Palo Alto Networks Palo Alto Networks Certifications PCNSE Questions & Answers

• Question 151:

  Why are external zones required to be configured on a Palo Alto Networks NGFW in an environment with multiple virtual systems?

  A. To allow traffic between zones in different virtual systems while the traffic is leaving the appliance

  B. External zones are required because the same external zone can be used on different virtual systems

  C. To allow traffic between zones in different virtual systems without the traffic leaving the appliance

  D. Multiple external zones are required in each virtual system to allow the communications between virtual systems

  Correct Answer: C

  External zones are required to allow traffic between zones in different virtual systems, without the traffic leaving the firewall. https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/virtual-systems/communication-between-virtual-systems/ inter-vsys-traffic-that-remains-within-the-firewall/external-zone

• Question 152:

  Which rule type controls end user SSL traffic to external websites?

  A. SSL Inbound Inspection

  B. SSH Proxy

  C. SSL Forward Proxy

  D. SSL Outbound Proxyless Inspection

  Correct Answer: C

  https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/decryption/decryption-concepts/ssl-forward-proxy#:~:text=When%20you%20configure%20the%20firewall%20to%20decrypt%20SSL,SSL%2FTLS%20traffic%20from%20internal% 20users%20to%20the%20web.

• Question 153:

  A firewall administrator wants to be able to see all NAT sessions that are going through a firewall with source NAT. Which CLI command can the administrator use?

  A. show session all filter nat source

  B. show running nat-rule-ippool rule "rule_name"

  C. show running nat-policy

  D. show session all filter nat-rule-source

  Correct Answer: A

• Question 154:

  An engineer needs to configure a standardized template for all Panorama-managed firewalls. These settings will be configured on a template named "Global" and will be included in all template stacks. Which three settings can be configured in this template? (Choose three.)

  A. Log Forwarding profile

  B. SSL decryption exclusion

  C. Tags

  D. Login banner

  E. Dynamic updates

  Correct Answer: BDE

• Question 155:

  All firewalls at a company are currently forwarding logs to Palo Alto Networks log collectors. The company also wants to deploy a syslog server and forward all firewall logs to the syslog server and to the log collectors. There is a known logging peak time during the day and the security team has asked the firewall engineer to determine how many logs per second the current Palo Alto Networks log collectors are processing at that particular time.

  Which method is the most time-efficient to complete this task?

  A. Navigate to Panorama > Managed Collectors, and open the Statistics window for each Log Collector during the peak time

  B. Navigate to ACC > Network Activity, and determine the total number of sessions and threats during the peak time

  C. Navigate to Monitor > Unified logs, set the filter to the peak time, and browse to the last page to find out how many logs have been received

  D. Navigate to Panorama > Managed Devices > Health, open the Logging tab for each managed firewall and check the log rates during the peak time

  Correct Answer: A

  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClXbCAK

• Question 156:

  A firewall engineer is configuring quality of service (QoS) policy for the IP address of a specific server in an effort to limit the bandwidth consumed by frequent downloads of large files from the internet. Which combination of pre-NAT and/or post-NAT information should be used in the QoS rule?

  A. Pre-NAT source IP address Pre-NAT source zone

  B. Post-NAT source IP address Pre-NAT source zone

  C. Pre-NAT source IP address Post-NAT source zone

  D. Post-NAT source IP address Post-NAT source zone

  Correct Answer: A

• Question 157:

  The decision to upgrade PAN-OS has been approved. The engineer begins the process by upgrading the Panorama servers, but gets an error when attempting the install. When performing an upgrade on Panorama to PAN-OS, what is the potential cause of a failed install?

  A. GlobalProtect agent version

  B. Outdated plugins

  C. Management only mode

  D. Expired certificates

  Correct Answer: B

  https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-upgrade/upgrade-panorama/install-content-and-software-updates-for-panorama/install-updates-for-panorama-with-internet-connection#id21940aa0-7656-4ac2-9115-611e9111d6d9

• Question 158:

  Following a review of firewall logs for traffic generated by malicious activity, how can an administrator confirm that WildFire has identified a virus?

  A. By navigating to Monitor > Logs > Traffic, applying filter "(subtype eq virus)"

  B. By navigating to Monitor > Logs > Threat, applying filter "(subtype eq virus)"

  C. By navigating to Monitor > Logs > Threat, applying filter "(subtype eq wildfire-virus)"

  D. By navigating to Monitor > Logs > WildFire Submissions, applying filter "(subtype eq wildfire-virus)"

  Correct Answer: C

  https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/threat-log-fields

• Question 159:

  A firewall engineer is managing a Palo Alto Networks NGFW which is not in line of any DHCP traffic.

  Which interface mode can the engineer use to generate Enhanced Application logs (EALs) for classifying IoT devices while receiving broadcast DHCP traffic?

  A. Virtual wire

  B. Layer 3

  C. Layer 2

  D. Tap

  Correct Answer: A

  "Virtual Wire: When the firewall has Virtual Wire interfaces with multicast firewalling enabled, it generates Enhanced Application logs (EALs) for broadcast DHCP sessions." https://docs.paloaltonetworks.com/iot/iot-security-admin/get-startedwith-iot-security/firewall-deployment-for-dhcp-visibility/firewall-deployment-options-for-iot-security

• Question 160:

  An administrator is considering deploying WildFire globally.

  What should the administrator consider with regards to the WildFire infrastructure?

  A. To comply with data privacy regulations, WildFire signatures and verdicts are not shared globally.

  B. Palo Alto Networks owns and maintains one global cloud and four WildFire regional clouds.

  C. Each WildFire cloud analyzes samples independently of the other WildFire clouds.

  D. The WildFire Global Cloud only provides bare metal analysis.

  Correct Answer: C

  Each WildFire cloud-global and regional-analyzes samples and generates malware signatures and verdicts independently of the other WildFire clouds. WildFire signatures and verdicts are then shared globally, enabling WildFire users worldwide to benefit from malware coverage regardless of the location in which the malware was first detected.