PCNSE practice questions 521–530

1. Question 521 · 610 in bank

   A security engineer wants to upgrade the company's deployed firewalls from PAN-OS 10.1 to 11.0.x to take advantage of the newTLSv1.3 support for management access. What is the recommended upgrade path procedure from PAN-OS 10.1 to 11.0.x?

   • ARequired: Download and install the latest preferred PAN-OS 10.1 maintenance release and reboot. Required: Download PAN-OS 10.2.0. Optional: Install the latest preferred PAN-OS 10.2 maintenance release. Required: Download PAN-OS 11.0.0. Required: Download and install the desired PAN-OS 11.0.x.
   • BOptional: Download and install the latest preferred PAN-OS 10.1 release. Optional: Install the latest preferred PAN-OS 10.2 maintenance release. Required: Download PAN-OS 11.0.0. Required: Download and install the desired PAN-OS 11.0.x.
   • CRequired: Download PAN-OS 10.2.0 or earlier release that is not EOL. Required: Download and install the latest preferred PAN-OS 10.2 maintenance release and reboot. Required: Download PAN-OS 11.0.0. Required: Download and install the desired PAN-OS 11.0.x.
   • DRequired: Download and install the latest preferred PAN-OS 10.1 maintenance release and reboot. Required: Download PAN-OS 10.2.0. Required: Download and install the latest preferred PAN-OS 10.2 maintenance release and reboot. Required: Download PAN-OS 11.0.0. Required: Download and install the desired PAN-OS 11.0.x.

   Show answer

   Answer: B

   Explanation

   Not sure to be honest! https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-upgrade/upgrade-pan-os/upgrade-the-firewall-pan-os/determine-the-upgrade-path#id85bdf6f4-2e83-49f0-8525-3eb2163f2d2e You can now use the Skip Software Version Upgrade feature to skip software versions when upgrading your device from PAN-OS 10.1 or later releases. If you are already running a PAN-OS 10.1 release, you can upgrade directly to PAN-OS 11.0. So none of these answers fit. B might be the closest I suppose.

   Source: Adapted from community discussion — franko_72

   References

   • docs.paloaltonetworks.com documentation

   Next question

2. Question 522 · 610 in bank

   Select 2

   Which two actions must an engineer take to configure SSL Forward Proxy decryption? (Choose two.)

   • AConfigure the decryption profile.
   • BConfigure SSL decryption rules.
   • CDefine a Forward Trust Certificate.
   • DConfigure a SSL / TLS service profile.

   Show answer

   Answer: BC

   Explanation

   https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/decryption/configure-ssl-forward-proxy Although Decryption profiles are optional, it is a best practice to include a Decryption profile with each Decryption policy rule to prevent weak, vulnerable protocols and algorithms from allowing questionable traffic on your network.

   Source: Adapted from community discussion — d34a5eb

   References

   • docs.paloaltonetworks.com documentation

   Next question

3. Question 523 · 610 in bank

   Select 2

   A firewall engineer supports a mission-critical network that has zero tolerance for application downtime. A best-practice action taken by the engineer is to configure an Applications and Threats update schedule with a new App-ID threshold of 48 hours. Which two additional best-practice guideline actions should be taken with regard to dynamic updates? (Choose two.)

   • AConfigure an Applications and Threats update schedule with a threshold of 24 to 48 hours.
   • BClick "Review Apps" after application updates are installed in order to assess how the changes might impact Security policy.
   • CCreate a Security policy rule with an application filter to always allow certain categories of new App-IDs.
   • DSelect the action "download-only" when configuring an Applications and Threats update schedule.

   Show answer

   Answer: BC

   Explanation

   https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/software-and-content-updates/best-practices-for-app-and-threat-content-updates/best-practices-mission-critical#id184AH00L078 Always review the new and modified App-IDs that a content release introduces, in order to assess how the changes might impact your security policy. The following topic describes the options you can use to update your security policy both before and after installing new App-IDs: Manage New and Modified App-IDs.

   Source: Adapted from community discussion — omgt2k2

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • live.paloaltonetworks.com documentation

   Next question

4. Question 524 · 610 in bank

   When a new firewall joins a high availability (HA) cluster, the cluster members will synchronize all existing sessions over which HA port?

   • AHA1
   • BHA2
   • CHA3
   • DHA4

   Show answer

   Answer: D

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

5. Question 525 · 610 in bank

   What can the Log Forwarding built-in action with tagging be used to accomplish?

   • AForward selected logs to the Azure Security Center.
   • BBlock the destination zones of selected unwanted traffic.
   • CBlock the source zones of selected unwanted traffic.
   • DBlock the destination IP addresses of selected unwanted traffic.

