PCNSE practice questions 141–150

1. Question 141 · 610 in bank

   When you configure a Layer 3 interface, what is one mandatory step?

   • AConfigure virtual routers to route the traffic for each Layer 3 interface.
   • BConfigure Interface Management profiles, which need to be attached to each Layer 3 interface.
   • CConfigure Security profiles, which need to be attached to each Layer 3 interface.
   • DConfigure service routes to route the traffic for each Layer 3 interface.

   Show answer

   Answer: A

   Explanation

   https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-networking-admin/configure-interfaces/layer-3-interfaces "In a Layer 3 deployment, the firewall routes traffic between multiple ports. Before you can Configure Layer 3 Interfaces, you must configure the virtual router that you want the firewall to use to route the traffic for each Layer 3 interface."

   Source: Adapted from community discussion — TAKUM1y

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

2. Question 142 · 610 in bank

   Which statement accurately describes service routes and virtual systems?

   • AVirtual systems can only use one interface for all global service and service routes of the firewall.
   • BVirtual systems that do not have specific service routes configured inherit the global service and service route settings for the firewall.
   • CVirtual systems cannot have dedicated service routes configured; and virtual systems always use the global service and service route settings for the firewall.
   • DThe interface must be used for traffic to the required external services.

   Show answer

   Answer: B

   Explanation

   https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/virtual-systems/customize-service-routes-for-a-virtual-system "When a firewall is enabled for multiple virtual systems, the virtual systems inherit the global service and service route settings. For example, the firewall can use a shared email server to originate email alerts to all virtual systems. In some scenarios, you’d want to create different service routes for each virtual system."

   Source: Adapted from community discussion — TAKUM1y

   References

   • docs.paloaltonetworks.com documentation

   Next question

3. Question 143 · 610 in bank

   An administrator is considering upgrading the Palo Alto Networks NGFW and central management Panorama version. What is considered best practice for this scenario?

   • APerform the Panorama and firewall upgrades simultaneously.
   • BUpgrade the firewall first, wait at least 24 hours, and then upgrade the Panorama version.
   • CUpgrade Panorama to a version at or above the target firewall version.
   • DExport the device state, perform the update, and then import the device state.

   Show answer

   Answer: C

   Explanation

   C is correct. Panorama should be running the same or a later version of a feature release than the firewall (more than two feature versions is supported but not recommended).

   Source: Adapted from community discussion — Marcyy

   References

   • docs.paloaltonetworks.com documentation

   Next question

4. Question 144 · 610 in bank

   An administrator needs to implement an NGFW between their DMZ and Core network. EIGRP Routing between the two environments is required. Which interface type would support this business requirement?

   • AVirtual Wire interfaces to permit EIGRP routing to remain between the Core and DMZ
   • BLayer 3 or Aggregate Ethernet interfaces, but configuring EIGRP on subinterfaces only
   • CTunnel interfaces to terminate EIGRP routing on an IPsec tunnel (with the GlobalProtect License to support LSVPN and EIGRP protocols)
   • DLayer 3 interfaces, but configuring EIGRP on the attached virtual router

   Show answer

   Answer: A

   Explanation

   EIGRP is a Cisco proprietary protocol. The dynamic routing protocols supported on the PAN are RIPv2, OSPF and BGP. Answer A.

   Source: Adapted from community discussion — vj77

   Next question

5. Question 145 · 610 in bank

   An administrator has 750 firewalls. The administrator's central-management Panorama instance deploys dynamic updates to the firewalls. The administrator notices that the dynamic updates from Panorama do not appear on some of the firewalls. If Panorama pushes the configuration of a dynamic update schedule to managed firewalls, but the configuration does not appear, what is the root cause?

   • APanorama does not have valid licenses to push the dynamic updates.
   • BPanorama has no connection to Palo Alto Networks update servers.
   • CLocally-defined dynamic update settings take precedence over the settings that Panorama pushed.
   • DNo service route is configured on the firewalls to Palo Alto Networks update servers.

   Show answer

   Answer: C

   Explanation

   C is correct. C C C C is correct. Locally defined dynamic updates setting on a managed Palo Alto Networks firewall take preference over the Panorama pushed setting. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClKQCA0

   Source: Adapted from community discussion — Marcyy

   Next question

6. Question 146 · 610 in bank

   An enterprise Information Security team has deployed policies based on AD groups to restrict user access to critical infrastructure systems. However, a recent phishing campaign against the organization has prompted information Security to look for more controls that can secure access to critical assets. For users that need to access these systems, Information Security wants to use PAN-OS multi-factor authentication (MFA) integration to enforce MFA. What should the enterprise do to use PAN-OS MFA?

   • AUse a Credential Phishing agent to detect, prevent, and mitigate credential phishing campaigns.
   • BCreate an authentication profile and assign another authentication factor to be used by a Captive Portal authentication policy.
   • CConfigure a Captive Portal authentication policy that uses an authentication sequence.
   • DConfigure a Captive Portal authentication policy that uses an authentication profile that references a RADIUS profile.

   Show answer

   Answer: B

   Explanation

   I think it's B, because with D you are referencing Radius, which doesn't necessarily imply you're using another factor. With B, you might not have had an auth profile already (since you don't need one with user/pwd auth) so you would be creating one, and you would assign another factor in it. FWIW, this question is poorly worded.

   Source: Adapted from community discussion — homersimpson

   Next question

7. Question 147 · 610 in bank

   An administrator wants to enable zone protection. Before doing so, what must the administrator consider?

   • AActivate a zone protection subscription.
   • BSecurity policy rules do not prevent lateral movement of traffic between zones.
   • CThe zone protection profile will apply to all interfaces within that zone.
   • DTo increase bandwidth, no more than one firewall interface should be connected to a zone.

   Show answer

   Answer: C

   References

   • docs.paloaltonetworks.com documentation

   Next question

8. Question 148 · 610 in bank

   When you import the configuration of an HA pair into Panorama, how do you prevent the import from affecting ongoing traffic?

   • ADisable HA.
   • BDisable the HA2 link.
   • CSet the passive link state to "shutdown."
   • DDisable config sync.

   Show answer

   Answer: D

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

9. Question 149 · 610 in bank

   Before you upgrade a Palo Alto Networks NGFW, what must you do?

   • AMake sure that the PAN-OS support contract is valid for at least another year.
   • BExport a device state of the firewall.
   • CMake sure that the firewall is running a supported version of the app + threat update.
   • DMake sure that the firewall is running a version of antivirus software and a version of WildFire that support the licensed subscriptions.

   Show answer

   Answer: C

   Explanation

   It is C: Dependencies Before you upgrade, make sure the firewall is running a version of app + threat (content version) that meets the minimum requirement of the new PAN-OS https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRrCAK

   Source: Adapted from community discussion — Plato22

   References

   • docs.paloaltonetworks.com documentation

   Next question

10. Question 150 · 610 in bank

    The UDP-4501 protocol-port is used between which two GlobalProtect components?

    • AGlobalProtect app and GlobalProtect satellite
    • BGlobalProtect app and GlobalProtect portal
    • CGlobalProtect app and GlobalProtect gateway
    • DGlobalProtect portal and GlobalProtect gateway

    Show answer

    Answer: C

    References

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNSE practice, question 141. 610 questions available.