PCNSE practice questions 431–440

1. Question 431 · 610 in bank

   Select 3

   An administrator is configuring SSL decryption and needs to ensure that all certificates for both SSL Inbound inspection and SSL Forward Proxy are installed properly on the firewall. When certificates are being imported to the firewall for these purposes, which three certificates require a private key? (Choose three.)

   • AForward Untrust certificate
   • BEnterprise Root CA certificate
   • CForward Trust certificate
   • DEnd-entity (leaf) certificate
   • EIntermediate certificate(s)

   Show answer

   Answer: ACD

   Explanation

   ACD. The question is asking "When certificates are being imported", not "which certificates are generally imported". All certificates listed with the exception of the End-entity cert could be generated on the firewall. Forward Trust (SSL Forward Proxy), Forward Untrust (SSL Forward Proxy), and End-entity (SSL Inbound Inspection) certificates require private keys for the firewall to act as the client (SSL Forward Proxy) or server (SSL Inbound Inspection) in the decyreption process. The Root CA and Intermediate certs only require a public key to verify the signature of subordinate certs. https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/decryption/decryption-concepts/keys-and-certificates-for-decryption-policies

   Source: Adapted from community discussion — McDrudge

   References

   • docs.paloaltonetworks.com documentation

   Next question

2. Question 432 · 610 in bank

   An administrator would like to determine which action the firewall will take for a specific CVE. Given the screenshot below, where should the administrator navigate to view this information?

   

   • AThe profile rule action
   • BCVE column
   • CThe profile rule threat name
   • DExceptions tab

   Show answer

   Answer: D

   Explanation

   D is correct answer. Here my explanation: The Exceptions settings allows you to change the response to a specific signature. For example, you can block all packets that match a signature, except for the selected one, which generates an alert. The Exception tab supports filtering functions. If you not believed, then login the firewall go to Vulnerability > Exceptions and select "Show all signatures". From there you will see all threat information including specific actions. More detail: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm4yCAC Best regards, KH29

   Source: Adapted from community discussion — KH29

   Next question

3. Question 433 · 610 in bank

   Select 2

   An administrator has configured OSPF with Advanced Routing enabled on a Palo Alto Networks firewall running PAN-OS 10.2. After OSPF was configured the administrator noticed that OSPF routes were not being learned. Which two actions could an administrator take to troubleshoot this issue? (Choose two.)

   • ARun the CLI command show advanced-routing ospf neighbor
   • BIn the WebUI, view the Runtime Stats in the virtual router
   • CLook for configuration problems in Network > virtual router > OSPF
   • DIn the WebUI, view Runtime Stats in the logical router

   Show answer

   Answer: AD

   Explanation

   Answer is A,D. 1. The ARE will enable the logical router, not the virtual router. 2. The CLI command is valid and only will appear if you enable it.

   Source: Adapted from community discussion — kosu39

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

4. Question 434 · 610 in bank

   In an HA failover scenario what happens with sessions decrypted by a SSL Forward Proxy Decryption policy?

   • AThe existing session is transferred to the active firewall.
   • BThe firewall drops the session.
   • CThe session is sent to fastpath.
   • DThe firewall allows the session but does not decrypt the session.

   Show answer

   Answer: D

   Explanation

   Correct answer A In an HA failover scenario, the active firewall takes over the traffic processing from the failed firewall. The SSL Forward Proxy Decryption policy is configured on the firewall to decrypt the SSL traffic and inspect it for threats. If the firewall fails over, the existing session is transferred to the active firewall, which continues to decrypt the SSL traffic and inspect it for threats. This ensures that there is no disruption in the traffic flow and the security of the network is maintained. Option B is incorrect because dropping the session would result in disruption of the traffic flow and could lead to security issues. Option C is incorrect because sending the session to fastpath would bypass the SSL Forward Proxy Decryption policy, which defeats the purpose of having the policy in place. Option D is incorrect because allowing the session without decrypting it would also defeat the purpose of having the SSL Forward Proxy Decryption policy in place.

   Source: Adapted from community discussion — nguyendtv50

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

5. Question 435 · 610 in bank

   An administrator just enabled HA Heartbeat Backup on two devices. However, the status on the firewall's dashboard is showing as down.

   

   What could an administrator do to troubleshoot the issue?