   Show answer

   Answer: D

   Explanation

   You can tag either Source or Destination IP addresses. On the other hand, A refers to an action you can only take on VM Series firewalls on Azure.

   Source: Adapted from community discussion — rmorganq

   References

   • docs.paloaltonetworks.com documentation

   Next question

6. Question 526 · 610 in bank

   An administrator notices interface ethernet1/2 failed on the active firewall in an active I passive firewall high availability(HA) pair. Based on the image below, what - if any - action was taken by the active firewall when the link failed?

   

   • ANo action was taken because interface ethernet1/1 did not fail.
   • BThe active firewall failed over to the passive HA member due to an AE1 Link Group failure.
   • CNo action was taken because Path Monitoring is disabled.
   • DThe active firewall failed over to the passive HA member because "any" is selected for the Link Monitoring "Failure Condition".

   Show answer

   Answer: A

   Next question

7. Question 527 · 610 in bank

   Which option would an administrator choose to define the certificate and protocol that Panorama and its managed devices use for SSL/TLS services?

   • AConfigure a Decryption Profile and select SSL/TLS services.
   • BSet up SSL/TLS under Policies > Service/URL Category > Service.
   • CSet up Security policy rule to allow SSL communication.
   • DConfigure an SSL/TLS Profile.

   Show answer

   Answer: D

   Explanation

   Reference: https://www.paloaltonetworks.com/documentation/80/pan-os/web-interface-help/device/device-certificate-management-ssltls-service-profile

   References

   • docs.paloaltonetworks.com documentation

   Next question

8. Question 528 · 610 in bank

   A firewall administrator wants to be able to see all NAT sessions that are going through a firewall with source NAT. Which CLI command can the administrator use?

   • Ashow session all filter nat source
   • Bshow running nat-rule-ippool rule “rule_name”
   • Cshow running nat-policy
   • Dshow session all filter nat-rule-source

   Show answer

   Answer: A

   Explanation

   A. show session all filter nat source Explanation: The correct CLI command to view all NAT sessions that are going through a firewall with source NAT is “show session all filter nat source”. This command displays active sessions on the firewall, filtered to show only those sessions that have undergone source NAT. Source NAT changes the source IP address of a packet as it traverses the firewall, typically to allow internal hosts to access the internet using a public IP address. By filtering the session table with “filter nat source”, the administrator can see the original source IP address, the translated source IP address, and other details about the active NAT sessions. This information is useful for troubleshooting NAT-related issues, monitoring traffic patterns, and analyzing the utilization of NAT resources.

   Source: Adapted from community discussion — nebulanerd

   Next question

9. Question 529 · 610 in bank

   All firewalls at a company are currently forwarding logs to Palo Alto Networks log collectors. The company also wants to deploy a syslog server and forward all firewall logs to the syslog server and to the log collectors. There is a known logging peak time during the day and the security team has asked the firewall engineer to determine how many logs per second the current Palo Alto Networks log collectors are processing at that particular time. Which method is the most time-efficient to complete this task?

   • ANavigate to Panorama > Managed Collectors, and open the Statistics window for each Log Collector during the peak time
   • BNavigate to ACC > Network Activity, and determine the total number of sessions and threats during the peak time
   • CNavigate to Monitor > Unified logs, set the filter to the peak time, and browse to the last page to find out how many logs have been received
   • DNavigate to Panorama > Managed Devices > Health, open the Logging tab for each managed firewall and check the log rates during the peak time

   Show answer

   Answer: A

   References

   • docs.paloaltonetworks.com documentation

   Next question

10. Question 530 · 610 in bank

    A firewall engineer is configuring quality of service (QoS) policy for the IP address of a specific server in an effort to limit the bandwidth consumed by frequent downloads of large files from the internet. Which combination of pre-NAT and/or post-NAT information should be used in the QoS rule?

    • APre-NAT source IP address - Pre-NAT source zone
    • BPost-NAT source IP address - Pre-NAT source zone
    • CPre-NAT source IP address - Post-NAT source zone
    • DPost-NAT source IP address - Post-NAT source zone

    Show answer

    Answer: A

    Explanation

    If you want to apply QoS treatment to traffic based on source, you must specify the pre-NAT source address (such as pre-NAT source IP, pre-NAT source zone, pre-NAT destination IP, and post-NAT destination zone) in a QoS policy rule. https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/quality-of-service/configure-qos

    Source: Adapted from community discussion — b53fdf1

    References

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNSE practice, question 521. 610 questions available.