PCNSE practice questions 591–600

1. Question 591 · 610 in bank

   Which processing order will be enabled when a Panorama administrator selects the setting `Objects defined in ancestors will take higher precedence?`

   • ADescendant objects will take precedence over other descendant objects.
   • BDescendant objects will take precedence over ancestor objects.
   • CAncestor objects will have precedence over descendant objects.
   • DAncestor objects will have precedence over other ancestor objects.

   Show answer

   Answer: C

   Explanation

   By default, when device groups at different levels in the Device Group Hierarchy have an object with the same name but different values (because of overrides, as an example), policy rules in a descendant device group use the object values in that descendant instead of using object values inherited from ancestor device groups. Optionally, you can reverse this order of precedence to push values from the highest ancestor containing the object to all descendant device groups. After you enable this option, the next time you push configuration changes to device groups, the values of inherited objects replace the values of any overridden objects in the descendant device groups.

   Source: Adapted from community discussion — DenskyDen

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

2. Question 592 · 610 in bank

   An administrator using an enterprise PKI needs to establish a unique chain of trust to ensure mutual authentication between Panorama and the managed firewalls and Log Collectors. How would the administrator establish the chain of trust?

   • AUse custom certificates
   • BEnable LDAP or RADIUS integration
   • CSet up multi-factor authentication
   • DConfigure strong password authentication

   Show answer

   Answer: A

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

3. Question 593 · 610 in bank

   What will be the egress interface if the traffic's ingress interface is ethernet1/6 sourcing from 192.168.111.3 and to the destination 10.46.41.113 during the time shown in the image?

   

   • Aethernet1/7
   • Bethernet1/5
   • Cethernet1/6
   • Dethernet1/3

   Show answer

   Answer: D

   Next question

4. Question 594 · 610 in bank

   Refer to the exhibit. A web server in the DMZ is being mapped to a public address through DNAT.

   

   Which Security policy rule will allow traffic to flow to the web server?

   • AUntrust (any) to Untrust (10.1.1.100), web browsing ג€" Allow
   • BUntrust (any) to Untrust (1.1.1.100), web browsing ג€" Allow
   • CUntrust (any) to DMZ (1.1.1.100), web browsing ג€" Allow
   • DUntrust (any) to DMZ (10.1.1.100), web browsing ג€" Allow

   Show answer

   Answer: C

   Explanation

   I believe the correct answer is 'B' Since this is DNAT setup, rule for security policy is: PRE-NAT addresses, POST-NAT zone. PCNSA study guide PAN OS 10.0, p.111

   Source: Adapted from community discussion — Angel123

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

5. Question 595 · 610 in bank

   A web server is hosted in the DMZ and the server is configured to listen for incoming connections on TCP port 443. A Security policies rules allowing access from the Trust zone to the DMZ zone needs to be configured to allow web-browsing access. The web server hosts its contents over HTTP(S). Traffic from Trust to DMZ is being decrypted with a Forward Proxy rule. Which combination of service and application, and order of Security policy rules, needs to be configured to allow cleartext web-browsing traffic to this server on tcp/443?

   • ARule #1: application: web-browsing; service: application-default; action: allow Rule #2: application: ssl; service: application-default; action: allow
   • BRule #1: application: web-browsing; service: service-http; action: allow Rule #2: application: ssl; service: application-default; action: allow
   • CRule # 1: application: ssl; service: application-default; action: allow Rule #2: application: web-browsing; service: application-default; action: allow
   • DRule #1: application: web-browsing; service: service-https; action: allow Rule #2: application: ssl; service: application-default; action: allow

   Show answer

   Answer: D

   Explanation

   D -- Server hosts HTTP/HTTPs both on Port 443 .. that means to access the HTTP on port 443, web-browsing "Application" need to be enabled on "service-https" service

   Source: Adapted from community discussion — YasserSaied

   References

   • docs.paloaltonetworks.com documentation

   Next question

6. Question 596 · 610 in bank

   Select 2

   Which two options prevent the firewall from capturing traffic passing through it? (Choose two.)

   • AThe firewall is in multi-vsys mode.
   • BThe traffic is offloaded.
   • CThe traffic does not match the packet capture filter.
   • DThe firewall's DP CPU is higher than 50%.

   Show answer

   Answer: BC

   References

   • docs.paloaltonetworks.com documentation

   Next question

7. Question 597 · 610 in bank

   A global corporate office has a large-scale network with only one User-ID agent, which creates a bottleneck near the User-ID agent server. Which solution in PAN-OSֲ® software would help in this case?

   • Aapplication override
   • BVirtual Wire mode
   • Ccontent inspection
   • Dredistribution of user mappings

   Show answer

   Answer: D

   References

   • docs.paloaltonetworks.com documentation

   Next question

8. Question 598 · 610 in bank

   An administrator has been asked to create 100 virtual firewalls in a local, on-premise lab environment (not in ג€the cloudג€). Bootstrapping is the most expedient way to perform this task. Which option describes deployment of a bootstrap package in an on-premise virtual environment?

   • AUse config-drive on a USB stick.
   • BUse an S3 bucket with an ISO.
   • CCreate and attach a virtual hard disk (VHD).
   • DUse a virtual CD-ROM with an ISO.

   Show answer

   Answer: D

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

9. Question 599 · 610 in bank

   Select 2

   Which two benefits come from assigning a Decryption Profile to a Decryption policy rule with a `No Decrypt` action? (Choose two.)

   • ABlock sessions with expired certificates
   • BBlock sessions with client authentication
   • CBlock sessions with unsupported cipher suites
   • DBlock sessions with untrusted issuers
   • EBlock credential phishing

   Show answer

   Answer: AD

   Explanation

   A,C,D are all correct for this question: Depending on your needs, create Decryption profiles to: Block sessions based on certificate status, including blocking sessions with >>>expired certificates, >>>untrusted issuers, unknown certificate status, certificate status check timeouts, and certificate extensions. Block sessions with >>>unsupported versions and cipher suites, and that require using client authentication.

   Source: Adapted from community discussion — djedeen

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

10. Question 600 · 610 in bank

    When configuring a GlobalProtect Portal, what is the purpose of specifying an Authentication Profile?

    • ATo enable Gateway authentication to the Portal
    • BTo enable Portal authentication to the Gateway
    • CTo enable user authentication to the Portal
    • DTo enable client machine authentication to the Portal

    Show answer

    Answer: C

    Explanation

    Answer: c Users authenticate to the portal... Each GlobalProtect client authentication configuration specifies the settings that enable the user to authenticate with the GlobalProtect portal.

    Source: Adapted from community discussion — lol1000

    References

    • docs.paloaltonetworks.com documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNSE practice, question 591. 610 questions available.