PCNSE practice questions 71–80

1. Question 71 · 610 in bank

   How can an administrator configure the firewall to automatically quarantine a device using GlobalProtect?

   • Aby adding the device's Host ID to a quarantine list and configure GlobalProtect to prevent users from connecting to the GlobalProtect gateway from a quarantined device
   • Bby exporting the list of quarantined devices to a pdf or csv file by selecting PDF/CSV at the bottom of the Device Quarantine page and leveraging the appropriate XSOAR playbook
   • Cby using security policies, log forwarding profiles, and log settings
   • Dthere is no native auto-quarantine feature so a custom script would need to be leveraged

   Show answer

   Answer: C

   Explanation

   After you identify a device as compromised (for example, if a device has been infected with malware and is performing command and control actions), you can manually add the device’s Host ID to a quarantine list and configure GlobalProtect to prevent users from connecting to the GlobalProtect gateway from a quarantined device. You can also automatically quarantine the device using security policies, log forwarding profiles, and log settings.

   Source: Adapted from community discussion — NLT

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

2. Question 72 · 610 in bank

   To protect your firewall and network from single source denial of service (DoS) attacks that can overwhelm its packet buffer and cause legitimate traffic to drop, you can configure:

   • APBP (Protocol Based Protection)
   • BBGP (Border Gateway Protocol)
   • CPGP (Packet Gateway Protocol)
   • DPBP (Packet Buffer Protection)

   Show answer

   Answer: D

   Explanation

   D https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/zone-protection-and-dos-protection/zone-defense/packet-buffer-protection Packet Buffer Protection defends your firewall and network from single session DoS attacks that can overwhelm the firewall’s packet buffer and cause legitimate traffic to drop. Although you don’t configure Packet Buffer Protection in a Zone Protection profile or in a DoS Protection profile or policy rule, Packet Buffer Protection defends ingress zones. While zone and DoS protection apply to new sessions (connections) and are granular, Packet Buffer Protection applies to existing sessions and is global.

   Source: Adapted from community discussion — lol12

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

3. Question 73 · 610 in bank

   A bootstrap USB flash drive has been prepared using a Windows workstation to load the initial configuration of a firewall that was previously being used in a lab. The USB flash drive was formatted using file system FAT32 and the initial configuration is stored in a file named init-cfg.txt. The firewall is currently running PAN- OS 10.0 and using a lab config. The contents of init-cfg.txt in the USB flash drive are as follows:

   

   The USB flash drive has been inserted in the firewalls' USB port, and the firewall has been restarted using command: > request restart system Upon restart, the firewall fails to begin the bootstrapping process. The failure is caused because:

   • AThe bootstrap.xml file is a required file, but it is missing
   • BFirewall must be in factory default state or have all private data deleted for bootstrapping
   • CThe hostname is a required parameter, but it is missing in init-cfg.txt
   • DThe USB must be formatted using the ext3 file system. FAT32 is not supported

   Show answer

   Answer: B

   Explanation

   B is the correct =====> For security reasons, you can bootstrap a firewall only when it is in factory default state or has all private data deleted.

   Source: Adapted from community discussion — Pochex

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

4. Question 74 · 610 in bank

   An Administrator is configuring Authentication Enforcement and they would like to create an exemption rule to exempt a specific group from authentication. Which authentication enforcement object should they select?

   • Adefault-no-captive-portal
   • Bdefault-authentication-bypass
   • Cdefault-browser-challenge
   • Ddefault-web-form

   Show answer

   Answer: A

   Explanation

   default-browser-challenge—The firewall transparently obtains user authentication credentials default-web-form—To authenticate users, the firewall uses the certificate profile or authentication profile you specified when configuring Authentication Portal default-no-captive-portal—The firewall evaluates Security policy without authenticating users.

