PCNSE practice questions 511–520

1. Question 511 · 610 in bank

   A firewall engineer creates a new App-ID report under Monitor > Reports > Application Reports > New Applications to monitor new applications on the network and better assess any Security policy updates the engineer might want to make. How does the firewall identify the New App-ID characteristic?

   • AIt matches to the New App-IDs downloaded in the last 90 days.
   • BIt matches to the New App-IDs in the most recently installed content releases.
   • CIt matches to the New App-IDs downloaded in the last 30 days.
   • DIt matches to the New App-IDs installed since the last time the firewall was rebooted.

   Show answer

   Answer: B

   Explanation

   "...the New App-ID characteristic always matches to only the new App-IDs in the most recently installed content releases. When a new content release is installed, the new App-ID characteristic automatically begins to match only to the new App-IDs in that content release version." https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/app-id/manage-new-app-ids-introduced-in-content-releases/monitor-new-app-ids

   Source: Adapted from community discussion — evilCorpBot7494

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

2. Question 512 · 610 in bank

   An engineer is monitoring an active/active high availability (HA) firewall pair. Which HA firewall state describes the firewall that is currently processing traffic?

   • APassive
   • BInitial
   • CActive
   • DActive-primary

   Show answer

   Answer: D

   Explanation

   There is no Active in an Active/Active configuration, this is only seen in an Active/Passive configuration. --------------- Active A/P State of the active firewall in an active/passive configuration. -------- For an Active passing traffic is Active/Primary ------------ Active-Primary A/A In an active/active configuration, state of the firewall that connects to User-ID agents, runs DHCP server and DHCP relay, and matches NAT and PBF rules with the Device ID of the active-primary firewall. A firewall in this state can own sessions and set up sessions. ------

   Source: Adapted from community discussion — techplus

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

3. Question 513 · 610 in bank

   Select 3

   An engineer needs to configure a standardized template for all Panorama-managed firewalls. These settings will be configured on a template named "Global" and will be included in all template stacks. Which three settings can be configured in this template? (Choose three.)

   • ALog Forwarding profile
   • BSSL decryption exclusion
   • CEmail scheduler
   • DLogin banner
   • EDynamic updates

   Show answer

   Answer: BDE

   Explanation

   A. Log Forwarding profile >> INCORRECT > It is located in Objects (not template related) B. SSL decryption exclusion >> CORRECT > Located in Device C. Email scheduler >> INCORRECT > Located in Monitor (not template related) D. Login banner >> CORRECT > located in Located in Device / Setup E. Dynamic updates >> CORRECT > Located in Device

   Source: Adapted from community discussion — scanossa

   Next question

4. Question 514 · 610 in bank

   An organization wants to begin decrypting guest and BYOD traffic. Which NGFW feature can be used to identify guests and BYOD users, instruct them how to download and install the CA certificate, and clearly notify them that their traffic will be decrypted?

   • AAuthentication Portal
   • BSSL Decryption profile
   • CSSL decryption policy
   • Dcomfort pages

   Show answer

   Answer: A

   Explanation

   https://docs.paloaltonetworks.com/content/techdocs/en_US/best-practices/10-2/decryption-best-practices/decryption-best-practices/plan-ssl-decryption-best-practice-deployment.html Note: "Enterprises don’t control BYOD devices. If you allow BYOD devices on your network, decrypt their traffic and subject it to the same Security policy that you apply to other network traffic. To do this, redirect BYOD users through an Authentication Portal, instruct them how to download and install the CA certificate, and clearly notify users that their traffic will be decrypted. Educate BYOD users about the process and include it in your company’s privacy and computer usage policy."

   Source: Adapted from community discussion — ATRRHMN

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

5. Question 515 · 610 in bank

   Select 2

   Which two key exchange algorithms consume the most resources when decrypting SSL traffic? (Choose two.)

   • AECDSA
   • BECDHE
   • CRSA
   • DDHE

   Show answer

   Answer: BD

   Explanation

   Key exchange algorithm. Perfect forward secrecy (PFS) ephemeral algorithms such as DHE and ECDHE consume more resources than RSA. https://docs.paloaltonetworks.com/best-practices/10-2/decryption-best-practices/decryption-best-practices/plan-ssl-decryption-best-practice-deployment

   Source: Adapted from community discussion — tune_in

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

6. Question 516 · 610 in bank

   Refer to the exhibit.

   

   Which certificates can be used as a Forward Trust certificate?

