Palo Alto Networks Palo Alto Networks Certifications PCNSE8 Questions & Answers

• Question 81:

  What are three valid actions in a File Blocking Profile? (Choose three)

  A. Forward

  B. Block

  C. Alret

  D. Upload

  E. Reset-both

  F. Continue

  Correct Answer: ABC

  https://live.paloaltonetworksHYPERLINK "https://live.paloaltonetworks.com/t5/Configuration- Articles/File-Blocking-Rulebase-and-Action-Precedence/ta-p/53623".com/t5/Configuration- ArticHYPERLINK "https://live.paloaltonetworks.com/t5/ Configuration-Articles/File-Blocking- Rulebase-and-Action-Precedence/ta-p/53623"les/File-Blocking-RulebHYPERLINK "https://live.paloaltonetworks.com/t5/Configuration-Articles/File-Blocking-Rulebase-and-Action- Precedence/tap/53623"ase-and-Action-Precedence/ta-p/53623

• Question 82:

  How is the Forward Untrust Certificate used?

  A. It issues certificates encountered on the Untrust security zone when clients attempt to connect to a site that has be decrypted/

  B. It is used when web servers request a client certificate.

  C. It is presented to clients when the server they are connecting to is signed by a certificate authority that is not trusted by firewall.

  D. It is used for Captive Portal to identify unknown users.

  Correct Answer: C

• Question 83:

  Click the Exhibit button

  

  An administrator has noticed a large increase in bittorrent activity. The administrator wants to determine where the traffic is going on the company. What would be the administrator's next step?

  A. Right-Click on the bittorrent link and select Value from the context menu

  B. Create a global filter for bittorrent traffic and then view Traffic logs.

  C. Create local filter for bittorrent traffic and then view Traffic logs.

  D. Click on the bittorrent application link to view network activity

  Correct Answer: D

• Question 84:

  Which two mechanisms help prevent a spilt brain scenario an Active/Passive High Availability (HA) pair? (Choose two)

  A. Configure the management interface as HA3 Backup

  B. Configure Ethernet 1/1 as HA1 Backup

  C. Configure Ethernet 1/1 as HA2 Backup

  D. Configure the management interface as HA2 Backup

  E. Configure the management interface as HA1 Backup

  F. Configure ethernet1/1 as HA3 Backup

  Correct Answer: BE

• Question 85:

  Which two statements are correct for the out-of-box configuration for Palo Alto Networks NGFWs? (Choose two)

  A. The devices are pre-configured with a virtual wire pair out the first two interfaces.

  B. The devices are licensed and ready for deployment.

  C. The management interface has an IP address of 192.168.1.1 and allows SSH and HTTPS connections.

  D. A default bidirectional rule is configured that allows Untrust zone traffic to go to the Trust zone.

  E. The interface are pingable.

  Correct Answer: BC

• Question 86:

  A network Administrator needs to view the default action for a specific spyware signature. The administrator follows the tabs and menus through Objects> Security Profiles> Anti-Spyware and select default profile. What should be done next?

  A. Click the simple-critical rule and then click the Action drop-down list.

  B. Click the Exceptions tab and then click show all signatures.

  C. View the default actions displayed in the Action column.

  D. Click the Rules tab and then look for rules with "default" in the Action column.

  Correct Answer: B

• Question 87:

  A network engineer has revived a report of problems reaching 98.139.183.24 through vr1 on the firewall. The routing table on this firewall is extensive and complex. Which CLI command will help identify the issue?

  A. test routing fib virtual-router vr1

  B. show routing route type static destination 98.139.183.24

  C. test routing fib-lookup ip 98.139.183.24 virtual-router vr1

  D. show routing interface

  Correct Answer: C

• Question 88:

  A company hosts a publically accessible web server behind a Palo Alto Networks next generation firewall with the following configuration information. Users outside the company are in the "Untrust-L3" zone The web server physically resides in the "Trust-L3" zone. Web server public IP address: 23.54.6.10 Web server private IP address: 192.168.1.10

  Which two items must be NAT policy contain to allow users in the untrust-L3 zone to access the web server? (Choose two)

  A. Untrust-L3 for both Source and Destination zone

  B. Destination IP of 192.168.1.10

  C. Untrust-L3 for Source Zone and Trust-L3 for Destination Zone

  D. Destination IP of 23.54.6.10

  Correct Answer: CD

• Question 89:

  Which three fields can be included in a pcap filter? (Choose three)

  A. Egress interface

  B. Source IP

  C. Rule number

  D. Destination IP

  E. Ingress interface

  Correct Answer: BCD

  (https://live.paloaltonetworks.com/t5/Featured-Articles/Getting-Started-Packet-Capture/ta- p/72069)

• Question 90:

  A logging infrastructure may need to handle more than 10,000 logs per second. Which two options support a dedicated log collector function? (Choose two)

  A. Panorama virtual appliance on ESX(i) only

  B. M-500

  C. M-100 with Panorama installed

  D. M-100

  Correct Answer: BC

  (httpHYPERLINK "https://live.paloaltonetworks.com/t5/Management-Articles/Panorama-Sizing-and- Design-Guide/ta-p/72181"s://live.paloaltonetworks.com/t5/Management-Articles/Panorama-Sizing- and-Design-Guide/ta-p/72181)