Palo Alto Networks PCNSE Online Practice Questions and Exam Preparation

Palo Alto Networks PCNSE Online Questions & Answers

• Question 731:

  A VPN connection is set up between Site-A and Site-B, but no traffic is passing in the system log of Site-A, there is an event logged as like-nego-p1-fail-psk.

  What action will bring the VPN up and allow traffic to start passing between the sites?

  A. Change the Site-B IKE Gateway profile version to match Site-A,
  B. Change the Site-A IKE Gateway profile exchange mode to aggressive mode.
  C. Enable NAT Traversal on the Site-A IKE Gateway profile.
  D. Change the pre-shared key of Site-B to match the pre-shared key of Site-A
  D. Change the pre-shared key of Site-B to match the pre-shared key of Site-A

  ---

  Explanation

• Question 732:

  Which Panorama administrator types require the configuration of at least one access domain? (Choose two)

  A. Dynamic
  B. Custom Panorama Admin
  C. Role Based
  D. Device Group
  E. Template Admin
  D. Device Group
  E. Template Admin

  ---

  Explanation

  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClETCA0

• Question 733:

  A decryption policy has been created with an action of "No Decryption." The decryption profile is configured in alignment to best practices. What protections does this policy provide to the enterprise?

  A. It allows for complete visibility into certificate data, ensuring secure connections to all websites.
  B. It ensures that the firewall checks its certificate store, enabling sessions with trusted self-signed certificates even when an alternative trust anchor exists.
  C. It encrypts all certificate information to maintain privacy and compliance with local regulations.
  D. It enhances security by actively blocking access to potentially insecure sites with expired certificates or untrusted issuers.
  D. It enhances security by actively blocking access to potentially insecure sites with expired certificates or untrusted issuers.

  ---

  Explanation

• Question 734:

  Which PAN-OS policy must you configure to force a user to provide additional credentials before he is allowed to access an internal application that contains highly-sensitive business data?

  A. Security policy
  B. Decryption policy
  C. Authentication policy
  D. Application Override policy
  C. Authentication policy

  ---

  Explanation

  Authentication policy enables you to authenticate end users before they can access services and applications. Whenever a user requests a service or application (such as by visiting a web page), the firewall evaluates Authentication policy. Based on the matching Authentication policy rule, the firewall then prompts the user to authenticate using one or more methods (factors), such as login and password, Voice, SMS, Push, or One-time Password (OTP) authentication https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/authentication/authentication-policy

• Question 735:

  A firewall engineer is migrating port-based rules to application-based rules by using the Policy Optimizer. The engineer needs to ensure that the new application-based rules are future-proofed, and that they will continue to match if the existing signatures for a specific application are expanded with new child applications. Which action will meet the requirement while ensuring that traffic unrelated to the specific application is not matched?

  A. Create a custom application and define it by the correct TCP and UDP ports
  B. Create an application filter based on the existing application category and risk
  C. Add specific applications that are seen when creating cloned rules
  D. Add the relevant container application when creating cloned rules
  D. Add the relevant container application when creating cloned rules

  ---

  Explanation

  Using Policy Optimizer to migrate to application-based rules, adding the container application (Option D) ensures future-proofing. Container apps (e.g., "web-browsing") include child apps (e.g., specific web services) as signatures evolve, maintaining rule accuracy without over-matching unrelated traffic.

  PAN-OS 11.2 Administrator's Guide, "Policy Optimizer" section; "App-ID" section -Container Applications.

• Question 736:

  A company is using wireless controllers to authenticate users. Which source should be used for User-ID mappings?

  A. Syslog
  B. XFF headers
  C. server monitoring
  D. client probing
  A. Syslog

  ---

  Explanation

• Question 737:

  Your company occupies one floor in a single building. You have two Active Directory domain controllers on a single network. The firewall's management-plane resources are lightly utilized.

  Given the size of this environment, which User-ID collection method is sufficient?

  A. Citrix terminal server agent deployed on the network
  B. Windows-based agent deployed on each domain controller
  C. PAN-OS integrated agent deployed on the firewall
  D. a syslog listener
  C. PAN-OS integrated agent deployed on the firewall

  ---

  Explanation

• Question 738:

  Which processing order will be enabled when a Panorama administrator selects the setting "Objects defined in ancestors will take higher precedence?"

  A. Descendant objects will take precedence over other descendant objects.
  B. Descendant objects will take precedence over ancestor objects.
  C. Ancestor objects will have precedence over descendant objects.
  D. Ancestor objects will have precedence over other ancestor objects.
  C. Ancestor objects will have precedence over descendant objects.

  ---

  Explanation

  https://www.paloaltonetworks.com/documentation/71/pan-os/web-interface-help/device/device-setup-management

• Question 739:

  An administrator wants to perform HIP checks on the endpoints to ensure their security posture.

  Which license is required on all Palo Alto Networks next-generation firewalls that will be performing the HIP checks?

  A. GlobalProtect Gateway
  B. Current and Active Support License
  C. Threat Prevention
  D. GlobalProtect Portal
  A. GlobalProtect Gateway

  ---

  Explanation

• Question 740:

  An administrator just submitted a newly found piece of spyware for WildFire analysis. The spyware passively monitors behavior without the user's knowledge.

  What is the expected verdict from WildFire?

  A. Grayware
  B. Malware
  C. Spyware
  D. Phishing
  A. Grayware

  ---

  Explanation

  Wildfire verdictions are as follow1-Begnin2-Greyware3-Mallicious4-Phishing https://www.paloaltonetworks.com/documentation/80/wildfire/wf_admin/wildfire-overview/wildfire-concepts/verdicts The sample does not pose a direct security threat, but might display otherwise obtrusive behavior. Grayware typically includes adware, spyware, and Browser Helper Objects (BHOs)