Palo Alto Networks Palo Alto Networks Certifications PCNSE8 Questions & Answers

• Question 171:

  During the packet flow process, which two processes are performed in application identification? (Choose two.)

  A. Pattern based application identification

  B. Application override policy match

  C. Application changed from content inspection

  D. Session application identified.

  Correct Answer: BD

• Question 172:

  Which tool provides an administrator the ability to see trends in traffic over periods of time, such as threats detected in the last 30 days?

  A. Session Browser

  B. Application Command Center

  C. TCP Dump

  D. Packet Capture

  Correct Answer: B

  Reference: https://live.paloaltonetworks.com/t5/Management-Articles/Tips-amp-Tricks-How-to- Use-the-Application-Command-Center- ACC/ta-p/67342

• Question 173:

  Which CLI command enables an administrator to view details about the firewall including uptime, PAN-OS-version, and serial number?

  A. debug system details

  B. show session info

  C. show system info

  D. show system details

  Correct Answer: C

  Reference: https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/technical- documentation/pan-os-60/PAN-OS-6.0- CLI-ref.pdf

• Question 174:

  Which three options are supported in HA Lite? (Choose three.)

  A. Virtual link

  B. Active/passive deployment

  C. Synchronization of IPsec security associations

  D. Configuration synchronization

  E. Session synchronization

  Correct Answer: BCD

  Reference: https://www.paloaltonetworks.com/documentation/80/pan-os/web-interface- help/device/device-high-availability/ha-lite

• Question 175:

  An administrator has configured the Palo Alto Networks NGFW's management interface to connect to the internet through a dedicated path that does not traverse back through the NGFW itself. Which configuration setting or step will allow the firewall to get automatic application signature updates?

  A. A scheduler will need to be configured for application signatures.

  B. A Security policy rule will need to be configured to allow the update requests from the firewall to the update servers.

  C. A Threat Prevention license will need to be installed.

  D. A service route will need to be configured.

  Correct Answer: D

  The firewall uses the service route to connect to the Update Server and checks for new content release versions and, if there are updates available, displays them at the top of the list. Reference: https://www.paloaltonetworks.com/documentation/80/pan-os/web-interface- help/device/device-dynamic-updates

• Question 176:

  Which CLI command can be used to export the tcpdump capture?

  A. scp export tcpdump from mgmt.pcap to

  B. scp extract mgmt-pcap from mgmt.pcap to

  C. scp export mgmt-pcap from mgmt.pcap to

  D. download mgmt.-pcap

  Correct Answer: C

  Reference: https://live.paloaltonetworks.com/t5/Management-Articles/How-To-Packet-Capture- tcpdump-On-Management-Interface/ta- p/55415

• Question 177:

  Which item enables a firewall administrator to see details about traffic that is currently active through the NGFW?

  A. ACC

  B. System Logs

  C. App Scope

  D. Session Browser

  Correct Answer: D

• Question 178:

  Which protection feature is available only in a Zone Protection Profile?

  A. SYN Flood Protection using SYN Flood Cookies

  B. ICMP Flood Protection

  C. Port Scan Protection

  D. UDP Flood Protections

  Correct Answer: A

• Question 179:

  Refer to the exhibit.

  

  Which certificates can be used as a Forwarded Trust certificate?

  A. Certificate from Default Trust Certificate Authorities

  B. Domain Sub-CA

  C. Forward_Trust

  D. Domain-Root-Cert

  Correct Answer: A

• Question 180:

  Which option would an administrator choose to define the certificate and protocol that Panorama and its managed devices use for SSL/TLS services?

  A. Configure a Decryption Profile and select SSL/TLS services.

  B. Set up SSL/TLS under Polices > Service/URL Category>Service.

  C. Set up Security policy rule to allow SSL communication.

  D. Configure an SSL/TLS Profile.

  Correct Answer: D

  Reference: https://www.paloaltonetworks.com/documentation/80/pan-os/web-interface- help/device/device-certificate-management- ssltls-service-profile