PCNSE practice questions 231–240

1. Question 231 · 610 in bank

   The administrator for a small company has recently enabled decryption on their Palo Alto Networks firewall using a self-signed root certificate. They have also created a Forward Trust and Forward Untrust certificate and set them as such. The admin has not yet installed the root certificate onto client systems. What effect would this have on decryption functionality?

   • ADecryption will not function because self-signed root certificates are not supported
   • BDecryption will function, but users will see certificate warnings for each SSL site they visit
   • CDecryption will not function until the certificate is installed on client systems
   • DDecryption will function, and there will be no effect to end users

   Show answer

   Answer: B

   Explanation

   B. In order to decrypt the SSL sessions, a CA certificate is required. This certificate is used to generate certifcates for each SSL destination. By default, a self-signed certifcate is used. Because this certificate is not a “Trusted CA”, browsers and other applications will give the users a warning indicating that the identity of site they are accessing could not be verifed.

   Source: Adapted from community discussion — DenskyDen

   Next question

2. Question 232 · 610 in bank

   A session in the Traffic log is reporting the application as `incomplete.` What does `incomplete` mean?

   • AThe three-way TCP handshake was observed, but the application could not be identified.
   • BThe three-way TCP handshake did not complete.
   • CThe traffic is coming across UDP, and the application could not be identified.
   • DData was received but was instantly discarded because of a Deny policy was applied before App-ID could be applied.

   Show answer

   Answer: B

   Explanation

   The answer looks to be A or B, if the article is still valid. It was last modified 2 years ago. From the article (https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClibCAC): Incomplete means that either the three-way TCP handshake did not complete OR the three-way TCP handshake did complete but there was no enough data after the handshake to identify the application. Insufficient data means not enough data to identify the application. Unknown-tcp means the firewall captured the three-way TCP handshake, but the application was not identified. Not-applicable means that the Palo Alto device has received data that will be discarded because the port or service that the traffic is coming in on is not allowed, or there is no rule or policy allowing that port or service.

   Source: Adapted from community discussion — PaloSteve

   Next question

3. Question 233 · 610 in bank

   A network administrator plans a Prisma Access deployment with three service connections, each with a BGP peering to a CPE. The administrator needs to minimize the BGP configuration and management overhead on on-prem network devices. What should the administrator implement?

   • Ahot potato routing
   • Bsummarized BGP routes before advertising
   • Cdefault routing
   • Dtarget service connection for traffic steering

   Show answer

   Answer: C

   Explanation

   Default routing—This is the default routing model that Prisma Access uses. Use this routing mode if you want Prisma Access to use BGP best path-selection mechanisms without adjusting any of the BGP attributes. In this mode, Prisma Access will honor any attribute advertised by the customer premises equipment (CPE). https://docs.paloaltonetworks.com/prisma/prisma-access/prisma-access-panorama-admin/prisma-access-advanced-deployments/service-connection-advanced-deployments/route-preferences-for-service-connection-traffic

   Source: Adapted from community discussion — mizuno92

   References

   • docs.paloaltonetworks.com documentation

   Next question

4. Question 234 · 610 in bank

   During the process of developing a decryption strategy and evaluating which websites are required for corporate users to access, several sites have been identified that cannot be decrypted due to technical reasons. In this case, the technical reason is unsupported ciphers. Traffic to these sites will therefore be blocked if decrypted. How should the engineer proceed?

   • ACreate a Security policy to allow access to those sites
   • BInstall the unsupported cipher into the firewall to allow the sites to be decrypted
   • CAdd the sites to the SSL Decryption Exclusion list to exempt them from decryption
   • DAllow the firewall to block the sites to improve the security posture

   Show answer

   Answer: C

   Explanation

   From the question "...websites are required for corporate users to access". From this we can infer that access to the websites is required by the customer/business which means the sites shouldn't be blocked, even if from a security standpoint we would prefer it so C can be correct.

   Source: Adapted from community discussion — secdaddy

   References

   • docs.paloaltonetworks.com documentation

   Next question

5. Question 235 · 610 in bank

   A network security engineer wants to prevent resource-consumption issues on the firewall. Which strategy is consistent with decryption best practices to ensure consistent performance?

