PCNSE practice questions 161–170

1. Question 161 · 610 in bank

   DRAG DROP - Place the steps to onboard a ZTP firewall into Panorama/CSP/ZTP-Service in the correct order. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.paloaltonetworks.com/panorama/9-1/panorama-admin/manage-firewalls/set-up-zero-touch-provisioning/ztp-overview/ztp-configuration- elements.html

   Source: Adapted from community discussion — DenskyDen

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   

   Next question

2. Question 162 · 610 in bank

   Which of the following commands would you use to check the total number of the sessions that are currently going through SSL Decryption processing?

   • Ashow session all filter ssl-decryption yes total-count yes
   • Bshow session all ssl-decrypt yes count yes
   • Cshow session all filter ssl-decrypt yes count yes
   • Dshow session filter ssl-decryption yes total-count yes

   Show answer

   Answer: C

   Explanation

   To display the count of decrypted sessions > show session all filter ssl-decrypt yes count yes Number of sessions that match filter: 2758

   Source: Adapted from community discussion — GivemeMoney

   Next question

3. Question 163 · 610 in bank

   

   Refer to the image. An administrator is tasked with correcting an NTP service configuration for firewalls that cannot use the Global template NTP servers. The administrator needs to change the IP address to a preferable server for this template stack but cannot impact other template stacks. How can the issue be corrected?

   • AOverride the value on the NYCFW template.
   • BOverride a template value using a template stack variable.
   • COverride the value on the Global template.
   • DEnable "objects defined in ancestors will take higher precedence" under Panorama settings.

   Show answer

   Answer: B

   Explanation

   Option B Create a template or template stack variable to replace IP addresses, Group IDs, and interfaces in your configurations. Template variables are inherited by the template stack and you can override them to create a template stack variable https://docs.paloaltonetworks.com/panorama/10-2/panorama-admin/panorama-overview/centralized-firewall-configuration-and-update-management/templates-and-template-stacks

   Source: Adapted from community discussion — awtsuritacuna

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

4. Question 164 · 610 in bank

   While troubleshooting an SSL Forward Proxy decryption issue, which PAN-OS CLI command would you use to check the details of the end entity certificate that is signed by the Forward Trust Certificate or Forward Untrust Certificate?

   • Ashow system setting ssl-decrypt certs
   • Bshow system setting ssl-decrypt certificate
   • Cdebug dataplane show ssl-decrypt ssl-stats
   • Dshow system setting ssl-decrypt certificate-cache

   Show answer

   Answer: D

   Explanation

   Read the question - "end entity certificate". Now run the various command options on your firewall. Answer A is invalid syntax Answer B shows you your Certificates installed on your Palo; not end-entity certificates Answer C shows you some various hit counters. Answer D shows you certificate details from "end entities"

   Source: Adapted from community discussion — ConfuzedOne

   Next question

5. Question 165 · 610 in bank

   Which action disables Zero Touch Provisioning (ZTP) functionality on a ZTP firewall during the onboarding process?

   • Aremoving the Panorama serial number from the ZTP service
   • Bperforming a factory reset of the firewall
   • Cperforming a local firewall commit
   • Dremoving the firewall as a managed device in Panorama

   Show answer

   Answer: C

   Explanation

   https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/manage-firewalls/set-up-zero-touch-provisioning/add-ztp-firewalls-to-panorama/add-a-ztp-firewall-to-panorama While adding ZTP firewalls to Panorama, do not perform any commits on the ZTP firewall before you verify that the firewall is successfully added to Panorama in Step 4. Performing a local commit on the ZTP firewall disables ZTP functionality and results in the failure to successfully add the firewall to Panorama.

   Source: Adapted from community discussion — UFanat

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

6. Question 166 · 610 in bank

   A web server is hosted in the DMZ, and the server is configured to listen for incoming connections only on TCP port 8080. A Security policy rule allowing access from the Trust zone to the DMZ zone need to be configured to enable we browsing access to the server. Which application and service need to be configured to allow only cleartext web-browsing traffic to thins server on tcp/8080?

   • Aapplication: web-browsing; service: application-default
   • Bapplication: web-browsing; service: service-https
   • Capplication: ssl; service: any
   • Dapplication: web-browsing; service: (custom with destination TCP port 8080)

   Show answer

   Answer: D

   Explanation

   The correct answer is: Application: web-browsing Service: application-default Explanation: Since the server is listening on TCP port 8080, we need to use a custom service to specify this port. However, the question specifically asks for allowing only clear-text web-browsing traffic, which means HTTP traffic on port 8080. The 'web-browsing' application represents HTTP traffic, and the 'application-default' service includes TCP ports commonly used for HTTP traffic, including port 8080. Therefore, the correct configuration is to use the 'web-browsing' application and the 'application-default' service.

   Source: Adapted from community discussion — nguyendtv50

   References

   • docs.paloaltonetworks.com documentation

   Next question

7. Question 167 · 610 in bank

   In URL filtering, which component matches URL patterns?

   • Alive URL feeds on the management plane
   • Bsecurity processing on the data plane
   • Csingle-pass pattern matching on the data plane
   • Dsignature matching on the data plane

   Show answer

   Answer: B

   Explanation

   Malicious question. I'm gonna go with "B" because URL Filtering is NOT pattern based, this is one of the APP-ID components "Pattern based application identification".

   Source: Adapted from community discussion — Pretorian

   Next question

8. Question 168 · 610 in bank

   Select 2

   In a template, you can configure which two objects? (Choose two.)

   • AMonitor profile
   • Bapplication group
   • CSD-WAN path quality profile
   • DIPsec tunnel

   Show answer

   Answer: AD

   Explanation

   Application group and SD-WAN path quality profile should be configured in Objects tab which means in Device Group, not in a Template. Monitor Profile and IPsec tunnel are belong to Network tab (templates)

   Source: Adapted from community discussion — UFanat

   References

   • docs.paloaltonetworks.com documentation

   Next question

9. Question 169 · 610 in bank

   An organization's administrator has the funds available to purchase more firewalls to increase the organization's security posture. The partner SE recommends placing the firewalls as close as possible to the resources that they protect. Is the SE's advice correct, and why or why not?

   • ANo. Firewalls provide new defense and resilience to prevent attackers at every stage of the cyberattack lifecycle, independent of placement.
   • BYes. Firewalls are session-based, so they do not scale to millions of CPS.
   • CNo. Placing firewalls in front of perimeter DDoS devices provides greater protection for sensitive devices inside the network.
   • DYes. Zone Protection profiles can be tailored to the resources that they protect via the configuration of specific device types and operating systems.

   Show answer

   Answer: B

   Explanation

   https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/zone-protection-and-dos-protection/zone-defense/firewall-placement-for-dos-protection "The firewall is a session-based device that isn’t designed to scale to millions of connections-per-second (CPS) to defend against large volumetric DoS attacks"

   Source: Adapted from community discussion — TAKUM1y

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

10. Question 170 · 610 in bank

    DRAG DROP - Match each GlobalProtect component to the purpose of that component. Select and Place:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    Reference: https://docs.paloaltonetworks.com/globalprotect/8-1/globalprotect-admin/globalprotect-overview/about-the-globalprotect-components.html

    References

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNSE practice, question 161. 610 questions available.