PCNSE practice questions 451–460

1. Question 451 · 610 in bank

   An administrator has users accessing network resources through Citrix XenApp 7.x. Which User-ID mapping solution will map multiple users who are using Citrix to connect to the network and access resources?

   • AClient Probing
   • BTerminal Services agent
   • CGlobalProtect
   • DSyslog Monitoring

   Show answer

   Answer: B

   Explanation

   B In environments with multi-user systems—such as Microsoft Terminal Server or Citrix environments—many users share the same IP address. In this case, the user-to-IP address mapping process requires knowledge of the source port of each client. To perform this type of mapping, you must install the Palo Alto Networks Terminal Server Agent on the Windows/Citrix terminal server itself to intermediate the assignment of source ports to the various user processes. For terminal servers that do not support the Terminal Server agent, such as Linux terminal servers, you can use the XML API to send user mapping information from login and logout events to UserID. See Configure User Mapping for Terminal Server Users for configuration details.

   Source: Adapted from community discussion — [Removed]

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

2. Question 452 · 610 in bank

   A superuser is tasked with creating administrator accounts for three contractors. For compliance purposes, all three contractors will be working with different device-groups in their hierarchy to deploy policies and objects. Which type of role-based access is most appropriate for this project?

   • ACreate a Dynamic Admin with the Panorama Administrator role.
   • BCreate a Dynamic Read only superuser.
   • CCreate a Device Group and Template Admin.
   • DCreate a Custom Panorama Admin.

   Show answer

   Answer: C

   Explanation

   Most appropriate is C. Custom Panorama Admin: Custom Panorama Admin roles allow you to customize the elements of Panorama that an administrator can access. You can hide tabs in the web interface, you can set specific items in Panorama to read-only, or you can limit an administrator’s access to Panorama plugins. Custom Panorama Admin roles require planning and configuration, but they provide extensive flexibility because you can control what administrators can access through the web interface or the CLI. Device Group and Template Admin: Device Group and Template Admin roles also require configuration because there are no built-in examples. These Admin Roles allow you to define which Panorama templates or Panorama device groups an administrator can access and configure. You can hide tabs in the web interface or set specific items to read only to control what administrators can configure.

   Source: Adapted from community discussion — JRKhan

   References

   • docs.paloaltonetworks.com documentation

   Next question

3. Question 453 · 610 in bank

   An administrator connects four new remote offices to the corporate data center. The administrator decides to use the Large Scale VPN (LSVPN) feature on the Palo Alto Networks next-generation firewall. What should the administrator configure in order to connect the sites?

   • AGeneric Routing Encapsulation (GRE) Tunnels
   • BGlobalProtect Satellite
   • CSD-WAN
   • DIKE Gateways

   Show answer

   Answer: B

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

4. Question 454 · 610 in bank

   A customer wants to set up a site-to-site VPN using tunnel interfaces. What format is the correct naming convention for tunnel interfaces?

   • Atun.1025
   • Btunnel.50
   • Cvpn.1024
   • Dgre1/2

   Show answer

   Answer: B

   Explanation

   tunnel is the default name on the setup page, while 50 is the number you assigned for the tunnel... and when you finish creating the tunnel, the wizard adds the default name and assgined number together making it tunnel.50 --- so Answer B is 100% correct guys..

   Source: Adapted from community discussion — ShehuUsman

   Next question

5. Question 455 · 610 in bank

   An engineer notices that the tunnel monitoring has been failing for a day and the VPN should have failed over to a backup path. What part of the network profile configuration should the engineer verify?

   • ADestination IP
   • BThreshold
   • CAction
   • DInterval

   Show answer

   Answer: C

   Explanation

   C: Configure a Monitoring Profile. Network > Network Profiles > Monitor > Add Make sure "Fail Over" Option is selected. < Action Settings https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000POO0CAO

   Source: Adapted from community discussion — Betty2022

   Next question

6. Question 456 · 610 in bank

   Select 3

   Which three multi-factor authentication methods can be used to authenticate access to the firewall? (Choose three.)

   • AOne-time password
   • BUser certificate
   • CSMS
   • DVoice
   • EFingerprint

   Show answer

   Answer: ACD

   Explanation

   Why are there so many wrong solutions given as the correct answer? Really? Fingerprint? This is the 5th or 6th question in a row where the wrong answer is provided as the correct solution.

   Source: Adapted from community discussion — [Removed]

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

7. Question 457 · 610 in bank

   Select 2

   Which two profiles should be configured when sharing tags from threat logs with a remote User-ID agent? (Choose two.)

   • ALDAP
   • BLog Ingestion
   • CHTTP
   • DLog Forwarding

   Show answer

   Answer: CD

   Explanation

   C & D based on: >Threat logs, create a log forwarding profile to define how you want the firewall or Panorama to handle logs. >Configure an HTTP server profile to forward logs to a remote User-ID agent. > Select the log forwarding profile you created then select this server profile as the HTTP server profile https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/policy/use-auto-tagging-to-automate-security-actions

   Source: Adapted from community discussion — Betty2022

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

8. Question 458 · 610 in bank

   What is the PAN-OS NPTv6 feature based on RFC 6296 used for?

   • AApplication port number translation
   • BIPv6-to-IPv6 network prefix translation
   • CStateful translation to provide better security
   • DIPv6-to-IPv6 host portion translation

   Show answer

   Answer: B

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

9. Question 459 · 610 in bank

   Select 2

   An administrator has been tasked with deploying SSL Forward Proxy. Which two types of certificates are used to decrypt the traffic? (Choose two.)

   • ADevice certificate
   • BSubordinate CA from the administrator’s own PKI infrastructure
   • CSelf-signed root CA
   • DExternal CA certificate

   Show answer

   Answer: BC

   References

   • docs.paloaltonetworks.com documentation

   Next question

10. Question 460 · 610 in bank

    Select 2

    An engineer is deploying multiple firewalls with common configuration in Panorama. What are two benefits of using nested device groups? (Choose two.)

    • AInherit all Security policy rules and objects
    • BInherit settings from the Shared group
    • CInherit IPSec crypto profiles
    • DInherit parent Security policy rules and objects

    Show answer

    Answer: BD

    References

    • docs.paloaltonetworks.com documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNSE practice, question 451. 610 questions available.