Question 181 · 610 in bank
Which configuration task is best for reducing load on the management plane?
Show answer
Answer: D
PCNSEProfessionalPalo Alto NetworksAll questions freePage 19 of 61
PCNSE practice questions 181–190
Palo Alto Networks Certified Network Security Engineer610 questions across 61 pages are complete and free, with no account or card.
Official study references
610 questions in this bank
Free access · progress saved on this device
Question 182 · 610 in bank
An engineer is in the planning stages of deploying User-ID in a diverse directory services environment. Which server OS platforms can be used for server monitoring with User-ID?
Show answer
Answer: D
Explanation
100 d.With server monitoring a User-ID agent—either a Windows-based agent running on a domain server in your network, or the PAN-OS integrated User-ID agent running on the firewall—monitors the security event logs for specified Microsoft Exchange Servers, Domain Controllers, or Novell eDirectory servers for login events.
Source: Adapted from community discussion — Sarbi
Question 183 · 610 in bank
Cortex XDR notifies an administrator about grayware on the endpoints. There are no entries about grayware in any of the logs of the corresponding firewall. Which setting can the administrator configure on the firewall to log grayware verdicts?
Show answer
Answer: C
Explanation
Answer is C. When this option is enabled (disabled by default), files analyzed by WildFire that are determined to be grayware will appear in the Monitor > WildFire Submissions log.
Source: Adapted from community discussion — Whizdhum
Question 184 · 610 in bank
Your company has 10 Active Directory domain controllers spread across multiple WAN links. All users authenticate to Active Directory. Each link has substantial network bandwidth to support all mission-critical applications. The firewall's management plane is highly utilized. Given this scenario, which type of User-ID agent is considered a best practice by Palo Alto Networks?
Show answer
Answer: D
References
Question 185 · 610 in bank
Which component enables you to configure firewall resource protection settings?
Show answer
Answer: C
Explanation
https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/zone-protection-and-dos-protection/zone-defense/dos-protection-profiles-and-policy-rules https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/zone-protection-and-dos-protection/zone-defense/dos-protection-profiles-and-policy-rules/dos-protection-profiles The question asks to "configure...protection settings" DoS Protection policy rules determine the devices, users, zones, and services to which DoS Profiles apply. DoS Protection profiles set thresholds that protect against new session IP flood attacks and provide resource protection (maximum concurrent session limits for specified endpoints and resources). So I am leaning Answer A. The Profile gives the settings, and the policy describes what to protect.
Source: Adapted from community discussion — PaloSteve
Question 186 · 610 in bank
How can an administrator use the Panorama device-deployment option to update the apps and threat version of an HA pair of managed firewalls?
Show answer
Question 187 · 610 in bank
In the image, what caused the commit warning?
Show answer
Answer: A
Explanation
Option A. The FWDtrust is a CA certificate type capable of signing other certificates. That means either it's a Root Certificate or Intermediate certificate. If it was a Root Certificate, then you wouldn't get that warning. That means the certificate is an intermediate and you need to import its Root Certificate.
Source: Adapted from community discussion — AdamLolzSmith
Question 188 · 610 in bank
A Panorama administrator configures a new zone and uses the zone in a new Security policy. After the administrator commits the configuration to Panorama, which device-group commit push operation should the administrator use to ensure that the push is successful?
Show answer
Answer: B
Explanation
"Commit from Device Group, with the Include Network and Device Template option enabled to allow the template push to succeed along with the Device Group references." https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClpwCAC
Source: Adapted from community discussion — certprep2021
References
Question 189 · 610 in bank
What would allow a network security administrator to authenticate and identify a user with a new BYOD-type device that is not joined to the corporate domain?
Show answer
Answer: D
Explanation
Seems D is correct, as authentication policy with with the "Unknown", as unknown—Includes all users for whom the firewall does not have IP address-to-username mappings. After the rule evokes authentication, the firewall creates user mappings for unknown users based on the usernames they entered. https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-web-interface-help/policies/policies-authentication/building-blocks-of-an-authentication-policy-rule
Source: Adapted from community discussion — bimyo
Question 190 · 610 in bank
Select 2An administrator needs firewall access on a trusted interface. Which two components are required to configure certificate-based, secure authentication to the web UI? (Choose two.)
Show answer
Answer: BC
Explanation
https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/firewall-administration/manage-firewall-administrators/configure-administrative-accounts-and-authentication/configure-certificate-based-administrator-authentication-to-the-web-interface#:~:text=OS%C2%AE%20Administrator%E2%80%99s%20Guide-,Configure%20Certificate%2DBased%20Administrator%20Authentication%20to%20the%20Web%20Interface,-As%20a%20more. The doc clearly states you need to configure CA cert and a cert profile. So A is incorrect. D is incorrect as it is SSH. So B & C are correct since you do configure SSL /TLS profile in Management.
Source: Adapted from community discussion — melsg
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
PCNSE practice, question 181. 610 questions available.
About this question bank
Version 1.0.0. How we source questions