Palo Alto Networks Palo Alto Networks Certifications PCNSE Questions & Answers

• Question 771:

  A customer is replacing their legacy remote access VPN solution The current solution is in place to secure only internet egress for the connected clients Prisma Access has been selected to replace the current remote access VPN solution During onboarding the following options and licenses were selected and enabled

  1.

  Prisma Access for Remote Networks 300Mbps

  2.

  Prisma Access for Mobile Users 1500 Users

  3.

  Cortex Data Lake 2TB

  4.

  Trusted Zones trust

  5.

  Untrusted Zones untrust

  6.

  Parent Device Group shared

  How can you configure Prisma Access to provide the same level of access as the current VPN solution?

  A. Configure mobile users with trust-to-untrust Security policy rules to allow the desired traffic outbound to the internet

  B. Configure mobile users with a service connection and trust-to-trust Security policy rules to allow the desired traffic outbound to the internet

  C. Configure remote networks with a service connection and trust-to-untrust Security policy rules to allow the desired traffic outbound to the internet

  D. Configure remote networks with trust-to-trust Security policy rules to allow the desired traffic outbound to the internet

  Correct Answer: A

  To provide the same level of access as the current VPN solution, which is to secure only Internet egress for the connected clients, you can configure mobile users with trust-to-untrust Security policy rules to allow the desired traffic outbound to the Internet. This way, the mobile users will be assigned an IP address from a pool that belongs to the trust zone, and they will be able to access the Internet through Prisma Access using a gateway that belongs to the untrust zone. You do not need to configure a service connection for this scenario, as a service connection is used to enable access between mobile users and remote networks or private apps. You also do not need to configure trust-to-trust Security policy rules, as they are used to enable access between mobile users and other trusted resources.

  References: https://docs.paloaltonetworks.com/prisma/prisma-access/prisma-access-panorama-admin/prepare-the-prisma-access-infrastructure/service-connection-overview/create-a-service-connection-to-enable-access-between-users-and-networks https://docs.paloaltonetworks.com/prisma/prisma-access/prisma-access-cloud-managed-admin/prisma-access-service-connections https://docs.paloaltonetworks.com/prisma/prisma-access/prisma-access-cloud-managed-admin/prisma-access-mobile-users/mobile-users-globalprotect/globalprotect-features-for-prisma-access.html

• Question 772:

  What are three reasons why an installed session can be identified with the application incomplete" tag? (Choose three.)

  A. The TCP connection was terminated without identifying any application data

  B. The client sent a TCP segment with the PUSH flag set

  C. There is not enough application data after the TCP connection was established

  D. The TCP connection did not fully establish

  E. There was no application data after the TCP connection was established

  Correct Answer: ADE

  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClibCAC

• Question 773:

  Which action disables Zero Touch Provisioning (ZTP) functionality on a ZTP firewall during the onboarding process?

  A. performing a local firewall commit

  B. removing the firewall as a managed device in Panorama

  C. performing a factory reset of the firewall

  D. removing the Panorama serial number from the ZTP service

  Correct Answer: A

  https://docs.paloaltonetworks.com/panorama/10-0/panorama- admin/manage-firewalls/set-up-zero-touch-provisioning/add-ztp-firewalls-to-panorama/add- a-ztp-firewall-to-panorama.html#id182211ac-a31c-4122-a11f-19450ec9ca4e

• Question 774:

  A firewall is configured with SSL Forward Proxy decryption and has the following four enterprise certificate authorities (Cas)

  A. Enterprise-Trusted-CA; which is verified as Forward Trust Certificate (The CA is also installed in the trusted store of the end-user browser and system ) ii. Enterpnse-Untrusted-CA, which is verified as Forward Untrust Certificate

  iii. Enterprise-lntermediate-CA

  iv. Enterprise-Root-CA which is verified only as Trusted Root CA

  An end-user visits https //www example-website com/ with a server certificate Common Name (CN) www example-website com The firewall does the SSL Forward Proxy decryption for the website and the server certificate is not trusted by

  the firewall.

  The end-user's browser will show that the certificate for www.example-website.com was issued by which of the following?

  B. Enterprise-Untrusted-CA which is a self-signed CA

  C. Enterprise-Trusted-CA which is a self-signed CA

  D. Enterprise-lntermediate-CA which was. in turn, issued by Enterprise-Root-CA

  E. Enterprise-Root-CA which is a self-signed CA

  Correct Answer: A

  Enterprise-Trusted-CA is installed in the trusted store of the end-user browser and system. So it should not lead to any certificate issue. The most possible that www.example-website.com is signed by not trusted certificate authority which leads to use Enterprise-Untrusted-CA, which is not trusted as well

• Question 775:

  Which statement is true regarding a Best Practice Assessment?

  A. It shows how your current configuration compares to Palo Alto Networks recommendations

  B. It runs only on firewalls

  C. When guided by an authorized sales engineer, it helps determine the areas of greatest risk where you should focus prevention activities.

  D. It provides a set of questionnaires that help uncover security risk prevention gaps across all areas of network and security architecture

  Correct Answer: A

• Question 776:

  Which two statements are true about DoS Protection and Zone Protection Profiles? (Choose two).

  A. Zone Protection Profiles protect ingress zones

  B. Zone Protection Profiles protect egress zones

  C. DoS Protection Profiles are packet-based, not signature-based

  D. DoS Protection Profiles are linked to Security policy rules

  Correct Answer: AD

  https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/zone-protection- and-dos-protection/zone-defense/zone-protection-profiles

• Question 777:

  An administrator device-group commit push is tailing due to a new URL category How should the administrator correct this issue?

  A. verify that the URL seed Tile has been downloaded and activated on the firewall

  B. change the new category action to alert" and push the configuration again

  C. update the Firewall Apps and Threat version to match the version of Panorama

  D. ensure that the firewall can communicate with the URL cloud

  Correct Answer: C

  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PNqw

• Question 778:

  A user at an external system with the IP address 65.124 57 5 quenes the DNS server at 4 2 2 2 for the IP address of the web server www xyz com The DNS server returns an address of 172 16 151 In order to reach the web server, which Security rule and NAT rule must be configured on the firewall?

  

  A. Option A

  B. Option B

  C. Option C

  D. Option D

  Correct Answer: D

• Question 779:

  What are three valid qualifiers for a Decryption Policy Rule match? (Choose three )

  A. Destination Zone

  B. App-ID

  C. Custom URL Category

  D. User-ID E. Source Interface

  Correct Answer: ACD

• Question 780:

  An enterprise information Security team has deployed policies based on AD groups to restrict user access to critical infrastructure systems However a recent phisning campaign against the organization has prompted Information Security to look for more controls that can secure access to critical assets For users that need to access these systems Information Security wants to use PAN-OS multi-factor authentication (MFA) integration to enforce MFA.

  What should the enterprise do to use PAN-OS MFA1?

  A. Configure a Captive Porta1 authentication policy that uses an authentication profile that references a RADIUS profile

  B. Create an authentication profile and assign another authentication factor to be used by a Captive Portal authentication policy

  C. Configure a Captive Portal authentication policy that uses an authentication sequence

  D. Use a Credential Phishing agent to detect prevent and mitigate credential phishing campaigns

  Correct Answer: B

  You should create an auth profile and use it in captive protal auth policy.

  https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/authentication/configure-multi-factor-authentication