Question 31 · 610 in bank
Which feature can provide NGFWs with User-ID mapping information?
Palo Alto Networks Certified Network Security Engineer610 questions across 61 pages are complete and free, with no account or card.
610 questions in this bank
Free access · progress saved on this device
Which feature can provide NGFWs with User-ID mapping information?
Which Panorama administrator types require the configuration of at least one access domain? (Choose two.)
Answer: CE
Access domains allow you to control which permissions a specific administrator has when that administrator accesses a set of managed devices through Panorama. Access domains use Device Group and Template permission sets that you must define beforehand.
Source: Adapted from community discussion — JRKhan
Which option enables a Palo Alto Networks NGFW administrator to schedule Application and Threat updates while applying only new content-IDs to traffic?
Answer: C
Correct Answer C: On the Device Dynamic Updates page, select Schedule . Choose to Disable new apps in content update for downloads and installations of content releases. https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/app-id/manage-new-app-ids-introduced-in-content-releases/disable-or-enable-app-ids
Source: Adapted from community discussion — Ab121213
To connect the Palo Alto Networks firewall to AutoFocus, which setting must be enabled?
Answer: B
No, Palo Alto Networks no longer uses AutoFocus. AutoFocus was discontinued on September 30, 2022. Palo Alto Networks has replaced AutoFocus with two new products: Cortex XSOAR Threat Intelligence Management (TIM): This product provides a comprehensive threat intelligence management platform that includes features such as threat intelligence enrichment, threat intelligence correlation, and threat intelligence automation. Cortex XDR (Extended Detection and Response): This product provides a unified endpoint security platform that includes features such as threat detection, threat investigation, and threat response. Both Cortex XSOAR TIM and Cortex XDR include features that were previously available in AutoFocus. For example, both products can enrich threat intelligence with contextual information from Palo Alto Networks' threat intelligence feeds. Both products can also correlate threat intelligence to identify potential threats. And both products can automate threat response.
Source: Adapted from community discussion — bobmead
Which is the maximum number of samples that can be submitted to WildFire per day, based on a WildFire subscription?
Answer: A
answer is 1000 however its not listed in the choices, I assume option A is a typo error it should be 1000 not 10,000..if it is, correct answer is A. https://docs.paloaltonetworks.com/wildfire/9-0/wildfire-admin/submit-files-for-wildfire-analysis/manually-upload-files-to-the-wildfire-portal.html#:~:text=All%20Palo%20Alto%20Networks%20customers,a%20day%20for%20WildFire%20analysis.
Source: Adapted from community discussion — awtkas983
In which two types of deployment is active/active HA configuration supported? (Choose two.)
Answer: AC
A and C Active/Active— Both firewalls in the pair are active and processing traffic and work synchronously to handle session setup and session ownership. Both firewalls individually maintain session tables and routing tables and synchronize to each other. Active/active HA is supported in virtual wire and Layer 3 deployments. https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/high-availability/ha-concepts/ha-modes
Source: Adapted from community discussion — MS_NW
For which two reasons would a firewall discard a packet as part of the packet flow sequence? (Choose two.)
Answer: AB
A and B Denying traffic will discard the packet. Packets can also be discarded due to malformed or incorrect frames, datagrams or packets. C and D are irrelevant as packets would never be discarded if allowed and ECMP simply allows the use of multiple routes or paths to a destination. Read up on "Packer Flow Sequence", it details where exactly it will discard packets (layer 2, layer 3 and on) https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVHCA0
Source: Adapted from community discussion — Daniel2020
Which logs enable a firewall administrator to determine whether a session was decrypted?
Answer: A
A is the answer and not C. Yes in PAN-OS 10 the Decryption Log was introduced but that is more suited for troubleshooting where decryption broke the SSL/TLS session. It is far easier to check if a session was decrypted by checking the Traffic Log. It is clear here in the PAN-OS 10 Admin guide, section "Verify Decryption", that to check the Traffic Log to verify if decryption happened. Silly enough it also states in the very same document that you can check the decryption log (but, it seems to miss out that only for decryption failures). https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/decryption/verify-decryption.html Here is the link for Decryption Log, you will read that it only logs unsuccessful decryption attempts. https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/decryption/troubleshoot-and-monitor-decryption/decryption-logs.html#idb1b7e4a6-b48c-4ca7-8569-b785da780dd6 Now I am not running PAN-OS 10 in the real world so I can't say 100% but reading off the documentation, that is how I would answer the question.
Source: Adapted from community discussion — Daniel2020
An administrator needs to upgrade an NGFW to the most current version of PAN-OSֲ® software. The following is occurring: ✑ Firewall has internet connectivity through e 1/1. ✑ Default security rules and security rules allowing all SSL and web-browsing traffic to and from any zone. ✑ Service route is configured, sourcing update traffic from e1/1. ✑ A communication error appears in the System logs when updates are performed. ✑ Download does not complete. What must be configured to enable the firewall to download the current version of PAN-OS software?
Answer: D
D: A cant be, there is no static service route to point to "palo alto updates" question is regarding that there is existing internet connection, so, default route should exist, B: security policy allowing SSL traffic already exist so there is access from any to any C: there is no scheduler involved on errors recurring with communication, D: is the most closer to the issue, so D is correct.
Source: Adapted from community discussion — rammsdoct
A client has a sensitive application server in their data center and is particularly concerned about session flooding because of denial-of-service attacks. How can the Palo Alto Networks NGFW be configured to specifically protect this server against session floods originating from a single IP address?
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
PCNSE practice, question 31. 610 questions available.
Version 1.0.0. How we source questions