Palo Alto Networks Certified Network Security Engineer610 questions across 61 pages are complete and free, with no account or card.
610 questions in this bank
Free access · progress saved on this device
Which log type would provide information about traffic blocked by a Zone Protection profile?
Answer: C
c: Threat logs The threat logs will show events related to zone protection. In the screenshot below, ICMP flood protection was triggered by the Zone Protection policy:
Source: Adapted from community discussion — djedeen
Where can an administrator see both the management-plane and data-plane CPU utilization in the WebUI?
An administrator wants to perform HIP checks on the endpoints to ensure their security posture. Which license is required on all Palo Alto Networks next-generation firewalls that will be performing the HIP checks?
Answer: A
o use the HIP feature, you must purchase and install a GlobalProtect subscription license on each gateway that will perform HIP checks. To verify the status of your licenses on each portal and gateway, select Device Licenses
Source: Adapted from community discussion — blahblah1234567890000
A network security administrator wants to configure SSL inbound inspection. Which three components are necessary for inspecting the HTTPS traffic as it enters the firewall? (Choose three.)
Answer: BCD
Configuring SSL Inbound Inspection includes: - Installing the targeted server certificate on the firewall. - Creating an SSL Inbound Inspection Decryption policy rule. - Applying a Decryption profile to the policy rule.
Source: Adapted from community discussion — djedeen
You have been asked to implement GlobalProtect for your organization. You have decided on https://gp.mycompany.com for your Portal, and have received the certificate and key. Where would you navigate to on the firewall UI to import the certificate?
Answer: D
Palo has a lot of full of shitty questions. How's is a sysadmin supposed to cram interface layout and location of tabs. Admins work with several devices, and are supposed to cram tab layout?
Source: Adapted from community discussion — elemzy
Which event will happen if an administrator uses an Application Override Policy?
Answer: B
Correct: B "If you define an application override, the firewall stops processing at Layer-4. The custom application name is assigned to the session to help identify it in the logs, and the traffic is not scanned for threats." (See the bottom of the page) https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/app-id/manage-custom-or-unknown-applications
Source: Adapted from community discussion — ChiaPet75
An engineer has been asked to limit which routes are shared by running two different areas within an OSPF implementation. However, the devices share a common link for communication. Which virtual router configuration supports running multiple instances of the OSPF protocol over a single link?
Answer: B
Answer is B: Support for multiple instances per link—With OSPFv3, you can run multiple instances of the OSPF protocol over a single link. This is accomplished by assigning an OSPFv3 instance ID number. An interface that is assigned to an instance ID drops packets that contain a different ID.
Source: Adapted from community discussion — djedeen
An administrator is configuring a Panorama device group. Which two objects are configurable? (Choose two.)
Answer: AC
A&C are correct as you can see at this url: https://docs.paloaltonetworks.com/panorama/9-1/panorama-admin/manage-firewalls/manage-device-groups/create-objects-for-use-in-shared-or-device-group-policy#id8a81daf5-4363-4971-b9ec-411c41b510ba 1. Select the Objects>Security Profiles>URL Filtering tab and click Add... 2. Select Objects>Addresses and select the Device Group in which you will use the object.. .
Source: Adapted from community discussion — djedeen
An administrator wants to use LDAP, TACACS+, and Kerberos as external authentication services for authenticating users. What should the administrator be aware of regarding the authentication sequence, based on the Authentication profiles in the order Kerberos, LDAP, and TACACS+?
Answer: D
from study guide :- When user or administrative access is configured, one or more authentication methods must be specified. A user or administrator definition typically requires an Authentication Profile that specifies the desired authentication method. When more than one method is desired, you can instead use an Authentication Sequence, which is a list of Authentication Profiles. The first profile will be accessed. If it is not available, the next option will be tried. An Authentication Profile specifies a single Server Profile. A Server Profile contains specific configuration and access information that is necessary to reach the external authentication service.
Source: Adapted from community discussion — aatechler
An administrator has two pairs of firewalls within the same subnet. Both pairs of firewalls have been configured to use High Availability mode with Active/Passive. The ARP tables for upstream routes display the same MAC address being shared for some of these firewalls. What can be configured on one pair of firewalls to modify the MAC addresses so they are no longer in conflict?
Answer: C
Per Evdw's link: The Group ID is part of the MAC address in a HA pair. Each pair of devices in a multi-cluster environment must have a unique Group ID in order to prevent duplicate MAC entries in upstream ARP tables. Changing the Group ID in one of these clusters should resolve the problem.
Source: Adapted from community discussion — djedeen
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
PCNSE practice, question 401. 610 questions available.
Version 1.0.0. How we source questions