PCNSE practice questions 531–540

1. Question 531 · 610 in bank

   The decision to upgrade PAN-OS has been approved. The engineer begins the process by upgrading the Panorama servers, but gets an error when attempting the install. When performing an upgrade on Panorama to PAN-OS, what is the potential cause of a failed install?

   • AGlobalProtect agent version
   • BOutdated plugins
   • CManagement only mode
   • DExpired certificates

   Show answer

   Answer: B

   Explanation

   https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-upgrade/upgrade-panorama/install-content-and-software-updates-for-panorama/install-updates-for-panorama-with-internet-connection#id21940aa0-7656-4ac2-9115-611e9111d6d9 "This is required to successfully upgrade Panorama from PAN-OS 10.2 to PAN-OS 11.0. Upgrade to PAN-OS 11.0 is blocked if the supported plugin version is not downloaded."

   Source: Adapted from community discussion — poiuytr

   References

   • docs.paloaltonetworks.com documentation

   Next question

2. Question 532 · 610 in bank

   Following a review of firewall logs for traffic generated by malicious activity, how can an administrator confirm that WildFire has identified a virus?

   • ABy navigating to Monitor > Logs > Traffic, applying filter “(subtype eq virus)”
   • BBy navigating to Monitor > Logs > Threat, applying filter “(subtype eq virus)”
   • CBy navigating to Monitor > Logs > Threat, applying filter “(subtype eq wildfire-virus)”
   • DBy navigating to Monitor > Logs > WildFire Submissions, applying filter “(subtype eq wildfire-virus)”

   Show answer

   Answer: C

   Explanation

   "wildfire-virus is a subtype used for wildfire signatures delivered using wildfire signature database, to differentiate from regular anti-virus signatures. In short, AV signatures are identified using subtype virus. Wildfire signatures are identified using subtype wildfire-virus."

   Source: Adapted from community discussion — poiuytr

   References

   • docs.paloaltonetworks.com documentation

   Next question

3. Question 533 · 610 in bank

   A firewall engineer is managing a Palo Alto Networks NGFW which is not in line of any DHCP traffic. Which interface mode can the engineer use to generate Enhanced Application logs (EALs) for classifying IoT devices while receiving broadcast DHCP traffic?

   • AVirtual wire
   • BLayer 3
   • CLayer 2
   • DTap

   Show answer

   Answer: A

   Explanation

   I guess that “in line” in this sentence indicates that unicast DHCP is not received. Only Virtual wire can generate an EAL for broadcast DHCP Traffic. https://docs.paloaltonetworks.com/iot/iot-security-admin/get-started-with-iot-security/firewall-deployment-for-dhcp-visibility/dhcp-data-collection-by-traffic-type

   Source: Adapted from community discussion — Phoenix2462

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

4. Question 534 · 610 in bank

   An administrator is considering deploying WildFire globally. What should the administrator consider with regards to the WildFire infrastructure?

   • ATo comply with data privacy regulations, WildFire signatures and verdicts are not shared globally.
   • BPalo Alto Networks owns and maintains one global cloud and four WildFire regional clouds.
   • CEach WildFire cloud analyzes samples independently of the other WildFire clouds.
   • DThe WildFire Global Cloud only provides bare metal analysis.

   Show answer

   Answer: C

   Next question

5. Question 535 · 610 in bank

   Which log type is supported in the Log Forwarding profile?

   • AUser-ID
   • BGlobalProtect
   • CConfiguration
   • DTunnel

   Show answer

   Answer: D

   Explanation

   Log Forwarding profile. The profile defines the destinations for Traffic, Threat, WildFire Submission, URL Filtering, Data Filtering, ***Tunnel and Authentication logs. Select Objects> Log Forwarding and Add a profile.

   Source: Adapted from community discussion — [Removed]

   Next question

6. Question 536 · 610 in bank

   A firewall engineer needs to update a company’s Panorama-managed firewalls to the latest version of PAN-OS. Strict security requirements are blocking internet access to Panorama and to the firewalls. The PAN-OS images have previously been downloaded to a secure host on the network. Which path should the engineer follow to deploy the PAN-OS images to the firewalls?

   • AUpload the image to Panorama > Device Deployment > Software menu, and deploy it to the firewalls.
   • BUpload the image to Panorama > Device Deployment > Dynamic Updates menu, and deploy it to the firewalls.
   • CUpload the image to Panorama > Software menu, and deploy it to the firewalls.
   • DUpload the image to Panorama > Dynamic Updates menu, and deploy it to the firewalls.

   Show answer

   Answer: A

   Next question

7. Question 537 · 610 in bank

   Which menu item enables a firewall administrator to see details about traffic that is currently active through the NGFW?

   • AACC
   • BSystem Logs
   • CApp Scope
   • DSession Browser

   Show answer

   Answer: D

   Explanation

   The menu item that enables a firewall administrator to see details about traffic that is currently active through the NGFW is option D: Session Browser. The Session Browser is a tool in the Palo Alto Networks NGFW web interface that allows administrators to view and monitor active sessions on the firewall. The Session Browser displays a list of active sessions, including the source and destination IP addresses, the application, the security rule that allowed the traffic, and other details. Using the Session Browser, administrators can search for specific sessions using various criteria, such as source or destination IP address, application, or security rule. They can also filter and sort the sessions based on different attributes, and view detailed information about each session, such as the number of bytes sent and received, the session ID, and the start and end times. The Session Browser is a useful tool for troubleshooting network issues and monitoring network activity in real-time.

   Source: Adapted from community discussion — Pallab_Kundu

   Next question

8. Question 538 · 610 in bank

   Select 2

   Which conditions must be met when provisioning a high availability (HA) cluster? (Choose two.)

   • AHA cluster members must be the same firewall model and run the same PAN-OS version.
   • BHA cluster members must share the same zone names.
   • CPanorama must be used to manage HA cluster members.
   • DDedicated HA communication interfaces for the cluster must be used over HSCI interfaces.

   Show answer

   Answer: AB

   Explanation

   Provisioning Requirements and Best Practices HA cluster members must be the same firewall model and run the same PAN-OS® version. HA cluster members must share the same zone names in order for sessions to successfully fail over to another cluster member. https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/high-availability/ha-clustering-best-practices-and-provisioning

   Source: Adapted from community discussion — b53fdf1

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

9. Question 539 · 610 in bank

   Why are external zones required to be configured on a Palo Alto Networks NGFW in an environment with multiple virtual systems?

   • ATo allow traffic between zones in different virtual systems while the traffic is leaving the appliance
   • BExternal zones are required because the same external zone can be used on different virtual systems
   • CTo allow traffic between zones in different virtual systems without the traffic leaving the appliance
   • DMultiple external zones are required in each virtual system to allow the communications between virtual systems

   Show answer

   Answer: C

   Explanation

   C External zones are required to allow traffic between zones in different virtual systems, without the traffic leaving the firewall. https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/virtual-systems/communication-between-virtual-systems/inter-vsys-traffic-that-remains-within-the-firewall/external-zone

   Source: Adapted from community discussion — Thunnu

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

10. Question 540 · 610 in bank

    Select 2

    Which two are required by IPSec in transport mode? (Choose two.)

    • AAuto generated key
    • BNAT Traversal
    • CIKEv1
    • DDH-group 20 (ECP-384 bits)

    Show answer

    Answer: AD

    Explanation

    NAT traversal is not supported in transport mode because only the payload is encrypted. IKEv1 is not supported, it is probably a vendor decision.

    Source: Adapted from community discussion — hcir

    References

    • docs.paloaltonetworks.com documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNSE practice, question 531. 610 questions available.