PCNSE practice questions 411–420

1. Question 411 · 610 in bank

   The same route appears in the routing table three times using three different protocols. Which mechanism determines how the firewall chooses which route to use?

   • AAdministrative distance
   • BMetric
   • COrder in the routing table
   • DRound Robin load balancing

   Show answer

   Answer: A

   Explanation

   Set Administrative Distances for types of routes as required for your network. When the virtual router has two or more different routes to the same destination, it uses administrative distance to choose the best path from different routing protocols and static routes, by preferring a lower distance. https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/networking/virtual-routers

   Source: Adapted from community discussion — blahblah1234567890000

   References

   • docs.paloaltonetworks.com documentation
   • live.paloaltonetworks.com documentation
   • live.paloaltonetworks.com documentation

   Next question

2. Question 412 · 610 in bank

   An engineer has discovered that certain real-time traffic is being treated as best effort due to it exceeding defined bandwidth. Which QoS setting should the engineer adjust?

   • AQoS interface: Egress Guaranteed
   • BQoS profile: Egress Max
   • CQoS profile: Egress Guaranteed
   • DQoS interface: Egress Max

   Show answer

   Answer: C

   Explanation

   C. Any traffic that exceeds the Egress Guaranteed value is best effort and not guaranteed. Set the overall bandwidth limits for the QoS profile: Enter an Egress Max value to set the overall bandwidth allocation for the QoS profile. Enter an Egress Guaranteed value to set the guaranteed bandwidth for the QoS Profile. https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/quality-of-service/configure-qos

   Source: Adapted from community discussion — DenskyDen

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

3. Question 413 · 610 in bank

   A Security policy rule is configured with a Vulnerability Protection Profile and an action of “Deny”. Which action will this configuration cause on the matched traffic?

   • AIt will cause the firewall to deny the matched sessions. Any configured Security Profiles have no effect if the Security policy rule action is set to “Deny”.
   • BThe configuration will allow the matched session unless a vulnerability signature is detected. The “Deny” action will supersede the per-severity defined actions defined in the associated Vulnerability Protection Profile.
   • CIt will cause the firewall to skip this Security policy rule. A warning will be displayed during a commit.
   • DThe Profile Settings section will be grayed out when the Action is set to “Deny”.

   Show answer

   Answer: A

   Explanation

   A: If you want to block traffic from zone A to zone B and you have configured the security rule to block this traffic, lets say the first packet comes from zone A, we do a route lookup and find the destination zone to be zone B. You will then do a policy lookup and see that there is a policy match. But since the action is set to "deny", the packet is dropped immediately. Firewall will only inspect the traffic if the policy it matched has action set to "allow".

   Source: Adapted from community discussion — djedeen

   Next question

4. Question 414 · 610 in bank

   Which feature detects the submission of corporate login information into website forms?

   • AApp-ID
   • BFile Blocking profile
   • CData Filtering profile
   • DCredential Phishing

   Show answer

   Answer: D

   References

   • docs.paloaltonetworks.com documentation

   Next question

5. Question 415 · 610 in bank

   Select 3

   Which three firewall multi-factor authentication factors are supported by PAN-OS? (Choose three.)

   • AShort message service
   • BPush
   • CUser logon
   • DOne-Time Password
   • ESSH key

   Show answer

   Answer: ABD

   References

   • docs.paloaltonetworks.com documentation

   Next question

6. Question 416 · 610 in bank

   An administrator needs to identify which NAT policy is being used for internet traffic. From the GUI of the firewall, how can the administrator identify which NAT policy is in use for a traffic flow?

   • AFrom the Monitor tab, click Traffic view and review the information in the detailed log view.
   • BFrom the Monitor tab, click Traffic view, ensure that the Source or Destination NAT columns are included and review the information in the detailed log view.
   • CFrom the Monitor tab, click App Scope > Network Monitor and filter the report for NAT rules.
   • DFrom the Monitor tab, click Session Browser and review the session details.

   Show answer

   Answer: D

   Explanation

   Answerd is D, if you go to monitor>Session Browser and see the details you can locate the NAT policy that the flow is matching. its the only way to see the NAT policy for a session log (only if active at the time) in the GUI.

   Source: Adapted from community discussion — jmolina777

   Next question

7. Question 417 · 610 in bank

   Which Security policy rule will allow an admin to block facebook chat but allow Facebook in general?

   • ADeny application facebook-chat before allowing application facebook
   • BDeny application facebook on top
   • CAllow application facebook on top
   • DAllow application facebook before denying application facebook-chat

   Show answer

   Answer: A

   Explanation

   Allowing Facebook will allow all its dependents including Facebook chat. therefore, you will need to block Facebook chat before the allow Facebook below it. A is the correct answer.

   Source: Adapted from community discussion — NNgiggs

   Next question

8. Question 418 · 610 in bank

   Select 3

   Which three external services perform both authentication and authorization for administration of firewalls? (Choose three.)

   • AKerberos
   • BTACACS+
   • CSAML
   • DRadius
   • ELDAP

   Show answer

   Answer: BCD

   Explanation

   The administrative accounts are defined on an external SAML, TACACS+, or RADIUS server. The server performs both authentication and authorization. For authorization, you define Vendor-Specific Attributes (VSAs) on the TACACS+ or RADIUS server, or SAML attributes on the SAML server. PAN-OS maps the attributes to administrator roles, access domains, user groups, and virtual systems that you define on the firewall. For details, see:

   Source: Adapted from community discussion — aatechler

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

9. Question 419 · 610 in bank

   A firewall administrator has been tasked with ensuring that all firewalls forward System logs to Panorama. In which section is this configured?

   • AMonitor > Logs > System
   • BObjects > Log Forwarding
   • CDevice > Log Settings
   • DPanorama > Managed Devices

   Show answer

   Answer: C

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

10. Question 420 · 610 in bank

    A customer would like to support Apple Bonjour in their environment for ease of configuration. Which type of interface in needed on their PA-3200 Series firewall to enable Bonjour Reflector in a segmented network?

    • AVirtual Wire interface
    • BLayer 3 interface
    • CLayer 2 interface
    • DLoopback interface

    Show answer

    Answer: B

    References

    • docs.paloaltonetworks.com documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNSE practice, question 411. 610 questions available.