PCNSE practice questions 541–550

1. Question 541 · 610 in bank

   A firewall engineer needs to patch the company’s Palo Alto Networks firewalls to the latest version of PAN-OS. The company manages its firewalls by using Panorama. Logs are forwarded to Dedicated Log Collectors, and file samples are forwarded to WildFire appliances for analysis. What must the engineer consider when planning deployment?

   • AOnly Panorama and Dedicated Log Collectors must be patched to the target PAN-OS version before updating the firewalls.
   • BPanorama, Dedicated Log Collectors, and WildFire appliances must have the target PAN-OS version downloaded, after which the order of patching does not matter.
   • CPanorama, Dedicated Log Collectors, and WildFire appliances must be patched to the target PAN-OS version before updating the firewalls.
   • DOnly Panorama must be patched to the target PAN-OS version before updating the firewalls.

   Show answer

   Answer: C

   Explanation

   https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-upgrade/upgrade-pan-os/upgrade-the-firewall-pan-os "When upgrading firewalls that you manage with Panorama or firewalls that are configured to forward content to a WildFire appliance, you must first upgrade Panorama and its Log Collectors and then upgrade the WildFire appliance before you upgrade the firewalls."

   Source: Adapted from community discussion — poiuytr

   References

   • docs.paloaltonetworks.com documentation

   Next question

2. Question 542 · 610 in bank

   Which rule type controls end user SSL traffic to external websites?

   • ASSL Inbound Inspection
   • BSSH Proxy
   • CSSL Forward Proxy
   • DSSL Outbound Proxyless Inspection

   Show answer

   Answer: C

   Explanation

   is C Based on the provided text, the rule type that controls end user SSL traffic to external websites is SSL Forward Proxy. Here's why: SSL Forward Proxy: This rule type is specifically designed to decrypt and inspect SSL/TLS traffic from internal users to external web servers. It allows the firewall to act as a man-in-the-middle, decrypting the traffic so that security policies and profiles can be applied before re-encrypting and forwarding the traffic to its destination. The other options do not match the described functionality: SSL Inbound Inspection: This is typically used to decrypt traffic coming to internal servers from external clients, not for traffic from internal users to external sites. SSH Proxy: This is used for inspecting and controlling SSH traffic, not SSL/TLS traffic. SSL Outbound Proxyless Inspection: This term is not mentioned in the provided text and does not align with the described SSL Forward Proxy functionality.

   Source: Adapted from community discussion — unless_mail

   References

   • docs.paloaltonetworks.com documentation

   Next question

3. Question 543 · 610 in bank

   An internal audit team has requested additional information to be included inside traffic logs forwarded from Palo Alto Networks firewalls to an internal syslog server. Where can the firewall engineer define the data to be added into each forwarded log?

   • ACustom Log Format within Device > Server Profiles > Syslog
   • BBuilt-in Actions within Objects > Log Forwarding Profile
   • CLogging and Reporting Settings within Device > Setup > Management
   • DData Patterns within Objects > Custom Objects

   Show answer

   Answer: A

   Explanation

   To facilitate the integration with external log parsing systems, the firewall allows you to customize the log format; it also allows you to add custom Key: Value attribute pairs. Custom message formats can be configured under DeviceServer ProfilesSyslogSyslog Server ProfileCustom Log Format. https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/custom-logevent-format

   Source: Adapted from community discussion — findkeywordcommand

   References

   • docs.paloaltonetworks.com documentation

   Next question

4. Question 544 · 610 in bank

   When you troubleshoot an SSL Decryption issue, which PAN-OS CLI command do you use to check the details of the Forward Trust certificate, Forward Untrust certificate, and SSL Inbound Inspection certificate?

   • Ashow system setting ssl-decrypt certs
   • Bshow system setting ssl-decrypt certificate
   • Cdebug dataplane show ssl-decrypt ssl-stats
   • Dshow system setting ssl-decrypt certificate-cache

   Show answer

   Answer: B

   Next question

5. Question 545 · 610 in bank

   Select 2

   Which two items must be configured when implementing application override and allowing traffic through the firewall? (Choose two.)

