Palo Alto Networks Palo Alto Networks Certifications PCNSE Questions & Answers

• Question 291:

  An engineer has been asked to limit which routes are shared by running two different areas within an OSPF implementation. However, the devices share a common link for communication. Which virtual router configuration supports running multiple instances of the OSPF protocol over a single link?

  A. ASBR

  B. ECMP

  C. OSPFv3

  D. OSPF

  Correct Answer: C

  Support for multiple instances per link--With OSPFv3, you can run multiple instances of the OSPF protocol over a single link. This is accomplished by assigning an OSPFv3 instance ID number. An interface that is assigned to an instance ID drops packets that contain a different ID. https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-networking-admin/ospf/ospf- concepts/ospfv3

• Question 292:

  The same route appears in the routing table three times using three different protocols. Which mechanism determines how the firewall chooses which route to use?

  A. Administrative distance

  B. Round Robin load balancing

  C. Order in the routing table

  D. Metric

  Correct Answer: A

  Administrative distance is the measure of trustworthiness of a routing protocol. It is used to determine the best path when multiple routes to the same destination exist. The route with the lowest administrative distance is chosen as the best route.

• Question 293:

  A company has configured a URL Filtering profile with override action on their firewall. Which two profiles are needed to complete the configuration? (Choose two)

  A. SSUTLS Service

  B. HTTP Server

  C. Decryption

  D. Interface Management

  Correct Answer: AD

  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRdCAK https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/url-filtering/configure-url-filtering https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/url-filtering/allow-password-access-to-certain-sites#id7e63ce07-8b30-4506-a1e3-5800303954e8

• Question 294:

  How can Panorama help with troubleshooting problems such as high CPU or resource exhaustion on a managed firewall?

  A. Firewalls send SNMP traps to Panorama when resource exhaustion is detected Panorama generates a system log and can send email alerts

  B. Panorama provides visibility into all the system and traffic logs received from firewalls it does not offer any ability to see or monitor resource utilization on managed firewalls

  C. Panorama monitors all firewalls using SNMP It generates a system log and can send email alerts when resource exhaustion is detected on a managed firewall

  D. Panorama provides information about system resources of the managed devices in the Managed Devices > Health menu

  Correct Answer: D

  https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-web-interface-help/panorama-web-interface/panorama-managed-devices-summary/panorama-managed-devices-health

• Question 295:

  During a laptop-replacement project, remote users must be able to establish a GlobalProtect VPN connection to the corporate network before logging in to their new Windows 10 endpoints.

  The new laptops have the 5.2.10 GlobalProtect Agent installed, so the administrator chooses to use the Connect Before Logon feature to solve this issue.

  What must be configured to enable the Connect Before Logon feature?

  A. The GlobalProtect Portal Agent App Settings Connect Method to Pre-logon then On- demand.

  B. Registry keys on the Windows system.

  C. X-Auth Support in the GlobalProtect Gateway Tunnel Settings.

  D. The Certificate profile in the GlobalProtect Portal Authentication Settings.

  Correct Answer: B

• Question 296:

  Which feature checks Panorama connectivity status after a commit?

  A. Automated commit recovery

  B. Scheduled config export

  C. Device monitoring data under Panorama settings

  D. HTTP Server profiles

  Correct Answer: A

• Question 297:

  Review the images. A firewall policy that permits web traffic includes the global-logs policy as depicted.

  

  

  What is the result of traffic that matches the "Alert - Threats" Profile Match List?

  A. The source address of SMTP traffic that matches a threat is automatically blocked as BadGuys for 180 minutes.

  B. The source address of traffic that matches a threat is automatically blocked as BadGuys for 180 minutes.

  C. The source address of traffic that matches a threat is automatically tagged as BadGuys for 180 minutes.

  D. The source address of SMTP traffic that matches a threat is automatically tagged as BadGuys for 180 minutes.

  Correct Answer: C

• Question 298:

  Exhibit.

  

  Given the screenshot, how did the firewall handle the traffic?

  A. Traffic was allowed by policy but denied by profile as encrypted.

  B. Traffic was allowed by policy but denied by profile as a threat.

  C. Traffic was allowed by profile but denied by policy as a threat.

  D. Traffic was allowed by policy but denied by profile as a nonstandard port.

  Correct Answer: B

• Question 299:

  A network administrator wants to deploy SSL Forward Proxy decryption. What two attributes should a forward trust certificate have? (Choose two.)

  A. A subject alternative name

  B. A private key

  C. A server certificate

  D. A certificate authority (CA) certificate

  Correct Answer: BD

  The two attributes that a forward trust certificate should have for SSL Forward Proxy decryption are:

  A private key. This is the key that the firewall uses to sign the certificates that it generates for the decrypted sessions. The private key must be securely stored on the firewall and not shared with anyone. A certificate authority (CA) certificate. This is the certificate that the firewall uses to issue the certificates for the decrypted sessions. The CA certificate must be trusted by the client browsers and devices that receive the certificates from the firewall.

• Question 300:

  A company is looking to increase redundancy in their network. Which interface type could help accomplish this?

  A. Layer 2

  B. Virtual wire

  C. Tap

  D. Aggregate ethernet

  Correct Answer: D

  An aggregate group increases the bandwidth between peers by load balancing traffic across the combined interfaces. It also provides redundancy https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-networking-admin/configure- interfaces/ configure-an-aggregate-interface-group#id9c0f5a8b-0aad-4be5-821d- ef9d7c11a88d