Palo Alto Networks Palo Alto Networks Certifications PCNSE8 Questions & Answers

• Question 131:

  Which three authentication factors does PAN-OS?software support for MFA (Choose three.)

  A. Push

  B. Pull

  C. Okta Adaptive

  D. Voice

  E. SMS

  Correct Answer: ADE

  Reference: https://www.paloaltonetworks.com/documentation/80/pan-os/pan- os/authentication/configure-multi-factor-authentication

• Question 132:

  VPN traffic intended for an administrator's Palo Alto Networks NGFW is being maliciously intercepted and retransmitted by the interceptor. When creating a VPN tunnel, which protection profile can be enabled to prevent this malicious behavior?

  A. Zone Protection

  B. Replay

  C. Web Application

  D. DoS Protection

  Correct Answer: A

• Question 133:

  A customer wants to combine multiple Ethernet interfaces into a single virtual interface using link aggregation. Which two formats are correct for naming aggregate interfaces? (Choose two.)

  A. ae.8

  B. aggregate.1

  C. ae.1

  D. aggregate.8

  Correct Answer: AC

• Question 134:

  Which prerequisite must be satisfied before creating an SSH proxy Decryption policy?

  A. Both SSH keys and SSL certificates must be generated.

  B. No prerequisites are required.

  C. SSH keys must be manually generated.

  D. SSL certificates must be generated.

  Correct Answer: B

  Reference: https://www.paloaltonetworks.com/documentation/71/pan-os/pan- os/decryption/configure-ssh-proxy

• Question 135:

  What is exchanged through the HA2 link?

  A. hello heartbeats

  B. User-ID information

  C. session synchronization

  D. HA state information

  Correct Answer: C

  Reference: https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/high- availability/ha-links-and-backup-links

• Question 136:

  Which three user authentication services can be modified to provide the Palo Alto Networks NGFW with both usernames and role names? (Choose three.)

  A. TACACS+

  B. Kerberos

  C. PAP

  D. LDAP

  E. SAML

  F. RADIUS

  Correct Answer: ADF

• Question 137:

  View the GlobalProtect configuration screen capture. What is the purpose of this configuration?

  

  A. It configures the tunnel address of all internal clients to an IP address range starting at 192.168.10.1.

  B. It forces an internal client to connect to an internal gateway at IP address 192.168.10.1.

  C. It enables a client to perform a reverse DNS lookup on 192.168.10.1 to detect that it is an internal client.

  D. It forces the firewall to perform a dynamic DNS update, which adds the internal gateway's hostname and IP address to the DNS server.

  Correct Answer: C

  Reference: https://www.paloaltonetworks.com/documentation/80/globalprotect/globalprotect- admin-guide/globalprotect-portals/define- the-globalprotect-client-authentication- configurations/define-the-globalprotect-agent-configurations

• Question 138:

  Which two subscriptions are available when configuring panorama to push dynamic updates to connected devices? (Choose two.)

  A. Content-ID

  B. User-ID

  C. Applications and Threats

  D. Antivirus

  Correct Answer: CD

  Reference: https://www.paloaltonetworks.com/documentation/71/pan-os/web-interface- help/device/device-dynamic-updates

• Question 139:

  Which DoS protection mechanism detects and prevents session exhaustion attacks?

  A. Packet Based Attack Protection

  B. Flood Protection

  C. Resource Protection

  D. TCP Port Scan Protection

  Correct Answer: C

  Reference: https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/policy/dos- protection-profiles

• Question 140:

  Which CLI command enables an administrator to check the CPU utilization of the dataplane?

  A. show running resource-monitor

  B. debug data-plane dp-cpu

  C. show system resources

  D. debug running resources

  Correct Answer: A