Palo Alto Networks Palo Alto Networks Certifications PCNSE8 Questions & Answers

• Question 191:

  Which Security policy rule will allow an admin to block facebook chat but allow Facebook in general?

  A. Deny application facebook-chat before allowing application facebook

  B. Deny application facebook on top

  C. Allow application facebook on top

  D. Allow application facebook before denying application facebook-chat

  Correct Answer: A

  Reference: https://live.paloaltonetworks.com/t5/Configuration-Articles/Failed-to-Block-Facebook- Chat-Consistently/ta-p/115673

• Question 192:

  Which three file types can be forwarded to WildFire for analysis as a part of the basic WildFire service? (Choose three.)

  A. dll

  B. exe

  C. src

  D. apk

  E. pdf

  F. jar

  Correct Answer: DEF

  Reference: https://www.paloaltonetworks.com/documentation/80/wildfire/wf_admin/wildfire- overview/wildfire-file-type-support

• Question 193:

  Refer to the exhibit.

  

  Which will be the egress interface if the traffic's ingress interface is ethernet 1/7 sourcing from 192.168.111.3 and to the destination 10.46.41.113?

  A. ethernet1/6

  B. ethernet1/3

  C. ethernet1/7

  D. ethernet1/5

  Correct Answer: D

• Question 194:

  An administrator wants multiple web servers in the DMZ to receive connections initiated from the internet. Traffic destined for 206.15.22.9 port 80/TCP needs to be forwarded to the server at 10.1.1.22

  Based on the information shown in the image, which NAT rule will forward web-browsing traffic correctly?

  

  A. Option A

  B. Option B

  C. Option C

  D. Option D

  Correct Answer: C

• Question 195:

  An administrator creates a custom application containing Layer 7 signatures. The latest application and threat dynamic update is downloaded to the same NGFW. The update contains an application that matches the same traffic signatures as

  the custom application.

  Which application should be used to identify traffic traversing the NGFW?

  A. Custom application

  B. System logs show an application error and neither signature is used.

  C. Downloaded application

  D. Custom and downloaded application signature files are merged and both are used

  Correct Answer: A

• Question 196:

  VPN traffic intended for an administrator's Palo Alto Networks NGFW is being maliciously intercepted and retransmitted by the interceptor. When creating a VPN tunnel, which protection profile can be enabled to prevent this malicious behavior?

  A. Zone Protection

  B. DoS Protection

  C. Web Application

  D. Replay

  Correct Answer: A

• Question 197:

  Which Palo Alto Networks VM-Series firewall is valid?

  A. VM-25

  B. VM-800

  C. VM-50

  D. VM-400

  Correct Answer: C

  Reference: https://www.paloaltonetworks.com/products/secure-the-network/virtualized-next- generation-firewall/vm-series

• Question 198:

  An administrator is using Panorama and multiple Palo Alto Networks NGFWs. After upgrading all devices to the latest PAN-OS?software, the administrator enables log forwarding from the firewalls to Panorama; Pre-existing logs from the

  firewalls are not appearing in PanoramA.

  Which action would enable the firewalls to send their pre-existing logs to Panorama?

  A. Use the import option to pull logs into Panorama;

  B. A CLI command will forward the pre-existing logs to Panorama;

  C. Use the ACC to consolidate pre-existing logs.

  D. The log database will need to exported form the firewalls and manually imported into Panorama;

  Correct Answer: B

• Question 199:

  A Palo Alto Networks NGFW just submitted a file to WildFire for analysis. Assume a 5-minute window for analysis. The firewall is configured to check for verdicts every 5 minutes. How quickly will the firewall receive back a verdict?

  A. More than 15 minutes

  B. 5 minutes

  C. 10 to 15 minutes

  D. 5 to 10 minutes

  Correct Answer: D

• Question 200:

  A customer has an application that is being identified as unknown-top for one of their custom PostgreSQL database connections. Which two configuration options can be used to correctly categorize their custom database application? (Choose two.)

  A. Application Override policy.

  B. Security policy to identify the custom application.

  C. Custom application.

  D. Custom Service object.

  Correct Answer: BD