PCNSE practice questions 21–30

1. Question 21 · 610 in bank

   An administrator wants to upgrade a firewall from PAN-OSֲ® 9.1 to PAN-OSֲ® 10.0. The firewall is not a part of an HA pair. What needs to be updated first?

   • AApplications and Threats
   • BXML Agent
   • CWildFire
   • DPAN-OS Upgrade Agent

   Show answer

   Answer: A

   Explanation

   Answer: A Ensure that the firewall is running the latest content release version. Refer to the Release Notes for the minimum content release version you must install for a PAN-OS 10.0 release. Make sure to follow the Best Practices for Application and Threat Updates. Select DeviceDynamic Updates and see which Applications or Applications and Threats content release version is Currently Installed. https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-new-features/upgrade-pan-os/upgrade-the-firewall-pan-os/upgrade-a-standalone-firewall.html

   Source: Adapted from community discussion — eyelasers1

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

2. Question 22 · 610 in bank

   When backing up and saving configuration files, what is achieved using only the firewall and is not available in Panorama?

   • ALoad configuration version
   • BSave candidate config
   • CExport device state
   • DLoad named configuration snapshot

   Show answer

   Answer: C

   Explanation

   Answer = C Export device state "there is no "Export Device State" option available on the WebGUI of the Panorama" https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClgKCAS

   Source: Adapted from community discussion — bmarks

   Next question

3. Question 23 · 610 in bank

   How does an administrator schedule an Applications and Threats dynamic update while delaying installation of the update for a certain amount of time?

   • AConfigure the option for ג€Thresholdג€.
   • BDisable automatic updates during weekdays.
   • CAutomatically ג€download onlyג€ and then install Applications and Threats later, after the administrator approves the update.
   • DAutomatically ג€download and installג€ but with the ג€disable new applicationsג€ option used.

   Show answer

   Answer: A

   Explanation

   A, as the question asks for delaying the whole update: https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/software-and-content-updates/best-practices-for-app-and-threat-content-updates/best-practices-mission-critical.html B is not relevant as it would disable the automatic updates. C involves manual/admin action to install the update which is not "certain amount of time". D would not delay the install of the content update, but disable the new Apps from it.

   Source: Adapted from community discussion — confusion

   References

   • docs.paloaltonetworks.com documentation

   Next question

4. Question 24 · 610 in bank

   Select 2

   Which two settings can be configured only locally on the firewall and not pushed from a Panorama template or template stack? (Choose two.)

   • AHA1 IP Address
   • BMaster Key
   • CZone Protection Profile
   • DNetwork Interface Type

   Show answer

   Answer: AB

   Explanation

   Correct: A,B You can use Templates and Template Stacks to define a wide array of settings but you can perform the following tasks only locally on each managed firewall: Configure a device block list. Clear logs. Enable operational modes such as normal mode, multi-vsys mode, or FIPS-CC mode. Configure the IP addresses of firewalls in an HA pair. Configure a master key and diagnostics. Compare configuration files (Config Audit). Renaming a vsys on a multi-vsys firewall.

   Source: Adapted from community discussion — ChiaPet75

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

5. Question 25 · 610 in bank

   An administrator just submitted a newly found piece of spyware for WildFire analysis. The spyware passively monitors behavior without the user's knowledge. What is the expected verdict from WildFire?

   • AMalware
   • BGrayware
   • CPhishing
   • DSpyware

   Show answer

   Answer: B

   Explanation

   Answer is GRAYWARE. The question is specifically asking for "VERDICT". There is NO verdict called "SPYWARE". "Spyware" is included within the "Grayware" Verdict. See Below. Benign Indicates that the entry received a WildFire analysis verdict of benign. Files categorized as benign are safe and do not exhibit malicious behavior. Grayware Indicates that the entry received a WildFire analysis verdict of grayware. Files categorized as grayware do not pose a direct security threat but might display otherwise obtrusive behavior. Grayware can include adware, spyware, and Browser Helper Objects (BHOs). Phishing Indicates that WildFire assigned a link and analysis verdict of phishing. A phishing verdict indicates that the site to which the link directs users displayed credential phishing activity. Malicious Indicates that the entry received a WildFire analysis verdict of malicious. Samples categorized as malicious can pose a security threat. Malware can include viruses, C2 (command-and-control), worms, Trojans, Remote Access Tools (RATs), rootkits, and botnets. For samples that are identified as malware, the WildFire cloud generates and distributes a signature to prevent against future exposure.

