Pass Your PCNSE Dumps as PDF Updated on 2024 With 179 Questions
Palo Alto Networks PCNSE Real Exam Questions and Answers FREE
NEW QUESTION # 103
An engineer is configuring Packet Buffer Protection on ingress zones to protect from single-session DoS attacks Which sessions does Packet Buffer Protection apply to?
- A. It applies to existing sessions and is global
- B. It applies to existing sessions and is not global
- C. It applies to new sessions and is global
- D. It applies to new sessions and is not global
Answer: A
Explanation:
Explanation
https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/zone-protection-and-dos-protection/zone-defense/p
NEW QUESTION # 104
How can a candidate or running configuration be copied to a host external from Panorama?
- A. Commit a running configuration.
- B. Save a configuration snapshot.
- C. Save a candidate configuration.
- D. Export a named configuration snapshot.
Answer: D
Explanation:
Reference:
https://www.paloaltonetworks.com/documentation/71/panorama/panorama_adminguide/administer-panorama/ba panorama-and-firewall-configurations
NEW QUESTION # 105
If an administrator wants to apply QoS to traffic based on source, what must be specified in a QoS policy rule?
- A. Post-NAT destination address
- B. Pre-NAT destination address
- C. Pre-NAT source address
- D. Post-NAT source address
Answer: D
Explanation:
Explanation
If an administrator wants to apply QoS to traffic based on source, they must specify the post-NAT source address in a QoS policy rule. This is because QoS is enforced on traffic as it egresses the firewall, and the firewall applies NAT rules before QoS rules. Therefore, the firewall will match the QoS policy rule based on the translated source address, not the original source address. If the administrator uses the pre-NAT source address in the QoS policy rule, the firewall will not be able to identify the traffic correctly and apply the desired QoS treatment. References:
QoS Policy
Configure QoS
NEW QUESTION # 106
In a firewall, which three decryption methods are valid? (Choose three )
- A. Decryption Mirror
- B. SSH Proxy
- C. SSL Outbound Proxyless Inspection
- D. SSL Inbound Proxy
- E. SSL Inbound Inspection
Answer: A,B,E
Explanation:
You can also use Decryption Mirroring to forward decrypted traffic as plaintext to a third party solution for additional analysis and archiving.
https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/decryption/decryption- overview.html#idd71f8b4d-cd40-4c6c-905f-2f8c7fca6537
https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/decryption/decryption-overview
NEW QUESTION # 107
Given the following configuration, which route is used for destination 10.10.0.4?
- A. Route 1
- B. Route 4
- C. Route 3
- D. Route 3
Answer: B
NEW QUESTION # 108
An administrator wants multiple web servers In the DMZ to receive connections initiated from the internet. Traffic destined for 206.15.22.9 port 80/TCP needs to be forwarded to the server at 10.1.1.22.
Based on the image, which NAT rule will forward web-browsing traffic correctly?
- A.
- B.
- C.
- D.
Answer: B
NEW QUESTION # 109
A company has recently migrated their branch office's PA-220S to a centralized Panorama. This Panorama manages a number of PA-7000 Series and PA-5200 Series devices All device group and template configuration is managed solely within Panorama They notice that commit times have drastically increased for the PA-220S after the migration What can they do to reduce commit times?
- A. Update the apps and threat version using device-deployment
- B. Perform a device group push using the "merge with device candidate config" option
- C. Use "export or push device config bundle" to ensure that the firewall is integrated with the Panorama config.
- D. Disable "Share Unused Address and Service Objects with Devices" in Panorama Settings.
Answer: D
Explanation:
https://docs.paloaltonetworks.com/panorama/9-1/panorama-admin/manage-firewalls/manage-device-groups/man
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm1CCAS
NEW QUESTION # 110
When using the predefined default profile, the policy will inspect for viruses on the decoders. Match each decoder with its default action.
Answer options may be used more than once or not at all.
Answer:
Explanation:
NEW QUESTION # 111
An administrator creates a custom application containing Layer 7 signatures. The latest application and threat dynamic update is downloaded to the same NGFW. The update contains an application that matches the same traffic signatures as the custom application. Which application should be used to identify traffic traversing the NGFW?
