Palo Alto Networks Certified Network Security Engineer610 questions across 61 pages are complete and free, with no account or card.
610 questions in this bank
Free access · progress saved on this device
Which three external authentication services can the firewall use to authenticate admins into the Palo Alto Networks NGFW without creating administrator account on the local firewall? (Choose three.)
Answer: ACD
With the default TCP and UDP settings on the firewall, what will be the identified application in the following session?
Answer: C
From this article: Incomplete means that either the three-way TCP handshake did not complete OR the three-way TCP handshake did complete but there was no enough data after the handshake to identify the application. Insufficient data means not enough data to identify the application. Unknown-tcp means the firewall captured the three-way TCP handshake, but the application was not identified. Not-applicable means that the Palo Alto device has received data that will be discarded because the port or service that the traffic is coming in on is not allowed, or there is no rule or policy allowing that port or service. The answer is C- Not-applicable.
Source: Adapted from community discussion — PaloSteve
Which feature prevents the submission of corporate login information into website forms?
Answer: D
Q69 is almost the same, and the answer on that one is "URL Filtering profile". As per https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/url-filtering/prevent-credential-phishing/set-up-credential-phishing-prevention.html, steps are 1. User-ID, 2. URL Filtering Profile... 4. Within URL Filtering select "User Credential Detection", not "Credential phishing prevent". So this ans should be B User ID.
Source: Adapted from community discussion — ochc
To ensure that a Security policy has the highest priority, how should an administrator configure a Security policy in the device group hierarchy?
Based on the graphic, which statement accurately describes the output shown in the Server Monitoring panel?
What can be used as an Action when creating a Policy-Based Forwarding (PBF) policy?
Answer: C
Answer is C. See doc: Set the Action to take when matching a packet: Forward—Directs the packet to the specified Egress Interface. Forward to VSYS (On a firewall enabled for multiple virtual systems)—Select the virtual system to which to forward the packet. Discard—Drops the packet. No PBF—Excludes packets that match the criteria for source, destination, application, or service defined in the rule. Matching packets use the route table instead of PBF; the firewall uses the route table to exclude the matched traffic from the redirected port. https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/policy/policy-based-forwarding/create-a-policy-based-forwarding-rule#ideca3cc65-03d7-449d-b47a-90fabee5293c
Source: Adapted from community discussion — sov4
An engineer manages a high availability network and requires fast failover of the routing protocols. The engineer decides to implement BFD. Which three dynamic routing protocols support BFD? (Choose three.)
Answer: ADE
"In addition to BFD for static routes, the firewall supports BFD for the BGP, OSPF, and RIP routing protocols." "The firewall does not support BFD on an OSPF or OSPFv3 virtual link." IGRP is a Cisco-proprietary protocol that is not mentioned in the Palo Alto Networks documentation. https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-networking-admin/bfd/bfd-overview/bfd-for-dynamic-routing-protocols
Source: Adapted from community discussion — nebulanerd
A company has recently migrated their branch office’s PA-220s to a centralized Panorama. This Panorama manages a number of PA-7000 Series and PA-5200 Series devices. All device group and template configuration is managed solely within Panorama. They notice that commit times have drastically increased for the PA-220s after the migration. What can they do to reduce commit times?
Answer: A
A: because the question is for the firewall commit response time, not Pano For Panorama Disabling Share Unused Address and Service Objects with Devices might increase the commit time on Panorama because Panorama has to dynamically check whether policy rules reference all the particular objects. For PA-220 On lower-end models, such as the PA-220, consider pushing only the relevant shared objects to the managed firewalls. This is because the number of objects that can be stored on the lower-end models is considerably lower than that of the mid- to high-end models. >https://docs.paloaltonetworks.com/panorama/9-1/panorama-admin/manage-firewalls/manage-device-groups/manage-unused-shared-objects
Source: Adapted from community discussion — Betty2022
An administrator is troubleshooting why video traffic is not being properly classified. If this traffic does not match any QoS classes, what default class is assigned?
An administrator notices that an interface configuration has been overridden locally on a firewall. They require all configuration to be managed from Panorama and overrides are not allowed. What is one way the administrator can meet this requirement?
Answer: C
C, the network settings are under the templates and you would need to force the template values to clear out the local change.
Source: Adapted from community discussion — procheeseburger
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
PCNSE practice, question 471. 610 questions available.
Version 1.0.0. How we source questions