Palo Alto Networks PCNSC Online Practice Questions and Exam Preparation

Palo Alto Networks PCNSC Online Questions & Answers

• Question 41:

  Which event will happen administrator uses an Application Override Policy?

  A. The application name assigned to the traffic by the security rule is written to the traffic log.
  B. The Palo Alto Networks NGFW Steps App-ID processing at Layer 4.
  C. Threat-ID processing time is decreased.
  D. App-ID processing time is increased.
  B. The Palo Alto Networks NGFW Steps App-ID processing at Layer 4.

  ---

  Explanation/Reference:

• Question 42:

  In High Availability, which information is transferred via the HA data link?

  A. heartbeats
  B. HA state information
  C. session information
  D. User-ID information
  C. session information

• Question 43:

  An administrator pushes a new configuration from panorama to a pair of firewalls that are configured as active/passive HA pair.

  Which NGFW receives the configuration from panorama?

  A. the active firewall, which then synchronizes to the passive firewall
  B. the passive firewall, which then synchronizes to the active firewall
  C. both the active and passive firewalls independently, with no synchronization afterward
  D. both the active and passive firewalls, which then synchronizes with each other
  D. both the active and passive firewalls, which then synchronizes with each other

• Question 44:

  Which two action would be part of an automatic solution that would block sites with untrusted certificates without enabling SSL forward proxy? (Choose two.)

  A. Configure an EDL to pull IP Addresses of known sites resolved from a CRL.
  B. Create a Security Policy rule with vulnerability Security Profile attached.
  C. Create a no-decrypt Decryption Policy rule.
  D. Enable the "Block seasons with untrusted Issuers- setting.
  E. Configure a Dynamic Address Group for untrusted sites.
  B. Create a Security Policy rule with vulnerability Security Profile attached.
  D. Enable the "Block seasons with untrusted Issuers- setting.

• Question 45:

  Which three authentication faction factors does PAN-OS software support for MFA? (Choose three.)

  A. Voice
  B. Pull
  C. SMS
  D. Push
  E. Okta Adaptive
  A. Voice
  B. Pull
  D. Push

  ---

  Explanation/Reference:

• Question 46:

  Which administrative authentication method supports authorization by an external service?

  A. RADIUS
  B. SSH keys
  C. Certification
  D. LDAP
  B. SSH keys

• Question 47:

  Which two options prevents the firewall from capturing traffic passing through it? (Choose two.)

  A. The firewall is in milti-vsys mode.
  B. The traffic does not match the packet capture filter
  C. The traffic is offloaded.
  D. The firewall's DP CPU is higher than 50%
  B. The traffic does not match the packet capture filter
  C. The traffic is offloaded.

• Question 48:

  SSL Forward Proxy decryption is enabled on (he firewall When clients use Chrome to browse to HTTPS sites, the firewall returns the Forward Trust certificate, even when accessing websites with invalid certificates The clients need to be presented with a browser warning error with the option to proceed to websites with invalid certificates

  Which two options will satisfy this requirement? (Choose two.)

  A. create a Decryption Profile with the Block sessions with expired certificates option enabled
  B. create a self-signed Forward Untrust enabled certificate
  C. create a PKI signed Forward Unlrust enabled certificate
  D. remove the Forward Untrust option from the Forward Trust certificate
  A. create a Decryption Profile with the Block sessions with expired certificates option enabled
  B. create a self-signed Forward Untrust enabled certificate

  ---

  Explanation/Reference:

  When SSL Forward Proxy decryption is enabled, and clients using Chrome need to see browser warnings for websites with invalid certificates, the following options will satisfy the requirement:

  Create a Decryption Profile with the Block sessions with expired certificates option enabled : This option ensures that sessions with expired certificates are blocked, which will present a warning to the user. Create a self-signed Forward

  Untrust enabled certificate : This certificate will be used for websites with invalid or untrusted certificates, prompting the browser to display a warning.

  These configurations ensure that users are properly warned when accessing sites with invalid certificates, allowing them to decide whether to proceed.

  References:

  Palo Alto Networks - SSL Decryption Best Practices:

  https://docs.paloaltonetworks.com/best-practices

  Palo Alto Networks - Configuring SSL Forward Proxy:

  https://knowledgebase.paloaltonetworks.com

• Question 49:

  Which feature prevents the submission of corporate login information into website forms?

  A. credential submission prevention
  B. file blocking
  C. User-ID
  D. data filtering
  A. credential submission prevention

• Question 50:

  Which CLI command should you use to verify whether all SFP SFP*, or QSFP modules are installed in a firewall?

  A. show system info
  B. show interface detail
  C. show system state filter sys.s'-p'-phy
  D. show system state filter sys.p*.phy
  C. show system state filter sys.s'-p'-phy

  ---

  Explanation/Reference:

  To verify whether all SFP, SFP+, or QSFP modules are installed in a firewall, you should use the following CLI command:

  show system state filter sys.s-phy *

  This command provides detailed information about the physical state of the system, including the status of SFP, SFP+, and QSFP modules installed in the firewall.

  References:

  Palo Alto Networks - CLI Commands for Troubleshooting Hardware Issues:

  https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-cli-quick-start/troubleshooting-hardware-issues

  Palo Alto Networks - Understanding Hardware and Interface Details via CLI:

  https://knowledgebase.paloaltonetworks.com