Question 51 · 610 in bank
Select 2Which two actions would be part of an automatic solution that would block sites with untrusted certificates without enabling SSL Forward Proxy? (Choose two.)
Show answer
Answer: AD
PCNSEProfessionalPalo Alto NetworksAll questions freePage 6 of 61
PCNSE practice questions 51–60
Palo Alto Networks Certified Network Security Engineer610 questions across 61 pages are complete and free, with no account or card.
Official study references
610 questions in this bank
Free access · progress saved on this device
Question 52 · 610 in bank
An administrator is defining protection settings on the Palo Alto Networks NGFW to guard against resource exhaustion. When platform utilization is considered, which steps must the administrator take to configure and apply packet buffer protection?
Show answer
Answer: A
Explanation
Answer = A The following excerpts from 9.1 Docs confirm the answer: ... Packet Buffer Protection defends ingress zones. ... you don’t configure Packet Buffer Protection in a Zone Protection profile ... tune the Packet Buffer Protection thresholds https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/zone-protection-and-dos-protection/zone-defense/packet-buffer-protection.html
Source: Adapted from community discussion — bmarks
Question 53 · 610 in bank
What is the purpose of the firewall decryption broker?
Show answer
Answer: A
Explanation
This feature will decrypt traffic and forward it out of the selected interface to a specific security device or service (or chain of devices) that examines the cleartext traffic. The last service in the chain returns the packet to the firewall, which then encrypts it and forwards it to the original destination.
Source: Adapted from community discussion — aatechler
Question 54 · 610 in bank
Select 2SAML SLO is supported for which two firewall features? (Choose two.)
Show answer
Answer: AC
Explanation
Agree with Anoopmp: A and C SSO is available to administrators who access the web interface and to end users who access applications through GlobalProtect or Captive Portal. SLO is available to administrators and GlobalProtect end users, but not to Captive Portal end users. https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/authentication/authentication-types/saml
Source: Adapted from community discussion — santino
Question 55 · 610 in bank
Select 2Which two virtualization platforms officially support the deployment of Palo Alto Networks VM-Series firewalls? (Choose two.)
Show answer
Answer: BD
Question 56 · 610 in bank
Select 2What are the two behavior differences between Highlight Unused Rules and the Rule Usage Hit counter when a firewall is rebooted? (Choose two.)
Show answer
Answer: AB
Explanation
Correct: A,B (Per PANOS Help Function) - Each firewall maintains a traffic flag for the rules that have a match. Because the flag is reset when a dataplane reset occurs on a reboot or a restart, it is best practice to monitor this list periodically to determine whether the rule had a match since the last check before you delete or disable it. This mean when the dataplane is reset or there is a reboot the flag will not be set for any security policies therefore they will all be highlighted until a rule is hit and the flag is set.
Source: Adapted from community discussion — ChiaPet75
Question 57 · 610 in bank
Which is not a valid reason for receiving a decrypt-cert-validation error?
Show answer
Answer: A
Explanation
Correct: A The question reads, "Which is NOT a valid reason for receiving a decrypt-cert-validation error?" Per the link "hamshoo" provided, receiving the decrypt-cert-validation error is valid for the following conditions: expired, untrusted issuer, unknown status, or status verification time-out. "Unsupported HSM" is not a valid reason for receiving a decrypt-cert-validation error.
Source: Adapted from community discussion — ChiaPet75
Question 58 · 610 in bank
In the following image from Panorama, why are some values shown in red?
Show answer
Answer: C
Explanation
The answer which makes the most sense is C, however I believe the questions is not properly worded. "In the following image from Panorama, why are some values shown in red?" C. uk3 has a logging rate that deviates from the seven-day calculated baseline. The values that are red are not red due to uk3 being a deviating device. A more adequate correct answer would be "Because the devices are deviating from the seven-day calculated baseline."
Source: Adapted from community discussion — BryanSalazar
Question 59 · 610 in bank
The firewall is not downloading IP addresses from MineMeld. Based on the image, what most likely is wrong?
Show answer
Answer: D
Explanation
D - "If the list source is secured with SSL (i.e. lists with an HTTPS URL), enable server authentication. Select a Certificate Profile or create a New Certificate Profile for authenticating the server that hosts the list. The certificate profile you select must have root certificate authority (CA) and intermediate CA certificates that match the certificates installed on the server you are authenticating."
Source: Adapted from community discussion — bloodtech
Question 60 · 610 in bank
Select 3Which three split tunnel methods are supported by a GlobalProtect Gateway? (Choose three.)
Show answer
Answer: ABC
Explanation
Answer = ABC You can configure split tunnel traffic based on an access route, destination domain, application, and HTTP/HTTPS video streaming application. https://docs.paloaltonetworks.com/globalprotect/9-1/globalprotect-admin/globalprotect-gateways/split-tunnel-traffic-on-globalprotect-gateways.html
Source: Adapted from community discussion — bmarks
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
PCNSE practice, question 51. 610 questions available.
About this question bank
Version 1.0.0. How we source questions