PCNSE practice questions 321–330

1. Question 321 · 610 in bank

   Which protocol is supported by GlobalProtect Clientless VPN?

   • AFTP
   • BHTTPS
   • CSSH
   • DRDP

   Show answer

   Answer: B

   Explanation

   GlobalProtect Clientless VPN supports the following Web application technologies: HTML HTML5 HTML5-Web-Sockets Javascript ES5 or earlier RDP, VNC, or SSH So A and B are not correct. C and D are both correct answers, maybe the question should be added (select two). * https://docs.paloaltonetworks.com/globalprotect/10-1/globalprotect-admin/globalprotect-clientless-vpn/supported-technologies * https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRaCAK

   Source: Adapted from community discussion — confusion

   References

   • docs.paloaltonetworks.com documentation

   Next question

2. Question 322 · 610 in bank

   During the implementation of SSL Forward Proxy decryption, an administrator imports the company’s Enterprise Root CA and Intermediate CA certificates onto the firewall. The company’s Root and Intermediate CA certificates are also distributed to trusted devices using Group Policy and GlobalProtect. Additional device certificates and/or Subordinate certificates requiring an Enterprise CA chain of trust are signed by the company’s Intermediate CA. Which method should the administrator use when creating Forward Trust and Forward Untrust certificates on the firewall for use with decryption?

   • AGenerate two subordinate CA certificates, one for Forward Trust and one for Forward Untrust.
   • BGenerate a CA certificate for Forward Trust and a self-signed CA for Forward Untrust.
   • CGenerate a single subordinate CA certificate for both Forward Trust and Forward Untrust.
   • DGenerate a single self-signed CA certificate for Forward Trust and another for Forward Untrust.

   Show answer

   Answer: B

   Explanation

   Correct answer is B The idea is that clients will trust the TRUST CERTIFICATE (signed by company CA) and do not trust the UNTRUST CERTIFICATE (self-signed)

   Source: Adapted from community discussion — evdw

   References

   • docs.paloaltonetworks.com documentation

   Next question

3. Question 323 · 610 in bank

   A firewall administrator needs to check which egress interface the firewall will use to route the IP 10.2.5.3. Which command should they use?

   • Atest routing fib-lookup ip 10.2.5.0/24 virtual-router default
   • Btest routing route ip 10.2.5.3
   • Ctest routing route ip 10.2.5.3 virtual-router default
   • Dtest routing fib-lookup ip 10.2.5.3 virtual-router default

   Show answer

   Answer: D

   Explanation

   admin@FWS> test routing fib-lookup ip 192.168.5.0 virtual-router default -------------------------------------------------------------------------------- runtime route lookup -------------------------------------------------------------------------------- virtual-router: default destination: 192.168.5.0 result: via x.x.x.x interface ae , sourcey.y.y.y, metric 10 -------------------------------------------------------------------------------- admin@FWS> Correct is D

   Source: Adapted from community discussion — 2022examtaker

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

4. Question 324 · 610 in bank

   A client is concerned about web shell attacks against their servers. Which profile will protect the individual servers?

   • AAnti-Spyware profile
   • BZone Protection profile
   • CDoS Protection profile
   • DAntivirus profile

   Show answer

   Answer: A

   Explanation

   A : webshell Applications and Threats Detects web shells and web shell traffic, including implant detection and command and control interaction. Web shells must first be implanted by a malicious actor onto the compromised host, most often targeting a web server or framework. Subsequent communication with the web shell file frequently enables a malicious actor to establish a foothold in the system, conduct service and network enumeration, data exfiltration, and remote code execution in the context of the web server user. The most common web shell types are PHP, .NET, and Perl markup scripts. Attackers can also use web shell-infected web servers (the web servers can be both internet-facing or internal systems) to target other internal systems.

   Source: Adapted from community discussion — mohr22

   References

   • docs.paloaltonetworks.com documentation

   Next question

5. Question 325 · 610 in bank

   Which firewall feature do you need to configure to query Palo Alto Networks service updates over a data-plane interface instead of the management interface?

