PCNSE practice questions 361–370

1. Question 361 · 610 in bank

   A network administrator is troubleshooting an issue with Phase 2 of an IPSec VPN tunnel. The administrator determines that the lifetime needs to be changed to match the peer. Where should this change be made?

   • AIKE Gateway profile
   • BIPSec Crypto profile
   • CIKE Crypto profile
   • DIPSec Tunnel settings

   Show answer

   Answer: B

   Explanation

   B: Details for both phases of IKE: The **IKE crypto profile** is used to set up the encryption and authentication algorithms used for the key exchange process in IKE Phase 1, and lifetime of the keys, which specifies how long the keys are valid. To invoke the profile, you must attach it to the IKE Gateway configuration. The **IPSec crypto profile** is invoked in IKE Phase 2. It specifies how the data is secured within the tunnel when Auto Key IKE is used to automatically generate keys for the IKE SAs.

   Source: Adapted from community discussion — djedeen

   References

   • docs.paloaltonetworks.com documentation

   Next question

2. Question 362 · 610 in bank

   An administrator creates a custom application containing Layer 7 signatures. The latest application and threat dynamic update is downloaded to the same NGFW. The update contains an application that matches the same traffic signatures as the custom application. Which application should be used to identify traffic traversing the NGFW?

   • ACustom application
   • BSystem logs show an application error and neither signature is used.
   • CDownloaded application
   • DCustom and downloaded application signature files are merged and both are used

   Show answer

   Answer: A

   Explanation

   Custom applications take precedence over predefined applications when traffic matches both a custom-defined signature and a Palo Alto Networks signature. Accordingly, Traffic logs reflect the custom application name once the new application has been configured. Answer is A

   Source: Adapted from community discussion — hamshoo

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

3. Question 363 · 610 in bank

   Which statement about High Availability timer settings is true?

   • AUse the Moderate timer for typical failover timer settings.
   • BUse the Critical timer for faster failover timer settings.
   • CUse the Aggressive timer for faster failover timer settings.
   • DUse the Recommended timer for faster failover timer settings.

   Show answer

   Answer: C

   Explanation

   From Maryaml link - Recommended profile for typical failover timer settings - Aggressive profile for faster failover timer settings Therefore C

   Source: Adapted from community discussion — Passam

   References

   • docs.paloaltonetworks.com documentation

   Next question

4. Question 364 · 610 in bank

   A firewall administrator is trying to identify active routes learned via BGP in the virtual router runtime stats within the GUI. Where can they find this information?

   • ARoutes listed in the routing table with flags Oi
   • BRoutes listed in the routing table with flags A?B
   • CUnder the BGP Summary tab
   • DRoutes listed in the forwarding table with BGP in the Protocol column

   Show answer

   Answer: B

   Explanation

   Flags A?B—Active and learned via BGP A C—Active and a result of an internal interface (connected) - Destination = network A H—Active and a result of an internal interface (connected) - Destination = Host only A R—Active and learned via RIP A S—Active and static S—Inactive (because this route has a higher metric) and static O1—OSPF external type-1 O2—OSPF external type-2 Oi—OSPF intra-area Oo—OSPF inter-area

   Source: Adapted from community discussion — djedeen

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

5. Question 365 · 610 in bank

   Select 3

   An engineer decides to use Panorama to upgrade devices to PAN-OS 10.2. Which three platforms support PAN-OS 10.2? (Choose three.)

   • APA-220
   • BPA-800 Series
   • CPA-5000 Series
   • DPA-500
   • EPA-3400 Series

   Show answer

   Answer: ABE

   Explanation

   Just going through PA questions for the first time, and I find so many absurd questions. Cramming what model supports what version?? Common! You also don't have to cram specific location of all config item to know how to administer a device. Otherwise, how many devices in this day and age will you master?

   Source: Adapted from community discussion — elemzy

   References

   • docs.paloaltonetworks.com documentation

   Next question

6. Question 366 · 610 in bank

   As a best practice, logging at session start should be used in which case?

   • AWhile troubleshooting
   • BOnly on Deny rules
   • COnly when log at session end is enabled
   • DOn all Allow rules

   Show answer

   Answer: A

   Explanation

   A. Logging at session start is usually used when troubleshooting applications that don't change over the course of the session, or applications that aren't recognized by the firewall. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Clt5CAC

   Source: Adapted from community discussion — DenskyDen

   Next question

7. Question 367 · 610 in bank

   What must be configured to apply tags automatically to User-ID logs?

   • AUser mapping
   • BLog Forwarding profile
   • CLog settings
   • DGroup mapping

   Show answer

   Answer: C

   Explanation

   Depending on the type of log you want to use for tagging, create a log forwarding profile or configure the log settings to define how you want the firewall or Panorama to handle logs. For Authentication, Data, Threat, Traffic, Tunnel Inspection, URL, and WildFire logs, create a log forwarding profile. For User-ID, GlobalProtect, and IP-Tag logs, configure the log settings. https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/policy/use-auto-tagging-to-automate-security-actions

   Source: Adapted from community discussion — chrisy042

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

8. Question 368 · 610 in bank

   The profile is configured to provide granular defense against targeted flood attacks for specific critical systems that are accessed by users from the internet. Which profile is the engineer configuring?

   • AVulnerability Protection
   • BDoS Protection
   • CPacket Buffer Protection
   • DZone Protection

   Show answer

   Answer: B

   Explanation

   I think its B because it's for a specific system https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/zone-protection-and-dos-protection/zone-defense/dos-protection-profiles-and-policy-rules. DoS Protection profiles and DoS Protection policy rules combine to protect specific groups of critical resources and individual critical resources against session floods. Compared to Zone Protection profiles, which protect entire zones from flood attacks, DoS protection provides granular defense for specific systems, especially critical systems that users access from the internet and are often attack targets, such as web servers and database servers.

   Source: Adapted from community discussion — aatechler

   References

   • docs.paloaltonetworks.com documentation

   Next question

9. Question 369 · 610 in bank

   Which states will a pair of firewalls be in if their HA Group ID is mismatched?

   • AActive/Non-functional
   • BActive/Passive
   • CInit/Init
   • DActive/Active

   Show answer

   Answer: A

   Explanation

   Non-functional Active/Passive or Active/Active Error state due to a dataplane failure or a configuration mismatch, such as only one firewall configured for packet forwarding, VR sync or QoS sync. https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/high-availability/ha-firewall-states

   Source: Adapted from community discussion — aatechler

   References

   • docs.paloaltonetworks.com documentation

   Next question

10. Question 370 · 610 in bank

    An engineer troubleshooting a site-to-site VPN finds a Security policy dropping the peer’s IKE traffic at the edge firewall. Both VPN peers are behind a NAT, and NAT-T is enabled. How can the engineer remediate this issue?

    • AAdd a Security policy to allow UDP/500.
    • BAdd a Security policy to allow the IKE application.
    • CAdd a Security policy to allow the IPSec application.
    • DAdd a Security policy to allow UDP/4501.

    Show answer

    Answer: C

    Explanation

    Looks like should be C according to below https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClFRCA0 The ipsec application contains the following sub-apps: ike ipsec-ah ipsec-esp ipsec-esp-udp(NAT-T) The sub-apps above are allowed implicitly when the ipsec application is configured as allowed.

    Source: Adapted from community discussion — MrR0bot

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNSE practice, question 361. 610 questions available.