- A. Custom and downloaded application signature files are merged and both are used
- B. System logs show an application error and neither signature is used.
- C. Downloaded application
- D. Custom application
Answer: C
NEW QUESTION # 112
Which event will happen if an administrator uses an Application Override Policy?
- A. App-ID processing time is increased.
- B. The Palo Alto Networks NGFW stops App-ID processing at Layer 4.
- C. The application name assigned to the traffic by the security rule is written to the Traffic log.
- D. Threat-ID processing time is decreased.
Answer: D
Explanation:
Reference:
https://live.paloaltonetworks.com/t5/Learning-Articles/Tips-amp-Tricks-How-to-Create-an-Application-Override
https://docs.paloaltonetworks.com/pan-os/7-1/pan-os-admin/app-id/manage-custom-or-unknown- applications#
NEW QUESTION # 113
The administrator has enabled BGP on a virtual router on the Palo Alto Networks NGFW, but new routes do not seem to be populating the virtual router.
Which two options would help the administrator troubleshoot this issue? (Choose two.)
- A. Perform a traffic pcap on the NGFW to see any BGP problems.
- B. View the System logs and look for the error messages about BGP.
- C. View the ACC tab to isolate routing issues.
- D. View the Runtime Stats and look for problems with BGP configuration.
Answer: C,D
Explanation:
Explanation/Reference:
NEW QUESTION # 114
An engineer is troubleshooting traffic routing through the virtual router. The firewall uses multiple routing protocols, and the engineer is trying to determine routing priority Match the default Administrative Distances for each routing protocol.
Answer:
Explanation:
NEW QUESTION # 115
What are three valid qualifiers for a Decryption Policy Rule match? (Choose three.)
- A. Custom URL Category
- B. App-ID
- C. Source Interface
- D. User-ID
- E. Destination Zone
Answer: A,D,E
Explanation:
Explanation
The valid qualifiers for a Decryption Policy Rule match are:
* Source Zone
* Destination Zone
* Source Address
* Destination Address
* Source User
* Destination User
* Source Region
* Destination Region
* Service/URL Category
* Custom URL Category
* URL Filtering Profile
Therefore, out of the options given, Destination Zone, Custom URL Category, and User-ID are valid qualifiers. References:
https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/decryption/configure-decryption-policies.html
NEW QUESTION # 116
An administrator needs to determine why users on the trust zone cannot reach certain websites. The only information available is shown on the following image.
Which configuration change should the administrator make?
A:
B:
C:
D:
E:
- A. Option B
- B. Option C
- C. Option A
- D. Option E
- E. Option D
Answer: A
NEW QUESTION # 117
Refer to the exhibit.
Based on the screenshots above what is the correct order in which the various rules are deployed to firewalls inside the DATACENTER_DG device group?
- A. shared pre-rules
DATACENTER_DG pre-rules
rules configured locally on the firewall
DATACENTER_DG post-rules
shared post-rules
DATACENTER_DG default rules - B. shared pre-rules
DATACENTER DG pre rules
rules configured locally on the firewall
shared post-rules
DATACENTER_DG post-rules
DATACENTER.DG default rules - C. shared pre-rules
DATACENTER_DG pre-rules
rules configured locally on the firewall
shared post-rules
DATACENTER.DG post-rules
shared default rules - D. shared pre-rules
DATACENTER_DG pre-rules
rules configured locally on the firewall
DATACENTER_DG post-rules
shared post-rules
shared default rules
Answer: B
NEW QUESTION # 118
Refer to the exhibit.
Which certificates can be used as a Forward Trust certificate?
- A. Domain-Root-Cert
- B. Domain Sub-CA
- C. Forward_Trust
- D. Certificate from Default Trust Certificate Authorities
Answer: D
NEW QUESTION # 119
Which two options are required on an M-100 appliance to configure it as a Log Collector?
(Choose two)
- A. From the Device tab of the Panorama GUI select Log Collector mode and then commit changes.
