PCNSE practice questions 211–220

1. Question 211 · 610 in bank

   A network-security engineer attempted to configure a bootstrap package on Microsoft Azure, but the virtual machine provisioning process failed. In reviewing the bootstrap package, the engineer only had the following directories: /config, /license and /software. Why did the bootstrap process fail for the VM-Series firewall in Azure?

   • AAll public cloud deployments require the /plugins folder to support proper firewall native integrations
   • BThe VM-Series firewall was not pre-registered in Panorama and prevented the bootstrap process from successfully completing
   • CThe /config or /software folders were missing mandatory files to successfully bootstrap
   • DThe /content folder is missing from the bootstrap package

   Show answer

   Answer: D

   Explanation

   https://docs.paloaltonetworks.com/vm-series/10-2/vm-series-deployment/bootstrap-the-vm-series-firewall/prepare-the-bootstrap-package Create the top-level directory structure for the bootstrap package. On your local client or laptop, or in a public cloud storage bucket, create the following folders: /config /content /software /license /plugins (Optional)

   Source: Adapted from community discussion — 0d2fdfa

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

2. Question 212 · 610 in bank

   Which GlobalProtect component must be configured to enable Clientless VPN?

   • AGlobalProtect satellite
   • BGlobalProtect app
   • CGlobalProtect portal
   • DGlobalProtect gateway

   Show answer

   Answer: C

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

3. Question 213 · 610 in bank

   Which statement regarding HA timer settings is true?

   • AUse the Moderate profile for typical failover timer settings
   • BUse the Critical profile for faster failover timer settings
   • CUse the Aggressive profile for slower failover timer settings
   • DUse the Recommended profile for typical failover timer settings

   Show answer

   Answer: D

   Explanation

   Recommended: Use for typical failover timer settings. Unless you’re sure that you need different settings, the best practice is to use the Recommended settings. Aggressive: Use for faster failover timer settings. Advanced: Allows you to customize the values to suit your network requirement for each of the following timers:

   Source: Adapted from community discussion — aatechler

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

4. Question 214 · 610 in bank

   You need to allow users to access the office-suite applications of their choice. How should you configure the firewall to allow access to any office-suite application?

   • ACreate an Application Group and add Office 365, Evernote, Google Docs, and Libre Office
   • BCreate an Application Group and add business-systems to it
   • CCreate an Application Filter and name it Office Programs, then filter it on the office-programs subcategory
   • DCreate an Application Filter and name it Office Programs, then filter it on the business-systems category

   Show answer

   Answer: C

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

5. Question 215 · 610 in bank

   Which statement is correct given the following message from the PanGPA.log on the GlobalProtect app? Failed to connect to server at port:4767

   • AThe GlobalProtect app failed to connect to the GlobalProtect Gateway on port 4767
   • BThe GlobalProtect app failed to connect to the GlobalProtect Portal on port 4767
   • CThe PanGPS process failed to connect to the PanGPA process on port 4767
   • DThe PanGPA process failed to connect to the PanGPS process on port 4767

   Show answer

   Answer: D

   Next question

6. Question 216 · 610 in bank

   A customer is replacing their legacy remote access VPN solution. The current solution is in place to secure only Internet egress for the connected clients. Prisma Access has been selected to replace the current remote access VPN solution. During onboarding the following options and licenses were selected and enabled: - Prisma Access for Remote Networks: 300Mbps - Prisma Access for Mobile Users: 1500 Users - Cortex Data Lake: 2TB - Trusted Zones: trust - Untrusted Zones: untrust - Parent Device Group: shared How can you configure Prisma Access to provide the same level of access as the current VPN solution?

   • AConfigure mobile users with trust-to-untrust Security policy rules to allow the desired traffic outbound to the Internet
   • BConfigure remote networks with a service connection and trust-to-untrust Security policy rules to allow the desired traffic outbound to the Internet
   • CConfigure remote networks with trust-to-trust Security policy rules to allow the desired traffic outbound to the Internet
   • DConfigure mobile users with a service connection and trust-to-trust Security policy rules to allow the desired traffic outbound to the Internet

   Show answer

   Answer: A

   Explanation

   Answer is A. If the remote network location is autonomous and does not need to access to infrastructure at other locations, you do not need to set up the service connection (unless your mobile users need access).

   Source: Adapted from community discussion — Whizdhum

   References

   • docs.paloaltonetworks.com documentation

   Next question

7. Question 217 · 610 in bank

   An administrator analyzes the following portion of a VPN system log and notices the following issue: `Received local id 10.10.1.4/24 type IPv4 address protocol 0 port 0, received remote id 10.1.10.4/24 type IPv4 address protocol 0 port 0.` What is the cause of the issue?

   • Abad local and peer identification IP addresses in the IKE gateway
   • BIPSec crypto profile mismatch
   • Cmismatched Proxy-IDs
   • DIPSec protocol mismatch

   Show answer

   Answer: C

   Explanation

   Summary Palo docs.. When a PA firewalls sets up IPSEC tunnels with a device as Plicy based VPN, the other end defines differenct parameters as Proxy IDs whereas on PA they are set to the default values of 0.0.0.0/24.

   Source: Adapted from community discussion — sujss

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

8. Question 218 · 610 in bank

   A network security engineer must implement Quality of Service policies to ensure specific levels of delivery guarantees for various applications in the environment. They want to ensure that they know as much as they can about QoS before deploying. Which statement about the QoS feature is correct?

   • AQoS can be used in conjunction with SSL decryption
   • BQoS is only supported on hardware firewalls
   • CQoS is only supported on firewalls that have a single virtual system configured
   • DQoS can be used on firewalls with multiple virtual systems configured

   Show answer

   Answer: D

   Explanation

   While D is indeed correct, QoS can be used without SSL decryption (it is less effective) and with. I don't see why not A, as well.

   Source: Adapted from community discussion — Bubu3k

   References

   • docs.paloaltonetworks.com documentation

   Next question

9. Question 219 · 610 in bank

   What type of address object would be useful for internal devices where the addressing structure assigns meaning to certain bits in the address, as illustrated in the diagram?

   

   • AIP Netmask
   • BIP Range
   • CIP Address
   • DIP Wildcard Mask

   Show answer

   Answer: D

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

10. Question 220 · 610 in bank

    Select 2

    A customer wants to set up a VLAN interface for a Layer 2 Ethernet port. Which two mandatory options are used to configure a VLAN interface? (Choose two.)

    • AVirtual router
    • BSecurity zone
    • CARP entries
    • DNetflow Profile

    Show answer

    Answer: AB

    Explanation

    Answer: A, B VLAN interface is not necessary but in this scenarion we assume it is. Create VLAN object, VLAN interface and VLAN Zone. Attach VLAN interface to VLAN object together with two L2 interfaces then attach VLAN interface to virtual router. Without VLAN interface you can pass traffic between interfaces on the same network and with VLAN interface you can route traffic to other networks. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRqCAK

    Source: Adapted from community discussion — lol1000

    References

    • docs.paloaltonetworks.com documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNSE practice, question 211. 610 questions available.