PCNSE practice questions 561–570

1. Question 561 · 610 in bank

   After implementing a new NGFW, a firewall engineer is alerted to a VoIP traffic issue. After troubleshooting, the engineer confirms that the firewall is alerting the voice packets payload. What can the engineer do to solve the VoIP traffic issue?

   • AIncrease the TCP timeout under SIP application
   • BDisable ALG under SIP application
   • CDisable ALG under H.323 application
   • DIncrease the TCP timeout under H.323 application

   Show answer

   Answer: B

   Explanation

   ALG (Application Layer Gateway) can sometimes interfere with VoIP traffic by modifying or inspecting SIP packets in a way that disrupts proper communication. Disabling ALG for SIP can resolve issues related to SIP traffic being improperly handled by the firewall, ensuring that the VoIP traffic flows correctly.

   Source: Adapted from community discussion — Moadil_001

   References

   • docs.paloaltonetworks.com documentation

   Next question

2. Question 562 · 610 in bank

   An administrator is considering deploying WildFire globally. What should the administrator consider with regards to the WildFire analysis process?

   • AEach WildFire cloud analyzes samples independently of the other WildFire clouds.
   • BTo comply with data privacy regulations, WildFire signatures and verdicts are not shared globally.
   • CPalo Alto Networks owns and maintains one global cloud and four WildFire regional clouds.
   • DThe WildFire Global Cloud only provides bare metal analysis.

   Show answer

   Answer: A

   Next question

3. Question 563 · 610 in bank

   Select 2

   Which two components are required to configure certificate-based authentication to the web UI when an administrator needs firewall access on a trusted interface? (Choose two.)

   • AServer certificate
   • BCA certificate
   • CSSL/TLS Service Profile
   • DCertificate Profile

   Show answer

   Answer: BD

   Explanation

   B. CA certificate The CA certificate is used to validate the client certificates presented during the authentication process. It ensures that the certificates are issued by a trusted Certificate Authority. D. Certificate Profile The Certificate Profile specifies the trusted Certificate Authorities and the certificate validation criteria for client certificates used in the authentication process. A. Server certificate: While important for establishing secure connections, it is not specifically required for configuring certificate-based authentication to the web UI itself. The server certificate is more related to securing the web interface rather than authenticating administrators.

   Source: Adapted from community discussion — Moadil_001

   References

   • docs.paloaltonetworks.com documentation

   Next question

4. Question 564 · 610 in bank

   What happens when an A/P firewall pair synchronizes IPsec tunnel security associations (SAs)?

   • APhase 2 SAs are synchronized over HA2 links.
   • BPhase 1 and Phase 2 SAs are synchronized over HA2 links.
   • CPhase 1 SAs are synchronized over HA1 links.
   • DPhase 1 and Phase 2 SAs are synchronized over HA3 links.

   Show answer

   Answer: A

   Explanation

   Phase 2 SAs (Security Associations) are synchronized over HA2 links. This ensures that the IPsec tunnels are consistent between the primary and secondary firewalls, allowing for seamless failover in case the active firewall fails. Phase 1 SAs are not specifically synchronized over HA links; instead, the Phase 1 configuration is usually re-established as part of the failover process.

   Source: Adapted from community discussion — Moadil_001

   Next question

5. Question 565 · 610 in bank

   Which function does the HA4 interface provide when implementing a firewall cluster which contains firewalls configured as active-passive pairs?

   • APerform session cache synchronization for all HA cluster members with the same cluster ID.
   • BPerform synchronization of sessions, forwarding tables, and IPSec security associations between firewalls in an HA pair.
   • CPerform packet forwarding to the active-passive peer during session setup and asymmetric traffic flow.
   • DPerform synchronization of routes, IPSec security associations, and User-ID information.

   Show answer

   Answer: A

   Explanation

   The HA4link andHA4backuplinkperform session cache synchronization among all HA cluster members having the same cluster ID. The HA4 link between cluster members detects connectivity failures between cluster members by sending and receiving Layer 2 keepalive messages. View the status of the HA4 and HA4 backup links on the firewall dashboard. Source : PCNSE study guide page 178

   Source: Adapted from community discussion — redgi0

   Next question

6. Question 566 · 610 in bank

   A security engineer has configured a GlobalProtect portal agent with four gateways. Which GlobalProtect Gateway will users connect to based on the chart provided?

   

   • AEast
   • BSouth
   • CWest
   • DCentral

   Show answer

   Answer: B

   Explanation

   "...the app uses the priority and response time to determine the gateway to which to connect. With GlobalProtect app 4.0.2 and earlier releases, the app connects to a lower priority gateway only if the response time for the higher priority gateway is greater than the average response time across all gateways." Time is 130/4 is 32.5 - East with 35ms is discarded, South become elected.

