Palo Alto Networks PCNSE Online Practice Questions and Exam Preparation

Palo Alto Networks PCNSE Online Questions & Answers

• Question 531:

  A security engineer wants to upgrade the company's deployed firewalls from PAN-OS 10.1 to 11.0.x to take advantage of the newTLSv1.3 support for management access.

  What is the recommended upgrade path procedure from PAN-OS 10.1 to 11.0.x?

  A. Required: Download and install the latest preferred PAN-OS 10.1 maintenance release and reboot. Required: Download PAN-OS 10.2.0. Optional: Install the latest preferred PAN-OS 10.2 maintenance release. Required: Download PAN-OS 11.0.0. Required: Download and install the desired PAN-OS 11.0.x.
  B. Optional: Download and install the latest preferred PAN-OS 10.1 release. Optional: Install the latest preferred PAN-OS 10.2 maintenance release. Required: Download PAN-OS 11.0.0. Required: Download and install the desired PAN-OS 11.0.x.
  C. Required: Download PAN-OS 10.2.0 or earlier release that is not EOL. Required: Download and install the latest preferred PAN-OS 10.2 maintenance release and reboot. Required: Download PAN-OS 11.0.0. Required: Download and install the desired PAN-OS 11.0.x.
  D. Required: Download and install the latest preferred PAN-OS 10.1 maintenance release and reboot. Required: Download PAN-OS 10.2.0. Required: Download and install the latest preferred PAN-OS 10.2 maintenance release and reboot. Required: Download PAN-OS 11.0.0. Required: Download and install the desired PAN-OS 11.0.x.
  B. Optional: Download and install the latest preferred PAN-OS 10.1 release. Optional: Install the latest preferred PAN-OS 10.2 maintenance release. Required: Download PAN-OS 11.0.0. Required: Download and install the desired PAN-OS 11.0.x.

  ---

  Explanation

• Question 532:

  How can a Palo Alto Networks firewall be configured to send syslog messages in a format compatible with non-standard syslog servers?

  A. Enable support for non-standard syslog messages under device management
  B. Check the custom-format check box in the syslog server profile
  C. Select a non-standard syslog server profile
  D. Create a custom log format under the syslog server profile
  D. Create a custom log format under the syslog server profile

  ---

  Explanation

• Question 533:

  In the New App Viewer under Policy Optimizer, what does the compare option for a specific rule allow an administrator to compare?

  A. The running configuration with the candidate configuration of the firewall
  B. Applications configured in the rule with their dependencies
  C. Applications configured in the rule with applications seen from traffic matching the same rule
  D. The security rule with any other security rule selected
  C. Applications configured in the rule with applications seen from traffic matching the same rule

  ---

  Explanation

  The compare option for a specific rule in the New App Viewer under Policy Optimizer allows an administrator to compare the applications configured in the rule with the applications seen from traffic matching the same rule. This option helps the administrator to identify any discrepancies between the intended and actual applications allowed by the rule. The administrator can then optimize the rule by adding or removing applications as needed. Option A is incorrect because the compare option does not compare the running configuration with the candidate configuration of the firewall. That is done by using the Commit > Commit and Push option. Option B is incorrect because the compare option does not compare applications configured in the rule with their dependencies. That is done by using the App Dependencies tab under Policy Optimizer. Option D is incorrect because the compare option does not compare the security rule with any other security rule selected. That is done by using the Compare Rules option under Policies > Security.

