PCNSE practice questions 201–210

1. Question 201 · 610 in bank

   An engineer needs to redistribute User-ID mappings from multiple data centers. Which data flow best describes redistribution of user mappings?

   • AUser-ID agent to firewall
   • Bfirewall to firewall
   • CDomain Controller to User-ID agent
   • DUser-ID agent to Panorama

   Show answer

   Answer: B

   References

   • docs.paloaltonetworks.com documentation

   Next question

2. Question 202 · 610 in bank

   An administrator is attempting to create policies for deployment of a device group and template stack. When creating the policies, the zone drop-down list does not include the required zone. What must the administrator do to correct this issue?

   • AAdd a firewall to both the device group and the template
   • BAdd the template as a reference template in the device group
   • CEnable "Share Unused Address and Service Objects with Devices" in Panorama settings
   • DSpecify the target device as the master device in the device group

   Show answer

   Answer: B

   Explanation

   In order to see what is in a template, the device-group needs the template referenced. Even if you add the firewall to both the template and device-group, the device-group will not see what is in the template. The following link has a video that demonstrates that B is the correct answer. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PNfeCAG

   Source: Adapted from community discussion — scally

   Next question

3. Question 203 · 610 in bank

   What best describes the HA Promotion Hold Time?

   • Athe time that the passive firewall will wait before taking over as the active firewall after communications with the HA peer have been lost
   • Bthe time that is recommended to avoid a failover when both firewalls experience the same link/path monitor failure simultaneously
   • Cthe time that is recommended to avoid an HA failover due to the occasional flapping of neighboring devices
   • Dthe time that a passive firewall with a low device priority will wait before taking over as the active firewall it the firewall is operational again

   Show answer

   Answer: A

   References

   • docs.paloaltonetworks.com documentation

   Next question

4. Question 204 · 610 in bank

   A user at an internal system queries the DNS server for their web server with a private IP of 10.250.241.131 in the DMZ. The DNS server returns an address of the web servers public address, 200.1.1.10. In order to reach the web server, which security rule and U-Turn NAT rule must be configured on the firewall?

   

   • ANAT Rule: Source Zone: Untrust_L3 Source IP: Any Destination Zone: DMZ Destination IP: 200.1.1.10 Destination Translation address: 10.250.241.131 Security Rule: Source IP: Any Destination Zone: DMZ Destination IP: 10.250.241.131
   • BNAT Rule: Source Zone: Trust_L3 Source IP: Any Destination Zone: DMZ Destination IP: 200.1.1.10 Destination Translation address: 10.250.241.131 Security Rule: Source Zone: Untrust-L3 Source IP: Any Destination Zone: DMZ Destination IP: 10.250.241.131
   • CNAT Rule: Source Zone: Untrust_L3 Source IP: Any Destination Zone: Untrust_L3 Destination IP: 200.1.1.10 Destination Translation address: 10.250.241.131 Security Rule: Source Zone: Untrust-L3 Source IP: Any Destination Zone: DMZ Destination IP: 10.250.241.131
   • DNAT Rule: Source Zone: Trust_L3 Source IP: Any Destination Zone: Untrust_L3 Destination IP: 200.1.1.10 Destination Translation address: 10.250.241.131 Security Rule: Source Zone: Trust-L3 Source IP: Any Destination Zone: DMZ Destination IP: 200.1.1.10

   Show answer

   Answer: D

   Next question

5. Question 205 · 610 in bank

   What is considered the best practice with regards to zone protection?

   • AUse separate log-forwarding profiles to forward DoS and zone threshold event logs separately from other threat logs
   • BReview DoS threat activity (ACC > Block Activity) and look for patterns of abuse
   • CSet the Alarm Rate threshold for event-log messages to high severity or critical severity
   • DIf the levels of zone and DoS protection consume too many firewall resources, disable zone protection

   Show answer

   Answer: A

   Explanation

   A Disabling zone protection because not enough resources is hardly best practices. Best practice would be to size the appliance accordingly in the first place and so make D obsolete. Then A is correct. https://docs.paloaltonetworks.com/best-practices/dos-and-zone-protection-best-practices/dos-and-zone-protection-best-practices/deploy-dos-and-zone-protection-using-best-practices

   Source: Adapted from community discussion — lol12

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

6. Question 206 · 610 in bank

   An administrator allocates bandwidth to a Prisma Access Remote Networks compute location with three remote networks. What is the minimum amount of bandwidth the administrator could configure at the compute location?

