PCNSE practice questions 571–580

1. Question 571 · 610 in bank

   An administrator has configured the Palo Alto Networks NGFW's management interface to connect to the internet through a dedicated path that does not traverse back through the NGFW itself. Which configuration setting or step will allow the firewall to get automatic application signature updates?

   • AA scheduler will need to be configured for application signatures.
   • BA Security policy rule will need to be configured to allow the update requests from the firewall to the update servers.
   • CA Threat Prevention license will need to be installed.
   • DA service route will need to be configured.

   Show answer

   Answer: A

   Explanation

   Correct Answer: A You don’t need a service route. Those are only used when you are using an interface OTHER THAN the MGMT interface.

   Source: Adapted from community discussion — Edu147

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

2. Question 572 · 610 in bank

   Select 3

   Which three options are supported in HA Lite? (Choose three.)

   • AVirtual link
   • BActive/passive deployment
   • CSynchronization of IPsec security associations
   • DConfiguration synchronization
   • ESession synchronization

   Show answer

   Answer: BCD

   Explanation

   Reference: https://www.paloaltonetworks.com/documentation/80/pan-os/web-interface-help/device/device-high-availability/ha-lite

   Source: Adapted from community discussion — Silent_Sanctuary

   References

   • docs.paloaltonetworks.com documentation

   Next question

3. Question 573 · 610 in bank

   Which CLI command enables an administrator to view details about the firewall including uptime, PAN-OSֲ® version, and serial number?

   • Adebug system details
   • Bshow session info
   • Cshow system info
   • Dshow system details

   Show answer

   Answer: C

   Explanation

   Reference: https://live.paloaltonetworks.com/t5/Learning-Articles/Quick-Reference-Guide-Helpful-Commands/ta-p/56511

   Next question

4. Question 574 · 610 in bank

   Select 2

   During the packet flow process, which two processes are performed in application identification? (Choose two.)

   • APattern based application identification
   • BApplication override policy match
   • CApplication changed from content inspection
   • DSession application identified

   Show answer

   Answer: AB

   Explanation

   The obvious answer is AB and a nuanced answer is AC. The packet flow shows clearly AB but really in application detection the decoders are used and the tunneled applications are identified so there is kind of overlap in real application identification process in the packet flow. One thing to remember is do not pick nuanced answers only pick the obvious answers in the exam!!

   Source: Adapted from community discussion — yogininangpal

   References

   • live.paloaltonetworks.com documentation

   Next question

5. Question 575 · 610 in bank

   Which tool provides an administrator the ability to see trends in traffic over periods of time, such as threats detected in the last 30 days?

   • ASession Browser
   • BApplication Command Center
   • CTCP Dump
   • DPacket Capture

   Show answer

   Answer: B

   Explanation

   B is correct B The Application Command Center (ACC) page visually depicts trends and a historic view of traffic on your network. It displays the overall risk level for all network traffic, the risk levels and number of threats detected for the most active and highest-risk applications on your network, and the number of threats detected from the busiest application categories and from all applications at each risk level. The ACC can be viewed for the past hour, day, week, month, or any custom-defined time frame.

   Source: Adapted from community discussion — dev46

   Next question

6. Question 576 · 610 in bank

   The certificate information displayed in the following image is for which type of certificate?

   

   • AForward Trust certificate
   • BSelf-Signed Root CA certificate
   • CWeb Server certificate
   • DPublic CA signed certificate

   Show answer

   Answer: B

   Explanation

   The question and answers do not match but i think the expected answer is B. Its actually an Intermediate certificate capable of signing other certificates. It is not self signed or a root cert as the issuer field mentions the root cert that signed this cert.

   Source: Adapted from community discussion — JRKhan

   Next question

7. Question 577 · 610 in bank

   Select 3

   Which three steps will reduce the CPU utilization on the management plane? (Choose three.)

   • ADisable SNMP on the management interface.
   • BApplication override of SSL application.
   • CDisable logging at session start in Security policies.
   • DDisable predefined reports.
   • EReduce the traffic being decrypted by the firewall.

   Show answer

   Answer: ACD

   Explanation

   i think the correct answer is CDE, because in this article : https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CleLCAS there is only mention to disable logging for snmp, not to disable SNMP. imagine if you disable SNMP on management interface, how you get snmp from HA device ? it will never happen on secondary firewall. and this article: https://live.paloaltonetworks.com/t5/general-topics/ssl-decryption-and-load-on-management-plane/td-p/236408 tells that decryption will using management plan, and will increase load of management plan.

   Source: Adapted from community discussion — kamikaze

   References

   • live.paloaltonetworks.com documentation

   Next question

8. Question 578 · 610 in bank

   Which feature must you configure to prevent users from accidentally submitting their corporate credentials to a phishing website?

   • AURL Filtering profile
   • BZone Protection profile
   • CAnti-Spyware profile
   • DVulnerability Protection profile

   Show answer

   Answer: A

   Explanation

   A is correct. Phishing attack prevention extends the URL filtering capabilities to actively detect targeted credential phishing attacks through a cloud-based analytics service as well as through heuristics on the device itself.

   Source: Adapted from community discussion — MarkyMarc

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

9. Question 579 · 610 in bank

   An administrator pushes a new configuration from Panorama to a pair of firewalls that are configured as an active/passive HA pair. Which NGFW receives the configuration from Panorama?

   • AThe passive firewall, which then synchronizes to the active firewall
   • BThe active firewall, which then synchronizes to the passive firewall
   • CBoth the active and passive firewalls, which then synchronize with each other
   • DBoth the active and passive firewalls independently, with no synchronization afterward

   Show answer

   Answer: D

   Explanation

   This has some info for migrating HA into Panorama: https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/manage-firewalls/transition-a-firewall-to-panorama-management/migrate-a-firewall-ha-pair-to-panorama-management Basically, Panorama configuration is not synced regardless of if the config sync box is checked. Only local configuration will be synchronized if the config sync box is checked.

   Source: Adapted from community discussion — myname_1

   References

   • live.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

10. Question 580 · 610 in bank

    How can a candidate or running configuration be copied to a host external from Panorama?

    • ACommit a running configuration.
    • BSave a configuration snapshot.
    • CSave a candidate configuration.
    • DExport a named configuration snapshot.

    Show answer

    Answer: D

    Explanation

    D - you have to first save the config, then to get it on another device you must export it, then import it on the other device locally

    Source: Adapted from community discussion — trashboat

    References

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNSE practice, question 571. 610 questions available.