Palo Alto Networks Palo Alto Networks Certifications PCNSE Questions & Answers

• Question 691:

  A network administrator wants to use a certificate for the SSL/TLS Service Profile. Which type of certificate should the administrator use?

  A. certificate authority (CA) certificate

  B. client certificate

  C. machine certificate

  D. server certificate

  Correct Answer: D

  Use only signed certificates, not CA certificates, in SSL/TLS service profiles. https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/certificate- management/configure-an-ssltls-service-profile.html

• Question 692:

  An administrator notices that an interlace configuration has been overridden locally on a firewall. They require an configuration to be managed from Panorama and overrides are not allowed. What is one way the administrator can meet this requirement?

  A. Perform a device-group commit push from Panorama using the "Include Device and Network Templates" option.

  B. Reload the running configuration and perform a Firewall local commit.

  C. Perform a template commit push from Panorama using the "Force Template Values'' option

  D. Perform a commit force from the CLI of the firewall.

  Correct Answer: C

  The best way for the administrator to meet the requirement of managing all configuration from Panorama and preventing local overrides is B: Perform a template commit push from Panorama using the "Force Template Values" option. This option allows the administrator to overwrite any local configuration on the firewall with the values defined in the template1. This way, the administrator can ensure that the interface configuration and any other

• Question 693:

  What is a key step in implementing WildFire best practices?

  A. In a mission-critical network, increase the WildFire size limits to the maximum value

  B. In a security-first network set the WildFire size limits to the minimum value

  C. Configure the firewall to retrieve content updates every minute

  D. Ensure that a Threat Prevention subscription is active

  Correct Answer: D

• Question 694:

  An administrator needs to build Security rules in a Device Group that allow traffic to specific users and groups defined in Active Directory. What must be configured in order to select users and groups for those rules from Panorama?

  A. The Security rules must be targeted to a firewall in the device group and have Group Mapping configured

  B. A master device with Group Mapping configured must be set in the device group where the Security rules are configured

  C. User-ID Redistribution must be configured on Panorama to ensure that all firewalls have the same mappings

  D. A User-ID Certificate profile must be configured on Panorama

  Correct Answer: B

  When building Security rules in a Device Group that need to allow traffic to specific users and groups defined in Active Directory, it's essential to have user and group information available in Panorama to select these entities for the rules.

  A master device with Group Mapping configured must be set in the device group where the Security rules are configured:

  The concept of a "master device" in Panorama refers to a specific firewall that is designated to provide certain settings or information, such as user and group mappings from Active Directory, to Panorama. This information can then be used

  across other firewalls within the same device group.

  By configuring Group Mapping on a master device, Panorama can leverage this information to populate user and group objects. These objects can then be used in Security rules within the device group, allowing for the creation of policies that

  are based on user identity and group membership, as defined in Active Directory.

  This setup ensures that Panorama has the necessary context to apply user- and group-based policies accurately across the managed firewalls, facilitating centralized management and consistency in policy enforcement.

• Question 695:

  During the process of developing a decryption strategy and evaluating which websites are required for corporate users to access, several sites have been identified that cannot be decrypted due to technical reasons. In this case, the technical reason is unsupported ciphers. Traffic to these sites will therefore be blocked if decrypted.

  How should the engineer proceed?

  A. Allow the firewall to block the sites to improve the security posture

  B. Add the sites to the SSL Decryption Exclusion list to exempt them from decryption

  C. Install the unsupported cipher into the firewall to allow the sites to be decrypted

  D. Create a Security policy to allow access to those sites

  Correct Answer: B

  https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/decryption/decryption-exclusions Traffic that breaks decryption for technical reasons, such as using a pinned certificate, an incomplete certificate chain, unsupported ciphers, or mutual authentication (attempting to decrypt the traffic results in blocking the traffic). Palo Alto Networks provides a predefined SSL Decryption Exclusion list (DeviceCertificate ManagementSSL Decryption Exclusion) that excludes hosts with applications and services that are known to break decryption technically from SSL Decryption by default. If you encounter sites that break decryption technically and are not on the SSL Decryption Exclusion list, you can add them to list manually by server hostname. The firewall blocks sites whose applications and services break decryption technically unless you add them to the SSL Decryption Exclusion list.

• Question 696:

  In a security-first network, what is the recommended threshold value for content updates to be dynamically updated?

  A. 1 to 4 hours

  B. 6 to 12 hours

  C. 24 hours

  D. 36 hours

  Correct Answer: B

  Schedule content updates so that they download-and-install automatically. Then, set a Threshold that determines the amount of time the firewall waits before installing the latest content. In a security-first network, schedule a six to twelve hour threshold. https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/threat-prevention/best-practices-for-content-and-threat-content-updates/best-practices-security-first.html#id184AH00F06E

• Question 697:

  An engineer is configuring Packet Buffer Protection on ingress zones to protect from single- session DoS attacks. Which sessions does Packet Buffer Protection apply to?

  A. It applies to existing sessions and is not global

  B. It applies to new sessions and is global

  C. It applies to new sessions and is not global

  D. It applies to existing sessions and is global

  Correct Answer: D

  https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/zone-protection-and-dos-protection/zone-defense/packet-buffer-protection

• Question 698:

  Users within an enterprise have been given laptops that are joined to the corporate domain. In some cases, IT has also deployed Linux-based OS systems with a graphical desktop. Information Security needs IP-to-user mapping, which it will use in group-based policies that will limit internet access for the Linux desktop users.

  Which method can capture IP-to-user mapping information for users on the Linux machines?

  A. You can configure Captive Portal with an authentication policy.

  B. IP-to-user mapping for Linux users can only be learned if the machine is joined to the domain.

  C. You can set up a group-based security policy to restrict internet access based on group membership

  D. You can deploy the User-ID agent on the Linux desktop machines

  Correct Answer: D

• Question 699:

  What does SSL decryption require to establish a firewall as a trusted third party and to establish trust between a client and server to secure an SSL/TLS connection?

  A. link state

  B. stateful firewall connection

  C. certificates

  D. profiles

  Correct Answer: C

  https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/decryption/decryption-overview.html#:~:text=SSL%20decryption%20(both%20forward%20proxy,secure%20an%20SSL%2FTLS%20connection.

• Question 700:

  An administrator has configured PAN-OS SD-WAN and has received a request to find out the reason for a session failover for a session that has already ended. Where would you find this in Panorama or firewall logs?

  A. Traffic Logs

  B. System Logs

  C. Session Browser

  D. You cannot find failover details on closed sessions

  Correct Answer: A

  https://docs.paloaltonetworks.com/sd-wan/1-0/sd-wan-admin/configure-sd-wan/sd-wan-traffic-distribution-profiles