Palo Alto Networks Palo Alto Networks Certifications PCNSE Questions & Answers

• Question 661:

  An organization has recently migrated its infrastructure and configuration to NGFWs, for which Panorama manages the devices The organization is coming from a L2-L4 firewall vendor, but wants to use App-ID while identifying policies that are no longer needed.

  Which Panorama tool can help this organization?

  A. Config Audit

  B. Policy Optimizer

  C. Application Groups

  D. Test Policy Match

  Correct Answer: B

  https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-new-features/app-id- features/policy-optimizer his new feature identifies port-based rules so you can convert them to application-based rules that allow the traffic or add applications to existing rules without compromising application availability. https://docs.paloaltonetworks.com/pan-os/90/pan-os-new- features/app-id-features/policy-optimizer.html

• Question 662:

  An administrator needs to assign a specific DNS server to one firewall within a device group. Where would the administrator go to edit a template variable at the device level?

  A. Variable CSV export under Panorama > templates

  B. PDF Export under Panorama > templates

  C. Manage variables under Panorama > templates

  D. Managed Devices > Device Association

  Correct Answer: C

• Question 663:

  What is the function of a service route?

  A. The service route is the method required to use the firewall's management plane to provide services to applications

  B. The service packets enter the firewall on the port assigned from the external service. The server sends its response to the configured destination interface and destination IP address

  C. The service packets exit the firewall on the port assigned for the external service. The server sends its response to the configured source interface and source IP address

  D. Service routes provide access to external services such as DNS servers external authentication servers or Palo Alto Networks services like the Customer Support Portal

  Correct Answer: C

  A service route is the path from an interface on the firewall to a service on a server. Service routes provide access to external services such as DNS servers, external authentication servers or Palo Alto Networks services like the Customer

  Support Portal . By default, the firewall uses the management (MGT) interface to access these services, but you can configure a data port (a regular interface) as an alternative. A service route is not related to the firewall's management plane

  or the port assigned for the external service. A service route does not affect how the server sends its response to the firewall.

  References:

  https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-networking-admin/service-routes/service-routes-overview https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-networking-admin/service-routes/configure-service-routes

• Question 664:

  The administrator for a small company has recently enabled decryption on their Palo Alto Networks firewall using a self-signed root certificate. They have also created a Forward Trust and Forward Untrust certificate and set them as such. The admin has not yet installed the root certificate onto client systems What effect would this have on decryption functionality?

  A. Decryption will function and there will be no effect to end users

  B. Decryption will not function because self-signed root certificates are not supported

  C. Decryption will not function until the certificate is installed on client systems

  D. Decryption will function but users will see certificate warnings for each SSL site they visit

  Correct Answer: D

• Question 665:

  Refer to the image.

  

  An administrator is tasked with correcting an NTP service configuration for firewalls that cannot use the Global template NTP servers. The administrator needs to change the IP address to a preferable server for this template stack but cannot impact other template stacks.

  How can the issue be corrected?

  A. Override the value on the NYCFW template.

  B. Override a template value using a template stack variable.

  C. Override the value on the Global template.

  D. Enable "objects defined in ancestors will take higher precedence" under Panorama settings.

  Correct Answer: B

  Both templates and template stacks support variables. Variables allow you to create placeholder objects with their value specified in the template or template stack based on your configuration needs. Create a template or template stack variable to replace IP addresses, Group IDs, and interfaces in your configurations. https://docs.paloaltonetworks.com/panorama/10-0/panorama-admin/manage- firewalls/manage-templates-and-template-stacks/override-a-templatesetting.html

• Question 666:

  A organizations administrator has the funds available to purchase more firewalls to increase the organization's security posture.

  The partner SE recommends placing the firewalls as close as possible to the resources that they protect.

  Is the SE's advice correct and why or why not?

  A. Yes Firewalls are session based so they do not scale to millions of CPS

  B. No Placing firewalls m front of perimeter DDoS devices provides greater protection tor sensitive devices inside the network

  C. Yes Zone Protection profiles can be tailored to the resources that they protect via the configuration of specific device types and operating systems

  D. No Firewalls provide new defense and resilience to prevent attackers at every stage of the cyberattack lifecycle independent of placement

  Correct Answer: A

  https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/zone- protection-and-dos-protection/zone-defense/firewall-placement-for-dos-protection

• Question 667:

  Which benefit do policy rule UUIDs provide?

  A. functionality for scheduling policy actions

  B. the use of user IP mapping and groups in policies

  C. cloning of policies between device-groups

  D. an audit trail across a policy's lifespan

  Correct Answer: D

  https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-new- features/management-features/universally-unique-identifiers-for-policy-rules.html

• Question 668:

  An organization is building a Bootstrap Package to deploy Palo Alto Networks VM-Series firewalls into their AWS tenant. Which two statements are correct regarding the bootstrap package contents? (Choose two )

  A. The /config /content and /software folders are mandatory while the /license and /plugin folders are optional

  B. The bootstrap package is stored on an AFS share or a discrete container file bucket

  C. The directory structure must include a /config /content, /software and /license folders

  D. The init-cfg txt and bootstrap.xml files are both optional configuration items for the /config folder

  E. The bootstrap.xml file allows for automated deployment of VM-Senes firewalls with full network and policy configurations.

  Correct Answer: CE

  https://docs.paloaltonetworks.com/vm-series/9-1/vm-series- deployment/bootstrap-the-vm-series-firewall/bootstrap-the-vm-series-firewall-in-aws.html

• Question 669:

  A prospect is eager to conduct a Security Lifecycle Review (SLR) with the aid of the Palo Alto Networks NGFW.

  Which interface type is best suited to provide the raw data for an SLR from the network in a way that is minimally invasive?

  A. Layer 3

  B. Virtual Wire

  C. Tap

  D. Layer 2

  Correct Answer: C

• Question 670:

  A customer is replacing their legacy remote access VPN solution The current solution is in place to secure internet egress and provide access to resources located in the main datacenter for the connected clients.

  Prisma Access has been selected to replace the current remote access VPN solution. During onboarding the following options and licenses were selected and enabled.

  

  What must be configured on Prisma Access to provide connectivity to the resources in the datacenter?

  A. Configure a mobile user gateway in the region closest to the datacenter to enable connectivity to the datacenter

  B. Configure a remote network to provide connectivity to the datacenter

  C. Configure Dynamic Routing to provide connectivity to the datacenter

  D. Configure a service connection to provide connectivity to the datacenter

  Correct Answer: B