PCNSE practice questions 381–390

1. Question 381 · 610 in bank

   An engineer is configuring SSL Inbound Inspection for public access to a company’s application. Which certificate(s) need to be installed on the firewall to ensure that inspection is performed successfully?

   • AIntermediate CA(s) and End-entity certificate
   • BRoot CA and Intermediate CA(s)
   • CSelf-signed certificate with exportable private key
   • DSelf-signed CA and End-entity certificate

   Show answer

   Answer: A

   Explanation

   https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/decryption/configure-ssl-inbound-inspection We recommend uploading a certificate chain (a single file) to the firewall if your end-entity (leaf) certificate is signed by one or more intermediate certificates and your web server supports TLS 1.2 and Rivest, Shamir, Adleman (RSA) or Perfect Forward Secrecy (PFS) key exchange algorithms. Uploading the chain avoids client-side server certificate authentication issues. You should arrange the certificates in the file as follows: End-entity (leaf) certificate Intermediate certificates (in issuing order) (Optional) Root certificate

   Source: Adapted from community discussion — MrR0bot

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

2. Question 382 · 610 in bank

   A network security administrator wants to begin inspecting bulk user HTTPS traffic flows egressing out of the internet edge firewall. Which certificate is the best choice to configure as an SSL Forward Trust certificate?

   • AA Machine Certificate for the firewall signed by the organization’s PKI
   • BA web server certificate signed by the organization’s PKI
   • CA subordinate Certificate Authority certificate signed by the organization’s PKI
   • DA self-signed Certificate Authority certificate generated by the firewall

   Show answer

   Answer: C

   Explanation

   Regardless of whether you generate Forward Trust certificates from your Enterprise Root CA or use a self-signed certificate generated on the firewall, generate a separate subordinate Forward Trust CA certificate for each firewall. The flexibility of using separate subordinate CAs enables you to revoke one certificate when you decommission a device (or device pair) without affecting the rest of the deployment and reduces the impact in any situation in which you need to revoke a certificate. Separate Forward Trust CAs on each firewall also helps troubleshoot issues because the CA error message the user sees includes information about the firewall the traffic is traversing. If you use the same Forward Trust CA on every firewall, you lose the granularity of that information.

   Source: Adapted from community discussion — bearfromdownunder

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

3. Question 383 · 610 in bank

   Select 2

   A company has configured a URL Filtering profile with override action on their firewall. Which two profiles are needed to complete the configuration? (Choose two.)

   • ADecryption
   • BHTTP Server
   • CSSL/TLS Service
   • DInterface Management

   Show answer

   Answer: CD

   Explanation

   CD: Select an SSL/TLS Service Profile. The profile specifies the certificate that the firewall presents to the user if the site with the override is an HTTPS site. Create a management profile to enable the interface to display the URL Filtering Continue and Override Page response page

   Source: Adapted from community discussion — Grace_Shu

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

4. Question 384 · 610 in bank

   Refer to the exhibit.

   

   Which will be the egress interface if the traffic's ingress interface is ethernet1/7 sourcing from 192.168.111.3 and to the destination 10.46.41.113?

   • Aethernet1/6
   • Bethernet1/3
   • Cethernet1/7
   • Dethernet1/5

   Show answer

   Answer: D

   Explanation

   When an interface is configured as virtual wire, the routing table is not checked by the FW. If it enters one interface, it has to exit the other interface of the virtual wire, there is no exception.

   Source: Adapted from community discussion — vj77

   References

   • docs.paloaltonetworks.com documentation

   Next question

5. Question 385 · 610 in bank

   Select 3

   Which three authentication types can be used to authenticate users? (Choose three.)

   • ALocal database authentication
   • BPingID
   • CKerberos single sign-on
   • DGlobalProtect client
   • ECloud authentication service

   Show answer

   Answer: ACE

   Explanation

   Posting to eliminate all doubt. I can find three options from directly quoting the website: "Kerberos SSO—The firewall first tries SSO authentication. If that fails, it falls back to the specified authentication Type." "External authentication or local database authentication—The firewall prompts the user to enter login credentials, and uses an external service or local database to authenticate the user." "Select the Type of authentication service. ... If you select Cloud Authentication Service, configure a Cloud Identity Engine instance to communicate with the firewall." Reference: https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/authentication/configure-an-authentication-profile-and-sequence#idf258e497-4998-4a70-8676-aa9aba521a44 https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/authentication/configure-an-authentication-profile-and-sequence#idf258e497-4998-4a70-8676-aa9aba521a44

   Source: Adapted from community discussion — examtopicstroilevw

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

6. Question 386 · 610 in bank

   Which feature checks Panorama connectivity status after a commit?

