Palo Alto Networks Palo Alto Networks Certifications PCNSE8 Questions & Answers

• Question 111:

  Which User-ID method maps IP address to usernames for users connecting through a web proxy that has already authenticated the user?

  A. Client Probing

  B. Port mapping

  C. Server monitoring

  D. Syslog listening

  Correct Answer: D

• Question 112:

  An administrator has configured a QoS policy rule and a QoS profile that limits the maximum allowable bandwidth for the YouTube application. However , YouTube is consuming more than the maximum bandwidth allotment configured. Which configuration step needs to be configured to enable QoS?

  A. Enable QoS Data Filtering Profile

  B. Enable QoS monitor

  C. Enable Qos interface

  D. Enable Qos in the interface Management Profile.

  Correct Answer: C

• Question 113:

  Which is the maximum number of samples that can be submitted to WildFire per day, based on wildfire subscription?

  A. 15,000

  B. 10,000

  C. 75,00

  D. 5,000

  Correct Answer: B

• Question 114:

  Refer to the exhibit.

  

  An administrator is using DNAT to map two servers to a single public IP address. Traffic will be steered to the specific server based on the application, where Host A (10.1.1.100) receives HTTP traffic and Host B (10.1.1.101) receives SSH traffic.

  Which two Security policy rules will accomplish this configuration? (Choose two.)

  A. Untrust (Any) to Untrust (10.1.1.1) Ssh-Allow

  B. Untrust (Any) to DMZ (1.1.1.100) Ssh-Allow

  C. Untrust (Any) to DMZ (1.1.1.100) Web-browsing -Allow

  D. Untrust (Any) to Untrust (10.1.1.1) Web-browsing -Allow

  E. Untrust (Any) to DMZ (10.1.1.100.10.1.1.101), ssh, web-browsing -Allow

  Correct Answer: CD

• Question 115:

  Which three firewall states are valid? (Choose three)

  A. Suspended

  B. Passive

  C. Active

  D. Pending

  E. Functional

  Correct Answer: ABC

• Question 116:

  An administrator wants to upgrade an NGFW from PAN-OS?7 .1. 2 to PAN-OS?8 .0.2 The firewall is not a part of an HA pair. What needs to be updated first?

  A. XML Agent

  B. Applications and Threats

  C. WildFire

  D. PAN-OS?Upgrade Agent

  Correct Answer: B

• Question 117:

  An administrator wants a new Palo Alto Networks NGFW to obtain automatic application updates daily, so it is configured to use a scheduler for the application database. Unfortunately, they required the management network to be isolated so

  that it cannot reach the internet.

  Which configuration will enable the firewall to download and install application updates automatically?

  A. Configure a Policy Based Forwarding policy rule for the update server IP address so that traffic sourced from themanagement interfaced destined for the update servers goes out of the interface acting as your internet connection.

  B. Configure a security policy rule to allow all traffic to and from the update servers.

  C. Download and install application updates cannot be done automatically if the MGT port cannot reach the internet.

  D. Configure a service route for Palo Alto networks services that uses a dataplane interface that can route traffic to the internet, and create a security policy rule to allow the traffic from that interface to the update servers if necessary.

  Correct Answer: B

• Question 118:

  Which log file can be used to identify SSL decryption failures?

  A. Configuration

  B. Threats

  C. ACC

  D. Traffic

  Correct Answer: C

• Question 119:

  An administrator needs to upgrade an NGFW to the most current version of PAN-OS?software. The following is occurring:

  irewall has Internet connectivity through e1/1.

  efault security rules and security rules allowing all SSL and web-browsing traffic to and from any zone.

  ervice route is configured, sourcing update traffic from e1/1. communication error appears in the System logs when updates are performed.

  ownload does not complete.

  What must be configured to enable the firewall to download the current version of PAN-OS software?

  A. DNS settings for the firewall to use for resolution

  B. scheduler for timed downloads of PAN-OS software

  C. static route pointing application PaloAlto-updates to the update servers

  D. Security policy rule allowing PaloAlto-updates as the application

  Correct Answer: D

• Question 120:

  Which four NGFW multi-factor authentication factors are supported by PAN-OSS? (Choose four.)

  A. User logon

  B. Short message service

  C. Push

  D. SSH key

  E. One-Time Password

  F. Voice

  Correct Answer: BCEF