   • AUse Decryption profiles to downgrade processor-intensive ciphers to ciphers that are less processor-intensive
   • BUse Decryption profiles to drop traffic that uses processor-intensive ciphers
   • CUse PFS in a Decryption profile for higher-priority and higher-risk traffic, and use less processor-intensive decryption methods for lower-risk traffic
   • DUse RSA in a Decryption profile for higher-priority and higher-risk traffic, and use less processor-intensive decryption methods for lower-risk traffic

   Show answer

   Answer: C

   Explanation

   The correct answer is D. he combination of these factors determines how decryption consumes firewall processing resources. To best utilize the firewall’s resources, understand the risks of the data you’re protecting. If firewall resources are an issue, use stronger decryption for higher-priority traffic and use less processor-intensive decryption to decrypt and inspect lower-priority traffic until you can increase the available resources. For example, you could use RSA instead of ECDHE and ECDSA for traffic that isn’t sensitive or high-priority to preserve firewall resources for using PFS-based decryption for higher priority, sensitive traffic. (You’re still decrypting and inspecting the lower-priority traffic, but trading off consuming fewer computational resources with using algorithms that aren’t as secure as PFS.) The key is to understand the risks of different traffic types and treat them accordingly.

   Source: Adapted from community discussion — Sarbi

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

6. Question 236 · 610 in bank

   With the default TCP and UDP settings on the firewall, what will be the identified application in the following session?

   

   • Aunknown-udp
   • Bnot-applicable
   • Cinsufficient-data
   • Dincomplete

   Show answer

   Answer: A

   Explanation

   A would be the correct answer here. It is a UDP connection on port 443. This would trigger unknown-udp. Incomplete is used in TCP connections only. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClibCAC

   Source: Adapted from community discussion — scally

   References

   • live.paloaltonetworks.com documentation

   Next question

7. Question 237 · 610 in bank

   Select 2

   A remote administrator needs firewall access on an untrusted interface. Which two components are required on the firewall to configure certificate-based administrator authentication to the web UI? (Choose two.)

   • Aclient certificate
   • Bcertificate profile
   • Ccertificate authority (CA) certificate
   • Dserver certificate

   Show answer

   Answer: BC

   Explanation

   B and C. Step 1. Generate a CA certificate ON THE FIREWALL. Step 2. Create a certificate profile for securing access to the web interface. The cruxt of the question is what is needed ON THE FIREWALL

   Source: Adapted from community discussion — GBD35055

   References

   • docs.paloaltonetworks.com documentation

   Next question

8. Question 238 · 610 in bank

   When configuring forward error correction (FEC) for PAN-OS SD-WAN, an administrator would turn on the feature inside which type of SD-WAN profile?

   • ATraffic Distribution profile
   • BPath Quality profile
   • CCertificate profile
   • DSD-WAN interface profile

   Show answer

   Answer: D

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

9. Question 239 · 610 in bank

   DRAG DROP - An engineer is troubleshooting traffic routing through the virtual router. The firewall uses multiple routing protocols, and the engineer is trying to determine routing priority. Match the default Administrative Distances for each routing protocol. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   The answer is incorrect. The correct order is as follows: EBGP - 20 RIP - 120 Static - 10 OSPF External - 110 Reference: Static—Range is 10-240; default is 10. OSPF Internal—Range is 10-240; default is 30. OSPF External—Range is 10-240; default is 110. IBGP—Range is 10-240; default is 200. EBGP—Range is 10-240; default is 20. RIP—Range is 10-240; default is 120.

   Source: Adapted from community discussion — scally

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   

   Next question

10. Question 240 · 610 in bank

    Which feature of Panorama allows an administrator to create a single network configuration that can be reused repeatedly for large-scale deployments even if values of configured objects, such as routes and interface addresses, change?

    • Atemplate variables
    • Bthe 'Shared' device group
    • Ctemplate stacks
    • Da device group

    Show answer

    Answer: A

    Explanation

    A here's my thought you can have "variables" without "stacks" = achieve single template that can be used on multiple devices, but you can't have "stacks" without "variables" to achieve the same

    Source: Adapted from community discussion — confusion

    References

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNSE practice, question 231. 610 questions available.