   • ACertificate from Default Trust Certificate Authorities
   • BDomain Sub-CA
   • CForward-Trust
   • DDomain-Root-Cert

   Show answer

   Answer: B

   Explanation

   wouldn't the only correct answer be B? Must be a CA to be used. must have private key also. can be a root but doesnt have to be.... so that only leaves B as correct answer? anyone? as far as i know you cant use public certs for decryption? so cant be A

   Source: Adapted from community discussion — Breyarg

   References

   • docs.paloaltonetworks.com documentation

   Next question

7. Question 517 · 610 in bank

   Select 2

   An engineer troubleshoots a Panorama-managed firewall that is unable to reach the DNS servers configured via a global template. As a troubleshooting step, the engineer needs to configure a local DNS server in place of the template value. Which two actions can be taken to ensure that only the specific firewall is affected during this process? (Choose two.)

   • AOverride the DNS server on the template stack.
   • BConfigure the DNS server locally on the firewall.
   • CChange the DNS server on the global template.
   • DConfigure a service route for DNS on a different interface.

   Show answer

   Answer: AB

   Explanation

   "There are two ways to override values pushed from a template or template stack. The first is to define a value locally on the firewall to override a value pushed from a template or template stack. The second is to define firewall-specific variables to override values pushed from a template or template stack." https://docs.paloaltonetworks.com/panorama/11-0/panorama-admin/manage-firewalls/manage-templates-and-template-stacks/override-a-template-setting

   Source: Adapted from community discussion — evilCorpBot7494

   References

   • docs.paloaltonetworks.com documentation

   Next question

8. Question 518 · 610 in bank

   An engineer troubleshoots a high availability (HA) link that is unreliable. Where can the engineer view what time the interface went down?

   • AMonitor > Logs > Traffic
   • BDevice > High Availability > Active/Passive Settings
   • CMonitor > Logs > System
   • DDashboard > Widgets > High Availability

   Show answer

   Answer: C

   Explanation

   The question is about the *time* it went down. You only see which HA interface went down on the widget. But for timestamps you need to check system logs.

   Source: Adapted from community discussion — Ksaifu

   Next question

9. Question 519 · 610 in bank

   Select 2

   A consultant advises a client on designing an explicit Web Proxy deployment on PAN-OS 11.0. The client currently uses RADIUS authentication in their environment. Which two pieces of information should the consultant provide regarding Web Proxy authentication? (Choose two.)

   • AKerberos or SAML authentication need to be configured.
   • BRADIUS is only supported for a transparent Web Proxy.
   • CRADIUS is not supported for explicit or transparent Web Proxy.
   • DLDAP or TACACS+ authentication need to be configured.

   Show answer

   Answer: AC

   Explanation

   A and C: For the explicit proxy method, the request contains the destination IP address of the configured proxy and the client browser sends requests to the proxy directly. You can use one of following methods to authenticate users with the explicit proxy: Kerberos, which requires a web proxy license. SAML 2.0, which requires Panorama, a Prisma Access license, the Cloud Services 3.2.1 plugin (and later versions), and the add-on web proxy license. Cloud Identity Engine, which requires Panorama, a Prisma Access license, the Cloud Services 3.2.1 plugin (and later versions), and the add-on web proxy license. https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-new-features/networking-features/web-proxy#id3d1ea0dd-360f-44ee-8c48-30678c80d509_id2b5c6385-2ec6-4ba8-b1f1-2bea8b5139f5

   Source: Adapted from community discussion — Pnosuke

   References

   • docs.paloaltonetworks.com documentation

   Next question

10. Question 520 · 610 in bank

    A customer wants to deploy User-ID on a Palo Alto Networks NGFW with multiple vsys. One of the vsys will support a GlobalProtect portal and gateway. The customer uses Windows Active Directory for authentication. What is the most operationally efficient way to redistribute the most accurate IP addresses to username mappings?

    • ADeploy a PAN-OS integrated User-ID agent on each vsys
    • BDeploy the GlobalProtect vsys as a User-ID data hub
    • CDeploy a M-200 as a User-ID collector
    • DDeploy Windows User-ID agents on each domain controller

    Show answer

    Answer: B

    Explanation

    It might be B, since the most operationally efficient way would be to configure one User-ID hub on one vsys and distribute the User-ID Sources from there to the other vsys.

    Source: Adapted from community discussion — cx777o

    References

    • docs.paloaltonetworks.com documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNSE practice, question 511. 610 questions available.