Palo Alto Networks Palo Alto Networks Certifications PCNSE Questions & Answers

• Question 371:

  A users traffic traversing a Palo Alto networks NGFW sometimes can reach http //www company com At other times the session times out. At other times the session times out The NGFW has been configured with a PBF rule that the user traffic matches when it goes to http://www.company.com

  goes to http://www company com

  How can the firewall be configured to automatically disable the PBF rule if the next hop goes down?

  A. Create and add a monitor profile with an action of fail over in the PBF rule in question

  B. Create and add a monitor profile with an action of wait recover in the PBF rule in question

  C. Configure path monitoring for the next hop gateway on the default route in the virtual router

  D. Enable and configure a link monitoring profile for the external interface of the firewall

  Correct Answer: A

• Question 372:

  Which three options are available when creating a security profile? (Choose three)

  A. Anti-Malware

  B. File Blocking

  C. Url Filtering

  D. IDS/ISP

  E. Threat Prevention

  F. Antivirus

  Correct Answer: ABF

• Question 373:

  A VPN connection is set up between Site-A and Site-B, but no traffic is passing in the system log of Site-A, there is an event logged as like-nego-p1-fail-psk.

  What action will bring the VPN up and allow traffic to start passing between the sites?

  A. Change the Site-B IKE Gateway profile version to match Site-A,

  B. Change the Site-A IKE Gateway profile exchange mode to aggressive mode.

  C. Enable NAT Traversal on the Site-A IKE Gateway profile.

  D. Change the pre-shared key of Site-B to match the pre-shared key of Site-A

  Correct Answer: D

• Question 374:

  A firewall administrator is troubleshooting problems with traffic passing through the Palo Alto Networks firewall. Which method shows the global counters associated with the traffic after configuring the appropriate packet filters?

  A. From the CLI, issue the show counter global filter pcap yes command.

  B. From the CLI, issue the show counter global filter packet-filter yes command.

  C. From the GUI, select show global counters under the monitor tab.

  D. From the CLI, issue the show counter interface command for the ingress interface.

  Correct Answer: B

• Question 375:

  How is the Forward Untrust Certificate used?

  A. It issues certificates encountered on the Untrust security zone when clients attempt to connect to a site that has be decrypted/

  B. It is used when web servers request a client certificate.

  C. It is presented to clients when the server they are connecting to is signed by a certificate authority that is not trusted by firewall.

  D. It is used for Captive Portal to identify unknown users.

  Correct Answer: C

• Question 376:

  Which Panorama feature allows for logs generated by Panorama to be forwarded to an external Security Information and Event Management(SIEM) system?

  A. Panorama Log Settings

  B. Panorama Log Templates

  C. Panorama Device Group Log Forwarding

  D. Collector Log Forwarding for Collector Groups

  Correct Answer: A

  https://www.paloaltonetworks.com/documentation/61/panorama/panorama_adminguide/ma nage-log-collection/enable-log-forwarding-from-panorama-to-external-destinations

• Question 377:

  Given the following table.

  

  Which configuration change on the firewall would cause it to use 10.66.24.88 as the next hop for the 192.168.93.0/30 network?

  A. Configuring the administrative Distance for RIP to be lower than that of OSPF Int.

  B. Configuring the metric for RIP to be higher than that of OSPF Int.

  C. Configuring the administrative Distance for RIP to be higher than that of OSPF Ext.

  D. Configuring the metric for RIP to be lower than that OSPF Ext.

  Correct Answer: A

• Question 378:

  An engineer needs to permit XML API access to a firewall for automation on a network segment that is routed through a Layer 3 subinterface on a Palo Alto Networks firewall. However this network segment cannot access the dedicated management interface due to the Security policy.

  Without changing the existing access to the management interface how can the engineer fulfill this request?

  A. Enable HTTPS in an Interface Management profile on the subinterface

  B. Add the network segment's IP range to the Permitted IP Addresses list

  C. Specify the subinterface as a management interface in Setup > Device > Interfaces

  D. Configure a service route for HTTP to use the subinterface

  Correct Answer: A

  To enable XML API access to a firewall for automation from a network segment routed through a Layer 3 sub-interface, the most straightforward approach is to use an Interface Management profile.

  This can be achieved by:

  Configuring an Interface Management profile and enabling HTTPS access on it. This profile defines management services that are permitted on the interface, including HTTPS, which is required for XML API access.

  Applying this Interface Management profile to the desired Layer 3 sub-interface. This action enables HTTPS access (and thus XML API access) on the sub-interface, allowing devices on the connected network segment to communicate with

  the firewall for automation purposes.

  This solution allows for the secure extension of management capabilities to network segments without direct access to the dedicated management interface, facilitating automation and operational efficiency without necessitating changes to

  existing access configurations.

• Question 379:

  Refer to Exhibit:

  

  A firewall has three PDF rules and a default route with a next hop of 172.29.19.1 that is configured in the default VR. A user named XX-bes a PC with a 192.168.101.10 IP address.

  He makes an HTTPS connection to 172.16.10.29.

  What is the next hop IP address for the HTTPS traffic from Wills PC.

  A. 172.20.30.1

  B. 172.20.20.1

  C. 172.20.10.1

  D. 172.20.40.1

  Correct Answer: B

• Question 380:

  Site-A and Site-B have a site-to-site VPN set up between them. OSPF is configured to dynamically create the routes between the sites. The OSPF configuration in Site-A is configured properly, but the route for the tunner is not being established. The Site-B interfaces in the graphic are using a broadcast Link Type. The administrator has determined that the OSPF configuration in Site-B is using the wrong Link Type for one of its interfaces.

  

  Which Link Type setting will correct the error?

  A. Set tunnel. 1 to p2p

  B. Set tunnel. 1 to p2mp

  C. Set Ethernet 1/1 to p2mp

  D. Set Ethernet 1/1 to p2p

  Correct Answer: A