PCNSE practice questions 151–160

1. Question 151 · 610 in bank

   An enterprise has a large Palo Alto Networks footprint that includes onsite firewalls and Prisma Access for mobile users, which is managed by Panorama. The enterprise already uses GlobalProtect with SAML authentication to obtain IP-to-user mapping information. However, Information Security wants to use this information in Prisma Access for policy enforcement based on group mapping. Information Security uses on- premises Active Directory (AD) but is uncertain about what is needed for Prisma Access to learn groups from AD. How can policies based on group mapping be learned and enforced in Prisma Access?

   • AConfigure Prisma Access to learn group mapping via SAML assertion.
   • BSet up group mapping redistribution between an onsite Palo Alto Networks firewall and Prisma Access.
   • CAssign a master device in Panorama through which Prisma Access learns groups.
   • DCreate a group mapping configuration that references an LDAP profile that points to on-premises domain controllers.

   Show answer

   Answer: C

   Explanation

   Ah, no. C is correct. Above is relevant for USED-ID distribution, but for group mappings: Step 3: Allow Panorama to use group mappings in security policies by configuring one or more next-generation on-premises or VM-series firewalls as a Master Device. If you don’t configure a Master Device with a Prisma Access User-ID deployment, use long-form distributed name (DN) entries instead. https://docs.paloaltonetworks.com/prisma/prisma-access/prisma-access-panorama-admin/configure-user-based-policies-with-prisma-access/configure-user-id-in-prisma-access.html

   Source: Adapted from community discussion — prosto_marussia

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

2. Question 152 · 610 in bank

   What happens to traffic traversing SD-WAN fabric that doesn't match any SD-WAN policies?

   • ATraffic is dropped because there is no matching SD-WAN policy to direct traffic.
   • BTraffic matches a catch-all policy that is created through the SD-WAN plugin.
   • CTraffic matches implied policy rules and is redistributed round robin across SD-WAN links.
   • DTraffic is forwarded to the first physical interface participating in SD-WAN based on lowest interface number (i.e., Eth1/1 over Eth1/3).

   Show answer

   Answer: C

   Explanation

   https://docs.paloaltonetworks.com/sd-wan/3-0/sd-wan-admin/configure-sd-wan/distribute-unmatched-sessions ”If there is no match to any SD-WAN policy rule in the list, the session matches an implied SD-WAN policy rule at the end of the list that uses the round-robin method to distribute unmatched sessions among all links in one SD-WAN interface, which is based on the route lookup.”

   Source: Adapted from community discussion — TAKUM1y

   References

   • docs.paloaltonetworks.com documentation

   Next question

3. Question 153 · 610 in bank

   Select 2

   A remote administrator needs firewall access on an untrusted interface. Which two components are required on the firewall to configure certificate-based administrator authentication to the web Ul? (Choose two.)

   • Acertificate authority (CA) certificate
   • Bserver certificate
   • Cclient certificate
   • Dcertificate profile

   Show answer

   Answer: AD

   Explanation

   In the documentation: https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/certificate-management/configure-an-ssltls-service-profile It says: Use only signed certificates, not CA certificates, in SSL/TLS service profiles. So I think it is C and D.

   Source: Adapted from community discussion — Kalipso21

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

4. Question 154 · 610 in bank

   An administrator with 84 firewalls and Panorama does not see any WildFire logs in Panorama. All 84 firewalls have an active WildFire subscription. On each firewall, WildFire logs are available. This issue is occurring because forwarding of which type of logs from the firewalls to Panorama is missing?

   • AWildFire logs
   • BSystem logs
   • CThreat logs
   • DTraffic logs

   Show answer

   Answer: A

   Explanation

   It's C, threat logs "Access to the WildFire logs from Panorama requires the following: a WildFire subscription, a File Blocking profile that is attached to a Security rule, and Threat log forwarding to Panorama." https://docs.paloaltonetworks.com/panorama/9-1/panorama-admin/monitor-network-activity/use-case-respond-to-an-incident-using-panorama/review-wildfire-logs

   Source: Adapted from community discussion — Bubu3k

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

5. Question 155 · 610 in bank

   A speed/duplex negotiation mismatch is between the Palo Alto Networks management port and the switch port to which it connects. How would an administrator configure the interface to 1Gbps?

   • Aset deviceconfig interface speed-duplex 1Gbps-full-duplex
   • Bset deviceconfig system speed-duplex 1Gbps-duplex
   • Cset deviceconfig system speed-duplex 1Gbps-full-duplex
   • Dset deviceconfig Interface speed-duplex 1Gbps-half-duplex

   Show answer

   Answer: C

   Explanation

   Correct C I've checked in my lab admin@PA-LAB-01# set deviceconfig system speed-duplex 100Mbps-full-duplex 100Mbps-full-duplex 100Mbps-half-duplex 100Mbps-half-duplex 10Mbps-full-duplex 10Mbps-full-duplex 10Mbps-half-duplex 10Mbps-half-duplex 1Gbps-full-duplex 1Gbps-full-duplex 1Gbps-half-duplex 1Gbps-half-duplex auto-negotiate auto-negotiate

   Source: Adapted from community discussion — Edu147

   Next question

6. Question 156 · 610 in bank

   A company wants to use their Active Directory groups to simplify their Security policy creation from Panorama. Which configuration is necessary to retrieve groups from Panorama?