   Source: Adapted from community discussion — weze1336

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

6. Question 26 · 610 in bank

   When configuring the firewall for packet capture, what are the valid stage types?

   • Areceive, management, transmit, and non-syn
   • Breceive, management, transmit, and drop
   • Creceive, firewall, send, and non-syn
   • Dreceive, firewall, transmit, and drop

   Show answer

   Answer: D

   Explanation

   D is the correct answer. From Palo Alto, "You define the file name based on the stage (Drop, Firewall, Receive, or Transmit)." At first glance, you may select B, but to perform a packet capture of management traffic you would need to use tcpdump. ://docs.paloaltonetworks.com/pan-os/8-1/pan-os-web-interface-help/monitor/monitor-packet-capture/packet-capture-overview.html

   Source: Adapted from community discussion — bartbernini

   References

   • docs.paloaltonetworks.com documentation

   Next question

7. Question 27 · 610 in bank

   Which operation will impact the performance of the management plane?

   • ADoS protection
   • BWildFire submissions
   • Cgenerating a SaaS Application report
   • Ddecrypting SSL sessions

   Show answer

   Answer: C

   Explanation

   For Answer C: Both explaning “logging and reporting” are once causing MP high usage TIPS & TRICKS: REDUCING MANAGEMENT PLANE LOAD: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClSvCAK TIPS & TRICKS: REDUCING MANAGEMENT PLANE LOAD—PART 2: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClU4CAK

   Source: Adapted from community discussion — smasyed

   Next question

8. Question 28 · 610 in bank

   Which User-ID method maps IP addresses to usernames for users connecting through a web proxy that has already authenticated the user?

   • Asyslog listening
   • Bserver monitoring
   • Cclient probing
   • Dport mapping

   Show answer

   Answer: A

   Explanation

   Syslog: The Windows-based User-ID agent and the PAN-OS integrated User-ID agent use Syslog Parse Profiles to interpret login and logout event messages that are sent to syslog servers from devices that authenticate users. Such devices include wireless controllers, 802.1x devices, Apple Open Directory servers, proxy servers, and other network access control devices. Server monitoring: A Windows-based User-ID agent, or the built-in PAN-OS integrated User-ID agent inside the PAN-OS firewall, monitors Security Event logs for successful login and logout events on Microsoft domain controllers, Exchange servers, or Novell eDirectory servers.

   Source: Adapted from community discussion — aatechler

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

9. Question 29 · 610 in bank

   The firewall determines if a packet is the first packet of a new session or if a packet is part of an existing session using which kind of match?

   • A6-tuple match: Source IP Address, Destination IP Address, Source Port, Destination Port, Protocol, and Source Security Zone
   • B5-tuple match: Source IP Address, Destination IP Address, Source Port, Destination Port, Protocol
   • C7-tuple match: Source IP Address, Destination IP Address, Source Port, Destination Port, Source User, URL Category, and Source Security Zone
   • D9-tuple match: Source IP Address, Destination IP Address, Source Port, Destination Port, Source User, Source Security Zone, Destination Security Zone, Application, and URL Category

   Show answer

   Answer: A

   Explanation

   A On a Palo Alto Networks firewall, a session is defined by two uni-directional flows each uniquely identified by a 6-tuple key: source-address, destination-address, source-port, destination-port, protocol, and security-zone. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVECA0

   Source: Adapted from community discussion — MS_NW

   Next question

10. Question 30 · 610 in bank

    Which GlobalProtect Client connect method requires the distribution and use of machine certificates?

    • AAt-boot
    • BPre-logon
    • CUser-logon (Always on)
    • DOn-demand

    Show answer

    Answer: B

    Explanation

    for machine certificate it is B: Pre-Logon if it was client certificate would be USER-LOGON https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClFoCAK go to part B on cert profile topic.

    Source: Adapted from community discussion — rammsdoct

    References

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNSE practice, question 21. 610 questions available.