PCNSE practice questions 581–590

1. Question 581 · 610 in bank

   If an administrator does not possess a website's certificate, which SSL decryption mode will allow the Palo Alto Networks NGFW to inspect traffic when users browse to HTTP(S) websites?

   • ASSL Forward Proxy
   • BSSL Inbound Inspection
   • CSSL Reverse Proxy
   • DSSL Outbound Inspection

   Show answer

   Answer: A

   Explanation

   "If an administrator does not possess a website's certificate, which SSL decryption mode will allow the Palo Alto Networks NGFW to INSPECT traffic when users browse to HTTP(S) websites?" Should that not be B? SSL Forward Proxy mode does not inspect the SSL traffic but Inbound Inspection Decryption Mode does!

   Source: Adapted from community discussion — Woody

   Next question

2. Question 582 · 610 in bank

   An administrator sees several inbound sessions identified as unknown-tcp in the Traffic logs. The administrator determines that these sessions are form external users accessing the company's proprietary accounting application. The administrator wants to reliably identify this traffic as their accounting application and to scan this traffic for threats. Which option would achieve this result?

   • ACreate a custom App-ID and enable scanning on the advanced tab.
   • BCreate an Application Override policy.
   • CCreate a custom App-ID and use the ג€ordered conditionsג€ check box.
   • DCreate an Application Override policy and a custom threat signature for the application.

   Show answer

   Answer: A

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

3. Question 583 · 610 in bank

   Select 2

   The administrator has enabled BGP on a virtual router on the Palo Alto Networks NGFW, but new routes do not seem to be populating the virtual router. Which two options would help the administrator troubleshoot this issue? (Choose two.)

   • AView the System logs and look for the error messages about BGP.
   • BPerform a traffic pcap on the NGFW to see any BGP problems.
   • CView the Runtime Stats and look for problems with BGP configuration.
   • DView the ACC tab to isolate routing issues.

   Show answer

   Answer: AC

   Explanation

   Correct: B,C ======= PAN-EDU-311 Advanced Troubleshooting Dynamic Routing module "Confirm virtual router runtime status on the active firewall, go to the Network > Virtual Router screen and click on More Runtime Stats" ======= https://live.paloaltonetworks.com/t5/general-topics/bgp-traffic-pcap/td-p/237407 For troubleshooting purposes it may be necessary to collect the PCAPs of the OSPF and BGP traffic that the Palo Alto Networks device is processing. The quickest way to perform troubleshooting is through the CLI. To start the BGP capture, use the following CLI command: > debug routing pcap bgp on

   Source: Adapted from community discussion — ChiaPet75

   References

   • live.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

4. Question 584 · 610 in bank

   Select 2

   An administrator has enabled OSPF on a virtual router on the NGFW. OSPF is not adding new routes to the virtual router. Which two options enable the administrator to troubleshoot this issue? (Choose two.)

   • AView Runtime Stats in the virtual router.
   • BView System logs.
   • CAdd a redistribution profile to forward as BGP updates.
   • DPerform a traffic pcap at the routing stage.

   Show answer

   Answer: AB

   Explanation

   For me as more native network-engineer, I will always check/debug any routing protocol, so at first glance I will choose A-B but as per PA procedure seems to be A-D, check below. https://live.paloaltonetworks.com/t5/general-topics/bgp-traffic-pcap/td-p/237407 For troubleshooting purposes it may be necessary to collect the PCAPs of the OSPF and BGP traffic that the Palo Alto Networks device is processing. The quickest way to perform troubleshooting is through the CLI. Enjoy

   Source: Adapted from community discussion — rammsdoct

   References

   • live.paloaltonetworks.com documentation

   Next question

5. Question 585 · 610 in bank

   Select 3

   Which three firewall states are valid? (Choose three.)

   • AActive
   • BFunctional
   • CPending
   • DPassive
   • ESuspended

   Show answer

   Answer: ADE

   Explanation

   A, C, E - One of the operations is to "suspend" a firewall. Often used to force an HA event. Also, if HA goes crazy and flaps back and forth, after 3 flaps the active firewall will go into "suspend" state. A hard failure is easier to diagnose than a constantly changing HA state. If HA is enabled, these are the states you will see on the dashboard. Everything else is a diagnostic mode or part of the boot sequence.

   Source: Adapted from community discussion — PacketFairy

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

6. Question 586 · 610 in bank

   Which virtual router feature determines if a specific destination IP address is reachable?

