PCNSE practice questions 461–470

1. Question 461 · 610 in bank

   A network security administrator wants to inspect HTTPS traffic from users as it egresses through a firewall to the Internet/Untrust zone from trusted network zones. The security admin wishes to ensure that if users are presented with invalid or untrusted security certificates, the user will see an untrusted certificate warning. What is the best choice for an SSL Forward Untrust certificate?

   • AA self-signed certificate generated on the firewall
   • BA web server certificate signed by the organization’s PKI
   • CA web server certificate signed by an external Certificate Authority
   • DA subordinate Certificate Authority certificate signed by the organization’s PKI

   Show answer

   Answer: A

   Explanation

   It's A, A self-signed certificate generated on the firewall. Client is supposed to present a warning about untrusted certificate and that's what answer A will provide. I am surprised how many people answer wrong even for the simplest questions like this and create too much noise with their comments and create confusion. I hope there are people that really read study guides, admin guides, PAN Beacon study materials before they put comments here with so much confidence claiming something is correct 100% while it's not.

   Source: Adapted from community discussion — Andromeda1800

   Next question

2. Question 462 · 610 in bank

   An administrator needs to upgrade a Palo Alto Networks NGFW to the most current version of PAN-OSֲ® software. The firewall has internet connectivity through an Ethernet interface, but no internet connectivity from the management interface. The Security policy has the default security rules and a rule that allows all web- browsing traffic from any to any zone. What must the administrator configure so that the PAN-OSֲ® software can be upgraded?

   • ASecurity policy rule
   • BCRL
   • CService route
   • DScheduler

   Show answer

   Answer: C

   Explanation

   This one is another typical PANW malicious test question. We all know that a service route is needed. However, the question states web-browsing is being allowed by the policy. PANW updates are not delivered over web-browsing. Therefore, a new security policy must be added allowing app-ID "paloalto-updates", ssl, and web-browsing on application default service/port. Just something to consider. In summary, I'm not sure if "C" is the correct answer, or "A"

   Source: Adapted from community discussion — Pretorian

   Next question

3. Question 463 · 610 in bank

   After implementing a new NGFW, a firewall engineer sees a VoIP traffic issue going through the firewall. After troubleshooting, the engineer finds that the firewall performs NAT on the voice packets payload and opens dynamic pinholes for media ports. What can the engineer do to solve the VoIP traffic issue?

   • ADisable ALG under H.323 application
   • BIncrease the TCP timeout under H.323 application
   • CIncrease the TCP timeout under SIP application
   • DDisable ALG under SIP application

   Show answer

   Answer: D

   Explanation

   From the provided link: The Palo Alto Networks firewall uses the Session Initiation Protocol (SIP) application-level gateway (ALG) to open dynamic pinholes in the firewall where NAT is enabled. However, some applications—such as VoIP—have NAT intelligence embedded in the client application. In these cases, the SIP ALG on the firewall can interfere with the signaling sessions and cause the client application to stop working. One solution to this problem is to define an Application Override Policy for SIP, but using this approach disables the App-ID and threat detection functionality. A better approach is to disable the SIP ALG, which does not disable App-ID or threat detection.

   Source: Adapted from community discussion — Merlin0o

   References

   • docs.paloaltonetworks.com documentation

   Next question

4. Question 464 · 610 in bank

   After importing a pre-configured firewall configuration to Panorama, what step is required to ensure a commit/push is successful without duplicating local configurations?

   • AEnsure Force Template Values is checked when pushing configuration.
   • BPush the Template first, then push Device Group to the newly managed firewall.
   • CPush the Device Group first, then push Template to the newly managed firewall.
   • DPerform the Export or push Device Config Bundle to the newly managed firewall.

   Show answer

   Answer: D

   Explanation

   Agree D: Step5 as par Pochex comment https://docs.paloaltonetworks.com/panorama/11-0/panorama-admin/manage-firewalls/transition-a-firewall-to-panorama-management/migrate-a-firewall-to-panorama-management Push the configuration bundle from Panorama to the newly added firewall to remove all policy rules and objects from its local configuration. This step is necessary to prevent duplicate rule or object names, which would cause commit errors when you push the device group configuration from Panorama to the firewall in the next step.

   Source: Adapted from community discussion — Betty2022

   References

   • docs.paloaltonetworks.com documentation

   Next question

5. Question 465 · 610 in bank

   Which new PAN-OS 11.0 feature supports IPv6 traffic?

