Palo Alto Networks Certified Network Security Engineer610 questions across 61 pages are complete and free, with no account or card.
610 questions in this bank
Free access · progress saved on this device
Which log file can be used to identify SSL decryption failures?
Answer: A
A Always from the traffic log. Whether it is drilling down into traffic log details or enabling the decryption column. Acquaint yourself with this reference: https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/decryption/verify-decryption.html
Source: Adapted from community discussion — Daniel2020
Which method will dynamically register tags on the Palo Alto Networks NGFW?
Answer: D
D is correct. “o dynamically register tags, you can use the XML API or the VM Monitoring agent on the firewall or on the User-ID agent. Each tag is a metadata element or attribute-value pair that is registered on the firewall or Panorama. For example, IP1 {tag1, tag2,…..tag32}, w”
Source: Adapted from community discussion — ak23
A customer wants to set up a site-to-site VPN using tunnel interfaces. Which two formats are correct for naming tunnel interfaces? (Choose two.)
Answer: AC
Based on the following image, what is the correct path of root, intermediate, and end-user certificate?
Answer: B
This question is tricky, as it seems to ask "according to the exhibit" what is the path... but to be relevant to PCNSE the question may be asking "what is the correct way to make a chained certificate?". The answer should be A: First attach the final certificate, then add the signer thereof and follow it by the signing root authority. This is correct according to: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClkoCAC
Source: Adapted from community discussion — Elvenking
An administrator wants a new Palo Alto Networks NGFW to obtain automatic application updates daily, so it is configured to use a scheduler for the application database. Unfortunately, they required the management network to be isolated so that it cannot reach the Internet. Which configuration will enable the firewall to download and install application updates automatically?
A company wants to install a NGFW firewall between two core switches on a VLAN trunk link. They need to assign each VLAN to its own zone and to assign untagged (native) traffic to its own zone. Which option differentiates multiple VLANs into separate zones?
Answer: B
Correct: B The question says that the firewall was installed on a "trunk" link between to core switches. This mean Layer-3 is not usable in this situation. "Virtual wire interfaces by default allow all untagged traffic. You can, however, use a virtual wire to connect two interfaces and configure either interface to block or allow traffic based on the virtual LAN (VLAN) tags. VLAN tag 0 indicates untagged traffic. You can also create multiple subinterfaces, add them into different zones, and then classify traffic according to a VLAN tag or a combination of a VLAN tag with IP classifiers (address, range, or subnet) to apply granular policy control for specific VLAN tags or for VLAN tags from a specific source IP address, range, or subnet." https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/networking/configure-interfaces/virtual-wire-interfaces/vlan-tagged-traffic.html
Source: Adapted from community discussion — ChiaPet75
Which data flow describes redistribution of user mappings?
Answer: D
This one is a little confusing but I do believe that the right answer is "A". Step 3-1 says "Configure the firewall to function as a User-ID agent. If redistribution enables the firewall to function as a User-ID agent for other devices then the correct data flow would be "User-ID agent to firewall" The answer is A https://docs.paloaltonetworks.com/pan-os/7-1/pan-os-admin/user-id/deploy-user-id-in-a-large-scale-network/configure-firewalls-to-redistribute-user-mapping-information/configure-user-id-redistribution.html#idc123940a-367d-4515-b45e-29c1d0aa2bd1 In later version of the PANOS documentation it doesn't mention configuring the firewall as a User-Id agent specifically but all the configuration for redistribution is done within the User-ID agent configuration itself. See Step 1-3 in the doc link below. https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/user-id/deploy-user-id-in-a-large-scale-network/redistribute-user-mappings-and-authentication-timestamps/configure-user-id-redistribution
Source: Adapted from community discussion — ChiaPet75
Where can an administrator see both the management plane and data plane CPU utilization in the WebUI?
Answer: C
Answer = C System Resources Widget Displays the Management CPU usage, Data Plane usage, and the Session Count (the number of sessions established through the firewall or Panorama). https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-web-interface-help/dashboard/dashboard-widgets.html
Source: Adapted from community discussion — bmarks
Which four NGFW multi-factor authentication factors are supported by PAN-OSֲ®? (Choose four.)
Answer: ABDF
ANSWER: ABDF. "For example, the MFA service might prompt you to select the Voice, SMS, push, or PIN code (OTP) authentication method" https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/authentication/configure-multi-factor-authentication.html
Source: Adapted from community discussion — eyelasers1
Which two features does PAN-OSֲ® software use to identify applications? (Choose two.)
Answer: AD
Answer: A,D is correct The Palo Alto Networks firewall does not classify traffic by port and protocol; instead it identifies the application based on its unique properties and transaction characteristics using the App-ID technology. Some applications, however, require the firewall to dynamically open pinholes to establish the connection, determine the parameters for the session and negotiate the ports that will be used for the transfer of data; these applications use the application-layer payload to communicate the dynamic TCP or UDP ports on which the application opens data connections. For such applications, the firewall serves as an Application Level Gateway (ALG), and it opens a pinhole for a limited time and for exclusively transferring data or control traffic. The firewall also performs a NAT rewrite of the payload when necessary. https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/app-id/application-level-gateways#
Source: Adapted from community discussion — LeonSKennedy
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
PCNSE practice, question 11. 610 questions available.
Version 1.0.0. How we source questions