PCNSE practice questions 241–250

1. Question 241 · 610 in bank

   Select 3

   An engineer wants to implement the Palo Alto Networks firewall in VWire mode on the internet gateway and wants to be sure of the functions that are supported on the vwire interface. What are three supported functions on the VWire interface? (Choose three.)

   • AIPSec
   • BOSPF
   • CSSL Decryption
   • DQoS
   • ENAT

   Show answer

   Answer: CDE

   Explanation

   The virtual wire supports blocking or allowing traffic based on virtual LAN (VLAN) tags, in addition to supporting security policy rules, App-ID, Content-ID, User-ID, decryption, LLDP, active/passive and active/active HA, QoS, zone protection (with some exceptions), non-IP protocol protection, DoS protection, packet buffer protection, tunnel content inspection, and NAT. https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-networking-admin/configure-interfaces/virtual-wire-interfaces

   Source: Adapted from community discussion — al12345

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

2. Question 242 · 610 in bank

   A firewall has been assigned to a new template stack that contains both "Global" and "Local" templates in Panorama, and a successful commit and push has been performed. While validating the configuration on the local firewall, the engineer discovers that some settings are not being applied as intended. The setting values from the "Global" template are applied to the firewall instead of the "Local" template that has different values for the same settings. What should be done to ensure that the settings in the "Local" template are applied while maintaining settings from both templates?

   • AMove the "Local" template above the "Global" template in the template stack.
   • BPerform a commit and push with the "Force Template Values" option selected.
   • COverride the values on the local firewall and apply the correct settings for each value.
   • DMove the "Global" template above the "Local" template in the template stack.

   Show answer

   Answer: A

   Explanation

   is this even a good question? Ideally both global and local configs should not overlap, so that both global and local templates will get pushed to the FW (with global taking precedence). Admin should modify it this way, and not move the template above which may create more issue when another admin want to apply global policy to all FW.

   Source: Adapted from community discussion — jam1234

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

3. Question 243 · 610 in bank

   Select 2

   Refer to the exhibit.

   

   An administrator is using DNAT to map two servers to a single public IP address. Traffic will be steered to the specific server based on the application, where Host A (10.1.1.100) receives HTTP traffic and Host B (10.1.1.101) receives SSH traffic. Which two Security policy rules will accomplish this configuration? (Choose two.)

   • AUntrust (Any) to Untrust (10.1.1.1), web-browsing ג€" Allow
   • BUntrust (Any) to Untrust (10.1.1.1), ssh ג€" Allow
   • CUntrust (Any) to DMZ (1.1.1.100), web-browsing ג€" Allow
   • DUntrust (Any) to DMZ (1.1.1.100), ssh ג€" Allow
   • EUntrust (Any) to DMZ (10.1.1.100, 10.1.1.101), ssh, web-browsing ג€" Allow

   Show answer

   Answer: CD

   Explanation

   I think it is correct as written. 1.1.1.100 is the pre-NAT IP, and all web/ssh traffic should go to it. Once it hits the NAT policy then the IP will be translated to 10.1.1.100/10.1.1.101

   Source: Adapted from community discussion — utahman3431

   References

   • docs.paloaltonetworks.com documentation

   Next question

4. Question 244 · 610 in bank

   Select 2

   A network administrator wants to deploy SSL Inbound Inspection. What two attributes should the required certificate have? (Choose two.)

   • Aa client certificate
   • Ba private key
   • Ca server certificate
   • Da subject alternative name

   Show answer

   Answer: BC

   Explanation

   https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/decryption/decryption-concepts/ssl-inbound-inspection "On the firewall, you must install the certificate and private key for each server for which you want to perform SSL Inbound Inspection"

   Source: Adapted from community discussion — TAKUM1y

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

5. Question 245 · 610 in bank

   When using certificate authentication for firewall administration, which method is used for authorization?

   • ALDAP
   • BRadius
   • CLocal
   • DKerberos

   Show answer

   Answer: C

   Explanation

   Authentication: Certificates Authorization: Local The administrative accounts are local to the firewall, but authentication to the web interface is based on client certificates. You use the firewall to manage role assignments but access domains are not supported.

   Source: Adapted from community discussion — djedeen

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

6. Question 246 · 610 in bank

   Select 3

   Which three use cases are valid reasons for requiring an Active/Active high availability deployment? (Choose three.)

