Palo Alto Networks Certified Network Security Engineer610 questions across 61 pages are complete and free, with no account or card.
610 questions in this bank
Free access · progress saved on this device
Where can a service route be configured for a specific destination IP?
Answer: D
: D, question is related to a "specific destination"> see Destination tab. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGJCA0 >To configure service routes for non-predefined services, the destination addresses can be manually entered in the Destination section
Source: Adapted from community discussion — Betty2022
Phase two of a VPN will not establish a connection. The peer is using a policy-based VPN configuration. What part of the configuration should the engineer verify?
Answer: C
Information Security is enforcing group-based policies by using security-event monitoring on Windows User-ID agents for IP-to-User mapping in the network. During the rollout, Information Security identified a gap for users authenticating to their VPN and wireless networks. Root cause analysis showed that users were authenticating via RADIUS and that authentication events were not captured on the domain controllers that were being monitored. Information Security found that authentication events existed on the Identity Management solution (IDM). There did not appear to be direct integration between PAN-OS and the IDM solution. How can Information Security extract and learn IP-to-user mapping information from authentication events for VPN and wireless users?
Answer: A
I believe it's A. Here's why: Valid - See link below - A. Configure the integrated User-ID agent on PAN-OS to accept Syslog messages over TLS. Not valid - API doesnt "pull". Period. - B. Configure the User-ID XML API on PAN-OS firewalls to pull the authentication events directly from the IDM solution. Not valid - Devices use Radius, not domain controllers. Wouldnt make a difference. - C. Add domain controllers that might be missing to perform security-event monitoring for VPN and wireless users. Almost valid - The windows user-id agent accepts syslog, just like the integrated agent. It doesnt "monitor" the devices... it listens for syslog. See link below - D. Configure the Windows User-ID agents to monitor the VPN concentrators and wireless controllers for IP-to-User mapping. https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/user-id/map-ip-addresses-to-users/configure-user-id-to-monitor-syslog-senders-for-user-mapping#iddb1a7744-17c6-4900-a2cb-5f3511fef60f
Source: Adapted from community discussion — sov4
Which option is part of the content inspection process?
Answer: B
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVHCA0 Packet Flow Sequence A occurs during Forwarding/Egress B occurs during Content Inspection C occurs during Forwarding/Egress D occurs during Forwarding/Egress * The only option part of the Content Inspection Process is [B] SSL Proxy Re-encrypt ANSWER = [ B ]
Source: Adapted from community discussion — bmarks
An administrator troubleshoots an issue that causes packet drops. Which log type will help the engineer verify whether packet buffer protection was activated?
Answer: D
An engineer creates a set of rules in a Device Group (Panorama) to permit traffic to various services for a specific LDAP user group. What needs to be configured to ensure Panorama can retrieve user and group information for use in these rules?
Answer: C
It wouldn't surprise me if they've done a deal with the various exam companies to allow them to put wrong answers up in exchange for no legal action for violating various NDA's - after all the more people that fail then both this site and the exam providers make more money so its a win-win
Source: Adapted from community discussion — rubberbudgie
Review the information below. A firewall engineer creates a U-NAT rule to allow users in the trust zone access to a server in the same zone by using an external, public NAT IP for that server. Given the rule below, what change should be made to make sure the NAT works as expected?
Answer: D
D is correct, review the example of the U-turn NAT for Hosts and Web Servers in the Same Zone, refer to https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClEiCAK
Source: Adapted from community discussion — Pochex
An engineer is configuring a template in Panorama which will contain settings that need to be applied to all firewalls in production. Which three parts of a template an engineer can configure? (Choose three.)
Answer: ACE
The correct answer is- ACE in my opinion. A. Service route is configured under Templates/Device in Panorama->Setup->Services->Global- Service Route Configuration. B. Dynamic Address Gropus is not correct. Its Under Objects C. NTP Server Address is also configured under Setup-> Device-> Services-Global D. Antivurus Profile is configured in Objects-> Security Profiles- Antivirus E. Authentication Profile is configured under Templates/Device in Panorama-> Setup-Authentication Profile. Please let me know if Im wrong
Source: Adapted from community discussion — [Removed]
A firewall engineer reviews the PAN-OS GlobalProtect application and sees that it implicitly uses web-browsing and depends on SSL. When creating a new rule, what is needed to allow the application to resolve dependencies?
Answer: A
A. Tested this in the lab. SSL is the only additional app needed to be added. It appears in "depends on" when adding global protect to the rule. web-browsing doesnt need to be added because it's already implicitly allowed by allowing global protect.
Source: Adapted from community discussion — sov4
In a security-first network, what is the recommended threshold value for apps and threats to be dynamically updated?
Answer: B
Schedule content updates so that they download-and-install automatically. Then, set a Threshold that determines the amount of time the firewall waits before installing the latest content. In a security-first network, schedule a six to twelve hour threshold. https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-upgrade/software-and-content-updates/best-practices-for-app-and-threat-content-updates/best-practices-security-first
Source: Adapted from community discussion — davidnl1987
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
PCNSE practice, question 481. 610 questions available.
Version 1.0.0. How we source questions