   • AGo to Device > High Availability > General > HA Pair Settings > Setup and configuring the peer IP for heartbeat backup
   • BGo to Device > High Availability > HA Communications > General > and check the Heartbeat Backup under Election Settings
   • CCheck peer IP address for heartbeat backup to Device > High Availability > HA Communications > Packet Forwarding settings
   • DCheck peer IP address in the permit list in Device > Setup > Management > Interfaces > Management Interface Settings

   Show answer

   Answer: D

   Explanation

   If HA1 and HA1-backup are configured with data plane ports then Heartbeat backup is needed. If Management port is used as HA1 bkup then Heartbeat backup is not needed. https://live.paloaltonetworks.com/t5/best-practice-assessment-device/high-availability-ha-heartbeat-backup/ta-p/338210

   Source: Adapted from community discussion — 0d2fdfa

   References

   • live.paloaltonetworks.com documentation

   Next question

6. Question 436 · 610 in bank

   An engineer troubleshoots an issue that causes packet drops. Which command should the engineer run in the CLI to see if packet buffer protection is enabled and activated?

   • Ashow session id
   • Bshow system state | match packet-buffer-protection
   • Cshow session packet-buffer- protection
   • Dshow running resource-monitor

   Show answer

   Answer: C

   Next question

7. Question 437 · 610 in bank

   Select 3

   An engineer configures SSL decryption in order to have more visibility to the internal users’ traffic when it is egressing the firewall. Which three types of interfaces support SSL Forward Proxy? (Choose three.)

   • AHigh availability (HA)
   • BLayer 3
   • CLayer 2
   • DTap
   • EVirtual Wire

   Show answer

   Answer: BCE

   Explanation

   Answer BCE: PAN-OS can decrypt and inspect SSL inbound and outbound connections going through the firewall. SSL decryption can occur on interfaces in virtual wire, Layer 2 or Layer 3 mode https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClmyCAC

   Source: Adapted from community discussion — PsvdK

   Next question

8. Question 438 · 610 in bank

   If an administrator wants to apply QoS to traffic based on source, what must be specified in a QoS policy rule?

   • APost-NAT destination address
   • BPre-NAT destination address
   • CPre-NAT source address
   • DPost-NAT source address

   Show answer

   Answer: C

   Explanation

   Check STEP 3 in the below link: https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/quality-of-service/configure-qos Because QoS is enforced on traffic as it egresses the firewall, your QoS policy rule is applied to traffic after the firewall has enforced all other security policy rules, including Network Address Translation (NAT) rules. If you want to apply QoS treatment to traffic based on source, you must specify the pre-NAT source address (such as pre-NAT source IP, pre-NAT source zone, pre-NAT destination IP, and post-NAT destination zone) in a QoS policy rule. Do not configure the QoS policy with the post-NAT source address if you want to apply QoS treatment for the source traffic.

   Source: Adapted from community discussion — Mocix

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

9. Question 439 · 610 in bank

   A company needs to preconfigure firewalls to be sent to remote sites with the least amount of preconfiguration. Once deployed, each firewall must establish secure tunnels back to multiple regional data centers to include the future regional data centers. Which VPN configuration would adapt to changes when deployed to the future site?

   • APreconfigured GlobalProtect satellite
   • BPreconfigured GlobalProtect client
   • CPreconfigured IPsec tunnels
   • DPreconfigured PPTP Tunnels

   Show answer

   Answer: A

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

10. Question 440 · 610 in bank

    If the firewall is configured for credential phishing prevention using the `Domain Credential Filter` method, which login will be detected as credential theft?

    • AMapping to the IP address of the logged-in user.
    • BFirst four letters of the username matching any valid corporate username.
    • CUsing the same user's corporate username and password.
    • DMatching any valid corporate username.

    Show answer

    Answer: C

    Explanation

    Correct Answer is C The Windows-based User‐ID agent is installed on a Read-Only Domain Controller (RODC). The User‐ID agent collects password hashes that correspond to users for which you want to enable credential detection and sends these mappings to the firewall. The firewall then checks if the source IP address of a session matches a username and if the password submitted to the webpage belongs to that username. With this mode, the firewall blocks or alerts on the submission only when the password submitted matches a user password.

    Source: Adapted from community discussion — Silent_Sanctuary

    References

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNSE practice, question 431. 610 questions available.