Free PCNSC Exam Dumps PDF Preview

Question 1

Single choice

Which of the following is NOT a benefit of using App-ID?

A
Identifies applications running on non-standard ports
B
Blocks application traffic that uses dynamic ports
C
Reduces the attack surface by allowing only required applications
D
Ensures consistent bandwidth allocation for all applications

Reveal answer details Close answer details

Correct answerD

Question 2

Single choice

Which Captive Portal mode must be contoured to support MFA authentication?

A
Single Sign-On
B
Redirect
C
Transparent
D
NTLM

Reveal answer details Close answer details

Correct answerB

Question 3

Multiple choice

Winch three steps will reduce the CPU utilization on the management plane? (Choose three. )

A
Disable predefined reports.
B
Reduce the traffic being decrypted by the firewall.
C
Disable SNMP on the management interface.
D
Application override of SSL application.

Reveal answer details Close answer details

Correct answersA, B, C

Question 4

Single choice

If the firewall is configured for credential phishing prevention using the "Domain Credential Filter" method, which login will be detected as credential theft?

A
Using the name user's corporate username and password.
B
First four letters of the username matching any valid corporate username.
C
Matching any valid corporate username.
D
Mapping to the IP address of the logged-in user.

Reveal answer details Close answer details

Correct answerD

Question 5

Single choice

An existing customer who has deployed several Palo Alto Networks Next-Generation Firewalls would like to start using Device-ID to obtain policy rule recommendations.
They have also purchased a Support license, a Threat license a URL Filtering license, and a WildFire license for each firewall

What additional license do they need to purchase"?

A
a Cortex Data Lake license
B
an Enterprise Data Loss Prevention (DLP) license
C
an loT Security license (or the perimeter firewall
D
an loT Security license for each deployed firewall

Reveal answer details Close answer details

Correct answerA

Explanation

To start using Device-ID to obtain policy rule recommendations, the customer needs to purchase:

a Cortex Data Lake license

The Cortex Data Lake is a cloud-based logging service that aggregates data from all Palo Alto Networks products and services. Device-ID uses this data to provide insights and recommendations for policy rules based on the identities of devices on the network.

References:
Palo Alto Networks - Cortex Data Lake: (https://docs.paloaltonetworks.com/cortex/cortex-data-lake)
Palo Alto Networks - Device-ID Overview: (https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/policy/use-device-id-to-enforce-policy)

Question 6

Single choice

Which command would you use to view the current sessions on a Palo Alto firewall?

A
show session all
B
show session info
C
show session list
D
show session current

Reveal answer details Close answer details

Correct answerB

Question 7

Single choice

What is the default port used by the Terminal Services agent to communicate with a firewall?

A
5007
B
5009
C
443
D
636

Reveal answer details Close answer details

Correct answerA

Explanation

The default port used by the Terminal Services agent to communicate with a Palo Alto Networks firewall is5007. The Terminal Services agent (TS agent) integrates with Microsoft Terminal Services to associate user information with sessions, enabling User-ID to accurately map user identities to security policies.
References:
Palo Alto Networks Terminal Services Agent Documentation.

Question 8

Single choice

A session in the Traffic log is reporting the application as "incomplete"

What does "incomplete" mean?

A
The three-way TCP handshake did not complete.
B
Data was received but wan instantly discarded because of a Deny policy was applied before App ID could be applied.
C
The three-way TCP handshake was observed, but the application could not be identified.
D
The traffic is coming across UDP, and the application could not be identified.

Reveal answer details Close answer details

Correct answerA

Question 9

Single choice

Which prerequisite must be satisfied before creating an SSH proxy Decryption policy?

A
No prerequisites are required
B
SSH keys must be manually generated
C
Both SSH keys and SSL certificates must be generated
D
SSL certificates must be generated

Reveal answer details Close answer details

Correct answerA

Question 10

Single choice

An administrator using an enterprise PKI needs to establish a unique chain of trust to ensure mutual authentication between panorama and the managed firewall and Log Collectors.

How would the administrator establish the chain of trust?

A
Configure strong password
B
Set up multiple-factor authentication.
C
Use custom certificates.
D
Enable LDAP or RADIUS integration.

Reveal answer details Close answer details

Correct answerC

Question 11

Single choice

How would an administrator monitor/capture traffic on the management interface of the Palo Alto Networks NGFW?

A
Use the tcpdump command
B
Use the debug dataplane packet-diag set capture stage management file command
C
USe the debug dataplane packet-dia set capture stage firewall file command
D
Enable all four stage of traffic capture (TX, RX, DROP, Firewall)

Reveal answer details Close answer details

Correct answerA

Question 12

Single choice

Which of the following WildFire action settings will ensure that a malicious file is quarantined and prevented from spreading?

A
Alert
B
Allow
C
Block
D
Reset-Both

Reveal answer details Close answer details

Correct answerC

Question 13

Drag & drop

DRAG DROP

Match the task for server settings in group mapping with its order in the process.

Reveal answer details Close answer details

Explanation

To configure group mapping on a Palo Alto Networks firewall, follow these steps in order:

Navigate to Device > User Identification > Group Mapping:
This is the initial step where you access the group mapping settings in the web interface.
Add a new group mapping: After navigating to the group mapping section, the next step is to add a new group mapping configuration.