   Source: Adapted from community discussion — Style07

   References

   • docs.paloaltonetworks.com documentation

   Next question

7. Question 567 · 610 in bank

   Select 3

   A network security engineer needs to ensure that virtual systems can communicate with one another within a Palo Alto Networks firewall. Separate virtual routers (VRs) are created for each virtual system. In addition to confirming security policies, which three configuration details should the engineer focus on to ensure communication between virtual systems? (Choose three.)

   • AAdd a route with next hop next-vr by using the VR configured in the virtual system.
   • BLayer 3 zones for the virtual systems that need to communicate.
   • CAdd a route with next hop set to none, and use the interface of the virtual systems that need to communicate.
   • DEnsure the virtual systems are visible to one another.
   • EExternal zones with the virtual systems added.

   Show answer

   Answer: ADE

   Explanation

   Answer is based on free LabMinutes videos regarding vsys setup Step 1: Make vsys visible to each other Step 2: create external zone on each vsys and make it visible for another vsys Step 3: if you need routing via another vsys, create route with next-vr as a next hop (if independent virtual routers are used in each vsys)

   Source: Adapted from community discussion — elmorrre

   References

   • docs.paloaltonetworks.com documentation

   Next question

8. Question 568 · 610 in bank

   A new application server 192.168.197.40 has been deployed in the DMZ. There are no public IP addresses available, resulting in the server sharing NAT IP 198.51.100.88 with another DMZ serve that uses IP address 192.168.197.60. Firewall security and NAT rules have been configured. The application team has confirmed that the new server is able to establish a secure connection to an external database with IP address 203.0.113.40. The database team reports that they are unable to establish a secure connection to 198.51.100.88 from 203.0.113.40. However, it confirms a successful ping test to 198.51.100.88. Referring to the NAT configuration and traffic logs provided how can the firewall engineer resolve the situation and ensure inbound and outbound connections work concurrently for both DMZ servers?

   

   • AMove the NAT rule 6 DMZ server 2 above NAT rule 5 DMZ server 1.
   • BReplace the two NAT rules with a single rule that has both DMZ servers as "Source Address" both external servers as "Destination Address," and Source Translation remaining as is with bidirectional option enabled.
   • CConfigure separate source NAT and destination NAT rules for the two DMZ servers without using the bidirectional option.
   • DSharing a single NAT IP is possible for outbound connectivity not for inbound therefore a new public IP address must be obtained for the new DMZ server and used in the NAT rule 6 DMZ server 2.

   Show answer

   Answer: D

   Next question

9. Question 569 · 610 in bank

   A security team has enabled eal-time WildFire signature lookup on all its firewalls. Which additional action will further reduce the likelihood of newly discovered malware being allowed through the firewalls?

   • AEnable the "Hold Mode" option in Objects > Security Profiles > Antivirus
   • BIncrease the frequency of the applications and threats dynamic updates
   • CIncrease the frequency of the antivirus dynamic updates
   • DEnable the "Report Grayware Files" option in Device > Setup > WildFire

   Show answer

   Answer: A

   Explanation

   While increasing the frequency of antivirus dynamic updates ensures that the firewall has the latest malware signatures, it’s still a reactive approach. Antivirus updates only address known threats that have already been analyzed and added to the signature database. Even with frequent updates, there’s always a time gap between the discovery of new malware and its inclusion in the database, leaving the network vulnerable to zero-day threats. Enabling Hold Mode goes a step further by providing proactive protection. It delays file delivery until WildFire has completed its real-time analysis, ensuring that even newly discovered malware is blocked before it can pass through. This makes Hold Mode far more effective at addressing unknown or rapidly spreading threats than simply relying on frequent antivirus updates. In short, while antivirus updates are important for overall protection, they don’t offer the same level of real-time defense against new threats that Hold Mode and WildFire provide.

   Source: Adapted from community discussion — PaloGod

   References

   • docs.paloaltonetworks.com documentation

   Next question

10. Question 570 · 610 in bank

    A company configures its WildFire analysis profile to forward any file type to the WildFire public cloud. A company employee receives an email containing an unknown link that downloads a malicious Portable Executable (PE) file. What does Advanced WildFire do when the link is clicked?

    • APerforms malicious content analysis on the linked page: but not the corresponding PE file
    • BPerforms malicious content analysis on the linked page and the corresponding PE file
    • CDoes not perform malicious content analysis on the linked page but performs it on the corresponding PE file
    • DDoes not perform malicious content analysis on either the linked page or the corresponding PE file

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNSE practice, question 561. 610 questions available.