Palo Alto Networks Palo Alto Networks Certifications PCNSE8 Questions & Answers

• Question 31:

  Firewall administrators cannot authenticate to a firewall GUI. Which two logs on that firewall will contain authentication-related information useful in troubleshooting this issue? (Choose two.)

  A. ms log

  B. authd log

  C. System log

  D. Traffic log

  E. dp-monitor .log

  Correct Answer: BC

• Question 32:

  Several offices are connected with VPNs using static IPv4 routes. An administrator has been tasked with implementing OSPF to replace static routing. Which step is required to accomplish this goal?

  A. Assign an IP address on each tunnel interface at each site

  B. Enable OSPFv3 on each tunnel interface and use Area ID 0.0.0.0

  C. Assign OSPF Area ID 0.0.0.0 to all Ethernet and tunnel interfaces

  D. Create new VPN zones at each site to terminate each VPN connection

  Correct Answer: C

• Question 33:

  Which option is an IPv6 routing protocol?

  A. RIPv3

  B. OSPFv3

  C. OSPv3

  D. BGP NG

  Correct Answer: B

• Question 34:

  A Network Administrator wants to deploy a Large Scale VPN solution. The Network Administrator has chosen a GlobalProtect Satellite solution. This configuration needs to be deployed to multiple remote offices and the Network Administrator

  decides to use Panorama to deploy the configurations.

  How should this be accomplished?

  A. Create a Template with the appropriate IKE Gateway settings

  B. Create a Template with the appropriate IPSec tunnel settings

  C. Create a Device Group with the appropriate IKE Gateway settings

  D. Create a Device Group with the appropriate IPSec tunnel settings

  Correct Answer: B

• Question 35:

  A network design calls for a "router on a stick" implementation with a PA-5060 performing inter- VLAN routing All VLAN-tagged traffic will be forwarded to the PA-5060 through a single dot1q trunk interface Which interface type and configuration setting will support this design?

  A. Trunk interface type with specified tag

  B. Layer 3 interface type with specified tag

  C. Layer 2 interface type with a VLAN assigned

  D. Layer 3 subinterface type with specified tag

  Correct Answer: D

• Question 36:

  A company.com wants to enable Application Override. Given the following screenshot:

  

  Which two statements are true if Source and Destination traffic match the Application Override policy? (Choose two)

  A. Traffic that matches "rtp-base" will bypass the App-ID and Content-ID engines.

  B. Traffic will be forced to operate over UDP Port 16384.

  C. Traffic utilizing UDP Port 16384 will now be identified as "rtp-base".

  D. Traffic utilizing UDP Port 16384 will bypass the App-ID and Content-ID engines.

  Correct Answer: AC

• Question 37:

  Support for which authentication method was added in PAN-OS 8.0?

  A. RADIUS

  B. LDAP

  C. Diameter

  D. TACACS+

  Correct Answer: D

  https://www.paloaltonetworks.com/resources/datasheets/whats-new-in-pan-os-7-1

• Question 38:

  After pushing a security policy from Panorama to a PA-3020 firwall, the firewall administrator notices that traffic logs from the PA-3020 are not appearing in Panorama's traffic logs. What could be the problem?

  A. A Server Profile has not been configured for logging to this Panorama device.

  B. Panorama is not licensed to receive logs from this particular firewall.

  C. The firewall is not licensed for logging to this Panorama device.

  D. None of the firwwall's policies have been assigned a Log Forwarding profile

  Correct Answer: D

• Question 39:

  Which two interface types can be used when configuring GlobalProtect Portal?(Choose two)

  A. Virtual Wire

  B. Loopback

  C. Layer 3

  D. Tunnel

  Correct Answer: BC

• Question 40:

  Which three options does the WF-500 appliance support for local analysis? (Choose three)

  A. E-mail links

  B. APK files

  C. jar files

  D. PNG files

  E. Portable Executable (PE) files

  Correct Answer: ACE