Palo Alto Networks Palo Alto Networks Certifications PCNSE8 Questions & Answers

• Question 1:

  An administrator is configuring an IPSec VPN to a Cisco ASA at the administrator's home and experiencing issues completing the connection. the following is the output from the command:

  

  What could be the cause of this problem?

  A. The dead peer detection settings do not match between the Palo Alto Networks Firewall and the ASA.

  B. The Proxy IDs on the Palo Alto Networks Firewall do not match the setting on the ASA.

  C. The public IP addresses do not match for both the Palo Alto Networks Firewall and the ASA.

  D. The shared secrets do not match between the Palo Alto Networks Firewall and the ASA.

  Correct Answer: C

• Question 2:

  Which field is optional when creating a new Security Policy rule?

  A. Name

  B. Description

  C. Source Zone

  D. Destination Zone

  E. Action

  Correct Answer: B

• Question 3:

  YouTube videos are consuming too much bandwidth on the network, causing delays in mission- critical traffic. The administrator wants to throttle YouTube traffic. The following interfaces and zones are in use on the firewall:

  *

  ethernet1/1, Zone: Untrust (Internet-facing)

  *

  ethernet1/2, Zone: Trust (client-facing)

  A QoS profile has been created, and QoS has been enabled on both interfaces. A QoS rule exists to put the YouTube application into QoS class 6. Interface Ethernet1/1 has a QoS profile called Outbound, and interface Ethernet1/2 has a QoS

  profile called Inbound.

  Which setting for class 6 with throttle YouTube traffic?

  A.

  Outbound profile with Guaranteed Ingress

  B.

  Outbound profile with Maximum Ingress

  C.

  Inbound profile with Guaranteed Egress

  D.

  Inbound profile with Maximum Egress

  Correct Answer: D

• Question 4:

  Site-A and Site-B need to use IKEv2 to establish a VPN connection. Site A connects directly to the internet using a public IP address. Site-B uses a private IP address behind an ISP router to connect to the internet. How should NAT Traversal be implemented for the VPN connection to be established between Site-A and Site-B?

  A. Enable on Site-A only

  B. Enable on Site-B only

  C. Enable on Site-B only with passive mode

  D. Enable on Site-A and Site-B

  Correct Answer: D

• Question 5:

  Which two virtualized environments support Active/Active High Availability (HA) in PAN-OS 8.0? (Choose two.)

  A. KVM

  B. VMware ESX

  C. VMware NSX

  D. AWS

  Correct Answer: AB

• Question 6:

  Which two actions are required to make Microsoft Active Directory users appear in a firewall traffic log? (Choose two.)

  A. Run the User-ID Agent using an Active Directory account that has "event log viewer" permissions

  B. Enable User-ID on the zone object for the destination zone

  C. Run the User-ID Agent using an Active Directory account that has "domain administrator" permissions

  D. Enable User-ID on the zone object for the source zone

  E. Configure a RADIUS server profile to point to a domain controller

  Correct Answer: AD

• Question 7:

  A distributed log collection deployment has dedicated log Collectors. A developer needs a device to send logs to Panorama instead of sending logs to the Collector Group. What should be done first?

  A. Remove the cable from the management interface, reload the log Collector and then re-connect that cable

  B. Contact Palo Alto Networks Support team to enter kernel mode commands to allow adjustments

  C. remove the device from the Collector Group

  D. Revert to a previous configuration

  Correct Answer: C

• Question 8:

  Which Device Group option is assigned by default in Panorama whenever a new device group is created to manage a Firewall?

  A. Master

  B. Universal

  C. Shared

  D. Global

  Correct Answer: C

• Question 9:

  How can a Palo Alto Networks firewall be configured to send syslog messages in a format compatible with non-standard syslog servers?

  A. Enable support for non-standard syslog messages under device management

  B. Check the custom-format check box in the syslog server profile

  C. Select a non-standard syslog server profile

  D. Create a custom log format under the syslog server profile

  Correct Answer: D

• Question 10:

  Refer to Exhibit:

  

  A firewall has three PDF rules and a default route with a next hop of 172.29.19.1 that is configured in the default VR. A user named XX-bes a PC with a 192.168.101.10 IP address.

  He makes an HTTPS connection to 172.16.10.29.

  What is the next hop IP address for the HTTPS traffic from Wills PC.

  A. 172.20.30.1

  B. 172.20.20.1

  C. 172.20.10.1

  D. 172.20.40.1

  Correct Answer: B