Palo Alto Networks PCNSE Online Practice Questions and Exam Preparation

Palo Alto Networks PCNSE Online Questions & Answers

• Question 581:

  An engineer is troubleshooting a traffic-routing issue. What is the correct packet-flow sequence?

  A. PBF > Static route > Security policy enforcement
  B. BGP < PBF > NAT
  C. PBF > Zone Protection Profiles > Packet Buffer Protection
  D. NAT > Security policy enforcement > OSPF
  A. PBF > Static route > Security policy enforcement

  ---

  Explanation

  PBF > Static route > Security policy enforcement. This sequence describes the order of operations that the firewall performs when processing a packet. PBF stands for Policy-Based Forwarding, which is a feature that allows the firewall to override the routing table and forward traffic based on the source and destination addresses, application, user, or service. PBF is evaluated before the static route lookup, which is the default method of forwarding traffic based on the destination address and the longest prefix match. Security policy enforcement is the stage where the firewall applies the security policy rules to allow or block traffic based on various criteria, such as zone, address, port, user, application, etc.

  References: Policy-Based Forwarding, Packet Flow Sequence in PAN-OS

• Question 582:

  Which three firewall states are valid? (Choose three)

  A. Active
  B. Functional
  C. Pending
  D. Passive
  E. Suspended
  A. Active
  D. Passive
  E. Suspended

  ---

  Explanation

  https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/high-availability/ha-firewall-states

• Question 583:

  In an enterprise deployment, a network security engineer wants to assign to a group of administrators without creating local administrator accounts on the firewall.

  Which authentication method must be used?

  A. LDAP
  B. Kerberos
  C. Certification based authentication
  D. RADIUS with Vendor-Specific Attributes
  D. RADIUS with Vendor-Specific Attributes

  ---

  Explanation

• Question 584:

  All firewalls at a company are currently forwarding logs to Palo Alto Networks log collectors. The company also wants to deploy a syslog server and forward all firewall logs to the syslog server and to the log collectors. There is a known logging peak time during the day and the security team has asked the firewall engineer to determine how many logs per second the current Palo Alto Networks log collectors are processing at that particular time.

  Which method is the most time-efficient to complete this task?

  A. Navigate to Panorama > Managed Collectors, and open the Statistics window for each Log Collector during the peak time
  B. Navigate to ACC > Network Activity, and determine the total number of sessions and threats during the peak time
  C. Navigate to Monitor > Unified logs, set the filter to the peak time, and browse to the last page to find out how many logs have been received
  D. Navigate to Panorama > Managed Devices > Health, open the Logging tab for each managed firewall and check the log rates during the peak time
  D. Navigate to Panorama > Managed Devices > Health, open the Logging tab for each managed firewall and check the log rates during the peak time

  ---

  Explanation

• Question 585:

  A company requires the firewall to block expired certificates issued by internet-hosted websites. The company plans to implement decryption in the future, but it does not perform SSL Forward Proxy decryption at this time. Without the use of SSL Forward Proxy decryption, how is the firewall still able to identify and block expired certificates issued by internet-hosted websites?

  A. By having a Certificate profile that contains the website's Root CA assigned to the respective Security policy rule.
  B. By using SSL Forward Proxy to decrypt SSL and TLS handshake communication and the server/client session keys in order to validate a certificate's authenticity and expiration.
  C. By using SSL Forward Proxy to decrypt SSL and TLS handshake communication in order to validate a certificates authenticity and expiration.
  D. By having a Decryption profile that blocks sessions with expired certificates in the No Decryption section and assigning it to a No Decrypt policy rule.
  D. By having a Decryption profile that blocks sessions with expired certificates in the No Decryption section and assigning it to a No Decrypt policy rule.

  ---

  Explanation

  https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/decryption/troubleshoot-and-monitor-decryption/decryption-troubleshooting-workflow-examples/troubleshoot-certificate-expiration-issues

• Question 586:

  The decision to upgrade PAN-OS has been approved. The engineer begins the process by upgrading the Panorama servers, but gets an error when attempting the install.

  When performing an upgrade on Panorama to PAN-OS, what is the potential cause of a failed install?

  A. GlobalProtect agent version
  B. Outdated plugins
  C. Management only mode
  D. Expired certificates
  B. Outdated plugins

  ---

  Explanation

• Question 587:

  How is the Forward Untrust Certificate used?

  A. It issues certificates encountered on the Untrust security zone when clients attempt to connect to a site that has be decrypted/
  B. It is used when web servers request a client certificate.
  C. It is presented to clients when the server they are connecting to is signed by a certificate authority that is not trusted by firewall.
  D. It is used for Captive Portal to identify unknown users.
  C. It is presented to clients when the server they are connecting to is signed by a certificate authority that is not trusted by firewall.

  ---

  Explanation

• Question 588:

  How is an address object of type IP range correctly defined?

  A. 192 168 40 1-192 168 40 255
  B. 192.168 40 1/24
  C. 192.168 40 1, 192.168 40.255
  D. 192 168 40 1-255
  A. 192 168 40 1-192 168 40 255

  ---

  Explanation

  https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/policy/use-address-object-to-represent-ip-addresses/create-an-address-object

• Question 589:

  An engineer receives reports from users that applications are not working and that websites are only partially loading in an asymmetric environment. After investigating, the engineer observes the flow_tcp_non_syn_drop counter increasing in the show counters global output.

  Which troubleshooting command should the engineer use to work around this issue?

  A. set deviceconfig setting tcp asymmetric-path drop
  B. set deviceconfig setting session tcp-reject-non-syn no
  C. set session tcp-reject-non-syn yes
  D. set deviceconfig setting tcp asymmetric-path bypass
  B. set deviceconfig setting session tcp-reject-non-syn no

  ---

  Explanation

  To work around this issue, one possible troubleshooting command is set deviceconfig setting session tcp-reject-non-syn no which disables TCP reject non-SYN temporarily (until reboot)4. This command allows non-SYN first packet through without dropping it. The flow_tcp_non_syn_drop counter increases when the firewall receives packets with the ACK flag set, but not the SYN flag, which indicates asymmetric traffic flow. The tcp-reject-non-syn option enables or disables the firewall to drop non-SYN TCP packets. In this case, disabling the tcp-reject-non-syn option using the "set deviceconfig setting session tcp-reject-non-syn no" command can help work around the issue. This allows the firewall to accept non-SYN packets and create a session for the existing flow.

• Question 590:

  Which benefit do policy rule UUIDs provide?

  A. functionality for scheduling policy actions
  B. the use of user IP mapping and groups in policies
  C. cloning of policies between device-groups
  D. an audit trail across a policy's lifespan
  D. an audit trail across a policy's lifespan

  ---

  Explanation

  https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-new-features/management-features/universally-unique-identifiers-for-policy-rules.html