   • AOSPF
   • BIKEv1
   • CDHCP Server
   • DDHCPv6 Client with Prefix Delegation

   Show answer

   Answer: D

   References

   • docs.paloaltonetworks.com documentation

   Next question

6. Question 466 · 610 in bank

   If a URL is in multiple custom URL categories with different actions, which action will take priority?

   • ABlock
   • BAllow
   • CAlert
   • DOverride

   Show answer

   Answer: A

   Explanation

   A should be correct. When a URL matches multiple categories, the category chosen is the one that has the most severe action defined below (block being most severe and allow least severe). 1 block 2 override 3 continue 4 alert 5 allow https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClsmCAC

   Source: Adapted from community discussion — MohZekh

   Next question

7. Question 467 · 610 in bank

   An engineer is reviewing the following high availability (HA) settings to understand a recent HA failover event.

   

   Which timer determines the frequency between packets sent to verify that the HA functionality on the other HA firewall is operational?

   • AHello Interval
   • BMonitor Fail Hold Up Time
   • CHeartbeat Interval
   • DPromotion Hold Time

   Show answer

   Answer: A

   Explanation

   https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/high-availability/ha-concepts/failover "Heartbeat Polling and Hello messages- The firewalls use hello message and heartbeats to verify that the peer firewall is responsive and operational. Hello messages are sent from one peer to the other at the configured Hello Interval to verify the state of the firewall. The heartbeat is an ICMP ping to the HA peer over the control link, and the peer responds to the ping to establish that the firewalls are connected and responsive. By default, the interval for the heartbeat is 1000 milliseconds. A ping is sent every 1000 milliseconds and if there are three consecutive heartbeat losses, a failovers occurs. For details on the HA timers that trigger a failover, see HA Timers." Since the failover here talks about pings, and Heartbeat is the one that does pings, I'm leaning towards Answer C.

   Source: Adapted from community discussion — PaloSteve

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

8. Question 468 · 610 in bank

   Select 3

   Which three items must be configured to implement application override? (Choose three.)

   • AApplication filter
   • BApplication override policy rule
   • CCustom app
   • DDecryption policy rule
   • ESecurity policy rule

   Show answer

   Answer: BCE

   Explanation

   Based on the link you sent.... What You'll Need for Setup To configure an Application Override, go to Policies > Application Override in the WebGUI. For setup, you'll need the following: Custom Application to be used in the Application Override policy (recommended) Application Override policy Security Policy that allows the newly created Custom Application through the firewall should be BCE

   Source: Adapted from community discussion — mercysayno765

   References

   • docs.paloaltonetworks.com documentation

   Next question

9. Question 469 · 610 in bank

   An engineer is configuring a firewall with three interfaces: • MGT connects to a switch with internet access. • Ethernet1/1 connects to an edge router. • Ethernet1/2 connects to a virtualization network. The engineer needs to configure dynamic updates to use a dataplane interface for internet traffic. What should be configured in Setup > Services > Service Route Configuration to allow this traffic?

   • ASet DNS and Palo Alto Networks Services to use the MGT source interface.
   • BSet DNS and Palo Alto Networks Services to use the ethernet1/1 source interface.
   • CSet DNS and Palo Alto Networks Services to use the ethernet1/2 source interface.
   • DSet DDNS and Palo Alto Networks Services to use the MGT source interface.

   Show answer

   Answer: B

   Explanation

   B) is correct In A) the MGT interface is not a dataplane interface as the question requests In C) the E1/2 interface has no direct internet access as it goes to a virtualization network.

   Source: Adapted from community discussion — evilCorpBot7494

   Next question

10. Question 470 · 610 in bank

    Select 2

    An organization conducts research on the benefits of leveraging the Web Proxy feature of PAN-OS 11.0. What are two benefits of using an explicit proxy method versus a transparent proxy method? (Choose two.)

    • ANo client configuration is required for explicit proxy, which simplifies the deployment complexity.
    • BExplicit proxy supports interception of traffic using non-standard HTTPS ports.
    • CIt supports the X-Authenticated-User (XAU) header, which contains the authenticated username in the outgoing request.
    • DExplicit proxy allows for easier troubleshooting, since the client browser is aware of the existence of the proxy.

    Show answer

    Answer: CD

    Explanation

    The PA DoC clearly says "There is no client configuration and Panorama is optional" & "Transparent proxy does not support X-Authenticated Users (XAU) "which clearly means that A&D is the correct one, https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-new-features/networking-features/web-proxy

    Source: Adapted from community discussion — BryanSalazar

    References

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNSE practice, question 461. 610 questions available.