PCNSE practice questions 91–100

1. Question 91 · 610 in bank

   An administrator has purchased WildFire subscriptions for 90 firewalls globally. What should the administrator consider with regards to the WildFire infrastructure?

   • ATo comply with data privacy regulations, WildFire signatures and verdicts are not shared globally.
   • BPalo Alto Networks owns and maintains one global cloud and four WildFire regional clouds.
   • CEach WildFire cloud analyzes samples and generates malware signatures and verdicts independently of the other WildFire clouds.
   • DThe WildFire Global Cloud only provides bare metal analysis.

   Show answer

   Answer: C

   Explanation

   Option C Each WildFire cloud—global (U.S.), regional, and private—analyzes samples and generates WildFire verdicts independently of the other WildFire clouds. With the exception of WildFire private cloud verdicts, WildFire verdicts are shared globally, enabling WildFire users to access a worldwide database of threat data. https://docs.paloaltonetworks.com/wildfire/10-1/wildfire-admin/wildfire-overview/wildfire-concepts/verdicts.html

   Source: Adapted from community discussion — alanouaro

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

2. Question 92 · 610 in bank

   A firewall is configured with SSL Forward Proxy decryption and has the following four enterprise certificate authorities (CAs): i. Enterprise-Trusted-CA, which is verified as Forward Trust Certificate (The CA is also installed in the trusted store of the end-user browser and system.) ii. Enterprise-Untrusted-CA, which is verified as Forward Untrust Certificate iii. Enterprise-Intermediate-CA iv. Enterprise-Root-CA, which is verified only as Trusted Root CA An end-user visits https://www.example-website.com/ with a server certificate Common Name (CN): www.example-website.com. The firewall does the SSL Forward Proxy decryption for the website and the server certificate is not trusted by the firewall. The end-user's browser will show that the certificate for www. example-website.com was issued by which of the following?

   • AEnterprise-Trusted-CA which is a self-signed CA
   • BEnterprise-Root-CA which is a self-signed CA
   • CEnterprise-Intermediate-CA which was, in turn, issued by Enterprise-Root-CA
   • DEnterprise-Untrusted-CA which is a self-signed CA

   Show answer

   Answer: D

   Explanation

   Enterprise-Trusted-CA is installed in the trusted store of the end-user browser and system. So it should not lead to any certificate issue. The most possible that www.example-website.com is signed by not trusted certificate authority which leads to use Enterprise-Untrusted-CA, which is not trusted as well

   Source: Adapted from community discussion — UFanat

   References

   • docs.paloaltonetworks.com documentation

   Next question

3. Question 93 · 610 in bank

   Select 3

   What are three reasons for excluding a site from SSL decryption? (Choose three.)

   • Athe website is not present in English
   • Bunsupported ciphers
   • Ccertificate pinning
   • Dunsupported browser version
   • Emutual authentication

   Show answer

   Answer: BCE

   Explanation

   Options BCE Reasons that sites break decryption technically include pinned certificates, client authentication, incomplete certificate chains, and unsupported ciphers. https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/decryption/decryption-exclusions/exclude-a-server-from-decryption.html

   Source: Adapted from community discussion — alanouaro

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

4. Question 94 · 610 in bank

   DRAG DROP - Match each SD-WAN configuration element to the description of that element. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   

   Next question

5. Question 95 · 610 in bank

   When overriding a template configuration locally on a firewall, what should you consider?

   • APanorama will update the template with the overridden value.
   • BThe firewall template will show that it is out of sync within Panorama.
   • COnly Panorama can revert the override.
   • DPanorama will lose visibility into the overridden configuration.

   Show answer

   Answer: D

   Explanation

   The correct answer is D. "When you override a setting on the firewall, the firewall saves that setting to its local configuration and Panorama no longer manages the setting." "If you push a configuration with Force Template Values enabled, all overridden values on the firewall are replaced with values from the template. Before you use this option, check for overridden values on the firewalls to ensure your commit does not result in any unexpected network outages or issues caused by replacing those overridden values." Although this doesn't explicitly indicate that you lose visibility, it definitely implies by advising you to check local firewall settings before forcing template values. https://docs.paloaltonetworks.com/panorama/8-1/panorama-admin/panorama-overview/centralized-firewall-configuration-and-update-management/templates-and-template-stacks.html https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-web-interface-help/panorama-web-interface/panorama-commit-operations.html

   Source: Adapted from community discussion — bartbernini

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • live.paloaltonetworks.com documentation

   Next question

6. Question 96 · 610 in bank

   Select 3

   When setting up a security profile, which three items can you use? (Choose three.)

   • AWildfire analysis
   • Banti-ransomware
   • Cantivirus
   • DURL filtering
   • Edecryption profile

   Show answer

   Answer: ACD

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

7. Question 97 · 610 in bank

   An administrator wants to upgrade a firewall HA pair to PAN-OS 10.1. The firewalls are currently running PAN-OS 8.1.17. Which upgrade path maintains synchronization of the HA session (and prevents network outage)?

   • AUpgrade directly to the target major version.
   • BUpgrade the HA pair to a base image.
   • CUpgrade one major version at a time.
   • DUpgrade two major versions at a time.

   Show answer

   Answer: C

   Explanation

   Option C When you upgrade from one PAN-OS feature release version to a later feature release, you cannot skip the installation of any feature release versions in the path to your target release. In addition, the recommended upgrade path includes installing the latest maintenance release in each release version before you install the base image for the next feature release version. https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-upgrade/upgrade-pan-os/upgrade-the-firewall-pan-os/determine-the-upgrade-path.html

   Source: Adapted from community discussion — alanouaro

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

8. Question 98 · 610 in bank

   Select 3

   What are three types of Decryption Policy rules? (Choose three.)

   • ASSL Inbound Inspection
   • BSSH Proxy
   • CSSL Forward Proxy
   • DDecryption Broker
   • EDecryption Mirror

   Show answer

   Answer: ABC

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

9. Question 99 · 610 in bank

   A Security policy rule is configured with a Vulnerability Protection Profile and an action of `Deny`. Which action will this cause configuration on the matched traffic?

   • AThe configuration is invalid. The Profile Settings section will be grayed out when the Action is set to ג€Denyג€.
   • BThe configuration will allow the matched session unless a vulnerability signature is detected. The ג€Denyג€ action will supersede the per-severity defined actions defined in the associated Vulnerability Protection Profile.
   • CThe configuration is invalid. It will cause the firewall to skip this Security policy rule. A warning will be displayed during a commit.
   • DThe configuration is valid. It will cause the firewall to deny the matched sessions. Any configured Security Profiles have no effect if the Security policy rule action is set to ג€Denyג€.

   Show answer

   Answer: D

   Explanation

   D is correct First note in above link states: "Security profiles are not used in the match criteria of a traffic flow. The security profile is applied to scan traffic after the application or category is allowed by the security policy." The first thing the firewall checks per it's flow is the security policy match and action. The Security Profile never gets checked if a match happens on a policy set to deny that match.

   Source: Adapted from community discussion — bbud55

   Next question

10. Question 100 · 610 in bank

    Select 3

    During SSL decryption, which three factors affect resource consumption? (Choose three.)

    • Akey exchange algorithm
    • Btransaction size
    • CTLS protocol version
    • Dapplications ta non-standard ports
    • Ecertificate issuer

    Show answer

    Answer: ABC

    References

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNSE practice, question 91. 610 questions available.