Palo Alto Networks Palo Alto Networks Certifications PCNSE Questions & Answers

• Question 421:

  Which two events trigger the operation of automatic commit recovery? (Choose two.)

  A. when an aggregate Ethernet interface component fails

  B. when Panorama pushes a configuration

  C. when a firewall HA pair fails over

  D. when a firewall performs a local commit

  Correct Answer: BD

  https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-new- features/panorama-features/automatic-panorama-connection-recovery.html

  Automatic commit recovery allows you to configure the firewall to attempt a specified number of connectivity tests after:

  1- you push a configuration from Panorama or

  2- commit a configuration change locally on the firewall.

  Additionally, the firewall checks connectivity to Panorama every hour to ensure consistent communication in the event unrelated network configuration changes have disrupted connectivity between the firewall and Panorama or if implications to a pushed committed configuration may have affected connectivity.

• Question 422:

  Which CLI command displays the current management plane memory utilization?

  A. > debug management-server show

  B. > show running resource-monitor

  C. > show system info

  D. > show system resources

  Correct Answer: B

• Question 423:

  When is it necessary to activate a license when provisioning a new Palo Alto Networks firewall?

  A. When configuring Certificate Profiles

  B. When configuring GlobalProtect portal

  C. When configuring User Activity Reports

  D. When configuring Antivirus Dynamic Updates

  Correct Answer: D

• Question 424:

  Which two virtualized environments support Active/Active High Availability (HA) in PAN-OS 8.0? (Choose two.)

  A. KVM

  B. VMware ESX

  C. VMware NSX

  D. AWS

  Correct Answer: AB

• Question 425:

  How are IPV6 DNS queries configured to user interface ethernet1/3?

  A. Network > Virtual Router > DNS Interface

  B. Objects > CustomerObjects > DNS

  C. Network > Interface Mgrnt

  D. Device > Setup > Services > Service Route Configuration

  Correct Answer: D

• Question 426:

  Which Public Key infrastructure component is used to authenticate users for GlobalProtect when the Connect Method is set to pre-logon?

  A. Certificate revocation list

  B. Trusted root certificate

  C. Machine certificate

  D. Online Certificate Status Protocol

  Correct Answer: C

• Question 427:

  The IT department has received complaints abou VoIP call jitter when the sales staff is making or receiving calls. QoS is enabled on all firewall interfaces, but there is no QoS policy written in the rulebase. The IT manager wants to find out what traffic is causing the jitter in real time when a user reports the jitter.

  Which feature can be used to identify, in real time, the applications taking up the most bandwidth?

  A. QoS Statistics

  B. Applications Report

  C. Application Command Center (ACC)

  D. QoS Log

  Correct Answer: A

• Question 428:

  A company has a web server behind a Palo Alto Networks next-generation firewall that it wants to make accessible to the public at 1.1.1.1. The company has decided to configure a destination NAT Policy rule.

  Given the following zone information:

  DMZ zone: DMZ-L3 Public zone: Untrust-L3 Guest zone: Guest-L3 Web server zone: Trust-L3 Public IP address (Untrust-L3): 1.1.1.1 Private IP address (Trust-L3): 192.168.1.50

  What should be configured as the destination zone on the Original Packet tab of NAT Policy rule?

  A. Untrust-L3

  B. DMZ-L3

  C. Guest-L3

  D. Trust-L3

  Correct Answer: A

• Question 429:

  A network Administrator needs to view the default action for a specific spyware signature. The administrator follows the tabs and menus through Objects> Security Profiles> Anti- Spyware and select default profile.

  What should be done next?

  A. Click the simple-critical rule and then click the Action drop-down list.

  B. Click the Exceptions tab and then click show all signatures.

  C. View the default actions displayed in the Action column.

  D. Click the Rules tab and then look for rules with "default" in the Action column.

  Correct Answer: B

• Question 430:

  A network security engineer has been asked to analyze Wildfire activity. However, the Wildfire Submissions item is not visible form the Monitor tab.

  What could cause this condition?

  A. The firewall does not have an active WildFire subscription.

  B. The engineer's account does not have permission to view WildFire Submissions.

  C. A policy is blocking WildFire Submission traffic.

  D. Though WildFire is working, there are currently no WildFire Submissions log entries.

  Correct Answer: B