PCNSE practice questions 251–260

1. Question 251 · 610 in bank

   A user at an external system with the IP address 65.124.57.5 queries the DNS server at 4.2.2.2 for the IP address of the web server, www.xyz.com. The DNS server returns an address of 172.16.15.1. In order to reach the web server, which Security rule and NAT rule must be configured on the firewall?

   

   • ANAT Rule: Untrust-L3 (any) - Untrust-L3 (172.16.15.1) Destination Translation: 192.168.15.47 Security Rule: Untrust-L3 (any) - Trust-L3 (172.16.15.1) - Application: Web-browsing
   • BNAT Rule: Untrust-L3 (any) - Trust-L3 (172.16.15.1) Destination Translation: 192.168.15.47 Security Rule: Untrust-L3 (any) - Trust-L3 (192.168.15.47) - Application: Web-browsing
   • CNAT Rule: Untrust-L3 (any) - Trust-L3 (172.16.15.1) Destination Translation: 192.168.15.47 Security Rule: Untrust-L3 (any) - Trust-L3 (172.16.15.1) - Application: Web-browsing
   • DNAT Rule: Untrust-L3 (any) - Untrust-L3 (any) Destination Translation: 192.168.15.1 Security Rule: Untrust-L3 (any) - Trust-L3 (172.16.15.1) - Application: Web-browsing

   Show answer

   Answer: A

   Explanation

   A nat : source untrust (any) dest untrust (172.16.15.1) dtrans 192.168.15.47 security : source untrust (any) dest trust (172.16.15.1) application web-browsing The addresses used in destination NAT rules always refer to the original IP address in the packet (that is, the pre-translated address). The destination zone in the NAT rule is determined after the route lookup of the destination IP address in the original packet (that is, the pre-NAT destination IP address). The addresses in the security policy also refer to the IP address in the original packet (that is, the pre-NAT address). However, the destination zone is the zone where the end host is physically connected. In other words, the destination zone in the security rule is determined after the route lookup of the post-NAT destination IP address. https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/networking/nat/nat-configuration-examples/destination-nat-exampleone-to-one-mapping

   Source: Adapted from community discussion — secdaddy

   References

   • docs.paloaltonetworks.com documentation

   Next question

2. Question 252 · 610 in bank

   A network administrator is trying to prevent domain username and password submissions to phishing sites on some allowed URL categories. Which set of steps does the administrator need to take in the URL Filtering profile to prevent credential phishing on the firewall?

   • AChoose the URL categories in the User Credential Submission column and set action to block Select the User credential Detection tab and select Use Domain Credential Filter Commit
   • BChoose the URL categories in the User Credential Submission column and set action to block Select the User credential Detection tab and select use IP User Mapping Commit
   • CChoose the URL categories on Site Access column and set action to block Click the User credential Detection tab and select IP User Mapping Commit
   • DChoose the URL categories in the User Credential Submission column and set action to block Select the URL filtering settings and enable Domain Credential Filter Commit

   Show answer

   Answer: A

   Explanation

   This is a nasty question. The answer is A) It's not b or c as the IP option only works on username and question says password too. As far as I can tell A & D are identical. On my lab it says "use" rather than enable. https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-web-interface-help/objects/objects-security-profiles-url-filtering/user-credential-detection

   Source: Adapted from community discussion — mysteryzjoker

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

3. Question 253 · 610 in bank

   WildFire will submit for analysis blocked files that match which profile settings?

   • Afiles matching Anti-Spyware signatures
   • Bfiles matching Anti-Virus signatures
   • Cfiles that are blocked by a File Blocking profile
   • Dfiles that are blocked by URL filtering

   Show answer

   Answer: B

   Explanation

   Per the links below: If you enabled WildFire forwarding on your firewall, the firewall now submits blocked files that match antivirus signatures for WildFire analysis, in addition to unknown files.

   Source: Adapted from community discussion — djedeen

   References

   • docs.paloaltonetworks.com documentation

   Next question

4. Question 254 · 610 in bank

   A firewall has Security policies from three sources: 1. locally created policies 2. shared device group policies as pre-rules 3. the firewall's device group as post-rules How will the rule order populate once pushed to the firewall?

   • Ashared device group policies, local policies, firewall device group policies
   • Bfirewall device group policies, local policies, shared device group policies
   • Clocal policies, firewall device group policies, shared device group policies
   • Dshared device group policies, firewall device group policies, local policies

   Show answer

   Answer: A

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

5. Question 255 · 610 in bank

   Which function is handled by the management plane (control plane) of a Palo Alto Networks firewall?