Enter a unique name to identify the group mapping configuration: Provide a unique and descriptive name for the new group mapping configuration to easily identify it.
Create an LDAP Server Profile: This step involves creating an LDAP Server Profile, which defines the connection settings for the LDAP server that will be queried for user and group information.
Select the LDAP Server Profile: Finally, associate the created LDAP Server Profile with the group mapping configuration. This links the group mapping to the specific LDAP server.

Order in Process:
Navigate to Device > User Identification > Group Mapping
Add a new group mapping.
Enter a unique name to identify the group mapping configuration.
Create an LDAP Server Profile.
Select the LDAP Server Profile.

References:
Palo Alto Networks - Configuring Group Mapping: (https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/user-id/map-users-to-groups)
Palo Alto Networks - User-ID Agent and Group Mapping Configuration: (https://knowledgebase.paloaltonetworks.com)

Question 14

Single choice

What command can you use to check the status of GlobalProtect clients connected to the firewall?

A
show globalprotect status
B
show globalprotect gateway
C
show globalprotect current-user
D
show globalprotect statistics

Reveal answer details Close answer details

Correct answerB

Question 15

Multiple choice

Which three user authentication services can be modified in to provide the Palo Alto Networks NGFW with both username and role names? (Choose three.)

A
PAP
B
SAML
C
LDAP
D
TACACS+
E
RADIUS
F
Kerberos

Reveal answer details Close answer details

Correct answersC, D, E

Question 16

Single choice

Which administrative authentication method supports authorization by an external service?

A
RADIUS
B
SSH keys
C
Certification
D
LDAP

Reveal answer details Close answer details

Correct answerB

Question 17

Single choice

Which GlobalProtect feature ensures that only trusted endpoints can connect to the network?

A
Host Information Profile (HIP)
B
App-ID
C
User-ID
D
SSL Decryption

Reveal answer details Close answer details

Correct answerA

Question 18

Multiple choice

Which two action would be part of an automatic solution that would block sites with untrusted certificates without enabling SSL forward proxy? (Choose two.)

A
Configure an EDL to pull IP Addresses of known sites resolved from a CRL.
B
Create a Security Policy rule with vulnerability Security Profile attached.
C
Create a no-decrypt Decryption Policy rule.
D
Enable the "Block seasons with untrusted Issuers-setting.
E
Configure a Dynamic Address Group for untrusted sites.

Reveal answer details Close answer details

Correct answersB, D

Question 19

Single choice

A client has a sensitive application server in their data center and is particularly concerned about resource exhaustion because of distributed denial-of-service attacks.

How can the Palo Alto Networks NGFW be configured to specifically protect tins server against resource exhaustion originating from multiple IP address (DDoS attack)?

A
Define a custom App-ID to ensure that only legitimate application traffic reaches the server
B
Add a DoS Protection Profile with defined session count.
C
Add a Vulnerability Protection Profile to block the attack.
D
Add QoS Profiles to throttle incoming requests.

Reveal answer details Close answer details

Correct answerB

Question 20

Single choice

Which touting configuration should you recommend lo a customer who wishes lo actively use multiple pathways to the same destination?

A
OSPF
B
ECMP
C
BGP
D
RlPv2

Reveal answer details Close answer details

Correct answerB

Explanation

For a customer who wishes to actively use multiple pathways to the same destination, the recommended routing configuration is:

ECMP (Equal-Cost Multi-Path)

ECMP allows the use of multiple paths to the same destination with equal cost metrics, enabling load balancing and redundancy. It is suitable for scenarios where multiple pathways are desired for traffic distribution and fault tolerance.

References:
Palo Alto Networks - ECMP Overview: (https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-networking-admin/ecmp)
Palo Alto Networks - Configuring ECMP: (https://knowledgebase.paloaltonetworks.com)

Question 21

Single choice

When a malware-infected host attempts to resolve a known command-and-control server, the traffic matches a security policy with DNS sinhole enabled, generating a traffic log.

What will be the destination IP Address in that log entry?

A
The IP Address of sinkhole.paloaltonetworks.com
B
The IP Address of the command-and-control server
C
The IP Address specified in the sinkhole configuration
D
The IP Address of one of the external DNS servers identified in the anti-spyware database

Reveal answer details Close answer details

Correct answerC

Explanation

https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Verify-DNS-Sinkhole-Function-is-Working/ta-p/65864

Question 22

Multiple choice

An administrator has left a firewall to used default port for all management services.

Which three function performed by the dataplane? (Choose three.)

A
NTP
B
antivirus
C
NAT
D
WildFire updates
E
file blocking

Reveal answer details Close answer details

Correct answersA, C, D

Free PCNSC Exam Dumps Preview

Palo Alto Networks Certified Network Security Consultant (PCNSC)

PREVIEW CONTENTS · 3 VOLUMES

QUESTION 1

QUESTION 2

QUESTION 3

QUESTION 4

QUESTION 5

QUESTION 6

QUESTION 7

QUESTION 8

QUESTION 9

QUESTION 10

QUESTION 11

QUESTION 12

QUESTION 13

QUESTION 14

QUESTION 15

QUESTION 16

QUESTION 17

QUESTION 18

QUESTION 19

QUESTION 20

QUESTION 21

QUESTION 22

VOL	TYPE	QUESTIONS
1	Single choice	17
2	Multiple choice	4
3	Drag & drop	1