Palo Alto Networks Palo Alto Networks Certifications PCNSE8 Questions & Answers

• Question 41:

  Which Palo Alto Networks VM-Series firewall is supported for VMware NSX?

  A. VM-100

  B. VM-200

  C. VM-1000-HV

  D. VM-300

  Correct Answer: C

• Question 42:

  A client is deploying a pair of PA-5000 series firewalls using High Availability (HA) in Active/Passive mode. Which statement is true about this deployment?

  A. The two devices must share a routable floating IP address

  B. The two devices may be different models within the PA-5000 series

  C. The HA1 IP address from each peer must be on a different subnet

  D. The management port may be used for a backup control connection

  Correct Answer: D

• Question 43:

  Which interface configuration will accept specific VLAN IDs?

  A. Tab Mode

  B. Subinterface

  C. Access Interface

  D. Trunk Interface

  Correct Answer: B

• Question 44:

  A company has a policy that denies all applications it classifies as bad and permits only application it classifies as good. The firewall administrator created the following security policy on the company's firewall.

  

  Which interface configuration will accept specific VLAN IDs? Which two benefits are gained from having both rule 2 and rule 3 presents? (choose two)

  A. A report can be created that identifies unclassified traffic on the network.

  B. Different security profiles can be applied to traffic matching rules 2 and 3.

  C. Rule 2 and 3 apply to traffic on different ports.

  D. Separate Log Forwarding profiles can be applied to rules 2 and 3.

  Correct Answer: BD

  B: Most malware sneaks onto the network in legitimate applications or services. Therefore, to safely enable applications you must scan all traffic allowed into the network for threats. To do this, attach security profiles to all Security policy rules

  that allow traffic so that you can detect threats both known and unknown in your network traffic.

  D: Log forwarding profiles allow you to forward traffic and threat logs to Panorama or an external system. A log forwarding profile can be added to a security zone to forward zone protection logs or to a security policy to forward logs for traffic

  that matches that policy.

  Incorrect Answers:

  A: Rules are not use to identify unclassified traffic.

  Note: Besides checking for a specific application, you can also check for any unknown applications in the list of top applications These are applications that did not match a defined App-ID signature and display as unknown-udp and unknowntcp. To delve into these unknown applications, click on the name to drill down to the details for the unclassified traffic.

  C: Rule 2 and Rule 3 apply to all any address in Trust-L3, and are not restricted to any specific ports.

  References:

  https://www.Daloaltonetworks.com/documentation/7l/pan-os/pan-os/policv/create-best-practice-securitv-Drofiles

  https://www.paloaltonetworks.com/documentation/61/pan-os/pan-os/reports-and-loaainQ/loo-forwarding-profiles.html

• Question 45:

  The GlobalProtect Portal interface and IP address have been configured. Which other value needs to be defined to complete the network settings configuration of GlobalPortect Portal?

  A. Server Certificate

  B. Client Certificate

  C. Authentication Profile

  D. Certificate Profile

  Correct Answer: A

  (https://live.paloaltonetworks.HYPERLINK "https://live.paloaltonetworks.com/t5/Configuration- Articles/How-to-Configure-GlobalProtect/ta-p/58351"com/t5/Configuration-Articles/How-to- Configure-GlobalProtect/ta-p/58351)

• Question 46:

  A host attached to ethernet1/3 cannot access the internet. The default gateway is attached to ethernet1/4. After troubleshooting. It is determined that traffic cannot pass from the ethernet1/3 to ethernet1/4. What can be the cause of the problem?

  A. DHCP has been set to Auto.

  B. Interface ethernet1/3 is in Layer 2 mode and interface ethernet1/4 is in Layer 3 mode.

  C. Interface ethernet1/3 and ethernet1/4 are in Virtual Wire Mode.

  D. DNS has not been properly configured on the firewall

  Correct Answer: B

• Question 47:

  A firewall administrator is troubleshooting problems with traffic passing through the Palo Alto Networks firewall. Which method shows the global counters associated with the traffic after configuring the appropriate packet filters?

  A. From the CLI, issue the show counter global filter pcap yes command.

  B. From the CLI, issue the show counter global filter packet-filter yes command.

  C. From the GUI, select show global counters under the monitor tab.

  D. From the CLI, issue the show counter interface command for the ingress interface.

  Correct Answer: B

• Question 48:

  How are IPV6 DNS queries configured to user interface ethernet1/3?

  A. Network > Virtual Router > DNS Interface

  B. Objects > CustomerObjects > DNS

  C. Network > Interface Mgrnt

  D. Device > Setup > Services > Service Route Configuration

  Correct Answer: D

• Question 49:

  What can missing SSL packets when performing a packet capture on dataplane interfaces?

  A. The packets are hardware offloaded to the offloaded processor on the dataplane

  B. The missing packets are offloaded to the management plane CPU

  C. The packets are not captured because they are encrypted

  D. There is a hardware problem with offloading FPGA on the management plane

  Correct Answer: A

• Question 50:

  Which Security Policy Rule configuration option disables antivirus and anti-spyware scanning of server-to-client flows only?

  A. Disable Server Response Inspection

  B. Apply an Application Override

  C. Disable HIP Profile

  D. Add server IP Security Policy exception

  Correct Answer: A