   • A90Mbps
   • B75Mbps
   • C50Mbps
   • D300Mbps

   Show answer

   Answer: C

   Explanation

   https://docs.paloaltonetworks.com/prisma/prisma-access/prisma-access-panorama-admin/prisma-access-for-networks/configure-prisma-access-for-networks/configure-bandwidth-by-compute-location#id2a91f76f-db22-4c25-8c25-91db3701d860 "To verify the bandwidth amount you entered, select the check mark next to the bandwidth amount; to cancel the amount, select x. Specify a minimum bandwidth of 50 Mbps and a maximum bandwidth of the maximum remaining licensed bandwidth."

   Source: Adapted from community discussion — TAKUM1y

   References

   • docs.paloaltonetworks.com documentation

   Next question

7. Question 207 · 610 in bank

   An engineer must configure the Decryption Broker feature. Which Decryption Broker security chain supports bi-directional traffic flow?

   • ALayer 2 security chain
   • BLayer 3 security chain
   • CTransparent Bridge security chain
   • DTransparent Proxy security chain

   Show answer

   Answer: B

   Explanation

   Answers are B, C. The bidirectional flow option is available for both security chain types. Your network topology determines whether to use unidirectional or bidirectional flows. The performance is approximately the same using either method.

   Source: Adapted from community discussion — Whizdhum

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

8. Question 208 · 610 in bank

   An administrator is using Panorama to manage multiple firewalls. After upgrading all devices to the latest PAN-OS software, the administrator enables log forwarding from the firewalls to Panorama. However, pre-existing logs from the firewalls are not appearing in Panorama. Which action should be taken to enable the firewalls to send their pre-existing logs to Panorama?

   • AUse the import option to pull logs.
   • BUse the scp logdb export command.
   • CExport the log database.
   • DUse the ACC to consolidate the logs.

   Show answer

   Answer: C

   Explanation

   I think C is correct. Export log database includes all steps needed to export it, i.e. commands. B command is incorrect syntax. https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-cli-quick-start/use-the-cli/use-secure-copy-to-import-and-export-files/export-and-import-a-complete-log-database-logdb

   Source: Adapted from community discussion — lol12

   References

   • docs.paloaltonetworks.com documentation

   Next question

9. Question 209 · 610 in bank

   How would an administrator monitor/capture traffic on the management interface of the Palo Alto Networks NGFW?

   • AUse the debug dataplane packet-diag set capture stage firewall file command.
   • BEnable all four stages of traffic capture (TX, RX, DROP, Firewall).
   • CUse the debug dataplane packet-diag set capture stage management file command.
   • DUse the tcpdump command.

   Show answer

   Answer: D

   Explanation

   From https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/monitoring/take-packet-captures/take-a-packet-capture-on-the-management-interface.html "The tcpdump CLI command enables you to capture packets that traverse the management interface (MGT) on a Palo Alto Networks firewall."

   Source: Adapted from community discussion — eyelasers1

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

10. Question 210 · 610 in bank

    A prospect is eager to conduct a Security Lifecycle Review (SLR) with the aid of the Palo Alto Networks NGFW. Which interface type is best suited to provide the raw data for an SLR from the network in a way that is minimally invasive?

    • ALayer 2
    • BVirtual Wire
    • CTap
    • DLayer 3

    Show answer

    Answer: C

    Explanation

    It seems to be C, I found a non-official documentation about it: https://www.exclusive-networks.com/adriatics/palo-alto-networks-slr/#:~:text=The%20Palo%20Alto%20Networks%20Security,risks%20faced%20by%20an%20organization. The typical and most basic SLR deployment will use TAP mode interfaces, where the firewall can be connected to a core switch’s span port to identify applications running on the network. This option requires no changes to the existing network design.

    Source: Adapted from community discussion — JoyBoyMx

    References

    • docs.paloaltonetworks.com documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNSE practice, question 201. 610 questions available.