Palo Alto Networks Palo Alto Networks Certifications PCNSE8 Questions & Answers

• Question 161:

  An administrator has a requirement to export decrypted traffic from the Palo Alto Networks NGFW to a third-party, deep-level packet inspection appliance. Which interface type and license feature are necessary to meet the requirement?

  A. Decryption Mirror interface with the Threat Analysis license

  B. Virtual Wire interface with the Decryption Port Export license

  C. Tap interface with the Decryption Port Mirror license

  D. Decryption Mirror interface with the associated Decryption Port Mirror license

  Correct Answer: D

  Reference: https://www.paloaltonetworks.com/documentation/71/pan-os/pan- os/decryption/decryption-mirroring

• Question 162:

  Which three firewall states are valid? (Choose three.)

  A. Active

  B. Functional

  C. Pending

  D. Passive

  E. Suspended

  Correct Answer: ADE

  Reference: https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/high- availability/ha-firewall-states

• Question 163:

  The administrator has enabled BGP on a virtual router on the Palo Alto Networks NGFW, but new routes do not seem to be populating the virtual router. Which two options would help the administrator troubleshoot this issue? (Choose two.)

  A. View the System logs and look for the error messages about BGP.

  B. Perform a traffic pcap on the NGFW to see any BGP problems.

  C. View the Runtime Stats and look for problems with BGP configuration.

  D. View the ACC tab to isolate routing issues.

  Correct Answer: CD

• Question 164:

  An administrator has enabled OSPF on a virtual router on the NGFW. OSPF is not adding new routes to the virtual router. Which two options enable the administrator to troubleshoot this issue? (Choose two.)

  A. View Runtime Stats in the virtual router.

  B. View System logs.

  C. Add a redistribution profile to forward as BGP updates.

  D. Perform a traffic pcap at the routing stage.

  Correct Answer: AB

• Question 165:

  An administrator sees several inbound sessions identified as unknown-tcp in the Traffic logs. The administrator determines that these sessions are form external users accessing the company's proprietary accounting application. The

  administrator wants to reliably identify this traffic as their accounting application and to scan this traffic for threats.

  Which option would achieve this result?

  A. Create a custom App-ID and enable scanning on the advanced tab.

  B. Create an Application Override policy.

  C. Create a custom App-ID and use the "ordered conditions" check box.

  D. Create an Application Override policy and custom threat signature for the application.

  Correct Answer: A

• Question 166:

  If an administrator does not possess a website's certificate, which SSL decryption mode will allow the Palo Alto networks NGFW to inspect when users browse to HTTP(S) websites?

  A. SSL Forward Proxy

  B. SSL Inbound Inspection

  C. TLS Bidirectional proxy

  D. SSL Outbound Inspection

  Correct Answer: A

• Question 167:

  How can a candidate or running configuration be copied to a host external from Panorama?

  A. Commit a running configuration.

  B. Save a configuration snapshot.

  C. Save a candidate configuration.

  D. Export a named configuration snapshot.

  Correct Answer: D

  Reference:

  https://www.paloaltonetworks.com/documentation/71/panorama/panorama_adminguide/administ er-panorama/back-up- panorama-and-firewall-configurations

• Question 168:

  Which feature must you configure to prevent users form accidentally submitting their corporate credentials to a phishing website?

  A. URL Filtering profile

  B. Zone Protection profile

  C. Anti-Spyware profile

  D. Vulnerability Protection profile

  Correct Answer: A

  Reference: https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/threat- prevention/prevent-credential-phishing

• Question 169:

  The certificate information displayed in the following image is for which type of certificate?

  

  A. Forward Trust certificate

  B. Self-Signed Root CA certificate

  C. Web Server certificate

  D. Public CA signed certificate

  Correct Answer: B

• Question 170:

  Which three steps will reduce the CPU utilization on the management plane? (Choose three.)

  A. Disable SNMP on the management interface.

  B. Application override of SSL application.

  C. Disable logging at session start in Security policies.

  D. Disable predefined reports.

  E. Reduce the traffic being decrypted by the firewall.

  Correct Answer: CDE