Palo Alto Networks Palo Alto Networks Certifications PCNSE8 Questions & Answers

• Question 121:

  Which menu item enables a firewall administrator to see details about traffic that is currently active through the NGFW?

  A. App Scope

  B. ACC

  C. Session Browser

  D. System Logs

  Correct Answer: C

• Question 122:

  Which data flow describes redistribution of user mappings?

  A. User-ID agent to firewall

  B. firewall to firewall

  C. Domain Controller to User-ID agent

  D. User-ID agent to Panorama

  Correct Answer: B

• Question 123:

  Which two features does PAN-OS?software use to identify applications? (Choose two)

  A. port number

  B. session number

  C. transaction characteristics

  D. application layer payload

  Correct Answer: CD

• Question 124:

  Which logs enable a firewall administrator to determine whether a session was decrypted?

  A. Correlated Event

  B. Traffic

  C. Decryption

  D. Security Policy

  Correct Answer: B

• Question 125:

  An administrator sees several inbound sessions identified as unknown-tcp in the traffic logs. The administrator determines that these sessions are from external users accessing the company's proprietary accounting application. The

  administrator wants to reliably identify this as their accounting application and to scan this traffic for threats.

  Which option would achieve this result?

  A. Create an Application Override policy and a custom threat signature for the application

  B. Create an Application Override policy

  C. Create a custom App-ID and use the "ordered conditions" check box

  D. Create a custom App ID and enable scanning on the advanced tab

  Correct Answer: A

• Question 126:

  A company wants to install a PA-3060 firewall between two core switches on a VLAN trunk link. They need to assign each VLAN to its own zone and to assign untagged (native) traffic to its own zone, which options differentiates multiple VLAN into separate zones?

  A. Create VLAN objects for each VLAN and assign VLAN interfaces matching each VLAN ID. Repeat for every additional VLANand use a VLAN ID of 0 for untagged traffic. Assign each interface/subinterface to a unique zone.

  B. Create V-Wire objects with two V-Wire sub interface and assign only a single VLAN ID to the "Tag Allowed field one of the V-Wire object Repeat for every additional VLAN and use a VIAN ID of 0 for untagged traffic. Assign each interface/ subinterfaceto a unique zone.

  C. Create V-Wire objects with two V-Wire interfaces and define a range "0- 4096" in the 'Tag Allowed filed of the V-Wire object.

  D. Create Layer 3 sub interfaces that are each assigned to a single VLAN ID and a common virtual router. The physical Layer 3interface would handle untagged traffic. Assign each interface /subinterface to a unique zone. Do not assign any interface anIP address

  Correct Answer: C

• Question 127:

  The firewall determines if a packet is the first packet of a new session or if a packet is part of an existing session using which kind of match?

  A. 5-tuple match Source IP Address, Destination IP Address, Source Port, Destination Port, Protocol

  B. 7-tuple match Source IP Address, Destination IP Address, Source Port, Destination Port ,Source User, URL Category and Source Security Zone.

  C. 6-tuple match Source IP Address, Destination IP Address, Source Port, Destination Port, Protocol and Source Security Zone

  D. 9-tuple match Source IP Address, Destination IP Address, Source Port, Destination Port, Source User, Source Security Zone, Destination Security Zone, Application and URL Category

  Correct Answer: A

• Question 128:

  A customer wants to set up a site-to-site VPN using tunnel interfaces. Which two formats are correct for naming tunnel interfaces? (Choose two.)

  A. Vpn-tunnel.1024

  B. vpn-tunne.1

  C. tunnel 1025

  D. tunnel. 1

  Correct Answer: CD

• Question 129:

  For which two reasons would a firewall discard a packet as part of the packet flow sequence? (Choose two )

  A. equal-cost multipath

  B. ingress processing errors

  C. rule match with action "allow"

  D. rule match with action "deny"

  Correct Answer: BD

• Question 130:

  An administrator deploys PA-500 NGFWs as an active/passive high availability pair. The devices are not participating in dynamic routing and preemption is disabled. What must be verified to upgrade the firewalls to the most recent version of PAN-OS software?

  A. Wildfire update package

  B. User-ID agent

  C. Anti virus update package

  D. Application and Threats update package

  Correct Answer: D

  : Dependencies : Before upgrade, make sure the firewall is running a version of app + threat (content version) that meets the minimum requirement of the new PAN-OS Upgrade.

  Reference: https://live.paloaltonetworks.com/t5/Featured-Articles/Best-Practices-for-PAN-OS- Upgrade/ta-p/111045