Palo Alto Networks PCNSE Online Practice Questions and Exam Preparation

Palo Alto Networks PCNSE Online Questions & Answers

• Question 561:

  Which CLI command enables an administrator to check the CPU utilization of the dataplane?

  A. show running resource-monitor
  B. debug data-plane dp-cpu
  C. show system resources
  D. debug running resources
  A. show running resource-monitor

  ---

  Explanation

  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClXwCAK https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CluDCAS

• Question 562:

  When using SSH keys for CLI authentication for firewall administration, which method is used for authorization?

  A. Local
  B. LDAP
  C. Kerberos
  D. Radius
  A. Local

  ---

  Explanation

  When using SSH keys for CLI authentication for firewall administration, the method used for authorization is local. This is described in the Palo Alto Networks PCNSE Study Guide in Chapter 4: Authentication and Authorization, under the

  section "CLI Authentication with SSH Keys":

  "SSH keys use public key cryptography to authenticate users, but they do not provide a mechanism for authorization. Therefore, when using SSH keys for CLI authentication, authorization is always performed locally on the firewall."

• Question 563:

  A system administrator runs a port scan using the company tool as part of vulnerability check. The administrator finds that the scan is identified as a threat and is dropped by the firewall. After further investigating the logs, the administrator finds that the scan is dropped in the Threat Logs.

  What should the administrator do to allow the tool to scan through the firewall?

  A. Remove the Zone Protection profile from the zone setting.
  B. Add the tool IP address to the reconnaissance protection source address exclusion in the Zone Protection profile.
  C. Add the tool IP address to the reconnaissance protection source address exclusion in the DoS Protection profile.
  D. Change the TCP port scan action from Block to Alert in the Zone Protection profile.
  B. Add the tool IP address to the reconnaissance protection source address exclusion in the Zone Protection profile.

  ---

  Explanation

• Question 564:

  During the process of developing a decryption strategy and evaluating which websites are required for corporate users to access, several sites have been identified that cannot be decrypted due to technical reasons. In this case, the technical reason is unsupported ciphers. Traffic to these sites will therefore be blocked if decrypted.

  How should the engineer proceed?

  A. Allow the firewall to block the sites to improve the security posture
  B. Add the sites to the SSL Decryption Exclusion list to exempt them from decryption
  C. Install the unsupported cipher into the firewall to allow the sites to be decrypted
  D. Create a Security policy to allow access to those sites
  B. Add the sites to the SSL Decryption Exclusion list to exempt them from decryption

  ---

  Explanation

  https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/decryption/decryption-exclusions Traffic that breaks decryption for technical reasons, such as using a pinned certificate, an incomplete certificate chain, unsupported ciphers, or mutual authentication (attempting to decrypt the traffic results in blocking the traffic). Palo Alto Networks provides a predefined SSL Decryption Exclusion list (DeviceCertificate ManagementSSL Decryption Exclusion) that excludes hosts with applications and services that are known to break decryption technically from SSL Decryption by default. If you encounter sites that break decryption technically and are not on the SSL Decryption Exclusion list, you can add them to list manually by server hostname. The firewall blocks sites whose applications and services break decryption technically unless you add them to the SSL Decryption Exclusion list.

• Question 565:

  What are two best practices for incorporating new and modified App-IDs? (Choose two.)

  A. Run the latest PAN-OS version in a supported release tree to have the best performance for the new App-IDs
  B. Configure a security policy rule to allow new App-IDs that might have network-wide impact
  C. Perform a Best Practice Assessment to evaluate the impact of the new or modified App-IDs
  D. Study the release notes and install new App-IDs if they are determined to have low impact
  B. Configure a security policy rule to allow new App-IDs that might have network-wide impact
  D. Study the release notes and install new App-IDs if they are determined to have low impact

  ---

  Explanation

  https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/app-id/manage-new-app-ids-introduced-in-content-releases/app-id-updates-workflow.html

• Question 566:

  A company wants to add threat prevention to the network without redesigning the network routing.

  What are two best practice deployment modes for the firewall? (Choose two.)

  A. Virtual Wire
  B. Layer3
  C. TAP
  D. Layer2
  A. Virtual Wire
  D. Layer2

  ---

  Explanation

  VirtualWire and Layer2 deployment modes allow the firewall to act as a bump in the wire without changing the existing network routing. In VirtualWire mode, the firewall bridges two interfaces and passes traffic between them without any IP-layer processing. In Layer2 mode, the firewall acts as a transparent switch and processes traffic at Layer2 of the OSI model.

  References: https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/networking/configure-interfaces/virtual-wire-deployments.html https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/networking/configure-interfaces/layer-2-deployments.html

• Question 567:

  A client wants to detect the use of weak and manufacturer-default passwords for loT devices. Which option will help the customer?

  A. Configure a Data Filtering profile with alert mode.
  B. Configure an Antivirus profile with alert mode.
  C. Configure a Vulnerability Protection profile with alert mode
  D. Configure an Anti-Spyware profile with alert mode.
  C. Configure a Vulnerability Protection profile with alert mode

  ---

  Explanation

• Question 568:

  A network security administrator has been tasked with deploying User-ID in their organization.

  What are three valid methods of collecting User-ID information in a network? (Choose three.)

  A. Windows User-ID agent
  B. GlobalProtect
  C. XMLAPI
  D. External dynamic list
  E. Dynamic user groups
  A. Windows User-ID agent
  B. GlobalProtect
  C. XMLAPI

  ---

  Explanation

  User-ID is a feature that enables the firewall to identify users and groups based on their IP addresses, usernames, or other attributes. There are three valid methods of collecting User-ID information in a network:

  Windows User-ID agent: This is a software agent that runs on a Windows server and collects user mapping information from Active Directory, Exchange servers, or other sources. GlobalProtect: This is a VPN solution that provides secure

  remote access for users and devices. It also collects user mapping information from endpoints that connect to the firewall using GlobalProtect. XMLAPI: This is an application programming interface that allows third-party applications or scripts

  to send user mapping information to the firewall using XML format.

• Question 569:

  The administrator has enabled BGP on a virtual router on the Palo Alto Networks NGFW, but new routes do not seem to be populating the virtual router. Which two options would help the administrator troubleshoot this issue? (Choose two.)

  A. View the System logs and look for the error messages about BGP.
  B. Perform a traffic pcap on the NGFW to see any BGP problems.
  C. View the Runtime Stats and look for problems with BGP configuration.
  D. View the ACC tab to isolate routing issues.
  B. Perform a traffic pcap on the NGFW to see any BGP problems.
  C. View the Runtime Stats and look for problems with BGP configuration.

  ---

  Explanation

  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClEWCA0

• Question 570:

  Which statement regarding HA timer settings is true?

  A. Use the Recommended profile for typical failover timer settings
  B. Use the Moderate profile for typical failover timer settings
  C. Use the Aggressive profile for slower failover timer settings.
  D. Use the Critical profile for faster failover timer settings.
  A. Use the Recommended profile for typical failover timer settings

  ---

  Explanation

  https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/high-availability/ha-concepts/ha-timers