Palo Alto Networks PCNSE Online Practice Questions and Exam Preparation

Palo Alto Networks PCNSE Online Questions & Answers

• Question 391:

  An organization wishes to roll out decryption but gets some resistance from engineering leadership regarding the guest network. What is a common obstacle for decrypting traffic from guest devices?

  A. Guest devices may not trust the CA certificate used for the forward untrust certificate.
  B. Guests may use operating systems that can't be decrypted.
  C. The organization has no legal authority to decrypt their traffic.
  D. Guest devices may not trust the CA certificate used for the forward trust certificate.
  D. Guest devices may not trust the CA certificate used for the forward trust certificate.

  ---

  Explanation

  https://live.paloaltonetworks.com/t5/general-topics/decrypt-guest-network-traffic/td-p/119388

• Question 392:

  An engineer wants to forward all decrypted traffic on a PA-850 firewall to a forensic tool with a decrypt mirror interface. Which statement is true regarding the configuration of the Decryption Port Mirroring feature?

  A. The engineer should install the Decryption Port Mirror license and reboot the firewall.
  B. The PA-850 firewall does not support decrypt mirror interface, so the engineer needs to upgrade the firewall to PA-3200 series.
  C. The engineer must assign an IP from the same subnet with the forensic tool to the decrypt mirror interface.
  D. The engineer must assign the related virtual-router to the decrypt mirror interface.
  A. The engineer should install the Decryption Port Mirror license and reboot the firewall.

  ---

  Explanation

  https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/decryption/configure-decryption-port-mirroring

• Question 393:

  Which sessions does Packet Buffer Protection apply to when used on ingress zones to protect against single-session DoS attacks?

  A. New sessions and is global
  B. New sessions and is not global
  C. Existing sessions and is not global
  D. Existing sessions and is global
  B. New sessions and is not global

  ---

  Explanation

  Packet Buffer Protection mitigates single-session DoS attacks by monitoring resource usage on ingress zones. It applies to new sessions only (to prevent resource exhaustion before escalation) and is not global--it's zone-specific, configured

  under Zone Protection profiles.

  PAN-OS 11.2 Administrator's Guide, "Zone Protection" section -Packet Buffer Protection.

• Question 394:

  A network security administrator has an environment with multiple forms of authentication. There is a network access control system in place that authenticates and restricts access for wireless users, multiple Windows domain controllers, and an MDM solution for company-provided smartphones. All of these devices have their authentication events logged.

  Given the information, what is the best choice for deploying User-ID to ensure maximum coverage?

  A. Syslog listener
  B. agentless User-ID with redistribution
  C. standalone User-ID agent
  D. captive portal
  A. Syslog listener

  ---

  Explanation

  "To obtain user mappings from existing network services that authenticate users-such as wireless controllers, 802.1x devices, Apple Open Directory servers, proxy servers, or other Network Access Control (NAC) mechanisms-Configure User-ID to Monitor Syslog Senders for User Mapping."

  https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/user-id/map-ip-addresses-to-users

• Question 395:

  An administrator is troubleshooting why video traffic is not being properly classified. If this traffic does not match any QoS classes, what default class is assigned?

  A. 1
  B. 2
  C. 3
  D. 4
  D. 4

  ---

  Explanation

  The default class that is assigned to traffic that does not match any QoS classes is class 4. Class 4 is the default class for any session not matched to a QoS policy. QoS policy, like security policy, is processed top to bottom and the first policy match will be applied. If no policy match is found, the traffic is assigned to class 412. Option A is incorrect because class 1 is not the default class for unmatched traffic. Class 1 is a user-defined class that can be used to assign traffic based on QoS policy criteria. Option B is incorrect because class 2 is not the default class for unmatched traffic. Class 2 is a user-defined class that can be used to assign traffic based on QoS policy criteria. Option C is incorrect because class 3 is not the default class for unmatched traffic. Class 3 is a user-defined class that can be used to assign traffic based on QoS policy criteria.

• Question 396:

  Which configuration task is best for reducing load on the management plane?

  A. Disable logging on the default deny rule
  B. Enable session logging at start
  C. Disable pre-defined reports
  D. Set the URL filtering action to send alerts
  C. Disable pre-defined reports

  ---

  Explanation

• Question 397:

  A company is expanding its existing log storage and alerting solutions All company Palo Alto Networks firewalls currently forward logs to Panorama.

  Which two additional log forwarding methods will PAN-OS support? (Choose two)

  A. SSL
  B. TLS
  C. HTTP
  D. Email
  C. HTTP
  D. Email

  ---

  Explanation

• Question 398:

  Which translated port number should be used when configuring a NAT rule for a transparent proxy?

  B. 443

  C. 8080

  D. 4443

  Correct Answer. C
  C

  ---

  Explanation

  A transparent proxy operates by intercepting traffic without client configuration, typically redirecting HTTP (port 80) or HTTPS (port 443) to a proxy port on the firewall. In Palo Alto Networks NGFWs, when configuring a NAT rule for a transparent proxy, the standard translated port is 8080 (Option C), commonly used for proxy services. This port is where the firewall redirects client traffic for processing (e.g., URL filtering or decryption) before forwarding it to the destination.

  PAN-OS 11.2 Administrator's Guide, "NAT" section -Transparent Proxy Configuration; Palo Alto Networks Tech Docs -Transparent Proxy Deployment.

• Question 399:

  An enterprise network security team is deploying VM-Series firewalls in a multi-cloud environment. Some firewalls are deployed in VMware NSX-V, while others are in AWS, and all are centrally managed using Panorama with the appropriate plugins installed. The team wants to streamline policy management by organizing the firewalls into device groups in which the AWS-based firewalls act as a parent device group, while the NSX-V firewalls are configured as a child device group to inherit Security policies. However, after configuring the device group hierarchy and attempting to push configurations, the team receives errors, and policy inheritance is not functioning as expected. What is the most likely cause of this issue?

  A. Panorama must use the same plugin version numbers for both AWS and NSX-V environments before device group inheritance can function properly
  B. Panorama requires the objects to be overridden in the child device group before firewalls in different hypervisors can inherit Security policies
  C. Panorama by default does not allow different hypervisors in parent/child device groups, but this can be overridden with the command "set device-group allow-multi-hypervisor enable"
  D. Panorama does not support policy inheritance across device groups containing firewalls deployed in different hypervisors when using multiple plugins
  D. Panorama does not support policy inheritance across device groups containing firewalls deployed in different hypervisors when using multiple plugins

  ---

  Explanation

  Panorama's device group hierarchy supports policy inheritance, but it does not support inheritance across groups with firewalls on different hypervisors (e.g., AWS and NSX-V) when managed by multiple plugins (Option D). AWS and NSX-V

  firewalls use distinct plugins (e.g., AWS Plugin, NSX Plugin), and Panorama restricts cross-hypervisor inheritance due to differing configurations and contexts, causing errors when pushing policies.

  Panorama Administrator's Guide, PAN-OS 11.2, "Device Groups" section -Multi-Hypervisor Limitations.

• Question 400:

  Which two scripting file types require direct upload to the Advanced WildFire portal/API for analysis? (Choose two.)

  A. Ps1
  B. Perl
  C. Python
  D. VBS
  B. Perl
  D. VBS

  ---

  Explanation