartbeats between the devices
  D. Transmit HA control traffic
  A. Synchronize session state information

• Question 38:

  A Palo Alto Networks NGFW just submitted a file lo WildFire tor analysis Assume a 5-minute window for analysis. The firewall is configured to check for verdicts every 5 minutes.

  How quickly will the firewall receive back a verdict?

  A. 10 to 15 minutes
  B. 5 to 10 minutes
  C. More than 15 minutes
  D. 5 minutes
  B. 5 to 10 minutes

• Question 39:

  Which three steps must an administrator perform to load only address objects from a PAN-OS saved configuration file into a VM-3C0 firewall that is in production? (Choose three)

  A. use the device configuration import in Panorama
  B. Import named configuration snapshot through the web interface
  C. load the config in the web interface and commit
  D. enter the configuration mode from the CLI
  E. use load config partial command
  C. load the config in the web interface and commit
  D. enter the configuration mode from the CLI
  E. use load config partial command

  ---

  Explanation/Reference:

  To load only address objects from a PAN-OS saved configuration file into a VM-300 firewall that is in production, the administrator must follow these three steps:

  Enter the configuration mode from the CLI : This step is necessary to prepare the firewall to accept the new configuration.

  Use the load config partial command : This command allows the administrator to load only specific parts of the configuration, such as address objects, from a saved configuration file without overwriting the entire configuration. The command

  syntax typically looks like this:load config partial from mode merge exclude everything but address objects. Import named configuration snapshot through the web interface : This involves importing the configuration

  snapshot that contains the address objects through the web interface, but only after ensuring that the specific address objects are targeted and not the entire configuration.

  References:

  Palo Alto Networks - PAN-OS CLI Quick Start:

  https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-cli-quick-start

  Palo Alto Networks - How to Use the Partial Configuration Load Feature:

  https://knowledgebase.paloaltonetworks.com

• Question 40:

  What command can you use to check the status of GlobalProtect clients connected to the firewall?

  A. show globalprotect status
  B. show globalprotect gateway
  C. show globalprotect current-user
  D. show globalprotect statistics
  B. show globalprotect gateway