PCNSE practice questions 501–510

1. Question 501 · 610 in bank

   An engineer is monitoring an active/active high availability (HA) firewall pair. Which HA firewall state describes the firewall that is experiencing a failure of a monitored path?

   • AInitial
   • BPassive
   • CActive-secondary
   • DTentative

   Show answer

   Answer: D

   Explanation

   D is correct https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/high-availability/ha-firewall-states State of a firewall (in an active/active configuration) caused by one of the following: Failure of a firewall. Failure of a monitored object (a link or path). The firewall leaves suspended or non-functional state.

   Source: Adapted from community discussion — pavtoor

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

2. Question 502 · 610 in bank

   Select 3

   You are auditing the work of a co-worker and need to verify that they have matched the Palo Alto Networks Best Practices for Anti-Spyware Profiles. For which three severity levels should single-packet captures be enabled to meet the Best Practice standard? (Choose three.)

   • ACritical
   • BHigh
   • CMedium
   • DInformational
   • ELow

   Show answer

   Answer: ABC

   Explanation

   The best practice Anti-Spyware profile retains the default Action to reset the connection when the firewall detects a medium, high, or critical severity threat, and enables single packet capture (PCAP) for those threats. https://docs.paloaltonetworks.com/best-practices/9-1/data-center-best-practices/data-center-best-practice-security-policy/how-to-create-data-center-best-practice-security-profiles/create-the-data-center-best-practice-anti-spyware-profile

   Source: Adapted from community discussion — Omid2022

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

3. Question 503 · 610 in bank

   In the New App Viewer under Policy Optimizer, what does the compare option for a specific rule allow an administrator to compare?

   • AApplications configured in the rule with their dependencies
   • BThe security rule with any other security rule selected
   • CApplications configured in the rule with applications seen from traffic matching the same rule
   • DThe running configuration with the candidate configuration of the firewall

   Show answer

   Answer: C

   References

   • docs.paloaltonetworks.com documentation

   Next question

4. Question 504 · 610 in bank

   Given the following snippet of a WildFire submission log, did the end user successfully download a file?

   

   • AYes, because the final action is set to "allow."
   • BNo, because the action for the wildfire-virus is "reset-both."
   • CNo, because the URL generated an alert.
   • DYes, because both the web-browsing application and the flash file have the "alert" action.

   Show answer

   Answer: B

   Explanation

   Answer is B. WildFire Virus is a sub-type of the AV signatures. Data Filtering allowed the flash file but it was blocked by the AV signatures as a known WildFire Virus.

   Source: Adapted from community discussion — SRowe

   References

   • live.paloaltonetworks.com documentation

   Next question

5. Question 505 · 610 in bank

   An administrator creates an SSL decryption rule decrypting traffic on all ports. The administrator also creates a Security policy rule allowing only the applications DNS, SSL, and web-browsing. The administrator generates three encrypted BitTorrent connections and checks the Traffic logs. There are three entries. The first entry shows traffic dropped as application Unknown. The next two entries show traffic allowed as application SSL. Which action will stop the second and subsequent encrypted BitTorrent connections from being allowed as SSL?

   • ACreate a decryption rule matching the encrypted BitTorrent traffic with action ג€No-Decrypt,ג€ and place the rule at the top of the Decryption policy.
   • BCreate a Security policy rule that matches application ג€encrypted BitTorrentג€ and place the rule at the top of the Security policy.
   • CDisable the exclude cache option for the firewall.
   • DCreate a Decryption Profile to block traffic using unsupported cyphers, and attach the profile to the decryption rule.

   Show answer

   Answer: D

   Explanation

   D is Correct There is no application called "encrypted BitTorrent" so "B" is not the correct answer. If the application was just "BitTorrent" then "B" would be correct. "A" would not work either since you would still need to create a Decryption Profile which is not mentioned. "D" is the most complete answer which is to create the Decryption Profile and attach it to the Decryption rule. I found a PaloAlto KB article about blocking Tor traffic using a Decryption Profile that is blocking Unsupported cipher's, expired certificates, etc. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRtCAK

   Source: Adapted from community discussion — ChiaPet75

   Next question

6. Question 506 · 610 in bank

   Select 2

   Which two factors should be considered when sizing a decryption firewall deployment? (Choose two.)

   • ANumber of security zones in decryption policies
   • BEncryption algorithm
   • CTLS protocol version
   • DNumber of blocked sessions

   Show answer

   Answer: BC

   References

   • docs.paloaltonetworks.com documentation

   Next question

7. Question 507 · 610 in bank

   After switching to a different WAN connection, users have reported that various websites will not load, and timeouts are occurring. The web servers work fine from other locations. The firewall engineer discovers that some return traffic from these web servers is not reaching the users behind the firewall. The engineer later concludes that the maximum transmission unit (MTU) on an upstream router interface is set to 1400 bytes. The engineer reviews the following CLI output for ethernet1/1.

   

   Which setting should be modified on ethernet1/1 to remedy this problem?

   • AChange the subnet mask from /23 to /24.
   • BLower the interface MTU value below 1500.
   • CAdjust the TCP maximum segment size (MSS) value.
   • DEnable the Ignore IPv4 Don't Fragment (DF) setting.

   Show answer

   Answer: C

   Explanation

   The question is stupid, but so are some of the answers here. MTU= max data inside a frame (layer 2 packet) size. MSS max TCP payload. MTU = MSS + 40 (IP header + TCP header). Setting a lower MTU would force a lower MSS. Decreasing MSS also lowers the MTU. Based on how vague B is I would go with C, but, in my book either can work and this question is just dumb the listed answers aren't correct. And for what is worth I'm pretty sure D might work as well

   Source: Adapted from community discussion — Bubu3k

   References

   • docs.paloaltonetworks.com documentation

   Next question

8. Question 508 · 610 in bank

   An engineer configures a new template stack for a firewall that needs to be deployed. The template stack should consist of four templates arranged according to the diagram.

   

   Which template values will be configured on the firewall if each template has an SSL/TLS Service profile configured named Management?

   • AValues in Global Settings
   • BValues in Datacenter
   • CValues in efw01ab.chi
   • DValues in Chicago

   Show answer

   Answer: C

   Next question

9. Question 509 · 610 in bank

   An administrator configures two VPN tunnels to provide for failover and uninterrupted VPN service. What should an administrator configure to enable automatic failover to the backup tunnel?

   • AReplay Protection
   • BZone Protection
   • CTunnel Monitor
   • DPassive Mode

   Show answer

   Answer: C

   Explanation

   Answer is C https://docs.paloaltonetworks.com/network-security/ipsec-vpn/administration/set-up-tunnel-monitoring To provide uninterrupted VPN service, you can use the Dead Peer Detection capability along with the tunnel monitoring capability on the firewall.

   Source: Adapted from community discussion — Coryas

   References

   • docs.paloaltonetworks.com documentation

   Next question

10. Question 510 · 610 in bank

    An administrator configures a site-to-site IPsec VPN tunnel between a PA-850 and an external customer on their policy-based VPN devices. What should an administrator configure to route interesting traffic through the VPN tunnel?

    • AProxy IDs
    • BToS Header
    • CGRE Encapsulation
    • DTunnel Monitor

    Show answer

    Answer: A

    References

    • docs.paloaltonetworks.com documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNSE practice, question 501. 610 questions available.