Question 351 · 610 in bank
Select 2
View the screenshots. A QoS profile and policy rules are configured as shown.
Based on this information, which two statements are correct? (Choose two.)
Show answer
Answer: BD
PCNSEProfessionalPalo Alto NetworksAll questions freePage 36 of 61
PCNSE practice questions 351–360
Palo Alto Networks Certified Network Security Engineer610 questions across 61 pages are complete and free, with no account or card.
Official study references
610 questions in this bank
Free access · progress saved on this device
Question 352 · 610 in bank
An engineer is attempting to resolve an issue with slow traffic. Which PAN-OS feature can be used to prioritize certain network traffic?
Show answer
Answer: D
Question 353 · 610 in bank
An auditor is evaluating the configuration of Panorama and notices a discrepancy between the Panorama template and the local firewall configuration. When overriding the firewall configuration pushed from Panorama, what should you consider?
Show answer
Answer: B
Question 354 · 610 in bank
What happens, by default, when the GlobalProtect app fails to establish an IPSec tunnel to the GlobalProtect gateway?
Show answer
Answer: C
Question 355 · 610 in bank
Review the images. A firewall policy that permits web traffic includes the global-logs policy as depicted.
What is the result of traffic that matches the “Alert -Threats” Profile Match List?
Show answer
Answer: C
Question 356 · 610 in bank
An engineer troubleshooting a VPN issue needs to manually initiate a VPN tunnel from the CLI. Which CLI command can the engineer use?
Show answer
Answer: D
References
Question 357 · 610 in bank
What is the dependency for users to access services that require authentication?
Show answer
Answer: D
Explanation
D Before reaching to auth, you need to be allowed from the security policy. christy042's link: "Before starting, ensure that your Security Policy allows users to access the services and URL categories that require authentication."
Source: Adapted from community discussion — confusion
References
Question 358 · 610 in bank
An engineer is designing a deployment of multi-vsys firewalls. What must be taken into consideration when designing the device group structure?
Show answer
Answer: B
Explanation
Answer is B. I worked in an environment like this in my last job. The multi-vsys firewalls were in different Device Groups.
Source: Adapted from community discussion — PaloSteve
Question 359 · 610 in bank
Select 2An engineer needs to collect User-ID mappings from the company’s existing proxies. What two methods can be used to pull this data from third party proxies? (Choose two.)
Question 360 · 610 in bank
An engineer needs to configure SSL Forward Proxy to decrypt traffic on a PA-5260. The engineer uses a forward trust certificate from the enterprise PKI that expires December 31, 2025. The validity date on the PA-generated certificate is taken from what?
Show answer
Answer: C
Explanation
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm8wCAC "The validity date on the Palo Alto Networks firewall generated certificate is taken from the validity date on the real server certificate."
Source: Adapted from community discussion — Shoieb
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
PCNSE practice, question 351. 610 questions available.
About this question bank
Version 1.0.0. How we source questions