PCNSE practice questions 81–90

1. Question 81 · 610 in bank

   Select 2

   An administrator accidentally closed the commit window/screen before the commit was finished. Which two options could the administrator use to verify the progress or success of that commit task? (Choose two.)

   • ATask Manager
   • BSystem Logs
   • CTraffic Logs
   • DConfiguration Logs

   Show answer

   Answer: AB

   Explanation

   The correct answer is A and B. I don't know if this information used to be contained within system logs, but they are no longer there; this information is only available within the task manager and configuration logs. https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/monitoring/view-and-manage-logs/log-types-and-severity-levels/config-logs https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-web-interface-help/web-interface-basics/task-manager.html

   Source: Adapted from community discussion — bartbernini

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

2. Question 82 · 610 in bank

   Before an administrator of a VM-500 can enable DoS and zone protection, what actions need to be taken?

   • ACreate a zone protection profile with flood protection configured to defend an entire egress zone against SYN, ICMP, ICMPv6, UDP, and other IP flood attacks.
   • BAdd a WildFire subscription to activate DoS and zone protection features.
   • CReplace the hardware firewall, because DoS and zone protection are not available with VM-Series systems.
   • DMeasure and monitor the CPU consumption of the firewall data plane to ensure that each firewall is properly sized to support DoS and zone protection.

   Show answer

   Answer: D

   Explanation

   Option D Check and monitor firewall dataplane CPU consumption to ensure that each firewall is properly sized to support DoS and Zone Protection along with any other features that consume CPU cycles, such as decryption. https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/zone-protection-and-dos-protection.html

   Source: Adapted from community discussion — alanouaro

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

3. Question 83 · 610 in bank

   DRAG DROP - Please match the terms to their corresponding definitions. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   

   Next question

4. Question 84 · 610 in bank

   An organization has recently migrated its infrastructure and configuration to NGFWs, for which Panorama manages the devices. The organization is coming from a L2-L4 firewall vendor, but wants to use App-ID while identifying policies that are no longer needed. Which Panorama tool can help this organization?

   • ATest Policy Match
   • BApplication Groups
   • CPolicy Optimizer
   • DConfig Audit

   Show answer

   Answer: C

   Explanation

   Option C This new feature identifies port-based rules so you can convert them to application-based rules that allow the traffic or add applications to existing rules without compromising application availability. https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-new-features/app-id-features/policy-optimizer.html

   Source: Adapted from community discussion — alanouaro

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

5. Question 85 · 610 in bank

   Select 2

   An organization is building a Bootstrap Package to deploy Palo Alto Networks VM-Series firewalls into their AWS tenant. Which two statements are correct regarding the bootstrap package contents? (Choose two.)

   • AThe bootstrap package is stored on an AFS share or a discrete container file bucket.
   • BThe bootstrap.xml file allows for automated deployment of VM-Series firewalls with full network and policy configurations.
   • CThe /config, /content and /software folders are mandatory while the /license and /plugin folders are optional.
   • DThe init-cfg.txt and bootstrap.xml files are both optional configuration items for the /config folder.
   • EThe directory structure must include a /config, /content, /software and /license folders.

   Show answer

   Answer: BE

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

6. Question 86 · 610 in bank

   Which Panorama objects restrict administrative access to specific device-groups?

   • Aadmin roles
   • Bauthentication profiles
   • Ctemplates
   • Daccess domains

   Show answer

   Answer: D

   Explanation

   Option D Access domains control administrative access to specific Device Groups and templates, and also control the ability to switch context to the web interface of managed firewalls. https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/panorama-overview/role-based-access-control/access-domains.html

   Source: Adapted from community discussion — alanouaro

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

7. Question 87 · 610 in bank

   An engineer is planning an SSL decryption implementation. Which of the following statements is a best practice for SSL decryption?

   • AObtain an enterprise CA-signed certificate for the Forward Trust certificate.
   • BUse an enterprise CA-signed certificate for the Forward Untrust certificate.
   • CUse the same Forward Trust certificate on all firewalls in the network.
   • DObtain a certificate from a publicly trusted root CA for the Forward Trust certificate.

   Show answer

   Answer: A

   Explanation

   Option A (Best Practice) Enterprise CA-signed Certificates—An enterprise CA can issue a signing certificate that the firewall can use to sign the certificates for sites which require SSL decryption. When the firewall trusts the CA that signed the certificate of the destination server, the firewall can send a copy of the destination server certificate to the client, signed by the enterprise CA. This is a best practice because usually all network devices already trust the Enterprise CA (it is usually already installed in the devices’ CA Trust storage), so you don’t need to deploy the certificate on the endpoints, so the rollout process is smoother. https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/decryption/configure-ssl-forward-proxy.html

   Source: Adapted from community discussion — alanouaro

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

8. Question 88 · 610 in bank

   Which PAN-OSֲ® policy must you configure to force a user to provide additional credentials before he is allowed to access an internal application that contains highly-sensitive business data?

   • ASecurity policy
   • BDecryption policy
   • CAuthentication policy
   • DApplication Override policy

   Show answer

   Answer: C

   Next question

9. Question 89 · 610 in bank

   An administrator receives the following error message: "IKE phase-2 negotiation failed when processing Proxy ID. Received local id 192. 168.33.33/24 type IPv4 address protocol 0 port 0, received remote id 172.16.33.33/24 type IPv4 address protocol 0 port 0." How should the administrator identify the root cause of this error message?

   • AVerify that the IP addresses can be pinged and that routing issues are not causing the connection failure.
   • BCheck whether the VPN peer on one end is set up correctly using policy-based VPN.
   • CIn the IKE Gateway configuration, verify that the IP address for each VPN peer is accurate.
   • DIn the IPSec Crypto profile configuration, verify that PFS is either enabled on both VPN peers or disabled on both VPN peers.

   Show answer

   Answer: B

   Explanation

   Option B The VPN peer on one end is using policy-based VPN. You must configure a Proxy ID on the Palo Alto Networks firewall. https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/vpns/set-up-site-to-site-vpn/interpret-vpn-error-messages.html

   Source: Adapted from community discussion — alanouaro

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

10. Question 90 · 610 in bank

    The following objects and policies are defined in a device group hierarchy.

    

    Dallas-Branch has Dallas-FW as a member of the Dallas-Branch device-group NYC-DC has NYC-FW as a member of the NYC-DC device-group What objects and policies will the Dallas-FW receive if "Share Unused Address and Service Objects" is enabled in Panorama?

    • AAddress Objects -Shared Address1 -Branch Address1 Policies -Shared Policy1 -Branch Policy1
    • BAddress Objects -Shared Address1 -Shared Address2 -Branch Address1 Policies -Shared Policy1 -Shared Policy2 -Branch Policy1
    • CAddress Objects -Shared Address1 -Shared Address2 -Branch Address1 -DC Address1 Policies -Shared Policy1 -Shared Policy2 -Branch Policy1
    • DAddress Objects -Shared Address1 -Shared Address2 -Branch Address1 Policies -Shared Policy1 -Branch Policy1

    Show answer

    Answer: D

    Explanation

    Panorama will not push anything from Data-Centers group. That rules out C. Panorama will push all objects from "Shared", which rules out A. Note that the target of "Shared Policy 2" is NYC-FW, so this policy won't get pushed to Dallas-FW. This rules out B. Thus, answer is D.

    Source: Adapted from community discussion — homersimpson

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNSE practice, question 81. 610 questions available.