Palo Alto Networks Palo Alto Networks Certifications PCNSE Questions & Answers

• Question 221:

  A company has recently migrated their branch office's PA-220S to a centralized Panorama. This Panorama manages a number of PA-7000 Series and PA-5200 Series devices All device group and template configuration is managed solely within Panorama

  They notice that commit times have drastically increased for the PA-220S after the migration

  What can they do to reduce commit times?

  A. Disable "Share Unused Address and Service Objects with Devices" in Panorama Settings.

  B. Update the apps and threat version using device-deployment

  C. Perform a device group push using the "merge with device candidate config" option

  D. Use "export or push device config bundle" to ensure that the firewall is integrated with the Panorama config.

  Correct Answer: A

  According to the Palo Alto Networks documentation, disabling "Share Unused Address and Service Objects with Devices" in Panorama Settings is a possible solution to reduce commit times for firewalls managed by Panorama. This option prevents Panorama from pushing address and service objects that are not used in any policy rules to the firewalls, which can reduce the size of the configuration and improve the commit performance. Therefore, the correct answer is A. The other options are not relevant or effective for reducing commit times: Update the apps and threat version using device-deployment: This option would not help because it is not related to the commit process. Updating the apps and threat version using device-deployment is a feature that allows Panorama to distribute content updates to firewalls without requiring a commit. Perform a device group push using the "merge with device candidate config" option: This option would not help because it is not related to the commit performance. Performing a device group push using the "merge with device candidate config" option is a feature that allows Panorama to merge the local changes on a firewall with the Panorama configuration without overwriting them. Use "export or push device config bundle" to ensure that the firewall is integrated with the Panorama config: This option would not help because it is not related to the commit performance. Using "export or push device config bundle" is a feature that allows Panorama to export or push a complete configuration bundle to a firewall, which can be useful for troubleshooting or migrating configurations.

  References:

  1: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CleLCAS

  2: https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/firewall-administration/manage-firewalls/manage-content-updates-on-managed-firewalls/update-the-apps-and-threats-version-using-device-deployment

  3: https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/firewall-administration/manage-firewalls/manage-firewall-configurations/perform-a-device-group-push-using-the-merge-with-device-candidate-config-option

  4: https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/firewall-administration/manage-firewalls/manage-firewall-configurations/use-export-or-push-device-config-bundle-to-ensure-that-the-firewall-is-integrated-with-the-panoramaconfig

• Question 222:

  What can be used to create dynamic address groups?

  A. dynamic address

  B. region objects

  C. tags

  D. FODN addresses

  Correct Answer: C

• Question 223:

  You have upgraded your Panorama and Log Collectors lo 10.2 x. Before upgrading your firewalls using Panorama, what do you need do?

  A. Refresh your licenses with Palo Alto Network Support - Panorama/Licenses/Retrieve License Keys from License Server.

  B. Re-associate the firewalls in Panorama/Managed Devices/Summary.

  C. Commit and Push the configurations to the firewalls.

  D. Refresh the Mastor Key in Panorama/Master Key and Diagnostic

  Correct Answer: C

• Question 224:

  Your company occupies one floor in a single building. You have two Active Directory domain controllers on a single network. The firewall's management-plane resources are lightly utilized.

  Given the size of this environment, which User-ID collection method is sufficient?

  A. Citrix terminal server agent deployed on the network

  B. Windows-based agent deployed on each domain controller

  C. PAN-OS integrated agent deployed on the firewall

  D. a syslog listener

  Correct Answer: C

• Question 225:

  Information Security is enforcing group-based policies by using security-event monitoring on Windows User-ID agents for IP-to-User mapping in the network. During the rollout, Information Security identified a gap for users authenticating to their VPN and wireless networks.

  Root cause analysis showed that users were authenticating via RADIUS and that authentication events were not captured on the domain controllers that were being monitored Information Security found that authentication events existed on the Identity Management solution (IDM). There did not appear to be direct integration between PAN-OS and the IDM solution

  How can Information Security extract and learn iP-to-user mapping information from authentication events for VPN and wireless users?

  A. Add domain controllers that might be missing to perform security-event monitoring for VPN and wireless users.

  B. Configure the integrated User-ID agent on PAN-OS to accept Syslog messages over TLS.

  C. Configure the User-ID XML API on PAN-OS firewalls to pull the authentication events directly from the IDM solution

  D. Configure the Windows User-ID agents to monitor the VPN concentrators and wireless controllers for IP-to-User mapping.

  Correct Answer: B

• Question 226:

  A firewall administrator needs to be able to inspect inbound HTTPS traffic on servers hosted in their DMZ to prevent the hosted service from being exploited. Which combination of features can allow PAN-OS to detect exploit traffic in a session with TLS encapsulation?

  A. Decryption policy and a Data Filtering profile

  B. a WildFire profile and a File Blocking profile

  C. Vulnerability Protection profile and a Decryption policy

  D. a Vulnerability Protection profile and a QoS policy

  Correct Answer: C

• Question 227:

  Which Panorama mode should be used so that all logs are sent to, and only stored in Cortex Data Lake?

  A. Legacy

  B. Log Collector

  C. Panorama

  D. Management Only

  Correct Answer: D

• Question 228:

  Which three actions can Panorama perform when deploying PAN-OS images to its managed devices? (Choose three.)

  A. upload-only

  B. upload and install and reboot

  C. verify and install

  D. upload and install

  E. install and reboot

  Correct Answer: ABD

  In Panorama after you download the software you have the install button and then you are choosing devices.

  By default it is uploading and installing the software, but there is a check box if you want to upload the software only, and there is another check box if you want to reboot the device after installation.

• Question 229:

  Which statement best describes the Automated Commit Recovery feature?

  A. It performs a connectivity check between the firewall and Panorama after every configuration commit on the firewall. It reverts the configuration changes on the firewall if the check fails.

  B. It restores the running configuration on a firewall and Panorama if the last configuration commit fails.

  C. It performs a connectivity check between the firewall and Panorama after every configuration commit on the firewall. It reverts the configuration changes on the firewall and on Panorama if the check fails.

  D. It restores the running configuration on a firewall if the last configuration commit fails.

  Correct Answer: A

• Question 230:

  Which CLI command is used to determine how much disk space is allocated to logs?

  A. show logging-status

  B. show system info

  C. debug log-receiver show

  D. show system logdfo-quota

  Correct Answer: D