Palo Alto Networks Palo Alto Networks Certifications PCNSE Questions & Answers

• Question 791:

  What is considered the best practice with regards to zone protection?

  A. Review DoS threat activity (ACC > Block Activity) and look for patterns of abuse

  B. Use separate log-forwarding profiles to forward DoS and zone threshold event logs separately from other threat logs

  C. If the levels of zone and DoS protection consume too many firewall resources, disable zone protection

  D. Set the Alarm Rate threshold for event-log messages to high severity or critical severity

  Correct Answer: B

  https://docs.paloaltonetworks.com/best-practices/dos-and-zone-protection-best-practices/dos-and-zone-protection-best-practices/follow-post-deployment-dos-and-zone-protection-best-practices

• Question 792:

  A traffic log might list an application as "not-applicable" for which two reasons'? (Choose two )

  A. The firewall did not install the session

  B. The TCP connection terminated without identifying any application data

  C. The firewall dropped a TCP SYN packet

  D. There was not enough application data after the TCP connection was established

  Correct Answer: AD

• Question 793:

  A remote administrator needs access to the firewall on an untrust interlace. Which three options would you configure on an interface Management profile lo secure management access? (Choose three)

  A. HTTP

  B. User-ID

  C. SSH

  D. HTTPS

  E. Permitted IP Addresses

  Correct Answer: CDE

  https://docs.paloaltonetworks.com/pan-os/9-1/pan-os- admin/networking/configure-interfaces/use-interface-management-profiles-to-restrict- access.html

• Question 794:

  Which statement accurately describes service routes and virtual systems?

  A. Virtual systems can only use one interface for all global service and service routes of the firewall

  B. The interface must be used for traffic to the required external services

  C. Virtual systems that do not have specific service routes configured inherit the global service and service route settings for the firewall

  D. Virtual systems cannot have dedicated service routes configured: and virtual systems always use the global service and service route settings for the firewall

  Correct Answer: C

  https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/virtual-systems/customize-service-routes-for-a-virtual-system "When a firewall is enabled for multiple virtual systems, the virtual systems inherit the global service and service route settings. For example, the firewall can use a shared email server to originate email alerts to all virtual systems. In some scenarios, you'd want to create different service routes for each virtual system."