Palo Alto Networks Certified Network Security Engineer610 questions across 61 pages are complete and free, with no account or card.
610 questions in this bank
Free access · progress saved on this device
An engineer must configure a new SSL decryption deployment. Which profile or certificate is required before any traffic that matches an SSL decryption rule is decrypted?
Answer: D
I think it is A. For example, in SSL Inbound Inspection you do SSL decryption and don't need Forward Trust or Untrust Certificate. You only need a decrypt policy with a decrypt profile.
Source: Adapted from community discussion — vansardo
Which two features require another license on the NGFW? (Choose two.)
Answer: CD
An administrator has a PA-820 firewall with an active Threat Prevention subscription. The administrator is considering adding a WildFire subscription. How does adding the WildFire subscription improve the security posture of the organization?
Answer: C
What are two characteristic types that can be defined for a variable? (Choose two.)
Answer: BC
You can define variables (PanoramaTemplates) for templates and template stacks or you can edit existing variables for an individual device (PanoramaManaged DevicesSummary). Variables are configuration components defined on the template or template stack that provide flexibility and re-usability when you use Panorama to manage firewall configurations. You can use variables to replace: An IP address (includes IP Netmask, IP Range, and FQDN) in all areas of the configuration. Interfaces in an IKE Gateway configuration (Interface) and in an HA configuration (Group ID). Configuration elements in your SD-WAN configuration (AS Number, QoS Profile, Egress Max, Link Tag).
Source: Adapted from community discussion — NLT
A remote administrator needs access to the firewall on an untrust interface. Which three options would you configure on an Interface Management profile to secure management access? (Choose three.)
An administrator needs to troubleshoot a User-ID deployment. The administrator believes that there is an issue related to LDAP authentication. The administrator wants to create a packet capture on the management plane. Which CLI command should the administrator use to obtain the packet capture for validating the configuration?
Answer: A
Additionally, you can manually export the PCAP via SCP or TFTP, i.e.: > scp export mgmt-pcap from mgmt.pcap to Destination (username@host:path) Ref: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CleECAS
Source: Adapted from community discussion — K5000ism
When you configure an active/active high availability pair, which two links can you use? (Choose two.)
Answer: AD
on PA-7000 has 2 HSCI ports (HSCI-A and HSCI-B), all the rest have only on HSCI port (if they have it). so HSCI-C it's not a valid answer. Also Console Port cannot be.
Source: Adapted from community discussion — Micutzu
What are two common reasons to use a "No Decrypt" action to exclude traffic from SSL decryption? (Choose two.)
Answer: AD
For mutual authentication we must configure SSL Decryption Exclusion and once we include a destination into SSL Decryption Exclusion all the decryption policy rules are bypassed, therefor there is not action of "NO DECRYPT". "No decrypt" it's only inside decryption policy rule. https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/decryption/decryption-exclusions/create-a-policy-based-decryption-exclusion.html "Traffic that originates or is destined for executives or other users whose traffic shouldn’t be decrypted." = restricted/limited group of users In my opinion the correct answers are B&D.
Source: Adapted from community discussion — Micutzu
PBF can address which two scenarios? (Choose two.)
Answer: AB
Refer to the exhibit.
An organization has Palo Alto Networks NGFWs that send logs to remote monitoring and security management platforms. The network team has reported excessive traffic on the corporate WAN. How could the Palo Alto Networks NGFW administrator reduce WAN traffic while maintaining support for all the existing monitoring/security platforms?
Answer: A
there is no means to compress logs leaving the firewall AFAIK. Since all the data has to traverse the WAN link neither of the solutions will help reducing the log volume. I could imagine that they want to hear answer **A** though, but it rarely makes sense to me.
Source: Adapted from community discussion — tomsui44
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
PCNSE practice, question 101. 610 questions available.
Version 1.0.0. How we source questions