Palo Alto Networks PCNSE Online Practice Questions and Exam Preparation

Palo Alto Networks PCNSE Online Questions & Answers

• Question 301:

  An administrator Just enabled HA Heartbeat Backup on two devices However, the status on tie firewall's dashboard is showing as down High Availability.

  

  What could an administrator do to troubleshoot the issue?

  A. Goto Device > High Availability> General > HA Pair Settings > Setup and configuring the peer IP for heartbeat backup
  B. Check peer IP address In the permit list In Device > Setup > Management > Interfaces > Management Interface Settings
  C. Go to Device > High Availability > HA Communications> General> and check the Heartbeat Backup under Election Settings
  D. Check peer IP address for heartbeat backup to Device > High Availability > HA Communications > Packet Forwarding settings.
  B. Check peer IP address In the permit list In Device > Setup > Management > Interfaces > Management Interface Settings

  ---

  Explanation

  If the HA status is showing as down after enabling HA Heartbeat Backup on two devices, an administrator could troubleshoot the issue by checking the peer IP address in the permit list in Device > Setup > Management > Interfaces >

  Management Interface Settings. This is described in the Palo Alto Networks PCNSE Study Guide in Chapter 7:

  High Availability, under the section "Configure Heartbeat Backup for Redundancy":

  "Verify that the management interface's permitted IP addresses on each peer includes the IP address of the other peer's Heartbeat Backup interface."

• Question 302:

  Which CLI command displays the current management plan memory utilization?

  A. > show system info
  B. > show system resources
  C. > debug management-server show
  D. > show running resource-monitor
  B. > show system resources

  ---

  Explanation

  https://live.paloaltonetworks.com/t5/Management-Articles/Show-System-Resource-Command-Displays-CPU-Utilization-of-9999/ta-p/58149

• Question 303:

  Palo Alto Networks maintains a dynamic database of malicious domains.

  Which two Security Platform components use this database to prevent threats? (Choose two)

  A. Brute-force signatures
  B. BrightCloud Url Filtering
  C. PAN-DB URL Filtering
  D. DNS-based command-and-control signatures
  C. PAN-DB URL Filtering
  D. DNS-based command-and-control signatures

  ---

  Explanation

• Question 304:

  How are IPV6 DNS queries configured to user interface ethernet1/3?

  A. Network > Virtual Router > DNS Interface
  B. Objects > CustomerObjects > DNS
  C. Network > Interface Mgrnt
  D. Device > Setup > Services > Service Route Configuration
  D. Device > Setup > Services > Service Route Configuration

  ---

  Explanation

• Question 305:

  A network-security engineer attempted to configure a bootstrap package on Microsoft Azure, but the virtual machine provisioning process failed. In reviewing the bootstrap package, the engineer only had the following directories: /config, / license and /software.

  Why did the bootstrap process fail for the VM-Series firewall in Azure?

  A. All public cloud deployments require the /plugins folder to support proper firewall native integrations
  B. The /content folder is missing from the bootstrap package
  C. The VM-Series firewall was not pre-registered in Panorama and prevented the bootstrap process from successfully completing
  D. The /config or /software folders were missing mandatory files to successfully bootstrap
  B. The /content folder is missing from the bootstrap package

  ---

  Explanation

• Question 306:

  An engineer is configuring a template in Panorama which will contain settings that need to be applied to all firewalls in production. Which three parts of a template an engineer can configure? (Choose three.)

  A. NTP Server Address
  B. Antivirus Profile
  C. Authentication Profile
  D. Service Route Configuration
  E. Dynamic Address Groups
  A. NTP Server Address
  C. Authentication Profile
  D. Service Route Configuration

  ---

  Explanation

  NTP Server Address

  D. Service Route Configuration Short

  Explanation of Correct Answer Only: These parts of a template can be configured on Panorama. An antivirus profile and an authentication profile are not parts of a template, but parts

  of a device group.

  References:

  https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/manage-firewalls/manage-templates-and-template-stacks/templates-and-template-stacks-overview https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/

  manage-firewalls/manage-device-groups/device-group-overview

• Question 307:

  Which authentication source requires the installation of Palo Alto Networks software, other than PAN-OS 7x, to obtain a username-to-IP-address mapping?

  A. Microsoft Active Directory
  B. Microsoft Terminal Services
  C. Aerohive Wireless Access Point
  D. Palo Alto Networks Captive Portal
  B. Microsoft Terminal Services

  ---

  Explanation

• Question 308:

  An engineer decides to use Panorama to upgrade devices to PAN-OS 10.2. Which three platforms support PAN-OS 10 2? (Choose three.)

  A. PA-5000 Series
  B. PA-500
  C. PA-800 Series
  D. PA-220
  E. PA-3400 Series
  C. PA-800 Series
  D. PA-220
  E. PA-3400 Series

  ---

  Explanation

  According to the Palo Alto Networks Compatibility Matrix1, the three platforms that support PAN-OS 10.2 are: PA-800 Series2 PA-2202 PA-3400 Series2 The PA-5000 Series and PA-500 do not support PAN-OS 10.22. To upgrade devices to PAN-OS 10.2 using Panorama, you need to determine the upgrade path3, upgrade Panorama itself4, and then upgrade the firewalls using Panorama5.

• Question 309:

  DRAG DROP

  Below are the steps in the workflow for creating a Best Practice Assessment in a firewall and Panorama configuration Place the steps in order.

  Select and Place:

  

  

  Explanation

  Step 1. In either the NGFW or in Panorama, on the Operations/Support tab, download the technical support file.

  Step 2. Log in to the Customer Support Portal (CSP) and navigate to Tools > Best Practice Assessment.

  Step 3. Upload or drag and drop the technical support file.

  Step 4. Map the zone type and area of the architecture to each zone.

  Step 5.Follow the steps to download the BPA report bundle.

• Question 310:

  Which three options are supported in HA Lite? (Choose three.)

  A. Virtual link
  B. Active/passive deployment
  C. Synchronization of IPsec security associations
  D. Configuration synchronization
  E. Session synchronization
  B. Active/passive deployment
  C. Synchronization of IPsec security associations
  D. Configuration synchronization

  ---

  Explanation

  "The PA-200 firewall supports HA Lite only. HA Lite is an active/passive deployment that provides configuration synchronization and some runtime data synchronization such as IPSec security associations. It does not support any session synchronization (HA2), and therefore does not offer stateful failover."

  https://www.paloaltonetworks.com/documentation/80/pan-os/web-interface-help/device/device-high-availability/ha-lite