- B. Log in the Panorama CLI of the dedicated Log Collector
- C. Enter the command request system system-mode logger then enter Y to confirm the change to Log Collector mode.
- D. Enter the command logger-mode enable the enter Y to confirm the change to Log Collector mode.
- E. From the Panorama tab of the Panorama GUI select Log Collector mode and then commit changes
Answer: B,C
Explanation:
Step 1 (E): Access the Command Line Interface (CLI) on the M-100 appliance.
When prompted, log in to the appliance.
Step 2 (B): Switch from Panorama Mode to Log Collector Mode.
1. To switch to Log Collector mode, enter the following command:
request system logger-mode logger
2. Enter Yes to confirm the change to Log Collector mode. The appliance will reboot. If you see a CMS Login prompt, press Enter without typing a username or password. When the Panorama login prompt appears, enter the default admin account and the password assigned during initial configuration.
https://www.paloaltonetworks.com/documentation/61/panorama/panorama_adminguide/set-up- panorama/set-up-the-m-100-appliance#91340
NEW QUESTION # 120
Which CLI command is used to determine how much disk space is allocated to logs?
- A. debug log-receiver show
- B. show system logdfo-quota
- C. show system info
- D. show logging-status
Answer: B
Explanation:
Explanation
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClgZCAS
NEW QUESTION # 121
A network security engineer must implement Quality of Service policies to ensure specific levels of delivery guarantees for various applications in the environment.
]They want to ensure that they know as much as they can about QoS before deploying.
Which statement about the QoS feature is correct?
- A. QoS can be used on firewalls with multiple virtual systems configured
- B. QoS can be used in conjunction with SSL decryption
- C. QoS is only supported on hardware firewalls
- D. QoS is only supported on firewalls that have a single virtual system configured
Answer: A
Explanation:
https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/quality-of-service/configure-qos-for-a-virtual-system#idfbf5eebb-9d91-%20444d-99e8-2330be00fa4d
NEW QUESTION # 122
An administrator can not see any Traffic logs from the Palo Alto Networks NGFW in Panorama reports. The configuration problem seems to be on the firewall. Which settings, if configured incorrectly, most likely would stop only Traffic logs from being sent from the NGFW to Panorama?
A)
C)
D)
- A. Option A
- B. Option C
- C. Option D
- D. Option B
Answer: B
NEW QUESTION # 123
Match each GlobalProtect component to the purpose of that component
Answer:
Explanation:
NEW QUESTION # 124
An administrator has been asked to configure active/passive HA for a pair of Palo Alto Networks NGFWs. The administrator assigns priority 100 to the active firewall.
Which priority is correct for the passive firewall?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: C
Explanation:
Reference:
https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/framemaker/71/pan- os/pan-os/section_5.pdf (page 9)
NEW QUESTION # 125
A network security engineer needs to configure a virtual router using IPv6 addresses.
Which two routing options support these addresses? (Choose two.)
- A. RIP
- B. BGP
- C. Static Route
- D. OSPFv3
Answer: C,D
Explanation:
C: OSPFv3 provides support for the OSPF routing protocol within an IPv6 network. As such, it provides support for IPv6 addresses and prefixes.
A: How to Set Default Route for IPv6 Traffic
Steps
1. Go to Network > Virtual Router
2. Add a Virtual Router and go to Static Routes > IPv6.
3. Add a Static Route:
E. Set destination (example, IPV4 0.0.0.0/0) as ::0/
F. Select the Interface
G. Set the Next Hop IP address
https://www.paloaltonetworks.com/documentation/60/pan-os/newfeaturesguide/networking- features/ospf-v3-support
https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Set-Default-Route-for-IPv6- Traffic/ta-p/52731
NEW QUESTION # 126
......
Pass Palo Alto Networks PCNSE Exam Info and Free Practice Test: https://www.dumpsmaterials.com/PCNSE-real-torrent.html
New 2024 Latest Questions PCNSE Dumps - Use Updated Palo Alto Networks Exam: https://drive.google.com/open?id=1dT1Rt_OXvSIgp4C3g9qJ4_5_MRK8-u8n
