Palo Alto Networks Palo Alto Networks Certifications PCNSE Questions & Answers

• Question 301:

  An engineer is tasked with configuring a Zone Protection profile on the untrust zone.

  Which three settings can be configured on a Zone Protection profile? (Choose three.)

  A. Ethernet SGT Protection

  B. Protocol Protection

  C. DoS Protection

  D. Reconnaissance Protection

  E. Resource Protection

  Correct Answer: BCD

  B. Protocol Protection: is used to protect against known protocol vulnerabilities, such as buffer overflows and malformed packets. C. DoS Protection: is used to protect against denial-of-service (DoS) attacks, such as SYN floods and ICMP floods.

  D. Reconnaissance Protection: is used to protect against reconnaissance attacks, such as port scans and ping sweeps.

• Question 302:

  An engineer has discovered that certain real-time traffic is being treated as best effort due to it exceeding defined bandwidth Which QoS setting should the engineer adjust?

  A. QoS profile: Egress Max

  B. QoS interface: Egress Guaranteed

  C. QoS profile: Egress Guaranteed

  D. QoS interface: Egress Max

  Correct Answer: C

  When the egress guaranteed bandwidth is exceeded, the firewall passes traffic on a best-effort basis. https://docs.paloaltonetworks.com/pan-os/11-0/pan-os- admin/quality-of-service/qos-concepts/qos-bandwidth-management

• Question 303:

  How can an administrator use the Panorama device-deployment option to update the apps and threat version of an HA pair of managed firewalls?

  A. Configure the firewall's assigned template to download the content updates.

  B. Choose the download and install action for both members of the HA pair in the Schedule object.

  C. Switch context to the firewalls to start the download and install process.

  D. Download the apps to the primary; no further action is required.

  Correct Answer: B

  https://docs.paloaltonetworks.com/panorama/10-2/panorama- admin/manage-firewalls/use-case-configure-firewalls-using-panorama/set-up-your- centralized-configuration-and-policies/add-the-managed-firewalls-and-deploy- updates

• Question 304:

  An administrator is receiving complaints about application performance degradation. After checking the ACC. the administrator observes that there Is an excessive amount of SSL traffic.

  Which three elements should the administrator configure to address this issue? (Choose three.)

  A. QoS on the ingress Interface for the traffic flows

  B. An Application Override policy for the SSL traffic

  C. A QoS policy for each application ID

  D. A QoS profile defining traffic classes

  E. QoS on the egress interface for the traffic flows

  Correct Answer: CDE

• Question 305:

  Where can an administrator see both the management-plane and data-plane CPU utilization in the WebUI?

  A. System Resources widget

  B. System Logs widget

  C. Session Browser

  D. General Information widget

  Correct Answer: A

  The System Resources widget of the Exadata WebUI, displays a real-time overview of the various resources like CPU, Memory, and I/O usage across the entire Exadata Database Machine. It shows the usage of both management-plane and data-plane CPU utilization. System Resources Widget Displays the Management CPU usage, Data Plane usage, and the Session Count (the number of sessions established through the firewall or Panorama). https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-webinterface- help/dashboard/dashboard-widgets.html

• Question 306:

  What can an engineer use with GlobalProtect to distribute user-specific client certificates to each GlobalProtect user?

  A. Certificate profile

  B. SSL/TLS Service profile

  C. OCSP Responder

  D. SCEP

  Correct Answer: D

• Question 307:

  An administrator is configuring SSL decryption and needs 10 ensure that all certificates for both SSL Inbound inspection and SSL Forward Proxy are installed properly on the firewall. When certificates are being imported to the firewall for these purposes, which three certificates require a private key? (Choose three.)

  A. Forward Untrust certificate

  B. Forward Trust certificate

  C. Enterprise Root CA certificate

  D. End-entity (leaf) certificate

  E. Intermediate certificate(s)

  Correct Answer: ABD

• Question 308:

  An engineer configures SSL decryption in order to have more visibility to the internal users' traffic when it is regressing the firewall. Which three types of interfaces support SSL Forward Proxy? (Choose three.)

  A. High availability (HA)

  B. Layer 2

  C. Virtual Wire

  D. Tap

  E. Layer 3

  Correct Answer: BCE

  PAN-OS can decrypt and inspect SSL inbound and outbound connections going through the firewall. SSL decryption can occur on interfaces in virtual wire, Layer 2 or Layer 3 mode https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClmyCAC

• Question 309:

  A network administrator is trying to prevent domain username and password submissions to phishing sites on some allowed URL categories Which set of steps does the administrator need to take in the URL Filtering profile to prevent credential phishing on the firewall?

  A. Choose the URL categories on Site Access column and set action to block Click the User credential Detection tab and select IP User Mapping Commit

  B. Choose the URL categories in the User Credential Submission column and set action to block Select the User credential Detection tab and select use IP User Mapping Commit

  C. Choose the URL categories in the User Credential Submission column and set action to block Select the URL filtering settings and enable Domain Credential Filter Commit

  D. Choose the URL categories in the User Credential Submission column and set action to block Select the User credential Detection tab and select Use Domain Credential Filter Commit

  Correct Answer: D

  credential phishing prevention works by scanning username and password submissions to websites and comparing those submissions to known corporate credentials. You can configure solutions that detect and prevent credential phishing using URL filtering profiles and User-ID agents. https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/url-filtering/prevent-credential-phishing/set-up-credential-phishing-prevention

• Question 310:

  An administrator would like to determine which action the firewall will take for a specific CVE.

  Given the screenshot below, where should the administrator navigate to view this information?

  

  A. The profile rule action

  B. CVE column

  C. Exceptions tab

  D. The profile rule threat name

  Correct Answer: C

  The Exceptions settings allows you to change the response to a specific signature. For example, you can block all packets that match a signature, except for the selected one, which generates an alert. The Exception tab supports filtering

  functions.

  If you not believed, then login the firewall go to Vulnerability > Exceptions and select "Show all signatures". From there you will see all threat information including specific actions.

  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm4yCAC