   • AHTTP Server profiles
   • BDevice monitoring data under Panorama settings
   • CAutomated commit recovery
   • DScheduled config export

   Show answer

   Answer: C

   References

   • docs.paloaltonetworks.com documentation

   Next question

7. Question 387 · 610 in bank

   

   What are two explanations for this type of issue? (Choose two.)

   • AEither management or a data-plane interface is used as HA1-backup.
   • BOne of the firewalls has gone into the suspected state.
   • CThe peer IP is not included in the permit list on Management Interface Settings.
   • DThe Backup Peer HA1 IP Address was not configured when the commit was issued.

   Show answer

   Answer: D

   Explanation

   Answers: AD Cause The issue is seen when the HA1-backup is configured with either management (MGT) or an in-band interface. The "Backup Peer HA1 IP Address" is not configured : https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000008UmPCAU&lang=en_US%E2%80%A9

   Source: Adapted from community discussion — Kaspinas

   References

   • docs.paloaltonetworks.com documentation

   Next question

8. Question 388 · 610 in bank

   Select 2

   A network administrator wants to deploy SSL Forward Proxy decryption. What two attributes should a forward trust certificate have? (Choose two.)

   • AA certificate authority (CA) certificate
   • BA private key
   • CA server certificate
   • DA subject alternative name

   Show answer

   Answer: AB

   Explanation

   Subject Alternative Name (SAN) is not mandatory for a forward trust certificate. It may be utilized to identify alternate names for the server presenting the certificate, employing attributes such as dNSName or iPAddress. Regarding the requirements for all certificates: Subject: The Common Name (CN) attribute serves to establish the identity of the entity presenting the certificate. It's worth noting that in certain certificates, the Subject Alternate Name extension can be utilized as an alternative means of specifying identity. In this particular context, it appears that the term "attributes" is not confined to the conventional attributes of a certificate, but rather refers broadly to its properties. Since there is only one attribute mentioned, SAN, and it's not obligatory, the answer likely consists of attributes that are essential for decrypting the traffic. Thus, the correct response could be A and B, as without these properties (or attributes), decrypting the traffic would not be feasible.

   Source: Adapted from community discussion — Eluis007

   References

   • docs.paloaltonetworks.com documentation

   Next question

9. Question 389 · 610 in bank

   An administrator is assisting a security engineering team with a decryption rollout for inbound and forward proxy traffic. Incorrect firewall sizing is preventing the team from decrypting all of the traffic they want to decrypt. Which three items should be prioritized for decryption? (Choose three.)

   • AFinancial, health, and government traffic categories
   • BLess-trusted internal IP subnets
   • CKnown malicious IP space
   • DHigh-risk traffic categories
   • EPublic-facing servers

   Show answer

   Answer: B

   Explanation

   BDE, we all know why not A, but why would you decrypt C...if you block that traffic (as you should) then security profiles are not even applied (even if you set them on a blocking security profile, they wont take any affect) so why set up a decryption profile for it?

   Source: Adapted from community discussion — lildevil

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

10. Question 390 · 610 in bank

    During a laptop-replacement project, remote users must be able to establish a GlobalProtect VPN connection to the corporate network before logging in to their new Windows 10 endpoints. The new laptops have the 5.2.10 GlobalProtect Agent installed, so the administrator chooses to use the Connect Before Logon feature to solve this issue. What must be configured to enable the Connect Before Logon feature?

    • AThe Certificate profile in the GlobalProtect Portal Authentication Settings.
    • BRegistry keys on the Windows system.
    • CThe GlobalProtect Portal Agent App Settings Connect Method to Pre-logon then On-demand.
    • DX-Auth Support in the GlobalProtect Gateway Tunnel Settings.

    Show answer

    Answer: B

    Explanation

    Should be B https://docs.paloaltonetworks.com/globalprotect/5-2/globalprotect-app-new-features/new-features-released-in-gp-app/connect-before-logon "To use Connect Before Logon, you must enable the settings in the Windows registry and choose the authentication method"

    Source: Adapted from community discussion — Patacuah

    References

    • docs.paloaltonetworks.com documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNSE practice, question 381. 610 questions available.