   • AThe environment requires real full-time redundancy from both firewalls at all times.
   • BThe environment requires that traffic be load-balanced across both firewalls to handle peak traffic spikes.
   • CThe environment requires Layer 2 interfaces in the deployment.
   • DThe environment requires that all configuration must be fully synchronized between both members of the HA pair.
   • EThe environment requires that both firewalls maintain their own routing tables for faster dynamic routing protocol convergence.

   Show answer

   Answer: ADE

   Explanation

   Active/Active— Both firewalls in the pair are active and processing traffic and work synchronously to handle session setup and session ownership. Both firewalls individually maintain session tables and routing tables and synchronize to each other. ctive/active mode is recommended if each firewall needs its own routing instances and you require full, real-time redundancy out of both firewalls all the time. Active/active mode has faster failover and can handle peak traffic flows better than active/passive mode because both firewalls are actively processing traffic. https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/high-availability/ha-concepts/ha-modes

   Source: Adapted from community discussion — mizuno92

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

7. Question 247 · 610 in bank

   An organization wishes to roll out decryption but gets some resistance from engineering leadership regarding the guest network. What is a common obstacle for decrypting traffic from guest devices?

   • AGuest devices may not trust the CA certificate used for the forward trust certificate
   • BGuests may use operating systems that can't be decrypted
   • CThe organization has no legal authority to decrypt their traffic
   • DGuest devices may not trust the CA certificate used for the forward untrust certificate

   Show answer

   Answer: A

   Explanation

   I would say answer is A, Guests will be accepting the Policy/Guidelines of using yr Internet, so not really an obsticle Similarly to BYOD devices, enterprises don’t control guest devices. If you allow guest devices on your network, decrypt their traffic and subject it to the same Security policy that you apply to other network traffic. To do this, redirect guest users through an Authentication Portal, instruct them how to download and install the CA certificate, and clearly notify users that their traffic will be decrypted. Include the process in your company’s privacy and computer usage policy.

   Source: Adapted from community discussion — datz

   References

   • docs.paloaltonetworks.com documentation
   • live.paloaltonetworks.com documentation

   Next question

8. Question 248 · 610 in bank

   An administrator needs to build Security rules in a Device Group that allow traffic to specific users and groups defined in Active Directory. What must be configured in order to select users and groups for those rules from Panorama?

   • AThe Security rules must be targeted to a firewall in the device group and have Group Mapping configured.
   • BUser-ID Redistribution must be configured on Panorama to ensure that all firewalls have the same mappings.
   • CA master device with Group Mapping configured must be set in the device group where the Security rules are configured.
   • DA User-ID Certificate profile must be configured on Panorama.

   Show answer

   Answer: C

   References

   • docs.paloaltonetworks.com documentation

   Next question

9. Question 249 · 610 in bank

   Which feature of PAN-OS SD-WAN allows you to configure a bandwidth-intensive application to go directly to the internet through the branch's ISP link instead of going back to the data-center hub through the VPN tunnel, thus saving WAN bandwidth costs?

   • ASD-WAN Full Mesh with branches only
   • BSD-WAN direct internet access (DIA) links
   • CSD-WAN Interface profile
   • DVPN Cluster

   Show answer

   Answer: B

   Explanation

   I think B, from doc below: You may have cloud-based services and instead of having your internet traffic flow from branches to the hub to the cloud, you want the internet traffic to flow directly from branches to the cloud using a directly connected ISP. Such access from a branch to the internet is Direct Internet Access (DIA)

   Source: Adapted from community discussion — mysteryzjoker

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

10. Question 250 · 610 in bank

    What can you use with GlobalProtect to assign user-specific client certificates to each GlobalProtect user?

    • ACSP Responder
    • BCertificate profile
    • CSCEP
    • DSSL/TLS Service profile

    Show answer

    Answer: C

    Explanation

    If you have a Simple Certificate Enrollment Protocol (SCEP) server in your enterprise PKI, you can configure a SCEP profile to automate the generation and distribution of unique client certificates. https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/certificate-management/obtain-certificates/deploy-certificates-using-scep

    Source: Adapted from community discussion — PaloGuy

    References

    • docs.paloaltonetworks.com documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNSE practice, question 241. 610 questions available.