PCNSE practice questions 171–180

1. Question 171 · 610 in bank

   An administrator needs to validate that policies that will be deployed will match the appropriate rules in the device-group hierarchy. Which tool can the administrator use to review the policy creation logic and verify that unwanted traffic is not allowed?

   • APreview Changes
   • BPolicy Optimizer
   • CManaged Devices Health
   • DTest Policy Match

   Show answer

   Answer: A

   Explanation

   Common guys? "Which tool can the administrator use to review the policy creation logic and verify that unwanted traffic is not allowed?" which tool is used to review policy creation and also can verify that Unwanted traffic is not allowed? how on earth Test Policy will tell you what unwanted trafffic will be allowed? :/ I am going for A :)

   Source: Adapted from community discussion — datz

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

2. Question 172 · 610 in bank

   What is a key step in implementing WildFire best practices?

   • AConfigure the firewall to retrieve content updates every minute.
   • BEnsure that a Threat Prevention subscription is active.
   • CIn a mission-critical network, increase the WildFire size limits to the maximum value.
   • Dn a security-first network, set the WildFire size limits to the minimum value.

   Show answer

   Answer: B

   Explanation

   B is correct. In the WildFire best practices linked below, the first step is to "... make sure that you have an active Threat Prevention subscription. Together, WildFire® and Threat Prevention enable comprehensive threat detection and prevention." https://docs.paloaltonetworks.com/wildfire/10-1/wildfire-admin/wildfire-deployment-best-practices/wildfire-best-practices.html

   Source: Adapted from community discussion — bartbernini

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

3. Question 173 · 610 in bank

   What happens when an A/P firewall cluster synchronizes IPsec tunnel security associations (SAs)?

   • APhase 2 SAs are synchronized over HA2 links.
   • BPhase 1 and Phase 2 SAs are synchronized over HA2 links.
   • CPhase 1 SAs are synchronized over HA1 links.
   • DPhase 1 and Phase 2 SAs are synchronized over HA3 links.

   Show answer

   Answer: A

   Explanation

   From the Palo Alto documentation below, "when a VPN is terminated on a Palo Alto firewall HA pair, not all IPSEC related information is synchronized between the firewalls... This is an expected behavior. IKE phase 1 SA information is NOT synchronized between the HA firewalls." And from the second link, "Data link (HA2) is used to sync sessions, forwarding tables, IPSec security associations, and ARP tables between firewalls in the HA pair. Data flow on the HA2 link is always unidirectional (except for the HA2 keep-alive). It flows from the active firewall to the passive firewall." https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HAuZCAW&lang=en_US%E2%80%A9&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail https://help.aryaka.com/display/public/KNOW/Palo+Alto+Networks+NFV+Technical+Brief

   Source: Adapted from community discussion — bartbernini

   Next question

4. Question 174 · 610 in bank

   A security engineer needs to mitigate packet floods that occur on a set of servers behind the internet facing interface of the firewall. Which Security Profile should be applied to a policy to prevent these packet floods?

   • AVulnerability Protection profile
   • BDoS Protection profile
   • CData Filtering profile
   • DURL Filtering profile

   Show answer

   Answer: B

   Explanation

   Reference: https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/policy/security-profiles

   Next question

5. Question 175 · 610 in bank

   Select 3

   What are three reasons why an installed session can be identified with the "application incomplete" tag? (Choose three.)

   • AThere was no application data after the TCP connection was established.
   • BThe client sent a TCP segment with the PUSH flag set.
   • CThe TCP connection was terminated without identifying any application data.
   • DThere is not enough application data after the TCP connection was established.
   • EThe TCP connection did not fully establish.