   Source: Adapted from community discussion — aatechler

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

5. Question 75 · 610 in bank

   A bootstrap USB flash drive has been prepared using a Linux workstation to load the initial configuration of a Palo Alto Networks firewall. The USB flash drive was formatted using file system ntfs and the initial configuration is stored in a file named init-cfg.txt. The contents of init-cfg.txt in the USB flash drive are as follows:

   

   The USB flash drive has been inserted in the firewalls' USB port, and the firewall has been powered on. Upon boot, the firewall fails to begin the bootstrapping process. The failure is caused because:

   • Athe bootstrap.xml file is a required file, but it is missing
   • Bnit-cfg.txt is an incorrect filename, the correct filename should be init-cfg.xml
   • CThe USB must be formatted using the ext4 file system
   • DThere must be commas between the parameter names and their values instead of the equal symbols
   • EThe USB drive has been formatted with an unsupported file system

   Show answer

   Answer: E

   Explanation

   As per PA it will support FAT32 and ext3 so the correct ans is E ( Unsupported File System ) The USB flash drive that bootstraps a hardware-based Palo Alto Networks firewall must support one of the following: • File Allocation Table 32 (FAT32) • Third Extended File System (ext3)

   Source: Adapted from community discussion — Blut

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

6. Question 76 · 610 in bank

   To more easily reuse templates and template stacks, you can create template variables in place of firewall-specific and appliance-specific IP literals in your configurations. Which one is the correct configuration?

   • A&Panorama
   • B@Panorama
   • C$Panorama
   • D#Panorama

   Show answer

   Answer: C

   Explanation

   confirm C Create a template and template stack using a variable name for an object. Variable names must start with the dollar sign ( “$” ) symbol. For example, you could use $Panorama as a variable for the Panorama IP address that you want to configure on multiple managed firewalls and appliances

   Source: Adapted from community discussion — mmed

   References

   • docs.paloaltonetworks.com documentation

   Next question

7. Question 77 · 610 in bank

   Decrypted packets from the website https://www.microsoft.com will appear as which application and service within the Traffic log?

   • Aweb-browsing and 443
   • BSSL and 80
   • CSSL and 443
   • Dweb-browsing and 80

   Show answer

   Answer: A

   Explanation

   Made an account just to tell you guys the correct answer is A. Application is first identified as SSL on port 443, then decrypted, then identified as web-browsing on port 443. Application identification changes due to app shift, but the port number doesn't! Correct answer is A.

   Source: Adapted from community discussion — Pacheco

   References

   • docs.paloaltonetworks.com documentation

   Next question

8. Question 78 · 610 in bank

   On the NGFW, how can you generate and block a private key from export and thus harden your security posture and prevent rogue administrators or other bad actors from misusing keys?

   • A1. Select Device > Certificate Management > Certificates > Device > Certificates 2. Import the certificate 3. Select Import Private key 4. Click Generate to generate the new certificate
   • B1. Select Device > Certificates 2. Select Certificate Profile 3. Generate the certificate 4. Select Block Private Key Export
   • C1. Select Device > Certificate Management > Certificates > Device > Certificates 2. Generate the certificate 3. Select Block Private Key Export 4. Click Generate to generate the new certificate
   • D1. Select Device > Certificates 2. Select Certificate Profile 3. Generate the certificate 4. Select Block Private Key Export

   Show answer

   Answer: C

   Explanation

   C Available answers have typos and it should be Select Device > Certificate Management > Certificates > Device Certificates https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/decryption/block-private-key-export/generate-a-private-key-and-block-it

   Source: Adapted from community discussion — lol12

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

9. Question 79 · 610 in bank

   What is the maximum number of samples that can be submitted to WildFire manually per day?

   • A1,000
   • B2,000
   • C5,000
   • D15,000

   Show answer

   Answer: A

   Explanation

   actually, they changed the values. It is now 2,500 daily submissions and 17,500 queries peri API SKU (including manual submissions), but for some reason, they did not update techdoc. So if you see 2,500 in the exam, bear this in mind.

   Source: Adapted from community discussion — hcir

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

10. Question 80 · 610 in bank

    What file type upload is supported as part of the basic WildFire service?

    • AELF
    • BBAT
    • CPE
    • DVBS

    Show answer

    Answer: C

    Explanation

    From your URL -> With the basic WildFire service, the firewall can forward portable executable (PE) files for WildFire analysis

    Source: Adapted from community discussion — cempejon

    References

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNSE practice, question 71. 610 questions available.