   • AHeartbeat Monitoring
   • BFailover
   • CPath Monitoring
   • DPing-Path

   Show answer

   Answer: C

   Explanation

   Ans. C. Path monitoring allows you to verify connectivity to an IP address so that the firewall can direct traffic through an alternate route, when needed. https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/policy/pbf

   Source: Adapted from community discussion — sethjam

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

7. Question 587 · 610 in bank

   An administrator has a requirement to export decrypted traffic from the Palo Alto Networks NGFW to a third-party, deep-level packet inspection appliance. Which interface type and license feature are necessary to meet the requirement?

   • ADecryption Mirror interface with the Threat Analysis license
   • BVirtual Wire interface with the Decryption Port Export license
   • CTap interface with the Decryption Port Mirror license
   • DDecryption Mirror interface with the associated Decryption Port Mirror license

   Show answer

   Answer: D

   Explanation

   Correct: D ecryption port mirroring allows you to copy decrypted traffic from a firewall and then send it to a traffic collection tool, such as NetWitness or Solera. Decryption mirroring requires a Decryption Port Mirror license. This license is free of change and you can activate it through the customer support portal. https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-new-features/decryption-features/decryption_mirroring_support_extension#:~:text=Decryption%20port%20mirroring%20allows%20you,through%20the%20customer%20support%20portal.

   Source: Adapted from community discussion — ChiaPet75

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

8. Question 588 · 610 in bank

   When is the content inspection performed in the packet flow process?

   • Aafter the application has been identified
   • Bbefore session lookup
   • Cbefore the packet forwarding process
   • Dafter the SSL Proxy re-encrypts the packet

   Show answer

   Answer: A

   Explanation

   I'm thinking C. Here's my train of thought, let me know what you think. B and D are certainly not right. A and C could be both technically true, but which is more accurate? A indicates that "after app has been identified", so we can interpret that in the Flow Diagram as the step in App-ID which says "Pattern based application identification" however, considering the Packet Flow Sequence, after the app is identified, there are still several steps that don't lead directly to Content ID. First it checks for policy matches that will allow it (so it might still get dropped). Then it will check if there are any Security Profiles (ContentID) that will be applicable. QoS and SSL Decryption also might occur at this point. My point is there's a whole bunch of stuff still going on between the "app being identified" and content inspection. My conclusion is that whenever content inspection is performed it's always before packet forwarding. And it is not always the case that it happens immediatly after the app has been identified.

   Source: Adapted from community discussion — shamhala1228

   References

   • live.paloaltonetworks.com documentation
   • live.paloaltonetworks.com documentation
   • live.paloaltonetworks.com documentation

   Next question

9. Question 589 · 610 in bank

   An administrator has created an SSL Decryption policy rule that decrypts SSL sessions on any port. Which log entry can the administrator use to verify that sessions are being decrypted?

   • AIn the details of the Traffic log entries
   • BDecryption log
   • CData Filtering log
   • DIn the details of the Threat log entries

   Show answer

   Answer: A

   Explanation

   PCNSE 9 is current exam content [02/2021] *** ANSWER = A *** https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClboCAC The Question is simply asking how to verify if traffic was being decrypted. There are (2) ways to see this in the traffic logs: 1. To confirm that the traffic is decrypted inside the WebGUI > Monitor > Logs > Traffic. Click the magnifying glass icon in the traffic log entries to confirm that the connections were decrypted. 2. Another way to validate the decrypted session is by enabling the column "Decrypted" as below Traffic logs . This can be done by clicking on the arrow down next to any column title and selecting the Columns > Decrypted. This shows decrypted status in regular traffic log view.

   Source: Adapted from community discussion — bmarks

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

10. Question 590 · 610 in bank

    An administrator has been asked to configure a Palo Alto Networks NGFW to provide protection against external hosts attempting to exploit a flaw in an operating system on an internal system. Which Security Profile type will prevent this attack?

    • AVulnerability Protection
    • BAnti-Spyware
    • CURL Filtering
    • DAntivirus

    Show answer

    Answer: A

    Explanation

    Answer here is A. Key word here is 'Flaw' that a flaw can be classed as a vulnerability, in which can then be further exploited by an attacker.

    Source: Adapted from community discussion — Biz90

    References

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNSE practice, question 581. 610 questions available.