Palo Alto Networks Palo Alto Networks Certifications PCNSE Questions & Answers

• Question 451:

  Which Security Policy Rule configuration option disables antivirus and anti-spyware scanning of server-to-client flows only?

  A. Disable Server Response Inspection

  B. Apply an Application Override

  C. Disable HIP Profile

  D. Add server IP Security Policy exception

  Correct Answer: A

• Question 452:

  Which two statements are correct for the out-of-box configuration for Palo Alto Networks NGFWs? (Choose two)

  A. The devices are pre-configured with a virtual wire pair out the first two interfaces.

  B. The devices are licensed and ready for deployment.

  C. The management interface has an IP address of 192.168.1.1 and allows SSH and HTTPS connections.

  D. A default bidirectional rule is configured that allows Untrust zone traffic to go to the Trust zone.

  E. The interface are pingable.

  Correct Answer: BC

• Question 453:

  A company has a policy that denies all applications it classifies as bad and permits only application it classifies as good. The firewall administrator created the following security policy on the company's firewall.

  

  Which two benefits are gained from having both rule 2 and rule 3 presents? (choose two)

  A. A report can be created that identifies unclassified traffic on the network.

  B. Different security profiles can be applied to traffic matching rules 2 and 3.

  C. Rule 2 and 3 apply to traffic on different ports.

  D. Separate Log Forwarding profiles can be applied to rules 2 and 3.

  Correct Answer: BD

• Question 454:

  Which two mechanisms help prevent a spilt brain scenario an Active/Passive High Availability (HA) pair? (Choose two)

  A. Configure the management interface as HA3 Backup

  B. Configure Ethernet 1/1 as HA1 Backup

  C. Configure Ethernet 1/1 as HA2 Backup

  D. Configure the management interface as HA2 Backup

  E. Configure the management interface as HA1 Backup

  F. Configure ethernet1/1 as HA3 Backup

  Correct Answer: BE

• Question 455:

  An administrator has left a firewall to use the data of port for all management service which there functions are performed by the data face? (Choose three.)

  A. NTP

  B. Antivirus

  C. Wildfire updates

  D. NAT

  E. File tracking

  Correct Answer: ACD

• Question 456:

  Which setting allow a DOS protection profile to limit the maximum concurrent sessions from a source IP address?

  A. Set the type to Aggregate, clear the session's box and set the Maximum concurrent Sessions to 4000.

  B. Set the type to Classified, clear the session's box and set the Maximum concurrent Sessions to 4000.

  C. Set the type Classified, check the Sessions box and set the Maximum concurrent Sessions to 4000.

  D. Set the type to aggregate, check the Sessions box and set the Maximum concurrent Sessions to 4000.

  Correct Answer: C

• Question 457:

  How can a Palo Alto Networks firewall be configured to send syslog messages in a format compatible with non-standard syslog servers?

  A. Enable support for non-standard syslog messages under device management

  B. Check the custom-format check box in the syslog server profile

  C. Select a non-standard syslog server profile

  D. Create a custom log format under the syslog server profile

  Correct Answer: D

• Question 458:

  A network administrator uses Panorama to push security polices to managed firewalls at branch offices. Which policy type should be configured on Panorama if the administrators at the branch office sites to override these products?

  A. Pre Rules

  B. Post Rules

  C. Explicit Rules

  D. Implicit Rules

  Correct Answer: A

• Question 459:

  A network design calls for a "router on a stick" implementation with a PA-5060 performing inter-VLAN routing All VLAN-tagged traffic will be forwarded to the PA-5060 through a single dot1q trunk interface.

  Which interface type and configuration setting will support this design?

  A. Trunk interface type with specified tag

  B. Layer 3 interface type with specified tag

  C. Layer 2 interface type with a VLAN assigned

  D. Layer 3 subinterface type with specified tag

  Correct Answer: D

• Question 460:

  An Administrator is configuring an IPSec VPN toa Cisco ASA at the administrator's home and experiencing issues completing the connection. The following is th output from the command:

  less mp-log ikemgr.log:

  

  What could be the cause of this problem?

  A. The public IP addresse do not match for both the Palo Alto Networks Firewall and the ASA.

  B. The Proxy IDs on the Palo Alto Networks Firewall do not match the settings on the ASA.

  C. The shared secerts do not match between the Palo Alto firewall and the ASA

  D. The deed peer detection settings do not match between the Palo Alto Networks Firewall and the ASA

  Correct Answer: B