   Show answer

   Answer: ACE

   Explanation

   Incomplete means that either the three-way TCP handshake did not complete OR the three-way TCP handshake did complete but there was no enough data after the handshake to identify the application. In other words that traffic being seen is not really an application. One example is, if a client sends a server a SYN and the Palo Alto Networks device creates a session for that SYN , but the server never sends a SYN ACK back to the client, then that session is incomplete. Insufficient data means not enough data to identify the application. So for example, if the three-way TCP handshake completed and there was one data packet after the handshake but that one data packet was not enough to match any of our signatures, then user will see insufficient data in the application field of the traffic log.

   Source: Adapted from community discussion — scally

   Next question

6. Question 176 · 610 in bank

   Select 3

   Which three statements correctly describe Session 380280? (Choose three.)

   

   • AThe application was initially identified as "ssl."
   • BThe session has ended with the end-reason "unknown."
   • CThe session cid not go through SSL decryption processing.
   • DThe application shifted to "web-browsing."
   • EThe session went through SSL decryption processing.

   Show answer

   Answer: ADE

   Explanation

   There is a lack of available documentation for this CLI command. I think the answer is ADE Cannot be B because session is still active, hence reason "unknown" I don't think it can be C because "session proxied" is true which I've only seen when SSL Decryption is being performed - regular HTTP traffic does not show this flag

   Source: Adapted from community discussion — Shenanigans123

   Next question

7. Question 177 · 610 in bank

   If the firewall has the following link monitoring configuration, what will cause a failover?

   

   • Aethernet1/3 and ethernet1/6 going down
   • Bethernet1/3 going down
   • Cethernet1/3 or ethernet1/6 going down
   • Dethernet1/6 going down

   Show answer

   Answer: A

   Explanation

   A is correct because the "Group Failure Condition" in the image is "all". If it said "any", then losing link on either interface would cause failover.

   Source: Adapted from community discussion — homersimpson

   References

   • docs.paloaltonetworks.com documentation

   Next question

8. Question 178 · 610 in bank

   An administrator's device-group commit push is failing due to a new URL category. How should the administrator correct this issue?

   • Aupdate the Firewall Apps and Threat version to match the version of Panorama
   • Bchange the new category action to "alert" and push the configuration again
   • Censure that the firewall can communicate with the URL cloud
   • Dverity that the URL seed tile has been downloaded and activated on the firewall

   Show answer

   Answer: A

   Next question

9. Question 179 · 610 in bank

   Select 3

   A security engineer needs firewall management access on a trusted interface. Which three settings are required on an SSL/TLS Service Profile to provide secure Web Ul authentication? (Choose three.)

   • AAuthentication Algorithm
   • BEncryption Algorithm
   • CCertificate
   • DMaximum TLS version
   • EMinimum TLS version

   Show answer

   Answer: CDE

   Explanation

   Select DeviceCertificate ManagementSSL/TLS Service Profile. If the firewall has more than one virtual system (vsys), select the Location (vsys or Shared) where the profile is available. Click Add and enter a Name to identify the profile. Select the Certificate you just obtained. Define the range of protocols that the service can use: For the Min Version, select the earliest allowed TLS version: TLSv1.0 (default), TLSv1.1, or TLSv1.2. For the Max Version, select the latest allowed TLS version: TLSv1.0, TLSv1.1, TLSv1.2, or Max (latest available version). The default is Max.

   Source: Adapted from community discussion — NLT

   References

   • docs.paloaltonetworks.com documentation

   Next question

10. Question 180 · 610 in bank

    Which type of interface does a firewall use to forward decrypted traffic to a security chain for inspection?

    • ALayer 3
    • BLayer 2
    • CTap
    • DDecryption Mirror

    Show answer

    Answer: A

    Explanation

    Decryption Broker: Forwarding Interfaces A firewall enabled as a decryption broker uses a pair of dedicated Layer 3 interfaces to forward decrypted traffic to a security chain for inspection. The decryption forwarding interfaces must be assigned to a brand new virtual router https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/decryption/decryption-broker/decryption-broker-concepts/decryption-broker-forwarding-interfaces

    Source: Adapted from community discussion — UFanat

    References

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNSE practice, question 171. 610 questions available.