Palo Alto Networks Certified Network Security Engineer610 questions across 61 pages are complete and free, with no account or card.
610 questions in this bank
Free access · progress saved on this device
An administrator is building Security rules within a device group to block traffic to and from malicious locations. How should those rules be configured to ensure that they are evaluated with a high priority?
Answer: B
When planning to configure SSL Forward Proxy on a PA-5260, a user asks how SSL decryption can be implemented using a phased approach in alignment with Palo Alto Networks best practices. What should you recommend?
Answer: C
Agree C "Phase in decryption. Plan to decrypt the riskiest traffic first (URL Categories most likely to harbor malicious traffic, such as gaming or high-risk) and then decrypt more as you gain experience." https://docs.paloaltonetworks.com/best-practices/9-1/decryption-best-practices/decryption-best-practices/plan-ssl-decryption-best-practice-deployment https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClEZCA0
Source: Adapted from community discussion — secdaddy
What are two valid deployment options for Decryption Broker? (Choose two.)
Answer: AD
A network security engineer is attempting to peer a virtual router on a PAN-OS firewall with an external router using the BGP protocol. The peer relationship is not establishing. What command could the engineer run to see the current state of the BGP state between the two devices?
Answer: B
Difficult to chose as both provide the BGP peer state: B. show routing protocol bgp peer C. show routing protocol bgp summary Probably B is a little bit more correct answer as the output is split by peers with additional details and there is also an option to add "peer-name " which will filter output for only specific peer, summary shows them all.
Source: Adapted from community discussion — confusion
What is the best description of the HA4 Keep-alive Threshold (ms)?
Answer: B
B (Optional) Change the HA4 Keep-alive Threshold (ms) to specify the timeframe within which the firewall must receive keepalives from a cluster member to know that the cluster member is functional; range is 5,000 to 60,000; default is 10,000.
Source: Adapted from community discussion — confusion
An engineer is tasked with enabling SSL decryption across the environment. What are three valid parameters of an SSL Decryption policy? (Choose three.)
An engineer is configuring Packet Buffer Protection on ingress zones to protect from single-session DoS attacks. Which sessions does Packet Buffer Protection apply to?
Answer: B
Indeed, the doc says "existing sessions and global", but in reality, PBP applies to existing and new sessions. PBP measures Connections per seconds and can drop packets of new sessions or discard existing sessions should they consume too many buffers. Basically, the doc is wrong, but for the PCNSE, we should of course answer "While zone and DoS protection apply to new sessions (connections) and are granular, Packet Buffer Protection applies to existing sessions and is global." If only globally applied, PBP drops packets using RED. When applied in a zone, it can also block (with the "block countdown threshold") for an amount of time
Source: Adapted from community discussion — hcir
Which method does an administrator use to integrate all non-native MFA platforms in PAN-OSֲ® software?
Answer: C
C https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/authentication/authentication-types/multi-factor-authentication The firewall makes it easy to implement MFA in your network by integrating directly with several MFA platforms (Duo v2, Okta Adaptive, PingID, and Okta Adaptive) and integrating through RADIUS with all other MFA platforms.
Source: Adapted from community discussion — mmed
What are two best practices for incorporating new and modified App-IDs? (Choose two.)
Answer: BC
Answers are B, C. Always review Content Release Notes for the list of newly-identified and modified application and threat signatures that the content release introduces. Configure a security policy rule to always allow new App-IDs that might have network-wide impact, like authentication or software development applications.
Source: Adapted from community discussion — Whizdhum
The manager of the network security team has asked you to help configure the company's Security Profiles according to Palo Alto Networks best practice. As part of that effort, the manager has assigned you the Vulnerability Protection profile for the Internet gateway firewall. Which action and packet-capture setting for items of high severity and critical severity best matches Palo Alto Networks best practice?
Answer: D
answer is C "Enable extended-capture for critical, high, and medium severity events and single-packet capture for low severity events. " https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-web-interface-help/objects/objects-security-profiles-vulnerability-protection
Source: Adapted from community discussion — mysteryzjoker
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
PCNSE practice, question 191. 610 questions available.
Version 1.0.0. How we source questions