Palo Alto Networks Palo Alto Networks Certifications PCNSE8 Questions & Answers

• Question 71:

  Which client software can be used to connect remote Linux client into a Palo Alto Networks Infrastructure without sacrificing the ability to scan traffic and protect against threats?

  A. X-Auth IPsec VPN

  B. GlobalProtect Apple IOS

  C. GlobalProtect SSL

  D. GlobalProtect Linux

  Correct Answer: A

  ( http://blog.webernetz.net/2014/03/31/palo-alto-globalprotect-for-linux-with-vpnc/ )

• Question 72:

  How does Panorama handle incoming logs when it reaches the maximum storage capacity?

  A. Panorama discards incoming logs when storage capacity full.

  B. Panorama stops accepting logs until licenses for additional storage space are applied

  C. Panorama stops accepting logs until a reboot to clean storage space.

  D. Panorama automatically deletes older logs to create space for new ones.

  Correct Answer: D

  (https://www.paloaltonetworks.com/documentation/60/panorama/panorama_adminguide/set-up- panorama/determine-panorama-log-storage-requirements)

• Question 73:

  An Administrator is configuring an IPSec VPN toa Cisco ASA at the administrator's home and experiencing issues completing the connection. The following is th output from the command: less mp-log ikemgr.log:

  

  What could be the cause of this problem?

  A. The public IP addresse do not match for both the Palo Alto Networks Firewall and the ASA.

  B. The Proxy IDs on the Palo Alto Networks Firewall do not match the settings on the ASA.

  C. The shared secerts do not match between the Palo Alto firewall and the ASA

  D. The deed peer detection settings do not match between the Palo Alto Networks Firewall and the ASA

  Correct Answer: B

• Question 74:

  A critical US-CERT notification is published regarding a newly discovered botnet. The malware is very evasive and is not reliably detected by endpoint antivirus software. Furthermore, SSL is used to tunnel malicious traffic to command-andcontrol servers on the internet and SSL Forward Proxy Decryption is not enabled.

  Which component once enabled on a perirneter firewall will allow the identification of existing infected hosts in an environment?

  A. Anti-Spyware profiles applied outbound security policies with DNS Query action set to sinkhole

  B. File Blocking profiles applied to outbound security policies with action set to alert

  C. Vulnerability Protection profiles applied to outbound security policies with action set to block

  D. Antivirus profiles applied to outbound security policies with action set to alert

  Correct Answer: A

• Question 75:

  Which Public Key infrastructure component is used to authenticate users for GlobalProtect when the Connect Method is set to pre-logon?

  A. Certificate revocation list

  B. Trusted root certificate

  C. Machine certificate

  D. Online Certificate Status Protocol

  Correct Answer: C

• Question 76:

  Which three log-forwarding destinations require a server profile to be configured? (Choose three)

  A. SNMP Trap

  B. Email

  C. RADIUS

  D. Kerberos

  E. Panorama

  F. Syslog

  Correct Answer: ABF

• Question 77:

  The company's Panorama server (IP 10.10.10.5) is not able to manage a firewall that was recently deployed. The firewall's dedicated management port is being used to connect to the management network. Which two commands may be used to troubleshoot this issue from the CLI of the new firewall? (Choose two)

  A. test panoramas-connect 10.10.10.5

  B. show panoramas-status

  C. show arp all I match 10.10.10.5

  D. topdump filter "host 10.10.10.5

  E. debug dataplane packet-diag set capture on

  Correct Answer: BD

• Question 78:

  A company has a pair of Palo Alto Networks firewalls configured as an Acitve/Passive High Availability (HA) pair. What allows the firewall administrator to determine the last date a failover event occurred?

  A. From the CLI issue use the show System log

  B. Apply the filter subtype eq ha to the System log

  C. Apply the filter subtype eq ha to the configuration log

  D. Check the status of the High Availability widget on the Dashboard of the GUI

  Correct Answer: B

• Question 79:

  Which setting allow a DOS protection profile to limit the maximum concurrent sessions from a source IP address?

  A. Set the type to Aggregate, clear the session's box and set the Maximum concurrent Sessions to 4000.

  B. Set the type to Classified, clear the session's box and set the Maximum concurrent Sessions to 4000.

  C. Set the type Classified, check the Sessions box and set the Maximum concurrent Sessions to 4000.

  D. Set the type to aggregate, check the Sessions box and set the Maximum concurrent Sessions to 4000.

  Correct Answer: C

• Question 80:

  Which command can be used to validate a Captive Portal policy?

  A. eval captive-portal policy

  B. request cp-policy-eval

  C. test cp-policy-match

  D. debug cp-policy

  Correct Answer: C