Palo Alto Networks Certified Network Security Engineer610 questions across 61 pages are complete and free, with no account or card.
610 questions in this bank
Free access · progress saved on this device
An engineer configures a specific service route in an environment with multiple virtual systems instead of using the inherited global service route configuration. What type of service route can be used for this configuration?
An administrator is receiving complaints about application performance degradation. After checking the ACC, the administrator observes that there is an excessive amount of VoIP traffic. Which three elements should the administrator configure to address this issue? (Choose three.)
Answer: ACE
My input ACE: " The ingress interface for QoS traffic is the interface on which the traffic enters the firewall. The egress interface for QoS traffic is the interface that traffic leaves the firewall from. QoS is always enabled and enforced on the egress interface for a traffic flow. The egress interface in a QoS configuration can either be the external- or internal-facing interface of the firewall, depending on the flow of the traffic receiving QoS treatment." src: https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/quality-of-service/qos-concepts/qos-egress-interface A - Possible to setup B - Nothing to do with QoS C - Possible to setup D - Not Possible - Can only configure QoS on an egress interface - See Above E - Possible to setup Also see comment from sov4 Link provided by TeXJ talks about incoming / outgoing communications, Not about ingress / egress interfaces for QoS.
Source: Adapted from community discussion — Merlin0o
What are three tasks that cannot be configured from Panorama by using a template stack? (Choose three.)
Answer: ACE
From the link provided: You can use Templates and Template Stacks to define a wide array of settings but you can perform the following tasks only locally on each managed firewall: - Configure a device block list. - Clear logs. - Enable operational modes such as normal mode, multi-vsys mode, or FIPS-CC mode. - Configure the IP addresses of firewalls in an HA pair. - Configure a master key and diagnostics. - Compare configuration files (Config Audit). - Renaming a vsys on a multi-vsys firewall.
Source: Adapted from community discussion — Merlin0o
Based on the screenshots above, what is the correct order in which the various rules are deployed to firewalls inside the DATACENTER_DG device group?
Answer: D
I would choose D based on https://docs.paloaltonetworks.com/panorama/11-0/panorama-admin/panorama-overview/centralized-firewall-configuration-and-update-management/device-groups/device-group-policies: If you override default rules, their order of precedence runs from the lowest context to the highest: overridden settings at the firewall level take precedence over settings at the device group level, which take precedence over settings at the Shared level. As we have overridden the default ruleset in the device group it will be applied instead of the shared one.
Source: Adapted from community discussion — TeachTrooper
In a virtual router, which object contains all potential routes?
Answer: B
For a router, there is the Routing Information Base (RIB) and the Forwarding Information Base (FIB). The difference between these two is that while the RIB contains all possible routes to various destinations, even if, there are more than one to a specific destination, the FIB contains only the best route to each destination. So in this case, the answer is B which is RIB.
Source: Adapted from community discussion — john_bosco_champion
A company wants to implement threat prevention to take action without redesigning the network routing. What are two best practice deployment modes for the firewall? (Choose two.)
Answer: AB
Answers are A and B. They wouldn't require network redesign and can still apply the threat prevention profiles. TAP wouldn't need to redesign the network, but since the firewall won't be in-line with the traffic, it wouldn't be able to apply the threat prevention. Layer 3 would require a redesign of the network.
Source: Adapted from community discussion — evilCorpBot7494
Which type of policy in Palo Alto Networks firewalls can use Device-ID as a match condition?
Answer: C
"C" - Correct Answer Similar to how User-ID provides user-based policy rules and App-ID provides app-based policy rules, Device-ID provides policy rules that are based on a device, regardless of changes to its IP address or location. By providing traceability for devices and associating network events with specific devices, Device-ID lets you gain context for how events relate to devices and adds policy rules that are associated with devices, instead of users, locations, or IP addresses, which can change over time. You can use Device-ID in Security, Decryption, Quality of Service (QoS), and Authentication policies.
Source: Adapted from community discussion — ChiaPet75
Why would a traffic log list an application as "not-applicable"?
Answer: C
" If traffic hits a security rule that's set to "deny," based on any parameter before the application, the traffic log shows the application as not-applicable. This occurs because the traffic was dropped or denied before the application match could be performed." https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClspCAC#:~:text=If%20traffic%20hits%20a%20security,application%20match%20could%20be%20performed.&text=Traffic%20Log%20for%20this%20deny%20logs.
Source: Adapted from community discussion — certprep2021
What must be configured to apply tags automatically based on User-ID logs?
Answer: B
B is correct For Authentication, Data, Threat, Traffic, Tunnel Inspection, URL, and WildFire logs, create a log forwarding profile. For User-ID, GlobalProtect, and IP-Tag logs, configure the log settings.
Source: Adapted from community discussion — Cro13
A firewall engineer creates a NAT rule to translate IP address 1.1.1.10 to 192.168.1.10. The engineer also plans to enable DNS rewrite so that the firewall rewrites the IPv4 address in a DNS response based on the original destination IP address and translated destination IP address configured for the rule. The engineer wants the firewall to rewrite a DNS response of 1.1.1.10 to 192.168.1.10. What should the engineer do to complete the configuration?
Answer: A
forward—If the DNS response matches the Original Destination Address in the rule, translate the DNS response using the same translation the rule uses. For example, if the rule translates IP address 1.1.1.10 to 192.168.1.10, the firewall rewrites a DNS response of 1.1.1.10 to 192.168.1.10. https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/networking/nat/source-nat-and-destination-nat/destination-nat-dns-rewrite-use-cases#id0d85db1b-05b9-4956-a467-f71d558263bb
Source: Adapted from community discussion — dgonz
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
PCNSE practice, question 491. 610 questions available.
Version 1.0.0. How we source questions