   • AConfigure an LDAP Server profile and enable the User-ID service on the management interface.
   • BConfigure a group mapping profile to retrieve the groups in the target template.
   • CConfigure a Data Redistribution Agent to receive IP User Mappings from User-ID agents.
   • DConfigure a master device within the device groups.

   Show answer

   Answer: D

   Explanation

   In a Device-Group we need to select a Master Device. This is the firewall from which Panorama receives usernames, user group names, and username-to-group mapping information. In a Firewall we have option to pull AD Group info under Device > User Identification > Group mapping setting. But in a Panorama in 'User Identification' we don't have option for 'Group mapping setting'. Once User and Group information is retrieved on a Firewall from an LDAP server, we can pull same in Panorama by either using Template (for User-ID) or Device-Group (for username , Group etc.) Under Template stack - User-ID Master Device - Configure Panorama as a User-ID Master Device for mappings. Under Device group - Master Device- To configure policy rules and reports based on usernames and user groups, you must select a Master Device. This is the firewall from which Panorama receives usernames, user group names, and username-to-group mapping information.

   Source: Adapted from community discussion — Randomguy2021

   Next question

7. Question 157 · 610 in bank

   How can packet buffer protection be configured?

   • Aat zone level to protect firewall resources and ingress zones, but not at the device level
   • Bat the interface level to protect firewall resources
   • Cat the device level (globally) to protect firewall resources and ingress zones, but not at the zone level
   • Dat the device level (globally) and, if enabled globally, at the zone level

   Show answer

   Answer: D

   Explanation

   D is correct. You can configure Packet Buffer Protection at two levels: the device level (global) and if enabled globally, you can also enable it at the zone level https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/zone-protection-and-dos-protection/configure-zone-protection-to-increase-network-security/configure-packet-buffer-protection.html

   Source: Adapted from community discussion — Marcyy

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

8. Question 158 · 610 in bank

   An existing NGFW customer requires direct internet access offload locally at each site, and IPSec connectivity to all branches over public internet. One requirement is that no new SD-WAN hardware be introduced to the environment. What is the best solution for the customer?

   • AConfigure a remote network on PAN-OS
   • BUpgrade to a PAN-OS SD-WAN subscription
   • CConfigure policy-based forwarding
   • DDeploy Prisma SD-WAN with Prisma Access

   Show answer

   Answer: B

   Explanation

   B. The PAN-OS software now includes a native SD-WAN subscription to provide intelligent and dynamic path selection on top of the industry-leading security that PAN-OS software already delivers. Key features of the SD-WAN implementation include centralized configuration management, automatic VPN topology creation, traffic distribution, monitoring, and troubleshooting. https://docs.paloaltonetworks.com/sd-wan

   Source: Adapted from community discussion — DenskyDen

   References

   • docs.paloaltonetworks.com documentation

   Next question

9. Question 159 · 610 in bank

   A firewall administrator requires an A/P HA pair to fail over more quickly due to critical business application uptime requirements. What is the correct setting?

   • AChange the HA timer profile to "user-defined" and manually set the timers.
   • BChange the HA timer profile to "fast".
   • CChange the HA timer profile to "aggressive" or customize the settings in advanced profile.
   • DChange the HA timer profile to "quick" and customize in advanced profile.

   Show answer

   Answer: C

   Explanation

   C is correct. Use the Recommended profile for typical failover timer settings and the Aggressive profile for faster failover timer settings. The Advanced profile allows you to customize the timer values to suit your network requirements. https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/high-availability/ha-concepts/ha-timers.html

   Source: Adapted from community discussion — prosto_marussia

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

10. Question 160 · 610 in bank

    What is the function of a service route?

    • AThe service packets exit the firewall on the port assigned for the external service. The server sends its response to the configured source interface and source IP address.
    • BThe service packets enter the firewall on the port assigned from the external service. The server sends its response to the configured destination interface and destination IP address.
    • CThe service route is the method required to use the firewall's management plane to provide services to applications.
    • DService routes provide access to external services, such as DNS servers, external authentication servers or Palo Alto Networks services like the Customer Support Portal.

    Show answer

    Answer: A

    Explanation

    First Paragraph, Last statement "The service packets exit the firewall on the port assigned for the external service and the server sends its response to the configured source interface and source IP address." https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-networking-admin/service-routes/service-routes-overview#id69ef535a-d5b0-4c79-bb7f-1302a438e7c5

    Source: Adapted from community discussion — mercysayno765

    References

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNSE practice, question 151. 610 questions available.