PCNSE practice questions 441–450

1. Question 441 · 610 in bank

   An engineer reviews high availability (HA) settings to understand a recent HA failover event. Review the screenshot below.

   

   Which timer determines how long the passive firewall will wait before taking over as the active firewall after losing communications with the HA peer?

   • AHeartbeat Interval
   • BPromotion Hold Time
   • CAdditional Master Hold Up Time
   • DMonitor Fail Hold Up Time

   Show answer

   Answer: B

   Explanation

   B is correct answer. In my exam, they asked same questions but meaning refer to "Heartbeat Interval". So must read questions carefully.

   Source: Adapted from community discussion — KH29

   References

   • docs.paloaltonetworks.com documentation

   Next question

2. Question 442 · 610 in bank

   A firewall engineer creates a destination static NAT rule to allow traffic from the internet to a webserver hosted behind the edge firewall. The pre-NAT IP address of the server is 153.6.12.10, and the post-NAT IP address is 192.168.10.10. Refer to the routing and interfaces information below.

   

   

   What should the NAT rule destination zone be set to?

   • ANone
   • BInside
   • CDMZ
   • DOutside

   Show answer

   Answer: D

   Explanation

   Answer should be D .. Outside to outside based on below : The destination zone in the NAT rule is determined after the route lookup of the destination IP address in the original packet (that is, the pre-NAT destination IP address). https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-networking-admin/nat/nat-configuration-examples/destination-nat-exampleone-to-one-mapping

   Source: Adapted from community discussion — jhoncena

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

3. Question 443 · 610 in bank

   Select 3

   A consultant deploys a PAN-OS 11.0 VM-Series firewall with the Web Proxy feature in Transparent Proxy mode. Which three elements must be in place before a transparent web proxy can function? (Choose three.)

   • AUser-ID for the proxy zone
   • BDNS Security license
   • CPrisma Access explicit proxy license
   • DCortex Data Lake license
   • EAuthentication Policy Rule set to default-web-form

   Show answer

   Answer: ABC

   Explanation

   A. User-ID for the proxy zone >> is correct for Transparent B. DNS Security license >> DNS proxy C. Prisma Access explicit proxy license >> same license for explicit and transparent Doesn't seem like a great question but D and E are definitely not correct. Transparent mode does not need addiontional authentication and CDL has nothing to do with web proxy.

   Source: Adapted from community discussion — Frightened_Acrobat

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

4. Question 444 · 610 in bank

   Which source is the most reliable for collecting User-ID user mapping?

   • AMicrosoft Active Directory
   • BMicrosoft Exchange
   • CGlobalProtect
   • DSyslog Listener

   Show answer

   Answer: C

   Explanation

   Since it a Palo exam. I can see c being the answer. You have to login and the firewall monitors that log in. AD may half @$$ know about gp vpn or be slow to update with gp info

   Source: Adapted from community discussion — kewokil120

   References

   • docs.paloaltonetworks.com documentation

   Next question

5. Question 445 · 610 in bank

   Which type of zone will allow different virtual systems to communicate with each other?

   • ATap
   • BTunnel
   • CVirtual Wire
   • DExternal

   Show answer

   Answer: D

   References

   • docs.paloaltonetworks.com documentation

   Next question

6. Question 446 · 610 in bank

   An organization is interested in migrating from their existing web proxy architecture to the Web Proxy feature of their PAN-OS 11.0 firewalls. Currently, HTTP and SSL requests contain the destination IP address of the web server and the client browser is redirected to the proxy. Which PAN-OS proxy method should be configured to maintain this type of traffic flow?

   • ASSL forward proxy
   • BExplicit proxy
   • CTransparent proxy
   • DDNS proxy

   Show answer

   Answer: C

   Explanation

   For the transparent proxy method, the request contains the destination IP address of the web server and the proxy transparently intercepts the client request (either by being in-line or by traffic steering). There is no client configuration and Panorama is optional. Transparent proxy requires a loopback interface, User-ID configuration in the proxy zone, and specific Destination NAT (DNAT) rules. Transparent proxy does not support X-Authenticated Users (XAU) or Web Cache Communications Protocol (WCCP). https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-new-features/networking-features/web-proxy

   Source: Adapted from community discussion — samqq

   References

   • docs.paloaltonetworks.com documentation

   Next question

7. Question 447 · 610 in bank

   An engineer discovers the management interface is not routable to the User-ID agent. What configuration is needed to allow the firewall to communicate to the User-ID agent?

   • AAdd a Policy Based Forwarding (PBF) policy to the User-ID agent IP
   • BCreate a NAT policy for the User-ID agent server
   • CCreate a custom service route for the UID Agent
   • DAdd a static route to the virtual router

   Show answer

   Answer: C

   References

   • live.paloaltonetworks.com documentation

   Next question

8. Question 448 · 610 in bank

   An engineer receives reports from users that applications are not working and that websites are only partially loading in an asymmetric environment. After investigating, the engineer observes the flow_tcp_non_syn_drop counter increasing in the show counters global output. Which troubleshooting command should the engineer use to work around this issue?

   • Aset deviceconfig setting tcp asymmetric-path drop
   • Bset session tcp-reject-non-syn yes
   • Cset deviceconfig setting tcp asymmetric-path bypass
   • Dset deviceconfig setting session tcp-reject-non-syn no

   Show answer

   Answer: D

   Explanation

   Run the following commands to disable the option permanently: > configure # set deviceconfig setting session tcp-reject-non-syn no # commit ------ B, would be correct if it would be set to NO. Run the following commands to disable TCP reject non-SYN temporarily (until reboot) > set session tcp-reject-non-syn no source:https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClEwCAK

   Source: Adapted from community discussion — Betty2022

   Next question

9. Question 449 · 610 in bank

   Where is Palo Alto Networks Device Telemetry data stored on a firewall with a device certificate installed?

   • APanorama
   • BM600 Log Collectors
   • CCortex Data Lake
   • DOn Palo Alto Networks Update Servers

   Show answer

   Answer: C

   Explanation

   Device telemetry collects data about your next-generation firewall or Panorama and shares it with Palo Alto Networks by uploading the data to Cortex Data Lake. This data is used to power telemetry apps, which are cloud-based applications that make it easy to monitor and manage your next-generation firewalls and Panoramas. source: https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/device-telemetry/device-telemetry-overview PS a side note, for future use: iff your organization does not have a Cortex Data Lake license, then you must install a device certificate in order to share this data. -- so there are 2 options in case this ever comes up in the exam or in your job.

   Source: Adapted from community discussion — Betty2022

   References

   • docs.paloaltonetworks.com documentation

   Next question

10. Question 450 · 610 in bank

    Which GlobalProtect gateway setting is required to enable split-tunneling by access route, destination domain, and application?

    • ASatellite mode
    • BTunnel mode
    • CNo Direct Access to local networks
    • DIPSec mode

    Show answer

    Answer: B

    References

    • docs.paloaltonetworks.com documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNSE practice, question 441. 610 questions available.