   • Aservice route
   • Bdata redistribution
   • CSNMP setup
   • Ddynamic updates

   Show answer

   Answer: A

   Explanation

   Service route is used when you need to modify the interface (management by default) from which to reach certain services.

   Source: Adapted from community discussion — chrisy042

   Next question

6. Question 326 · 610 in bank

   How is an address object of type IP range correctly defined?

   • A192 168 40 1-192 168 40 255
   • B192.168 40 1/24
   • C192.168 40 1, 192.168 40.255
   • D192 168 40 1-255

   Show answer

   Answer: A

   References

   • docs.paloaltonetworks.com documentation

   Next question

7. Question 327 · 610 in bank

   An administrator wants to prevent users from unintentionally accessing malicious domains where data can be exfiltrated through established connections to remote systems. From the Pre-defined Categories tab within the URL Filtering profile what is the right configuration to prevent such connections?

   • ASet the malware category to block
   • BSet the Command and Control category to block
   • CSet the phishing category to override
   • DSet the hacking category to continue

   Show answer

   Answer: B

   Explanation

   https://docs.paloaltonetworks.com/advanced-url-filtering/administration/url-filtering-basics/url-categories Malware Sites containing or known to host malicious content, executables, scripts, viruses, trojans, and code. Command and Control Command-and-control (C2) URLs and domains used by malware or compromised systems to surreptitiously communicate with an attacker's remote server to receive malicious commands or exfiltrate data.

   Source: Adapted from community discussion — 422849c

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

8. Question 328 · 610 in bank

   In order to fulfill the corporate requirement to back up the configuration of Panorama and the Panorama-managed firewalls securely which protocol should you select when adding a new scheduled config export?

   • AHTTPS
   • BFTP
   • CSMB v3
   • DSCP

   Show answer

   Answer: D

   Explanation

   https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-web-interface-help/panorama-web-interface/panorama-scheduled-config-export "Select the protocol to use to export logs from Panorama to a remote host. Secure Copy (SCP) is a secure protocol; FTP is not."

   Source: Adapted from community discussion — confusion

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

9. Question 329 · 610 in bank

   An administrator has been asked to configure a Palo Alto Networks NGFW to provide protection against worms and trojans. Which Security Profile type will protect against worms and trojans?

   • AAnti-Spyware
   • BInstruction Prevention
   • CFile Blocking
   • DAntivirus

   Show answer

   Answer: D

   Explanation

   Antivirus profiles to protect against worms, viruses, and trojans and to block spyware downloads. URL filtering profiles to restrict users access to specific websites and/or website categories, such as shopping or gambling File blocking profiles to block selected file types, and in the specified session flow direction (inbound/outbound/both) WildFire™ analysis profiles to specify for file analysis to be performed locally on the WildFire appliance or in the WildFire cloud Data filtering profiles that help prevent sensitive information such as credit card or social security numbers from leaving a protected network DoS Protection profiles are used with DoS Protection policy rules to protect the firewall from high-volume single-session and multiple-session attacks. GTP Protection profiles enables the firewall to inspect, validate and filter GTP traffic

   Source: Adapted from community discussion — thelittleyellowbirdie

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

10. Question 330 · 610 in bank

    What are the differences between using a service versus using an application for Security Policy match?

    • AUse of a ג€serviceג€ enables the firewall to take immediate action with the first observed packet based on port numbers. Use of an ג€applicationג€ allows the firewall to take immediate action if the port being used is a member of the application standard port list.
    • BThere are no differences between ג€serviceג€ or ג€applicationג€. Use of an ג€applicationג€ simplifies configuration by allowing use of a friendly application name instead of port numbers.
    • CUse of a ג€serviceג€ enables the firewall to take immediate action with the first observed packet based on port numbers. Use of an ג€applicationג€ allows the firewall to take action after enough packets allow for App-ID identification regardless of the ports being used
    • DUse of a ג€serviceג€ enables the firewall to take action after enough packets allow for App-ID identification

    Show answer

    Answer: C

    References

    • docs.paloaltonetworks.com documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNSE practice, question 321. 610 questions available.