PCNSE practice questions 311–320

1. Question 311 · 610 in bank

   A firewall administrator is investigating high packet buffer utilization in the company firewall. After looking at the threat logs and seeing many flood attacks coming from a single source that are dropped by the firewall, the administrator decides to enable packet buffer protection to protect against similar attacks. The administrator enables packet buffer protection globally in the firewall but still sees a high packet buffer utilization rate. What else should the administrator do to stop packet buffers from being overflowed?

   • AApply DOS profile to security rules allow traffic from outside.
   • BEnable packet buffer protection for the affected zones.
   • CAdd the default Vulnerability Protection profile to all security rules that allow traffic from outside.
   • DAdd a Zone Protection profile to the affected zones

   Show answer

   Answer: B

   Explanation

   B is correct; you must enable Packet Buffer Globally before you can enabled it per zone for a second level of protection You Configure Packet Buffer Protection globally to protect the entire firewall and also enable Packet Buffer Protection on each zone to protect zones

   Source: Adapted from community discussion — happyism

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

2. Question 312 · 610 in bank

   What is a correct statement regarding administrative authentication using external services with a local authorization method?

   • AThe administrative accounts you define on an external authentication server serve as references to the accounts defined locally on the firewall.
   • BPrior to PAN-OS 10.2, an administrator used the firewall to manage role assignments, but access domains have not been supported by this method.
   • CStarting with PAN-OS 10.2, an administrator needs to configure Cloud Identity Engine to use external authentication services for administrative authentication.
   • DThe administrative accounts you define locally on the firewall serve as references to the accounts defined on an external authentication server.

   Show answer

   Answer: D

   Explanation

   D is correct; 10.2 does not seem to have changed this method. Cloud Identity Engine, for knowledge: https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-new-features/identity-features/cloud-identity-engine By using a cloud-based solution, you can reallocate the resources required for authentication from the firewall or Panorama to the cloud. The Cloud Authentication Service also allows you to configure the authentication source once instead of for each authentication method you use (for example, Authentication Portal or administrator authentication). https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/firewall-administration/manage-firewall-administrators/administrative-authentication

   Source: Adapted from community discussion — happyism

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

3. Question 313 · 610 in bank

   A network administrator notices there is a false-positive situation after enabling Security profiles. When the administrator checks the threat prevention logs, the related signature displays: threat type: spyware category: dns-c2 threat ID: 1000011111 Which set of steps should the administrator take to configure an exception for this signature?

   • ANavigate to Objects > Security Profiles > Anti-Spyware Select related profile Select the signature exceptions tab and then click show all signatures Search related threat ID and click enable Change the default action Commit
   • BNavigate to Objects > Security Profiles > Anti-Spyware Select related profile Select the Exceptions tab and then click show all signatures Search related threat ID and click enable Commit
   • CNavigate to Objects > Security Profiles > Vulnerability Protection Select related profile Select the Exceptions tab and then click show all signatures Search related threat ID and click enable Commit
   • DNavigate to Objects > Security Profiles > Anti-Spyware Select related profile Select DNS exceptions tabs Search related threat ID and click enable Commit

   Show answer

   Answer: D

   Explanation

   100% D A. Navigate to Objects > Security Profiles > Anti-Spyware Select related profile Select the signature exceptions tab and then click show all signatures Search related threat ID and click enable Change the default action Commit there is no option to change default action only enable B. Navigate to Objects > Security Profiles > Anti-Spyware Select related profile Select the Exceptions tab and then click show all signatures Search related threat ID and click enable Commit there is no any tab for Exception only signature Exception or DNS exception C. Navigate to Objects > Security Profiles > Vulnerability Protection Select related profile Select the Exceptions tab and then click show all signatures Search related threat ID and click enable Commit for sure not vulnerability D. Navigate to Objects > Security Profiles > Anti-Spyware Select related profile Select DNS exceptions tabs Search related threat ID and click enable Commit

   Source: Adapted from community discussion — millosz222

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

4. Question 314 · 610 in bank

   Select 2

   

   In the screenshot above, which two pieces of information can be determined from the ACC configuration shown? (Choose two.)

   • AInsecure-credentials, brute-force, and protocol-anomaly are all a part of the vulnerability Threat Type.
   • BThe Network Activity tab will display all applications, including FTP.
   • CThreats with a severity of ג€highג€ are always listed at the top of the Threat Name list.
   • DThe ACC has been filtered to only show the FTP application.

