Palo Alto Networks Certified Network Security Engineer610 questions across 61 pages are complete and free, with no account or card.
610 questions in this bank
Free access · progress saved on this device
A network administrator created an intrazone Security policy rule on the firewall. The source zones were set to IT, Finance, and HR. Which two types of traffic will the rule apply to? (Choose two.)
Answer: CD
When a rule is configured as “intrazone”, the “destination zone” cannot be changed (greyed out). Its value comes from the “source zone”.
Source: Adapted from community discussion — Kaspinas
An administrator connected a new fiber cable and transceiver to interface Ethernet1/1 on a Palo Alto Networks firewall. However, the link does not seem to be coming up. If an administrator were to troubleshoot, how would they confirm the transceiver type, tx-power, rx-power, vendor name, and part number via the CLI?
Answer: C
The correct syntax should be show system state filter-pretty sys.s1.p1.phy, where s is slot 1, p is port one = ethernet1/1
Source: Adapted from community discussion — chrisy042
An engineer wants to forward all decrypted traffic on a PA-850 firewall to a forensic tool with a decrypt mirror interface. Which statement is true regarding the configuration of the Decryption Port Mirroring feature?
Answer: A
Which statement is true regarding a heatmap in a BPA report?
Answer: C
The answer is not correct, the answer is correct according to Prevention Posture Assessment (PPA), but not about Best Practice Assessment (BPA) https://docs.paloaltonetworks.com/best-practices/10-2/data-center-best-practices/data-center-best-practice-security-policy/use-palo-alto-networks-assessment-and-review-tools
Source: Adapted from community discussion — certprep2021
An engineer is configuring secure web access (HTTPS) to a Palo Alto Networks firewall for management. Which profile should be configured to ensure that management access via web browsers is encrypted with a trusted certificate?
Answer: B
In an existing deployment, an administrator with numerous firewalls and Panorama does not see any WildFire logs in Panorama. Each firewall has an active WildFire subscription. On each firewall, WildFire logs are available. This issue is occurring because forwarding of which type of logs from the firewalls to Panorama is missing?
Answer: B
The question states that there are no "Wildfire" logs in Panorama but they are on the firewalls. Both Panorama and firewalls have "WildFire Submissions" under Monitor->Logs. If the question were referring to 'wildfire-virus' subtype of Threat logs, I think it would have hinted at that. Also, by saying Wildfire logs are not showing up on the Panorama, it's assumed Threat logs are seen, so C does not fit. Furthermore, 'Wildfire' type logs are an option in the Log Forwarding profile, which the question specifically asks.
Source: Adapted from community discussion — Frightened_Acrobat
An administrator wants to configure the Palo Alto Networks Windows User-ID agent to map IP addresses to usernames. The company uses four Microsoft Active Directory servers and two Microsoft Exchange servers, which can provide logs for login events. All six servers have IP addresses assigned from the following subnet: 192.168.28.32/27. The Microsoft Active Directory servers reside in 192.168.28.32/28, and the Microsoft Exchange servers reside in 192.168.28.48/28. What information does the administrator need to provide in the User Identification > Discovery section?
Answer: A
To collect all of the required mappings, the User-ID agent must connect to all servers that your users log in to in order to monitor the security log files on all servers that contain login events. Auto-discovery locates domain controllers in the local domain only; you must manually add Exchange servers, eDirectory servers, and syslog senders. https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/user-id/map-ip-addresses-to-users/configure-user-mapping-using-the-windows-user-id-agent/configure-the-windows-based-user-id-agent-for-user-mapping
Source: Adapted from community discussion — chrisy042
Refer to the diagram. Users at an internal system want to ssh to the SSH server. The server is configured to respond only to the ssh requests coming from IP 172.16.15.1. In order to reach the SSH server only from the Trust zone, which Security rule and NAT rule must be configured on the firewall?
Answer: D
So here's why it's not B: Security Policies should have pre-NAT IPs and post-NAT Zones (https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-networking-admin/nat/nat-policy-rules/nat-policy-overview). For B to be correct (which it could have been, mind) the pre-NAT IP in the Security Policy's destination IP should've been 192.168.15.1. This leaves D as the only correct answer.
Source: Adapted from community discussion — ceyave7754
What is the best definition of the Heartbeat Interval?
Answer: B
Promotion Hold Time The Promotion Hold Time is the amount of time the passive device (A/P) or active-secondary (A/A) waits when the active device is declared to be down. -- Hello Interval Hello packets are used to inform the other peer of the HA state information and are sent over the HA1 connection -- Heartbeat Interval Heartbeat monitoring uses ICMP pings to ensure that the HA1 connection (control plane) between the high availability members is operational. -- Preemption Hold Time The Preemtion Hold Time is set in minutes and is used to ensure that the higher priority firewall coming back up from a Suspend -- Additional Master Hold Up Time The Additional Master Hold Up Time is only applicable to the active device (A/P) or active-primary device (A/A) and is used to prevent a failover on the master device when both devices detect a link or path failure at the same time.
Source: Adapted from community discussion — Nawda
A QoS profile is configured as shown in the image. The following throughput is realized: Class 3 traffic 325Mbps - Class 5 traffic 470Mbps - Class 7 traffic: 330Mbps - What happens as a result?
Answer: B
B • Priority—Click and select a priority to assign it to a class: ◦ real-time ◦ high ◦ medium ◦ low When contention occurs, traffic that is assigned a lower priority is dropped. Real-time priority uses its own separate queue.
Source: Adapted from community discussion — confusion
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
PCNSE practice, question 331. 610 questions available.
Version 1.0.0. How we source questions