Palo Alto Networks Palo Alto Networks Certifications PCNSE8 Questions & Answers

• Question 91:

  A company is upgrading its existing Palo Alto Networks firewall from version 7.0.1 to 7.0.4.

  Which three methods can the firewall administrator use to install PAN-OS 8.0.4 across the enterprise?( Choose three)

  A. Download PAN-OS 8.0.4 files from the support site and install them on each firewall after manually uploading.

  B. Download PAN-OS 8.0.4 to a USB drive and the firewall will automatically update after the USB drive is inserted in the firewall.

  C. Push the PAN-OS 8.0.4 updates from the support site to install on each firewall.

  D. Push the PAN-OS 8.0.4 update from one firewall to all of the other remaining after updating one firewall.

  E. Download and install PAN-OS 8.0.4 directly on each firewall.

  F. Download and push PAN-OS 8.0.4 from Panorama to each firewall.

  Correct Answer: ACF

• Question 92:

  Given the following table.

  

  Which configuration change on the firewall would cause it to use 10.66.24.88 as the next hop for the 192.168.93.0/30 network?

  A. Configuring the administrative Distance for RIP to be lower than that of OSPF Int.

  B. Configuring the metric for RIP to be higher than that of OSPF Int.

  C. Configuring the administrative Distance for RIP to be higher than that of OSPF Ext.

  D. Configuring the metric for RIP to be lower than that OSPF Ext.

  Correct Answer: A

• Question 93:

  A VPN connection is set up between Site-A and Site-B, but no traffic is passing in the system log of Site-A, there is an event logged as like-nego-p1-fail-psk. What action will bring the VPN up and allow traffic to start passing between the sites?

  A. Change the Site-B IKE Gateway profile version to match Site-A,

  B. Change the Site-A IKE Gateway profile exchange mode to aggressive mode.

  C. Enable NAT Traversal on the Site-A IKE Gateway profile.

  D. Change the pre-shared key of Site-B to match the pre-shared key of Site-A

  Correct Answer: D

• Question 94:

  Site-A and Site-B have a site-to-site VPN set up between them. OSPF is configured to dynamically create the routes between the sites. The OSPF configuration in Site-A is configured properly, but the route for the tunner is not being established. The Site-B interfaces in the graphic are using a broadcast Link Type. The administrator has determined that the OSPF configuration in Site-B is using the wrong Link Type for one of its interfaces.

  

  Which Link Type setting will correct the error?

  A. Set tunnel. 1 to p2p

  B. Set tunnel. 1 to p2mp

  C. Set Ethernet 1/1 to p2mp

  D. Set Ethernet 1/1 to p2p

  Correct Answer: A

• Question 95:

  A host attached to Ethernet 1/4 cannot ping the default gateway. The widget on the dashboard shows Ethernet 1/1 and Ethernet 1/4 to be green. The IP address of Ethernet 1/1 is 192.168.1.7 and the IP address of Ethernet 1/4 is 10.1.1.7.

  The default gateway is attached to Ethernet 1/1. A default route is properly configured.

  What can be the cause of this problem?

  A. No Zone has been configured on Ethernet 1/4.

  B. Interface Ethernet 1/1 is in Virtual Wire Mode.

  C. DNS has not been properly configured on the firewall.

  D. DNS has not been properly configured on the host.

  Correct Answer: A

• Question 96:

  Based on the following image, what is the correct path of root, intermediate, and end-user certificate?

  

  A. Palo Alto Networks > Symantec > VeriSign

  B. Symantec > VeriSign > Palo Alto Networks

  C. VeriSign > Palo Alto Networks > Symantec

  D. VeriSign > Symantec > Palo Alto Networks

  Correct Answer: B

• Question 97:

  Which Zone Pair and Rule Type will allow a successful connection for a user on the internet zone to a web server hosted in the DMZ zone? The web server is reachable using a destination Nat policy in the Palo Alto Networks firewall.

  A. Zone Pair: Source Zone: Internet Destination Zone: DMZ Rule Type: "intrazone"

  B. Zone Pair: Source Zone: Internet Destination Zone: DMZ Rule Type: "intrazone" or "universal"

  C. Zone Pair: Source Zone: Internet Destination Zone: Internet Rule Type: "intrazone" or "universal"

  D. Zone Pair: Source Zone: Internet

  Destination Zone: Internet

  Rule Type:

  "intrazone"

  Correct Answer: B

• Question 98:

  Which option enables a Palo Alto Networks NGFW administrator to schedule Application and Threat updates while applying only new content-IDs to traffic?

  A. Select download-and-install.

  B. Select download-and-install, with "Disable new apps in content update" selected.

  C. Select download-only.

  D. Select disable application updates and select "Install only Threat updates"

  Correct Answer: C

• Question 99:

  Which two settings can be configured only locally on the firewall and not pushed from a Panorama template or template stack? (Choose two)

  A. HA1 IP Address

  B. Network Interface Type

  C. Master Key

  D. Zone Protection Profile

  Correct Answer: AB

• Question 100:

  Where can an administrator see both the management plane and data plane CPU utilization in the WebUI?

  A. System log

  B. CPU Utilization widget

  C. Resources widget

  D. System Utilization log

  Correct Answer: C