Palo Alto Networks Palo Alto Networks Certifications PCNSE Questions & Answers

• Question 351:

  An engineer needs to redistribute User-ID mappings from multiple data centers. Which data flow best describes redistribution of user mappings?

  A. Domain Controller to User-ID agent

  B. User-ID agent to Panorama

  C. User-ID agent to firewall

  D. firewall to firewall

  Correct Answer: D

• Question 352:

  A network administrator troubleshoots a VPN issue and suspects an IKE Crypto mismatch between peers. Where can the administrator find the corresponding logs after running a test command to initiate the VPN?

  A. Configuration logs

  B. System logs

  C. Traffic logs

  D. Tunnel Inspection logs

  Correct Answer: B

• Question 353:

  A network administrator plans a Prisma Access deployment with three service connections, each with a BGP peering to a CPE. The administrator needs to minimize the BGP configuration and management overhead on on-prem network devices.

  What should the administrator implement?

  A. target service connection for traffic steering

  B. summarized BGP routes before advertising

  C. hot potato routing

  D. default routing

  Correct Answer: D

  Default routing-This is the default routing model that Prisma Access uses.

  Use this routing mode if you want Prisma Access to use BGP best path-selection mechanisms without adjusting any of the BGP attributes. In this mode, Prisma Access will honor any attribute advertised by the customer premises equipment

  (CPE).

  https://docs.paloaltonetworks.com/prisma/prisma-access/prisma-access-panorama-admin/prisma-access-advanced-deployments/service-connection-advanced-deployments/route-preferences-for-service-connection-traffic

• Question 354:

  A firewall has been assigned to a new template stack that contains both "Global" and "Local" templates in Panorama, and a successful commit and push has been performed. While validating the configuration on the local firewall, the engineer

  discovers that some settings are not being applied as intended.

  The setting values from the "Global" template are applied to the firewall instead of the "Local" template that has different values for the same settings.

  What should be done to ensure that the settings in the "Local" template are applied while maintaining settings from both templates?

  A. Move the "Global" template above the "Local" template in the template stack.

  B. Perform a commit and push with the "Force Template Values" option selected.

  C. Move the "Local" template above the "Global" template in the template stack.

  D. Override the values on the local firewall and apply the correct settings for each value.

  Correct Answer: C

• Question 355:

  A network security engineer is attempting to peer a virtual router on a PAN-OS firewall with an external router using the BGP protocol. The peer relationship is not establishing. What command could the engineer run to see the current state of the BGP state between the two devices?

  A. show routing protocol bgp state

  B. show routing protocol bgp peer

  C. show routing protocol bgp summary

  D. show routing protocol bgp rib-out

  Correct Answer: B

  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000CpwaCACandlang=en_US%E2%80%A9

• Question 356:

  An administrator wants to enable WildFire inline machine learning. Which three file types does WildFire inline ML analyze? (Choose three.)

  A. MS Office

  B. ELF

  C. APK

  D. VBscripts

  E. Powershell scripts

  Correct Answer: ABE

• Question 357:

  A firewall administrator is trying to identify active routes learned via BGP in the virtual router runtime stats within the GUI. Where can they find this information?

  A. routes listed in the routing table with flags

  B. routes listed in the routing table with flags AB

  C. under the BGP Summary tab

  D. routes listed in the forwarding table with BGP in the Protocol column

  Correct Answer: B

  Flags AB--Active and learned via BGP A C--Active and a result of an internal interface (connected) -Destination = network A H--Active and a result of an internal interface (connected) -Destination = Host only A R--Active and learned via RIP A S--Active and static S--Inactive (because this route has a higher metric) and static O1--OSPF external type-1 O2--OSPF external type-2 Oi--OSPF intra-area Oo--OSPF inter-area

• Question 358:

  A network administrator configured a site-to-site VPN tunnel where the peer device will act as initiator None of the peer addresses are known. What can the administrator configure to establish the VPN connection1?

  A. Set up certificate authentication

  B. Enable Passive Mode

  C. Use the Dynamic IP address type

  D. Configure the peer address as an FQDN

  Correct Answer: C

  When the peer device will act as the initiator and none of the peer addresses are known, the administrator can enable Passive Mode to establish the VPN connection. Passive Mode tells the firewall to wait for the peer device to initiate the VPN connection. The other options are incorrect. Option A, setting up certificate authentication, would require the administrator to know the peer device's certificate. Option C, using the Dynamic IP address type, would require the administrator to know the peer device's dynamic IP address. Option D, configuring the peer address as an FQDN, would require the administrator to know the peer device's fully qualified domain name.

  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClIGCA0

• Question 359:

  An organization wishes to roll out decryption but gets some resistance from engineering leadership regarding the guest network. What is a common obstacle for decrypting traffic from guest devices?

  A. Guest devices may not trust the CA certificate used for the forward untrust certificate.

  B. Guests may use operating systems that can't be decrypted.

  C. The organization has no legal authority to decrypt their traffic.

  D. Guest devices may not trust the CA certificate used for the forward trust certificate.

  Correct Answer: D

  https://live.paloaltonetworks.com/t5/general-topics/decrypt-guest-network-traffic/td-p/119388

• Question 360:

  Which function is handled by the management plane (control plane) of a Palo Alto Networks firewall?

  A. signature matching for content inspection

  B. IPSec tunnel standup

  C. Quality of Service

  D. logging

  Correct Answer: D