Palo Alto Networks Palo Alto Networks Certifications PCNSE8 Questions & Answers

• Question 241:

  An administrator has been asked to configure active/active HA for a pair of Palo Alto Networks NGFWs. The firewall use Layer 3 interfaces to send traffic to a single gateway IP for the pair. Which configuration will enable this HA scenario?

  A. The two firewalls will share a single floating IP and will use gratuitous ARP to share the floating IP.

  B. Each firewall will have a separate floating IP, and priority will determine which firewall has the primary IP.

  C. The firewalls do not use floating IPs in active/active HA.

  D. The firewalls will share the same interface IP address, and device 1 will use the floating IP if device 0 fails.

  Correct Answer: A

• Question 242:

  Which two methods can be configured to validate the revocation status of a certificate? (Choose two.)

  A. CRL

  B. CRT

  C. OCSP

  D. Cert-Validation-Profile

  E. SSL/TLS Service Profile

  Correct Answer: AC

• Question 243:

  Which administrative authentication method supports authorization by an external service?

  A. Certificates

  B. LDAP

  C. RADIUS

  D. SSH keys

  Correct Answer: C

• Question 244:

  What should an administrator consider when planning to revert Panorama to a pre-PAN-OS 8.1 version?

  A. Panorama cannot be reverted to an earlier PAN-OS release if variables are used in templates or template stacks.

  B. An administrator must use the Expedition tool to adapt the configuration to the pre-PAN-OS 8.1 state.

  C. When Panorama is reverted to an earlier PAN-OS release, variables used in templates or template stacks will be removed automatically.

  D. Administrators need to manually update variable characters to those used in pre-PAN-OS 8.1.

  Correct Answer: A

• Question 245:

  Which is not a valid reason for receiving a decrypt-cert-validation error?

  A. Unsupported HSM

  B. Unknown certificate status

  C. Client authentication

  D. Untrusted issuer

  Correct Answer: A

• Question 246:

  In the following image from Panorama, why are some values shown in red?

  

  A. sg2 session count is the lowest compared to the other managed devices.

  B. us3 has a logging rate that deviates from the administrator-configured thresholds.

  C. uk3 has a logging rate that deviates from the seven-day calculated baseline.

  D. sg2 has misconfigured session thresholds.

  Correct Answer: C

• Question 247:

  The firewall is not downloading IP addresses from MineMeld. Based on the image, what most likely is wrong?

  

  A. A Certificate Profile that contains the client certificate needs to be selected.

  B. The source address supports only files hosted with an ftp://

  .

  C. External Dynamic Lists do not support SSL connections.

  D. A Certificate Profile that contains the CA certificate needs to be selected.

  Correct Answer: D

• Question 248:

  Which feature can provide NGFWs with User-ID mapping information?

  A. Web Captcha

  B. Native 802.1q authentication

  C. GlobalProtect

  D. Native 802.1x authentication

  Correct Answer: C

• Question 249:

  What are the two behavior differences between Highlight Unused Rules and the Rule Usage Hit counter when a firewall is rebooted? (Choose two.)

  A. Rule Usage Hit counter will not be reset

  B. Highlight Unused Rules will highlight all rules.

  C. Highlight Unused Rules will highlight zero rules.

  D. Rule Usage Hit counter will reset.

  Correct Answer: AB

• Question 250:

  An administrator is defining protection settings on the Palo Alto Networks NGFW to guard against resource exhaustion. When platform utilization is considered, which steps must the administrator take to configure and apply packet buffer protection?

  A. Enable and configure the Packet Buffer protection thresholds.Enable Packet Buffer Protection per ingress zone.

  B. Enable and then configure Packet Buffer thresholdsEnable Interface Buffer protection.

  C. Create and Apply Zone Protection Profiles in all ingress zones.Enable Packet Buffer Protection per ingress zone.

  D. Configure and apply Zone Protection Profiles for all egress zones.Enable Packet Buffer Protection pre egress zone.

  E. Enable per-vsys Session Threshold alerts and triggers for Packet Buffer Limits.Enable Zone Buffer Protection per zone.

  Correct Answer: A