Palo Alto Networks Palo Alto Networks Certifications PCNSE Questions & Answers

• Question 491:

  Which option describes the operation of the automatic commit recovery feature?

  A. It enables a firewall to revert to the previous configuration if rule shadowing is detected

  B. It enables a firewall to revert to the previous configuration if a commit causes Panorama connectivity failure.

  C. It enables a firewall to revert to the previous configuration if application dependency errors are found

  D. It enables a firewall to revert to the previous configuration if a commit causes HA partner connectivity failure

  Correct Answer: B

  PAN-OS 10.0 https://docs.paloaltonetworks.com/panorama/10-0/panorama-admin/administer- panorama/enable-automated-commit-recovery.html

  https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-new-features/panorama- features/automatic-panorama-connection-recovery

• Question 492:

  Which option is part of the content inspection process?

  A. Packet forwarding process

  B. SSL Proxy re-encrypt

  C. IPsec tunnel encryption

  D. Packet egress process

  Correct Answer: B

  http://live.paloaltonetworks.com//t5/image/serverpage/image- id/12862i950F549C7D4E6309

• Question 493:

  Which two are valid ACC GlobalProtect Activity tab widgets? (Choose two)

  A. Successful GlobalProtect Connection Activity

  B. Successful GlobalProtect Deployed Activity

  C. GlobalProtect Quarantine Activity

  D. GlobalProtect Deployment Activity

  Correct Answer: CD

  https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-new-features/globalprotect-features/enhanced-logging-for-globalprotect.html The ACC displays a graphical view of user activity in your GlobalProtect deployment on the GlobalProtect Activity tab. The following charts are available: *Successful GlobalProtect Connection Activity *Unsuccessful GlobalProtect Connection Activity *GlobalProtect Deployment Activity

• Question 494:

  What are the differences between using a service versus using an application for Security Policy match?

  A. Use of a "service" enables the firewall to take action after enough packets allow for App- ID identification

  B. Use of a "service" enables the firewall to take immediate action with the first observed packet based on port numbers Use of an "application" allows the firewall to take action after enough packets allow for App-ID identification regardless of the ports being used.

  C. There are no differences between "service" or "application" Use of an "application" simplifies configuration by allowing use of a friendly application name instead of port numbers.

  D. Use of a "service" enables the firewall to take immediate action with the first observed packet based on port numbers. Use of an "application" allows the firewall to take immediate action it the port being used is a member of the application standard port list

  Correct Answer: B

  https://live.paloaltonetworks.com/t5/blogs/what-are-applications-and- services/ba-p/342508# A service on the Palo Alto Networks firewall is a TCP or UDP portes which port is open or closed and does not look beyond Layer 4. An application it

  goes into Layer 7 inspection to ascertain which application is active in a data flow and will enforce "normal" behavior onto it, DNS Query

  https://live.paloaltonetworks.com/t5/blogs/what-are-applications-and-services/ba- p/342508#

  Concept 1

  A service on the Palo Alto Networks firewall is a TCP or UDP port, as it would be defined on a traditional firewall or access list. It simply defines which port is open or closed and does not look beyond Layer 4.

  Concept 2

  An application is what makes the Palo Alto Networks next-generation firewall so powerful; it goes into Layer 7 inspection to ascertain which application is active in a data flow and will enforce "normal" behavior onto it (e.g., a session identified

  as DNS that suddenly sends an SQL query is abnormal and will be blocked).

• Question 495:

  A client has a sensitive application server in their data center and is particularly concerned about resource exhaustion because of distributed denial-of-service attacks. How can the Palo Alto Networks NGFW be configured to specifically protect this server against resource exhaustion originating from multiple IP addresses (DDoS attack)?

  A. Define a custom App-ID to ensure that only legitimate application traffic reaches the server.

  B. Add a Vulnerability Protection Profile to block the attack.

  C. Add QoS Profiles to throttle incoming requests.

  D. Add a DoS Protection Profile with defined session count.

  Correct Answer: D

  Reference: https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/zone-protection- and-dos-protection/zone-defense/dos-protection-profiles-and-policy-rules/dos-protection- profiles.html

• Question 496:

  A web server is hosted in the DMZ, and the server is configured to listen for incoming connections only on TCP port 8080. A Security policy rule allowing access from the Trust zone to the DMZ zone need to be configured to enable we browsing access to the server.

  Which application and service need to be configured to allow only cleartext web-browsing traffic to thins server on tcp/8080.

  A. application: web-browsing; service: application-default

  B. application: web-browsing; service: service-https

  C. application: ssl; service: any

  D. application: web-browsing; service: (custom with destination TCP port 8080)

  Correct Answer: D

  If you check in the FW the default port for web-browsing is TCP 80, so you will need a custom app. admin@PA-LAB-01# show predefined application web-browsing web-browsing { category general-internet; subcategory internet-utility; technology browser- based; analysis 'Web browsing continues to evolve. Initially used to simply view HTML formatted information, web browsers have become the client, through which, users can access new applications that provide functionality far beyond simple information browsing. These applications include web mail, instant messaging, streaming media, web conferencing, blogs, file sharing and other social networkingapplications. Much of the plain web-browsing activities has effectively been overshadowed by all the other applications. } default { port tcp/80; } tunnel-applications http-proxy; risk 4; } [edit]

• Question 497:

  An administrator is defining protection settings on the Palo Alto Networks NGFW to guard against resource exhaustion. When platform utilization is considered, which steps must the administrator take to configure and apply packet buffer protection?

  A. Enable and configure the Packet Buffer protection thresholds.Enable Packet Buffer Protection per ingress zone.

  B. Enable and then configure Packet Buffer thresholdsEnable Interface Buffer protection.

  C. Create and Apply Zone Protection Profiles in all ingress zones.Enable Packet Buffer Protection per ingress zone.

  D. Configure and apply Zone Protection Profiles for all egress zones.Enable Packet Buffer Protection pre egress zone.

  E. Enable per-vsys Session Threshold alerts and triggers for Packet Buffer Limits.Enable Zone Buffer Protection per zone.

  Correct Answer: A

• Question 498:

  Which CLI command is used to simulate traffic going through the firewall and determine which Security policy rule, NAT translation, static route, or PBF rule will be triggered by the traffic?

  A. check

  B. find

  C. test

  D. sim

  Correct Answer: C

  Reference: http://www.shanekillen.com/2014/02/palo-alto-useful-cli-commands.html

  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClQSCA0

• Question 499:

  Which option enables a Palo Alto Networks NGFW administrator to schedule Application and Threat updates while applying only new content-IDs to traffic?

  A. Select download-and-install.

  B. Select download-and-install, with "Disable new apps in content update" selected.

  C. Select download-only.

  D. Select disable application updates and select "Install only Threat updates"

  Correct Answer: B

  On the Device Dynamic Updates page, select Schedule . Choose to Disable new apps in content update for downloads and installations of content releases. https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/app-id/manage-newapp-ids-introduced-in-content-releases/disable-or-enable-app-ids

• Question 500:

  Starling with PAN-OS version 9.1, GlobalProtect logging information is now recorded in which firewall log?

  A. Configuration

  B. GlobalProtect

  C. Authentication

  D. System

  Correct Answer: B