PCNSE practice questions 111–120

1. Question 111 · 610 in bank

   A user's traffic traversing a Palo Alto Networks NGFW sometimes can reach http://www.company.com. At other times the session times out. The NGFW has been configured with a PBF rule that the user's traffic matches when it goes to http://www.company.com. How can the firewall be configured automatically disable the PBF rule if the next hop goes down?

   • ACreate and add a Monitor Profile with an action of Wait Recover in the PBF rule in question.
   • BCreate and add a Monitor Profile with an action of Fail Over in the PBF rule in question.
   • CEnable and configure a Link Monitoring Profile for the external interface of the firewall.
   • DConfigure path monitoring for the next hop gateway on the default route in the virtual router.

   Show answer

   Answer: B

   Explanation

   B is a correct one: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-web-interface-help/network/network-network-profiles/network-network-profiles-monitor A monitor profile is used to monitor IPSec tunnels and to monitor a next-hop device for policy-based forwarding (PBF) rules. In both cases, the monitor profile is used to specify an action to take when a resource (IPSec tunnel or next-hop device) becomes unavailable. wait-recover—Wait for the tunnel to recover; do not take additional action. Packets will continue to be sent according to the PBF rule. fail-over—Traffic will fail over to a backup path, if one is available. The firewall uses routing table lookup to determine routing for the duration of this session.

   Source: Adapted from community discussion — UFanat

   References

   • docs.paloaltonetworks.com documentation

   Next question

2. Question 112 · 610 in bank

   Select 2

   A firewall should be advertising the static route 10.2.0.0/24 into OSPF. The configuration on the neighbour is correct, but the route is not in the neighbour's routing table. Which two configurations should you check on the firewall? (Choose two.)

   • AEnsure that the OSPF neighbour state is "2-Way"
   • BIn the OSPF configuration, ensure that the correct redistribution profile is selected in the OSPF Export Rules section.
   • CWithin the redistribution profile ensure that Redist is selected.
   • DIn the redistribution profile check that the source type is set to "ospf."

   Show answer

   Answer: BC

   References

   • docs.paloaltonetworks.com documentation

   Next question

3. Question 113 · 610 in bank

   Which value in the Application column indicates UDP traffic that did not match an App-ID signature?

   • Aunknown-udp
   • Bunknown-ip
   • Cincomplete
   • Dnot-applicable

   Show answer

   Answer: A

   Explanation

   Reference: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Clc6CAC

   Source: Adapted from community discussion — Chanderia

   References

   • docs.paloaltonetworks.com documentation

   Next question

4. Question 114 · 610 in bank

   Select 3

   What are three valid qualifiers for a Decryption Policy Rule match? (Choose three.)

   • AApp-ID
   • BCustom URL Category
   • CUser-ID
   • DDestination Zone
   • ESource Interface

   Show answer

   Answer: BCD

   References

   • docs.paloaltonetworks.com documentation

   Next question

5. Question 115 · 610 in bank

   An administrator needs to gather information about the CPU utilization on both the management plane and the data plane. Where does the administrator view the desired data?

   • AResources Widget on the Dashboard
   • BMonitor > Utilization
   • CSupport > Resources
   • DApplication Command and Control Center

   Show answer

   Answer: A

   References

   • docs.paloaltonetworks.com documentation

   Next question

6. Question 116 · 610 in bank

   Which CLI command displays the physical media that are connected to ethernet1/8?

   • A> show system state filter-pretty sys.s1.p8.stats
   • B> show system state filter-pretty sys.s1.p8.med
   • C> show interface ethernet1/8
   • D> show system state filter-pretty sys.s1.p8.phy

   Show answer

   Answer: D

   Explanation

   Option D Example output: > show system state filter-pretty sys.s1.p1.phy sys.s1.p1.phy: { link-partner: { }, media: CAT5, type: Ethernet, } https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cld3CAC

   Source: Adapted from community discussion — alanouaro

   Next question

7. Question 117 · 610 in bank

   A variable name must start with which symbol?

   • A$
   • B!
   • C#
   • D&

   Show answer

   Answer: A

   Explanation

   Reference: https://docs.paloaltonetworks.com/panorama/8-1/panorama-admin/manage-firewalls/manage-templates-and-template-stacks/configure-template-or- template-stack-variables.html

   References

   • docs.paloaltonetworks.com documentation

   Next question

8. Question 118 · 610 in bank

   Given the following configuration, which route is used for destination 10.10.0.4? set network virtual-router 2 routing-table ip static-route "Route 1" nexthop ip-address 192.168.1.2 set network virtual-router 2 routing-table ip static-route "Route 1" metric 30 set network virtual-router 2 routing-table ip static-route "Route 1" destination 10.10.0.0/24 set network virtual-router 2 routing-table ip static-route "Route 1" re route-table unicast set network virtual-router 2 routing-table ip static-route "Route 2" nexthop ip-address 192.168.1.2 set network virtual-router 2 routing-table ip static-route "Route 2" metric 20 set network virtual-router 2 routing-table ip static-route "Route 2" destination 10.10.0.0/24 set network virtual-router 2 routing-table ip static-route "Route 2" route-table unicast set network virtual-router 2 routing-table ip static-route "Route 3" nexthop ip-address 10.10.20.1 set network virtual-router 2 routing-table ip static-route "Route 3" metric 5 set network virtual-router 2 routing-table ip static-route "Route 3" destination 0.0.0.0/0 set network virtual-router 2 routing-table ip static-route "Route 3" route-table unicast set network virtual-router 2 routing-table ip static-route "Route 4" nexthop ip-address 192.168.1.2 set network virtual-router 2 routing-table ip static-route "Route 4" metric 10 set network virtual-router 2 routing-table ip static-route "Route 4" destination 10.10.1.0/25 set network virtual-router 2 routing-table ip static-route "Route 4" route-table unicast

   • ARoute 1
   • BRoute 3
   • CRoute 2
   • DRoute 4

   Show answer

   Answer: C

   Explanation

   This is the line that you want to pay attention to answer this question: set network virtual-router 2 routing-table ip static-route "Route 2" destination 10.10.0.0/24

   Source: Adapted from community discussion — Jheax

   Next question

9. Question 119 · 610 in bank

   Select 2

   In SSL Forward Proxy decryption, which two certificates can be used for certificate signing? (Choose two.)

   • Aself-signed CA certificate
   • Bserver certificate
   • Cwildcard server certificate
   • Dclient certificate
   • Eenterprise CA certificate

   Show answer

   Answer: AE

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

10. Question 120 · 610 in bank

    Select 2

    An administrator plans to deploy 15 firewalls to act as GlobalProtect gateways around the world. Panorama will manage the firewalls. The firewalls will provide access to mobile users and act as edge locations to on-premises infrastructure. The administrator wants to scale the configuration out quickly and wants all of the firewalls to use the same template configuration. Which two solutions can the administrator use to scale this configuration? (Choose two.)

    • Avirtual systems
    • Btemplate stacks
    • Cvariables
    • Dcollector groups

    Show answer

    Answer: BC

    Explanation

    Answers are B, C. Clearly, this is a question about templates, template stacks and variables in Panorama. The key to answering this question is to understand template capabilities and exceptions. You cannot use templates or template stacks to set firewall modes, but as an exception, Panorama can push default vsys settings in a template to firewalls that don't support them or don't have any vsys configured. Since these PANs will be shipped world-wide, you will benefit from the use of variables to serve as placeholder objects based on configuration needs.

    Source: Adapted from community discussion — Whizdhum

    References

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNSE practice, question 111. 610 questions available.