Palo Alto Networks PCNSE Online Practice Questions and Exam Preparation

Palo Alto Networks PCNSE Online Questions & Answers

• Question 451:

  An engineer configures a specific service route in an environment with multiple virtual systems instead of using the inherited global service route configuration.

  What type of service route can be used for this configuration?

  A. IPv6 Source or Destination Address
  B. Destination-Based Service Route
  C. IPv4 Source Interface
  D. Inherit Global Setting
  C. IPv4 Source Interface

  ---

  Explanation

  The IPv4 Source Interface service route allows the administrator to specify a source interface for a service based on the virtual system. This option overrides the inherited global service route configuration and provides more granular control over the service routes for each virtual system.

  References: https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/virtual-systems/customize-service-routes-for-a-virtual-system.html

• Question 452:

  An engineer reviews high availability (HA) settings to understand a recent HA failover event. Review the screenshot below.

  

  Which timer determines the frequency at which the HA peers exchange messages in the form of an ICMP (ping)

  A. Hello Interval
  B. Promotion Hold Time
  C. Heartbeat Interval
  D. Monitor Fail Hold Up Time
  A. Hello Interval

  ---

  Explanation

  The heartbeat interval determines the frequency at which the HA peers exchange messages in the form of an ICMP (ping). The default value is 1000 milliseconds (1 second). The heartbeat interval is used to detect failures and trigger fail over in an HA pair The other options are not correct. The hello interval determines the frequency at which the HA peers exchange messages in the form of an HA packet. The default value is 3000 milliseconds (3 seconds). The hello interval is used to establish and maintain HA connectivity The promotion hold time determines the amount of time that a passive firewall waits before it becomes active after detecting a failure on the active firewall. The default value is 5000 milliseconds (5 seconds) The monitor fail hold up time determines the amount of time that a firewall waits before it declares a monitor failure after detecting a link down event on an interface. The default value is 2000 milliseconds (2 seconds)

  References: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/high-availability/ha-concepts/ha-timers

• Question 453:

  The Aggregate Ethernet interface is showing down on a passive PA-7050 firewall of an active/passive HA pair. The HA Passive Link State is set to "Auto" under Device > High Availability > General > Active/Passive Settings. The AE interface is configured with LACP enabled and is up only on the active firewall.

  Why is the AE interface showing down on the passive firewall?

  A. It does not perform pre-negotiation LACP unless "Enable in HA Passive State" is selected under the High Availability Options on the LACP tab of the AE Interface.
  B. It does not participate in LACP negotiation unless Fast Failover is selected under the Enable LACP selection on the LACP tab of the AE Interface.
  C. It participates in LACP negotiation when Fast is selected for Transmission Rate under the Enable LACP selection on the LACP tab of the AE Interface.
  D. It performs pre-negotiation of LACP when the mode Passive is selected under the Enable LACP selection on the LACP tab of the AE Interface.
  A. It does not perform pre-negotiation LACP unless "Enable in HA Passive State" is selected under the High Availability Options on the LACP tab of the AE Interface.

  ---

  Explanation

• Question 454:

  An engineer wants to implement the Palo Alto Networks firewall in VWire mode on the internet gateway and wants to be sure of the functions that are supported on the vwire interface. What are three supported functions on the VWire interface? (Choose three )

  A. NAT
  B. QoS
  C. IPSec
  D. OSPF
  E. SSL Decryption
  A. NAT
  B. QoS
  E. SSL Decryption

  ---

  Explanation

  https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/networking/configure-interfaces/virtual-wire-interfaces

  "The virtual wire supports blocking or allowing traffic based on virtual LAN (VLAN) tags, in addition to supporting security policy rules, App-ID, Content-ID, User-ID, decryption, LLDP, active/passive and active/active HA, QoS, zone protection (with some exceptions), non-IP protocol protection, DoS protection, packet buffer protection, tunnel content inspection, and NAT."

• Question 455:

  Where can an administrator see both the management plane and data plane CPU utilization in the WebUI?

  A. System log
  B. CPU Utilization widget
  C. Resources widget
  D. System Utilization log
  C. Resources widget

  ---

  Explanation

  System Resources (widget)Displays the Management CPU usage, Data Plane usage, and the Session Count (the number of sessions established through the firewall or Panorama).https://docs.paloaltonetworks.com/pan-os/8-0/pan-os-webinterface-help/dashboard/dashboard-widgets#

• Question 456:

  Which Device Group option is assigned by default in Panorama whenever a new device group is created to manage a Firewall?

  A. Master
  B. Universal
  C. Shared
  D. Global
  C. Shared

  ---

  Explanation

• Question 457:

  The administrator for a small company has recently enabled decryption on their Palo Alto Networks firewall using a self-signed root certificate. They have also created a Forward Trust and Forward Untrust certificate and set them as such. The admin has not yet installed the root certificate onto client systems What effect would this have on decryption functionality?

  A. Decryption will function and there will be no effect to end users
  B. Decryption will not function because self-signed root certificates are not supported
  C. Decryption will not function until the certificate is installed on client systems
  D. Decryption will function but users will see certificate warnings for each SSL site they visit
  D. Decryption will function but users will see certificate warnings for each SSL site they visit

  ---

  Explanation

• Question 458:

  Which Palo Alto Networks tool provides configuration heat map displays for security controls?

  A. Expedition
  B. Security Life Cycle Review
  C. Prevention Posture Assessment
  D. Best Practice Assessment
  D. Best Practice Assessment

  ---

  Explanation

• Question 459:

  In a template, which two objects can be configured? (Choose two.)

  A. SD-WAN path quality profile
  B. Monitor profile
  C. IPsec tunnel
  D. Application group
  B. Monitor profile
  C. IPsec tunnel

  ---

  Explanation

  https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-web-interface-help/network/network-network-profiles/network-network-profiles-monitor.html

• Question 460:

  An administrator creates a custom application containing Layer 7 signatures. The latest application and threat dynamic update is downloaded to the same NGFW. The update contains an application that matches the same traffic signatures as the custom application.

  Which application should be used to identify traffic traversing the NGFW?

  A. Custom application
  B. System logs show an application error and neither signature is used.
  C. Downloaded application
  D. Custom and downloaded application signature files are merged and both are used
  C. Downloaded application

  ---

  Explanation