   Show answer

   Answer: AD

   References

   • docs.paloaltonetworks.com documentation

   Next question

5. Question 315 · 610 in bank

   

   Given the screenshot, how did the firewall handle the traffic?

   • ATraffic was allowed by policy but denied by profile as encrypted.
   • BTraffic was allowed by policy but denied by profile as a threat.
   • CTraffic was allowed by profile but denied by policy as a threat.
   • DTraffic was allowed by policy but denied by profile as a nonstandard port.

   Show answer

   Answer: B

   Next question

6. Question 316 · 610 in bank

   Your company wants greater visibility into their traffic and has asked you to start planning an SSL Decryption project. The company does not have a PKI infrastructure, and multiple certificates would be needed for this project. Which type of certificate can you use to generate other certificates?

   • Aself-signed root CA
   • Bexternal CA certificate
   • Cserver certificate
   • Ddevice certificate

   Show answer

   Answer: A

   Explanation

   A. Alternatively, generate a self-signed Root CA certificate on the firewall and create a subordinate Forward Trust CA certificate on that firewall to install on network devices. Self-signed certificates are best for small companies that don’t have an Enterprise Root CA and for proof-of-concept (POC) trials. See Passam link.

   Source: Adapted from community discussion — DenskyDen

   References

   • docs.paloaltonetworks.com documentation

   Next question

7. Question 317 · 610 in bank

   

   Refer to the screenshots. Without the ability to use Context Switch, where do admin accounts need to be configured in order to provide admin access to Panorama and to the managed devices?

   • AThe Panorama section overrides the Device section. The accounts need to be configured only in the Panorama section.
   • BThe sections are independent. The accounts need to be configured in both the Device and Panorama sections.
   • CThe Device section overrides Panorama section. The accounts need to be configured only in the Device section.
   • DConfiguration in the sections is merged together. The accounts need to be configured in either section.

   Show answer

   Answer: B

   Explanation

   100% B. Have seen this in a live network. You won't be able to log into managed Firewalls when you only have an account in Panorama. ( However you can change context if allowed)

   Source: Adapted from community discussion — sujss

   References

   • docs.paloaltonetworks.com documentation

   Next question

8. Question 318 · 610 in bank

   A firewall just submitted a file to WildFire for analysis. Assume a 5-minute window for analysis. The firewall is configured to check for verdicts every 5 minutes. How quickly will the firewall receive back a verdict?

   • AMore than 15 minutes
   • B5 minutes
   • C10 to 15 minutes
   • D5 to 10 minutes

   Show answer

   Answer: D

   Explanation

   Per the PCNSE study notes: "WildFire Analysis Profiles indicate which files are to be forwarded according to system-wide WildFire configuration settings. WildFire typically renders a verdict on a file within 5 to 10 minutes of receipt."

   Source: Adapted from community discussion — ChiaPet75

   Next question

9. Question 319 · 610 in bank

   A firewall administrator needs to be able to inspect inbound HTTPS traffic on servers hosted in their DMZ to prevent the hosted service from being exploited. Which combination of features can allow PAN-OS to detect exploit traffic in a session with TLS encapsulation?

   • Aa WildFire profile and a File Blocking profile
   • Ba Vulnerability Protection profile and a Decryption policy
   • Ca Vulnerability Protection profile and a QoS policy
   • Da Decryption policy and a Data Filtering profile

   Show answer

   Answer: B

   Explanation

   Decryption policy to inspect inbound HTTPS, and Vulnerability profile to stop attempts to exploit system flaws or gain unauthorized access to system.

   Source: Adapted from community discussion — happyism

   Next question

10. Question 320 · 610 in bank

    Select 2

    Engineer was tasked to simplify configuration of multiple firewalls with a specific set of configurations shared across all devices. Which two advantages would be gained by using multiple templates in a stack? (Choose two.)

    • Ainherits address-objects from the templates
    • Bstandardizes server profiles and authentication configuration across all stacks
    • Cstandardizes log-forwarding profiles for security policies across all stacks
    • Ddefines a common standard template configuration for firewalls

    Show answer

    Answer: BD

    Explanation

    I passed PCNSE last night. Lots of questions from here, many not from here, but by looking all these questions up you shouldn't have any problems

    Source: Adapted from community discussion — GBD35055

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNSE practice, question 311. 610 questions available.