Palo Alto Networks Certified Network Security Engineer610 questions across 61 pages are complete and free, with no account or card.
610 questions in this bank
Free access · progress saved on this device
An engineer was tasked to simplify configuration of multiple firewalls with a specific set of configurations shared across all devices. Which two advantages would be gained by using multiple templates in a stack? (Choose two.)
Answer: BD
A network engineer is troubleshooting a VPN and wants to verify whether the decapsulation/encapsulation counters are increasing. Which CLI command should the engineer run?
Answer: B
Check if encapsulation and decapsulation bytes are increasing. If the firewall is passing traffic, then both values should be increasing. > show vpn flow name | match bytes
Source: Adapted from community discussion — millosz222
How would an administrator configure a Bidirectional Forwarding Detection profile for BGP after enabling the Advance Routing Engine run on PAN-OS 10.2?
Answer: B
create a BFD profile under Network > Routing > Routing Profiles > BFD and then select the BFD profile under Network > Routing > Logical Routers > BGP > General > Global BFD Profile https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-networking-admin/advanced-routing/configure-bgp-on-an-advanced-routing-engine https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-networking-admin/advanced-routing/create-bfd-profiles
Source: Adapted from community discussion — al12345
An engineer is troubleshooting a traffic-routing issue. What is the correct packet-flow sequence?
Answer: A
Routing happens before security's enforcement so not D B is wrong would be right if PBF is before BGP I believe it would be like this: NAT > PBF > FIB > security enforcement closest match is A
Source: Adapted from community discussion — Nawda
While investigating a SYN flood attack, the firewall administrator discovers that legitimate traffic is also being dropped by the DoS profile. If the DoS profile action is set to Random Early Drop, what should the administrator do to limit the drop to only the attacking sessions?
Answer: B
"The SYN Cookies action requires more firewall resources than Random Early Drop; it’s more discerning because it affects bad traffic." https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/zone-protection-and-dos-protection/dos-protection-against-flooding-of-new-sessions/configure-dos-protection-against-flooding-of-new-sessions
Source: Adapted from community discussion — certprep2021
A firewall administrator wants to have visibility on one segment of the company network. The traffic on the segment is routed on the Backbone switch. The administrator is planning to apply Security rules on segment X after getting the visibility. There is already a PAN-OS firewall used in L3 mode as an internet gateway, and there are enough system resources to get extra traffic on the firewall. The administrator needs to complete this operation with minimum service interruptions and without making any IP changes. What is the best option for the administrator to take?
Answer: C
The correct answer is C. As it specifically states in the question that security rules will be applied, VWire is the only method that allows this without making any IP address changes.
Source: Adapted from community discussion — scally
A company is deploying User-ID in their network. The firewall team needs to have the ability to see and choose from a list of usernames and user groups directly inside the Panorama policies when creating new security rules. How can this be achieved?
Answer: B
An administrator is using Panorama and multiple Palo Alto Networks NGFWs. After upgrading all devices to the latest PAN-OSֲ® software, the administrator enables log forwarding from the firewalls to Panorama. Pre-existing logs from the firewalls are not appearing in Panorama. Which action would enable the firewalls to send their pre-existing logs to Panorama?
After some firewall configuration changes, an administrator discovers that application identification has started failing. The administrator investigates further and notices that a high number of sessions were going to a discard state with the application showing as unknown-tcp. Which possible firewall change could have caused this issue?
Answer: A
First, here is why it is NOT C: As others have pointed out, there is a link to a Palo Alto knowledge base describing the exact same behavior when enabling jumbo frames. There's one caveat, this issue is only seen in versions preceeding PAN-OS 9.0.10. "Resolution: Upgrade to PanOS version 9.0.10". Thus, this cannot be the a possible cuase in post PAN-OS 10.0.0. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HAZMCA4&lang=en_US%E2%80%A9 Argument for A: "Enable this option to forward segments and classify an application as unknown-tcp when the App-ID queue exceeds the 64-segment limit." Taken directly from https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-web-interface-help/device/device-setup-content-id
Source: Adapted from community discussion — Frightened_Acrobat
Which three actions can Panorama perform when deploying PAN-OS images to its managed devices? (Choose three.)
Answer: ACD
In Panorama after you download the software you have the install button and then you are choosing devices. By default it is uploading and installing the software, but there is a check box if you want to upload the software only, and there is another check box if you want to reboot the device after installation.
Source: Adapted from community discussion — mushi4ka
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
PCNSE practice, question 301. 610 questions available.
Version 1.0.0. How we source questions