   • Alogging
   • Bsignature matching for content inspection
   • CQuality of Service
   • DIPSec tunnel standup

   Show answer

   Answer: A

   Next question

6. Question 256 · 610 in bank

   Select 3

   An administrator wants to enable WildFire inline machine learning. Which three file types does WildFire inline ML analyze? (Choose three.)

   • AAPK
   • BVBscripts
   • CPowershell scripts
   • DELF
   • EMS Office

   Show answer

   Answer: CDE

   Explanation

   "The WildFire inline ML option present in the Antivirus profile enables the firewall dataplane to apply machine learning on PE (portable executable), ELF (executable and linked format) and MS Office files, and PowerShell and shell scripts in real-time." from https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/threat-prevention/wildfire-inline-ml Answer :C ,D & E

   Source: Adapted from community discussion — kalopilo

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

7. Question 257 · 610 in bank

   An administrator needs to assign a specific DNS server to one firewall within a device group. Where would the administrator go to edit a template variable at the device level?

   • APDF Export under Panorama > templates
   • BVariable CSV export under Panorama > templates
   • CManaged Devices > Device Association
   • DManage variables under Panorama > templates

   Show answer

   Answer: D

   Explanation

   You can define variables (PanoramaTemplates) for templates and template stacks or you can edit existing variables for an individual device (PanoramaManaged DevicesSummary). Variables are configuration components defined on the template or template stack that provide flexibility and re-usability when you use Panorama to manage firewall configurations. You can use variables to replace: An IP address (includes IP Netmask, IP Range, and FQDN) in all areas of the configuration. Interfaces in an IKE Gateway configuration (Interface) and in an HA configuration (Group ID). Configuration elements in your SD-WAN configuration (AS Number, QoS Profile, Egress Max, Link Tag). https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-web-interface-help/panorama-web-interface/panorama-templates/panorama-templates-template-variable

   Source: Adapted from community discussion — al12345

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

8. Question 258 · 610 in bank

   What is a feature of the PA-440 hardware platform?

   • AIt supports Zero Touch Provisioning to assist in automated deployments.
   • BIt supports 10GbE SFP+ modules.
   • CIt has twelve 1GbE Copper ports.
   • DIt has dedicated interfaces for high availability.

   Show answer

   Answer: A

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

9. Question 259 · 610 in bank

   An engineer wants to configure aggregate interfaces to increase bandwidth and redundancy between the firewall and switch. Which statement is correct about the configuration of the interfaces assigned to an aggregated interface group?

   • AThey can have different hardware media such as the ability to mix fiber optic and copper.
   • BThey can have a different interface type such as Layer 3 or Layer 2.
   • CThey can have a different interface type from an aggregate interface group.
   • DThey can have a different bandwidth.

   Show answer

   Answer: A

   Explanation

   Putting the relevant text from your URL for convenience : " Among the interfaces assigned to any particular aggregate group, the hardware media can differ (for example, you can mix fiber optic and copper), but the bandwidth and interface type must be the same."

   Source: Adapted from community discussion — secdaddy

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

10. Question 260 · 610 in bank

    A Firewall Engineer is migrating a legacy firewall to a Palo Alto Networks firewall in order to use features like App-ID and SSL decryption. Which order of steps is best to complete this migration?

    • AFirst migrate SSH rules to App-ID; then implement SSL decryption.
    • BConfigure SSL decryption without migrating port-based security rules to App-ID rules.
    • CFirst implement SSL decryption; then migrate port-based rules to App-ID rules.
    • DFirst migrate port-based rules to App-ID rules; then implement SSL decryption.

    Show answer

    Answer: D

    Explanation

    D is correct. Migrate from port-based to applicaon-based Security policy rules before you create and deploy Decrypon policy rules. If you create Decrypon rules based on port-based Security policy and then migrate to applicaon-based Security policy, the change could cause the Decrypon rules to block traffic that you intend to allow because Security policy rules are likely to use applicaon default ports to prevent traffic from using non-standard ports. Migrang to App-ID based rules before deploying decrypon ensures that when you test your decrypon deployment, you’ll discover Security policy misconfiguraons and fix them before rolling decrypon out to the general user populaon.

    Source: Adapted from community discussion — GBD35055

    References

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNSE practice, question 251. 610 questions available.