Palo Alto Networks Certified Network Security Engineer610 questions across 61 pages are complete and free, with no account or card.
610 questions in this bank
Free access · progress saved on this device
A security engineer received multiple reports of an IPSec VPN tunnel going down the night before. The engineer couldn't find any events related to VPN under system logs. What is the likely cause?
Answer: C
You dont need tunnel monitor to get ipsec vpn info from system logs. The only way system logs is not catching vpn logs is that the fw is not logging.
Source: Adapted from community discussion — DrNick0
A firewall administrator notices that many Host Sweep scan attacks are being allowed through the firewall sourced from the outside zone. What should the firewall administrator do to mitigate this type of attack?
The Aggregate Ethernet interface is showing down on a passive PA-7050 firewall of an active/passive HA pair. The HA Passive Link State is set to "Auto" under Device > High Availability > General > Active/Passive Settings. The AE interface is configured with LACP enabled and is up only on the active firewall. Why is the AE interface showing down on the passive firewall?
Which three settings are defined within the Templates object of Panorama? (Choose three.)
Answer: ABC
A company requires that a specific set of ciphers be used when remotely managing their Palo Alto Networks appliances. Which profile should be configured in order to achieve this?
Answer: C
SSL/TLS profile is only the TLS versions, not ciphers. Decryption Profile is for SSL Inbound and Forward Proxy applications, not mgmt of the PANW Firewall. There's also KB articles to strengthen SSH, but I couldn't find any for HTTPS, on the mgmt interface: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000004OOQCA2&lang=en_US%E2%80%A9 So it seems C is the winner.
Source: Adapted from community discussion — ConfuzedOne
An engineer needs to permit XML API access to a firewall for automation on a network segment that is routed through a Layer 3 subinterface on a Palo Alto Networks firewall. However, this network segment cannot access the dedicated management interface due to the Security policy. Without changing the existing access to the management interface, how can the engineer fulfill this request?
Answer: C
Has to be C. Here's why: 1) API access over HTTPS is allowed by default on the management interface. 2) Configuring an Interface Management profile, with the HTTPS allowed, would mimik this access on the subinterface of the network segment. 3) Assigning an Interface Managment profile to a Layer 3 Ethernet interface does not preclude still using the built-in management interface as before. Thus fullfilling the requirement to not change existing access to the mangaement interface. https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-panorama-api/about-the-pan-os-xml-api/structure-of-a-pan-os-xml-api-request/api-authentication-and-security#id12582d9a-f80e-42c3-a028-2fdbb5ff0bdd https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/networking/configure-interfaces/use-interface-management-profiles-to-restrict-access
Source: Adapted from community discussion — Frightened_Acrobat
A client wants to detect the use of weak and manufacturer-default passwords for IoT devices. Which option will help the customer?
Answer: D
Correct is D Checked in lab and under vulnerability protection you can find for example: "Compromised or manufacturer default password found in inbound Telnet login" and set action to alert.
Source: Adapted from community discussion — bimyo
When using SSH keys for CLI authentication for firewall administration, which method is used for authorization?
An engineer needs to see how many existing SSL decryption sessions are traversing a firewall. What command should be used?
Answer: B
A - not exist B - correct https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClhdCAC C - not exist D - incorect - should be - show session all filter application ssl (but show all session, not a count number of sessions)
Source: Adapted from community discussion — al12345
A network engineer has discovered that asymmetric routing is causing a Palo Alto Networks firewall to drop traffic. The network architecture cannot be changed to correct this. Which two actions can be taken on the firewall to allow the dropped traffic permanently? (Choose two.)
Answer: AC
A and C are the answers here. B can only be the answer if A is set. The question asks for two ways to accomplish this and A and C are those two ways. If B is set by itself, it will drop the connection as the default setting is to drop these.
Source: Adapted from community discussion — scally
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
PCNSE practice, question 261. 610 questions available.
Version 1.0.0. How we source questions