• Question 534:

  Which two options are required on an M-100 appliance to configure it as a Log Collector? (Choose two)

  A. From the Panorama tab of the Panorama GUI select Log Collector mode and then commit changes
  B. Enter the command request system system-mode logger then enter Y to confirm the change to Log Collector mode.
  C. From the Device tab of the Panorama GUI select Log Collector mode and then commit changes.
  D. Enter the command logger-mode enable the enter Y to confirm the change to Log Collector mode.
  E. Log in the Panorama CLI of the dedicated Log Collector
  B. Enter the command request system system-mode logger then enter Y to confirm the change to Log Collector mode.
  E. Log in the Panorama CLI of the dedicated Log Collector

  ---

  Explanation

  (https://www.paloaltonetworks.com/documentation/60/panorama/panorama_adminguide/se t-up-panorama/set-up-the-m-100-appliance)

• Question 535:

  An administrator is configuring a Panorama device group

  Which two objects are configurable? (Choose two )

  A. DNS Proxy
  B. Address groups
  C. SSL/TLS roles
  D. URL Filtering profiles
  B. Address groups
  D. URL Filtering profiles

  ---

  Explanation

  URL filtering is a feature in Palo Alto Networks firewalls that allows administrators to block access to specific URLs [1]. This feature can be configured via four different objects: Custom URL categories in URL Filtering profiles, PAN-DB URL

  categories in URL Filtering profiles, External Dynamic Lists (EDL) in URL Filtering profiles, and Custom URL categories in Security policy rules. The evaluation order for URL filtering is:

  Custom URL categories in URL Filtering profile, PAN-DB URL categories in URL Filtering profile, EDL in URL Filtering profile, and Custom URL category in Security policy rule. This information can be found in the Palo Alto Networks PCNSE

  Study Guide, which can be accessed here: https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/resource-library/palo-alto-networks-pcnse-study-guide.html.

• Question 536:

  People are having intermittent quality issues during a live meeting via web application.

  A. Use QoS profile to define QoS Classes
  B. Use QoS Classes to define QoS Profile
  C. Use QoS Profile to define QoS Classes and a QoS Policy
  D. Use QoS Classes to define QoS Profile and a QoS Policy
  C. Use QoS Profile to define QoS Classes and a QoS Policy

  ---

  Explanation

• Question 537:

  Which two are required by IPSec in transport mode? (Choose two.)

  A. Auto generated key
  B. NAT Traversal
  C. IKEv1
  D. DH-group 20 (ECP-384 bits)
  A. Auto generated key
  D. DH-group 20 (ECP-384 bits)

  ---

  Explanation

• Question 538:

  A users traffic traversing a Palo Alto networks NGFW sometimes can reach http //www company com At other times the session times out. At other times the session times out The NGFW has been configured with a PBF rule that the user traffic matches when it goes to http://www.company.com

  goes to http://www company com

  How can the firewall be configured to automatically disable the PBF rule if the next hop goes down?

  A. Create and add a monitor profile with an action of fail over in the PBF rule in question
  B. Create and add a monitor profile with an action of wait recover in the PBF rule in question
  C. Configure path monitoring for the next hop gateway on the default route in the virtual router
  D. Enable and configure a link monitoring profile for the external interface of the firewall
  A. Create and add a monitor profile with an action of fail over in the PBF rule in question

  ---

  Explanation

• Question 539:

  When a new firewall joins a high availability (HA) cluster, the cluster members will synchronize all existing sessions over which HA port?

  A. HA1
  B. HA2
  C. HA3
  D. HA4
  D. HA4

  ---

  Explanation

  https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/high-availability/ha-clustering-overview

• Question 540:

  The server team is concerned about the high volume of logs forwarded to their syslog server, it is determined that DNS is generating the most logs per second. The risk and compliance team requests that any Traffic logs indicating port abuse of port 53 must still be forwarded to syslog. All other DNS. Traffic logs can be exclude from syslog forwarding.

  How should syslog log forwarding be configured?

  A. With (port,dst neq 53)' Traffic log filter Object > Log Forwarding.
  B. With `(port dst neq 53)' Traffic log filter inside Device > log Settings.
  C. With `(app neq dns-base)'' Traffic log filter inside Device> Log Settings.
  D. With `(app neq dns-base)'' Traffic log filter inside Objects> Log Forwarding
  B. With `(port dst neq 53)' Traffic log filter inside Device > log Settings.

  ---

  Explanation