PCNSE practice questions 291–300

1. Question 291 · 610 in bank

   A network administrator configured a site-to-site VPN tunnel where the peer device will act as initiator. None of the peer addresses are known. What can the administrator configure to establish the VPN connection?

   • AUse the Dynamic IP address type.
   • BEnable Passive Mode.
   • CSet up certificate authentication.
   • DConfigure the peer address as an FQDN.

   Show answer

   Answer: A

   Explanation

   This question seems to have had its answers rearranged, since some of the explanations below discuss different letters than what is assigned. Both A and B are correct IMHO, but my first choice would be "Dynamic IP" since the tunnel wouldn't work w/o it, and second choice would be "passive mode" because without that you'd get error messages generated in the logs when the local side tried to initiate the tunnel to an IP it doesn't know.

   Source: Adapted from community discussion — homersimpson

   Next question

2. Question 292 · 610 in bank

   Select 3

   An administrator is seeing one of the firewalls in a HA active/passive pair moved to "suspended" state due to Non-functional loop. Which three actions will help the administrator resolve this issue? (Choose three.)

   • ACheck the HA Link Monitoring interface cables.
   • BCheck High Availability > Active/Passive Settings > Passive Link State
   • CCheck the High Availability > Link and Path Monitoring settings.
   • DCheck the High Availability > HA Communications > Packet Forwarding settings.
   • EUse the CLI command show high-availability flap-statistics

   Show answer

   Answer: ACE

   Explanation

   Guys, I've checked all the answers. If we see quickly, we identify 4 coorect answers: ABCE. If we pay more attention, we'll fond that B is false. In fact, the link High Availability > Active/Passive Settings > Passive Link State doesn't exist on PAN. The correct link is High Availability > General > Active/Passive Settings > Passive Link State "B" is the trap on this question.

   Source: Adapted from community discussion — Knowledge33

   Next question

3. Question 293 · 610 in bank

   Which CLI command is used to determine how much disk space is allocated to logs?

   • Adebug log-receiver show
   • Bshow system info
   • Cshow system logdb-quota
   • Dshow logging-status

   Show answer

   Answer: C

   Explanation

   C)first couple of lines of output below from lab show system logdb-quota Quotas: system: 4.00%, 0.609 GB Expiration-period: 0 days config: 4.00%, 0.609 GB Expiration-period: 0 days alarm: 3.00%, 0.457 GB Expiration-period: 0 days

   Source: Adapted from community discussion — mysteryzjoker

   Next question

4. Question 294 · 610 in bank

   An administrator has configured a pair of firewalls using high availability in Active/Passive mode. Link and Path Monitoring is enabled with the Failure Condition set to `any`. There is one link group configured containing member interfaces ethernet1/1 and ethernet1/2 with a Group Failure Condition set to `all`. Which HA state will the Active firewall go into if ethernet1/1 link goes down due to a failure?

   • AActive
   • BPassive
   • CActive-Secondary
   • DNon-functional

   Show answer

   Answer: A

   Explanation

   question is poorly written. it mentions "which HA state will the active firewall go into". The state will remain the same. it wont change

   Source: Adapted from community discussion — Alen

   Next question

5. Question 295 · 610 in bank

   Your company occupies one floor in a single building. You have two Active Directory domain controllers on a single network. The firewall's management-plane resources are lightly utilized. Given the size of this environment, which User-ID collection method is sufficient?

   • AWindows-based agent deployed on each domain controller
   • BPAN-OS integrated agent deployed on the firewall
   • Ca syslog listener
   • DCitrix terminal server agent deployed on the network

   Show answer

   Answer: B

   References

   • docs.paloaltonetworks.com documentation

   Next question

6. Question 296 · 610 in bank

   Which statement best describes the Automated Commit Recovery feature?

   • AIt performs a connectivity check between the firewall and Panorama after every configuration commit on the firewall. It reverts the configuration changes on the firewall if the check fails.
   • BIt restores the running configuration on a firewall if the last configuration commit fails.
   • CIt restores the running configuration on a firewall and Panorama if the last configuration commit fails.
   • DIt performs a connectivity check between the firewall and Panorama after every configuration commit on the firewall. It reverts the configuration changes on the firewall and on Panorama if the check fails.

   Show answer

   Answer: A

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

7. Question 297 · 610 in bank

   Select 3

   An administrator has left a firewall to use the default port for all management services. Which three functions are performed by the dataplane? (Choose three.)

   • AWildFire updates
   • BNAT
   • CNTP
   • Dantivirus
   • Efile blocking

   Show answer

   Answer: BDE

   Explanation

   Tasks related MGMT services, like, updates, NTP, user-id agent, are performed by control plane. Tasks related to traffic, content-id, app-id, are performed by dataplane.

   Source: Adapted from community discussion — dthetinski

   Next question

8. Question 298 · 610 in bank

   An engineer has been tasked with reviewing traffic logs to find applications the firewall is unable to identify with App-ID. Why would the application field display as incomplete?

   • AThere is insufficient application data after the TCP connection was established.
   • BThe TCP connection was terminated without identifying any application data.
   • CThe TCP connection did not fully establish.
   • DThe client sent a TCP segment with the PUSH flag set.

   Show answer

   Answer: C

   Explanation

   1-3 packets exchanged ---> incomplete, because not even TCP handshake was completed 4-10 packets exchanged ---> insufficient data, because TCP was completed but we did not see enough packets to precisely determine what application is it 11-more packets exchanged ---> if we can't determine what is the app, it is marked as "unknown"

   Source: Adapted from community discussion — Cro13

   References

   • live.paloaltonetworks.com documentation

   Next question

9. Question 299 · 610 in bank

   Which Security profile generates a packet threat type found in threat logs?

   • AWildFire
   • BZone Protection
   • CAnti-Spyware
   • DAntivirus

   Show answer

   Answer: B

   Explanation

   According to the question "Security Profile" is key. So Anti Malware should be the correct answer . Zone Protection is not Security Profile.

   Source: Adapted from community discussion — segene

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

10. Question 300 · 610 in bank

    What can an engineer use with GlobalProtect to assign user-specific client certificates to each GlobalProtect user?

    • ASCEP
    • BSSL/TLS Service profile
    • COCSP Responder
    • DCertificate profile

    Show answer

    Answer: A

    Explanation

    https://docs.paloaltonetworks.com/globalprotect/9-1/globalprotect-admin/authentication/set-up-client-certificate-authentication/deploy-user-specific-client-certificates-for-authentication To authenticate individual users, you must issue a unique client certificate to each GlobalProtect user and deploy the client certificate to the endpoints prior to enabling GlobalProtect. To automate the generation and deployment of user-specific client certificates, you can configure your GlobalProtect portal to act as a Simple Certificate Enrollment Protocol (SCEP) client to a SCEP server in your enterprise PKI.

    Source: Adapted from community discussion — happyism

    References

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNSE practice, question 291. 610 questions available.