Palo Alto Networks PCNSE Online Practice Questions and Exam Preparation

Palo Alto Networks PCNSE Online Questions & Answers

• Question 191:

  In a firewall, which three decryption methods are valid? (Choose three )

  A. SSL Inbound Inspection
  B. SSL Outbound Proxyless Inspection
  C. SSL Inbound Proxy
  D. Decryption Mirror
  E. SSH Proxy
  A. SSL Inbound Inspection
  D. Decryption Mirror
  E. SSH Proxy

  ---

  Explanation

  You can also use Decryption Mirroring to forward decrypted traffic as plaintext to a third party solution for additional analysis and archiving.

  Ref: https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/decryption/decryption-overview.html#idd71f8b4d-cd40-4c6c-905f-2f8c7fca6537

• Question 192:

  An engineer is designing a deployment of multi-vsys firewalls.

  What must be taken into consideration when designing the device group structure?

  A. Multiple vsys and firewalls can be assigned to a device group, and a multi-vsys firewall must have all its vsys in a single device group.
  B. Only one vsys or one firewall can be assigned to a device group, except for a multi-vsys firewall, which must have all its vsys in a single device group.
  C. Multiple vsys and firewalls can be assigned to a device group, and a multi-vsys firewall can have each vsys in a different device group.
  D. Only one vsys or one firewall can be assigned to a device group, and a multi-vsys firewall can have each vsys in a different device group.
  C. Multiple vsys and firewalls can be assigned to a device group, and a multi-vsys firewall can have each vsys in a different device group.

  ---

  Explanation

  A device group is a logical grouping of firewalls that share the same security policy rules. A device group can contain multiple vsys and firewalls, including multi-vsys firewalls. A multi-vsys firewall can have each vsys in a different device group, depending on the desired security policy for each vsys. This allows for granular control and flexibility in managing multi-vsys firewalls with Panorama1.

  References: Device Group Push to a Multi-VSYS Firewall, Configure Virtual Systems, PCNSE Study Guide (page 50)

• Question 193:

  An engineer is creating a template and wants to use variables to standardize the configuration across a large number of devices. Which Mo variable types can be defined? (Choose two.)

  A. Path group
  B. Zone
  C. IP netmask
  D. FQDN
  C. IP netmask
  D. FQDN

  ---

  Explanation

• Question 194:

  When planning to configure SSL Froward Proxy on a PA 5260, a user asks how SSL decryption can be implemented using phased approach in alignment with Palo Alto Networks best practices.

  What should you recommend?

  A. Enable SSL decryption for known malicious source IP addresses
  B. Enable SSL decryption for source users and known malicious URL categories
  C. Enable SSL decryption for malicious source users
  D. Enable SSL decryption for known malicious destination IP addresses
  B. Enable SSL decryption for source users and known malicious URL categories

  ---

  Explanation

• Question 195:

  The same route appears in the routing table three times using three different protocols. Which mechanism determines how the firewall chooses which route to use?

  A. Administrative distance
  B. Round Robin load balancing
  C. Order in the routing table
  D. Metric
  A. Administrative distance

  ---

  Explanation

  Administrative distance is the measure of trustworthiness of a routing protocol. It is used to determine the best path when multiple routes to the same destination exist. The route with the lowest administrative distance is chosen as the best route.

• Question 196:

  When you configure an active/active high availability pair which two links can you use? (Choose two)

  A. HA2 backup
  B. HA3
  C. Console Backup
  D. HSCI-C
  A. HA2 backup
  B. HA3

  ---

  Explanation

• Question 197:

  An administrator is tasked to provide secure access to applications running on a server in the company's on-premises datacenter.

  What must the administrator consider as they prepare to configure the decryption policy?

  A. Ensure HA3 interfaces are configured in a HA pair environment to sync decrypted sessions.
  B. Obtain or generate the server certificate and private key from the datacenter server.
  C. Obtain or generate the self-signed certificate with private key in the firewall
  D. Obtain or generate the forward trust and forward untrust certificate from the datacenter server.
  B. Obtain or generate the server certificate and private key from the datacenter server.

  ---

  Explanation

• Question 198:

  A firewall has Security policies from three sources

  1.locally created policies

  2.shared device group policies as pre-rules

  3.the firewall's device group as post-rules

  How will the rule order populate once pushed to the firewall?

  A. shared device group policies, firewall device group policies. local policies.
  B. firewall device group policies, local policies. shared device group policies
  C. shared device group policies. local policies, firewall device group policies
  D. local policies, firewall device group policies, shared device group policies
  C. shared device group policies. local policies, firewall device group policies

  ---

  Explanation

• Question 199:

  After importing a pre-configured firewall configuration to Panorama, what step is required to ensure a commit/push is successful without duplicating local configurations?

  A. Ensure Force Template Values is checked when pushing configuration.
  B. Push the Template first, then push Device Group to the newly managed firewal.
  C. Perform the Export or push Device Config Bundle to the newly managed firewall.
  D. Push the Device Group first, then push Template to the newly managed firewall
  C. Perform the Export or push Device Config Bundle to the newly managed firewall.

  ---

  Explanation

  When importing a pre-configured firewall configuration to Panorama, you need to perform the following steps12: Add the serial number of the firewall under Panorama > Managed Devices In Panorama, import the firewall's configuration bundle under Panorama > Setup > Operations > Import device configuration to Panorama Make changes to the imported firewall configuration within Panorama Commit the changes you made to Panorama Perform an Export or push Device Config Bundle operation under Panorama > Setup > Operations The Export or push Device Config Bundle operation allows you to push a complete configuration bundle from Panorama to a managed firewall without duplicating local configurations3. This operation ensures that any local settings on the firewall are preserved and merged with the settings from Panorama.

• Question 200:

  A security engineer has configured a GlobalProtect portal agent with four gateways.

  Which GlobalProtect Gateway will users connect to based on the chart provided?

  

  A. East
  B. South
  C. West
  D. Central
  B. South

  ---

  Explanation