   • AApplication filter
   • BApplication override policy rule
   • CSecurity policy rule
   • DCustom app

   Show answer

   Answer: BC

   Explanation

   B and C. Please note: a custom app IS NOT REQUIRED to do an application override. you can override the built-in app, per the KB article. "What You'll Need for Setup To configure an Application Override, go to Policies > Application Override in the WebGUI. For setup, you'll need the following: Custom Application to be used in the Application Override policy (recommended) Application Override policy Security Policy that allows the newly created Custom Application through the firewall Special Note about Content and Threat inspection Application Override to a custom application will force the firewall to bypass Content and Threat inspection for the traffic that is matching the override rule. The exception to this is when you override to a pre-defined application that supports threat inspection. " https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVLCA0

   Source: Adapted from community discussion — examtopicstroilevw

   Next question

6. Question 546 · 610 in bank

   Select 2

   A firewall administrator is configuring an IPSec tunnel between Site A and Site B. The Site A firewall uses a DHCP assigned address on the outside interface of the firewall, and the Site B firewall uses a static IP address assigned to the outside interface of the firewall. However, the use of dynamic peering is not working. Refer to the two sets of configuration settings provided. Which two changes will allow the configurations to work? (Choose two.) Site A configuration:

   

   Site B configuration:

   

   • AMatch IKE version on both firewalls.
   • BConfigure Local Identification on Site B firewall.
   • CEnable NAT Traversal on Site B firewall.
   • DDisable passive mode on Site A firewall.

   Show answer

   Answer: AD

   Explanation

   A - obvious, you need to have possibility to negotiate the same IKEversion B - not necessary, couse "If you don’t specify a value, the gateway will use the local IP address as the Local Identification value." C - not connected with screenshots; D - "Peer IP Address Type - Dynamic—Select this option if the peer IP address or FQDN value is unknown. When the peer IP address type is Dynamic, it is up to the peer to initiate the IKE gateway negotiation."

   Source: Adapted from community discussion — poiuytr

   Next question

7. Question 547 · 610 in bank

   Which server platforms can be monitored when a company is deploying User-ID through server monitoring in an environment with diverse directory services?

   • ANovell eDirectory, Microsoft Terminal Server, and Microsoft Active Directory
   • BRed Hat Linux, Microsoft Exchange, and Microsoft Terminal Server
   • CNovell eDirectory, Microsoft Exchange, and Microsoft Active Directory
   • DRed Hat Linux, Microsoft Active Directory, and Microsoft Exchange

   Show answer

   Answer: C

   References

   • docs.paloaltonetworks.com documentation

   Next question

8. Question 548 · 610 in bank

   An administrator has been asked to configure active/passive HA for a pair of Palo Alto Networks NGFWs. The administrator assigns priority 100 to the active firewall. Which priority is correct for the passive firewall?

   • A0
   • B99
   • C1
   • D255

   Show answer

   Answer: D

   Explanation

   The lower the number, the higher the priority. So if active is higher priority, therefore assigned 100 , then the only one that will be second priority will be with number larger than 100 so Only 255 is applicable. Therefore D is the correct answer.

   Source: Adapted from community discussion — Yasi

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

9. Question 549 · 610 in bank

   Which protection feature is available only in a Zone Protection Profile?

   • ASYN Flood Protection using SYN Flood Cookies
   • BICMP Flood Protection
   • CPort Scan Protection
   • DUDP Flood Protections

   Show answer

   Answer: C

   Explanation

   Correct C: SYN Flood Cookies is also available on DoS Protection Profile, the answer refers to ONLY. DoS Protection profiles protect specific devices (classified profiles) and groups of devices (aggregate profiles) against SYN, UDP, ICMP, ICMPv6, and Other IP flood attacks.

   Source: Adapted from community discussion — mzzzzz

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

10. Question 550 · 610 in bank

    An engineer is monitoring an active/passive high availability (HA) firewall pair. Which HA firewall state describes the firewall that is currently processing traffic?

    • AActive-primary
    • BActive
    • CActive-secondary
    • DInitial

    Show answer

    Answer: B

    References

    • docs.paloaltonetworks.com documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNSE practice, question 541. 610 questions available.