Palo Alto Networks Palo Alto Networks Certifications PCNSE Questions & Answers

• Question 171:

  What can the Log Forwarding built-in action with tagging be used to accomplish?

  A. Forward selected logs to the Azure Security Center.

  B. Block the destination zones of selected unwanted traffic.

  C. Block the source zones of selected unwanted traffic.

  D. Block the destination IP addresses of selected unwanted traffic.

  Correct Answer: D

  Tagging - block source/destination address Integration - Azure-Security-Center-Integration https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-web-interface-help/objects/objects-log-forwarding

• Question 172:

  When a new firewall joins a high availability (HA) cluster, the cluster members will synchronize all existing sessions over which HA port?

  A. HA1

  B. HA2

  C. HA3

  D. HA4

  Correct Answer: D

  https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/high-availability/ha-clustering-overview

• Question 173:

  A firewall administrator manages sets of firewalls which have two unique idle timeout values. Datacenter firewalls needs to be set to 20 minutes and BranchOffice firewalls need to be set to 30 minutes. How can the administrator assign these settings through the use of template stacks?

  A. Create one template stack and place the BranchOffice_Template in higher priority than Datacenter_Template.

  B. Create one template stack and place the Datanceter_Template in higher priority than BranchOffice_template.

  C. Create two separate template stacks one each for Datacenter and BranchOffice, and verify that Datacenter_Template and BranchOffice_template are at the bottom of their stack.

  D. Create two separate template stacks one each for Datacenter and BranchOffice, and verify that Datacenter_template are at the top of their stack

  Correct Answer: D

• Question 174:

  A firewall administrator configures the HIP profiles on the edge firewall where GlobalProtect is enabled, and adds the profiles to security rules. The administrator wants to redistribute the HIP reports to the data center firewalls to apply the same access restrictions using HIP profiles. However, the administrator can only see the HIP match logs on the edge firewall but not on the data center firewall

  What are two reasons why the administrator is not seeing HIP match logs on the data center firewall? (Choose two.)

  A. Log Forwarding Profile is configured but not added to security rules in the data center firewall.

  B. HIP profiles are configured but not added to security rules in the data center firewall.

  C. User ID is not enabled in the Zone where the users are coming from in the data center firewall.

  D. HIP Match log forwarding is not configured under Log Settings in the device tab.

  Correct Answer: BC

  For HIP match logs to be visible on the data center firewall, the following conditions must be met:

  HIP profiles added to security rules: HIP profiles must be applied to security rules on the data center firewall to enforce access restrictions based on the received HIP reports. If the HIP profiles are not associated with the security rules, the

  firewall will not evaluate traffic against these profiles, and consequently, no HIP match logs will be generated.

  User-ID enabled on the incoming zone: User-ID must be enabled on the zone where the users are located in the data center firewall. The User-ID feature is responsible for mapping IP addresses to user names, which is critical for applying

  policies based on user identity and, by extension, for HIP-based policy enforcement.

  The other options (A and D) are related to logging and log forwarding but would not directly impact the generation or visibility of HIP match logs on the data center firewall itself.

• Question 175:

  What are three prerequisites to enable Credential Phishing Prevention over SSL? (Choose three

  A. Configure a URL profile to block the phishing category.

  B. Create a URL filtering profile

  C. Enable User-ID.

  D. Create an anti-virus profile.

  E. Create a decryption policy rule.

  Correct Answer: BCE

• Question 176:

  A network security engineer is going to enable Zone Protection on several security zones

  How can the engineer ensure that Zone Protection events appear in the firewall's logs?

  A. Select the check box "Log packet-based attack events" in the Zone Protection profile

  B. No action is needed Zone Protection events appear in the threat logs by default

  C. Select the check box "Log Zone Protection events" in the Content-ID settings of the firewall

  D. Access the CLI in each firewall and enter the command set system setting additional-threat-log on

  Correct Answer: A

• Question 177:

  The UDP-4501 protocol-port is to between which two GlobalProtect components?

  A. GlobalProtect app and GiobalProtect satellite

  B. GlobalRrotect app and GlobalProtect gateway

  C. GlobalProtect portal and GlobalProtect gateway

  D. GlobalProtect app and GlobalProtect portal

  Correct Answer: B

• Question 178:

  A network security engineer needs to ensure that virtual systems can communicate with one another within a Palo Alto Networks firewall. Separate virtual routers (VRs) are created for each virtual system.

  In addition to confirming security policies, which three configuration details should the engineer focus on to ensure communication between virtual systems? {Choose three.)

  A. External zones with the virtual systems added.

  B. Layer 3 zones for the virtual systems that need to communicate.

  C. Add a route with next hop set to none, and use the interface of the virtual systems that need to communicate.

  D. Add a route with next hop next-vr by using the VR configured in the virtual system.

  E. Ensure the virtual systems are visible to one another.

  Correct Answer: ADE

  For virtual systems (vSys) on a Palo Alto Networks firewall to communicate with each other, especially when separate virtual routers (VRs) are used for each vSys, the configuration must facilitate proper routing and security policy enforcement. The key aspects to focus on include:

  A. External zones with the virtual systems added:

  External zones are special types of zones that are used to facilitate traffic flow between virtual systems within the same physical firewall. By adding virtual systems to an external zone, you enable them to communicate with each other,

  effectively bypassing the need for traffic to exit and re-enter the firewall.

  D. Add a route with next hop next-vr by using the VR configured in the virtual system:

  When using separate VRs for each vSys, it's essential to configure inter-VR routing. This is done by adding routes in each VR with the next hop set to 'next-vr', specifying the VR of the destination vSys. This setup enables traffic to be routed

  from one virtual system's VR to another, facilitating communication between them.

  E. Ensure the virtual systems are visible to one another:

  Visibility between virtual systems is a prerequisite for inter-vSys communication. This involves configuring the virtual systems in a way that they are aware of each other's existence. This is typically managed in the vSys settings, where you

  can specify which virtual systems can communicate with each other.

  By focusing on these configuration details, the network security engineer can ensure that the virtual systems can communicate effectively, maintaining the necessary isolation while allowing the required traffic flow.

• Question 179:

  A threat intelligence team has requested more than a dozen Short signatures to be deployed on all perimeter Palo Alto Networks firewalls. How does the firewall engineer fulfill this request with the least time to implement?

  A. Use Expedition to create custom vulnerability signatures, deploy them to Panorama using API and push them to the firewalls.

  B. Create custom vulnerability signatures manually on one firewall export them, and then import them to the rest of the firewalls

  C. Use Panorama IPs Signature Converter to create custom vulnerability signatures, and push them to the firewalls.

  D. Create custom vulnerability signatures manually in Panorama, and push them to the firewalls

  Correct Answer: C

• Question 180:

  Which interface type should a firewall administrator configure as an upstream to the ingress trusted interface when configuring transparent web proxy on a Palo Alto Networks firewall?

  A. Tunnel

  B. Ethernet

  C. VLAN

  D. Lookback

  Correct Answer: C