PCSFE practice questions 1–10

1. Question 1 · 101 in bank

   How is traffic directed to a Palo Alto Networks firewall integrated with Cisco ACI?

   • ABy using contracts between endpoint groups that send traffic to the firewall using a shared policy
   • BThrough a virtual machine (VM) monitor domain
   • CThrough a policy-based redirect (PBR)
   • DBy creating an access policy

   Show answer

   Answer: A

   References

   • Cisco documentation

   Next question

2. Question 2 · 101 in bank

   Select 2

   What are the two appropriate routing settings required to deploy software firewall integration with Amazon Web Service (AWS) GWLB? (Choose two.)

   • ARoute table with ALB subnet association - Add route destined to 0.0.0.0/0 with target as NAT Gateway
   • BRoute table with ALB subnet association - Add route destined to 0.0.0.0/0 with target as IGW
   • CRoute table with IGW edge association - Add route destined to ALB with target as GWLBE
   • DRoute table with GWLBE subnet association - Add route destined to 0.0.0.0/0 with target as IGW

   Show answer

   Answer: CD

   References

   • docs.paloaltonetworks.com documentation

   Next question

3. Question 3 · 101 in bank

   Select 2

   A user must be assigned one of which two roles in order to create local rulestacks in the Cloud NGFW for AWS tenant? (Choose two.)

   • ALocalRuleStackAdmin
   • BFirewallRulestackAdmin
   • CGlobalRulestackAdmin
   • DGlobalFirewallAdmin

   Show answer

   Answer: AC

   References

   • docs.paloaltonetworks.com documentation

   Next question

4. Question 4 · 101 in bank

   Which deployment method should a GCP administrator use to deploy a VM-Series firewall to secure east-west traffic between Virtual Private Clouds (VPCs)?

   • AInternet gateway
   • BHybrid IPSec VPN
   • CSegmentation gateway
   • DGlobalProtect

   Show answer

   Answer: C

   Next question

5. Question 5 · 101 in bank

   Select 3

   What are three attributes monitored by the Panorama AWS plugin? (Choose three.)

   • APrivate DNS name
   • BSubnet ID
   • CIAM instance profile
   • DVPC ID
   • EPublic DNS name

   Show answer

   Answer: BCD

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

6. Question 6 · 101 in bank

   In the Cloud NGFW for AWS distributed outbound architecture model, what is the first hop the traffic takes from the source?

   • AInternet gateway
   • BCloud NGFW
   • CNGFW endpoint
   • DNAT gateway

   Show answer

   Answer: C

   References

   • docs.paloaltonetworks.com documentation

   Next question

7. Question 7 · 101 in bank

   Which port / interface must be assigned as the HA2 link when deploying VM-Series firewalls in High Availability (HA) on Amazon Web Services (AWS)?

   • AHA2
   • BMGT port
   • CHSCI port
   • DEthernet1/1

   Show answer

   Answer: D

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

8. Question 8 · 101 in bank

   A system engineer is working on the Proof of Concept (POC) for Cloud Next-Generation Firewall (NGFW) for Azure using an existing Panorama setup. However, connection with the Cloud NGFW instance. What could be the cause of this issue?

   • AThere has not been an upgrade to the PAN-OS 10.2.
   • BCloud NGFW plugin has not been installed.
   • CValid device certificate is missing.
   • DNecessary ports 8443 and 443 for communication between Cloud NGFW and Panorama are blocked.

   Show answer

   Answer: C

   References

   • docs.paloaltonetworks.com documentation
   • AWS documentation

   Next question

9. Question 9 · 101 in bank

   Select 2

   A system engineer managing a deployment of CN-Series with Panorama (software version 11.0) installs the Kubernetes Plugin. When the installation is complete, templates are present. What are the names of two of these templates and for what are they used? (Choose two.)

   • AK8S-Network-Setup used for daemonset
   • BK8S-Network-Setup-V2 used for Kubernetes as a service deployment
   • CK8S-Network-Setup-V3 used for Kubernetes as a service deployment
   • DK8S-Network-Setup-V3 used for CNF daemonset

   Show answer

   Answer: AB

   References

   • docs.paloaltonetworks.com documentation

   Next question

10. Question 10 · 101 in bank

    Select 2

    Which two statements apply to the management Cloud NGFW by AWS firewall manager? (Choose two.)

    • AAvailability Zone can be created.
    • BFirewall policy can be included only with specified accounts and OUs.
    • CFirewall policy must be applied to all accounts under the Amazon Web Services (AWS) organization.
    • DEndpoints will be created via the firewall manager.

    Show answer

    Answer: AD

    References

    • docs.paloaltonetworks.com documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCSFE practice, question 1. 101 questions available.