PCSFE practice questions 21–30

1. Question 21 · 101 in bank

   Select 3

   What are three valid deployment options for Panorama in Amazon Web Services (AWS)? (Choose three.)

   • APanorama in AWS for management and log collection
   • BPanorama in AWS and Panorama on-premises for a high availability (HA) array
   • CPanorama in AWS CN-Series form factor for management and log collection
   • DPanorama in AWS with Cortex Data Lake
   • EOn-premises Panorama with log collectors in AWS

   Show answer

   Answer: ADE

   Explanation

   ADE are correct. https://docs.paloaltonetworks.com/panorama/11-1/panorama-admin/panorama-high-availability/panorama-ha-prerequisites Model and hypervisor must be the same, so HA with "AWS and on-prem" makes no sense. There is no CN-Series for Panorama. It can be deployed as: * Both a management server and log collector in AWS * Mgmt server on-prem with log collectors in AWS * Mgmt server in AWS and using Cortex Data Lake for logging

   Source: Adapted from community discussion — Doobiedoo

   References

   • docs.paloaltonetworks.com documentation

   Next question

2. Question 22 · 101 in bank

   Select 2

   In order to calculate the total number of Software NGFW Credits for an upcoming virtualization project in ESXi, which two pieces of information are needed? (Choose two.)

   • ANumber of VM-Series firewalls
   • BMemory consumption for each VM-Series firewall
   • CNumber of interfaces on each VM-Series firewall
   • DNumber of vCPU on each VM-Series firewall

   Show answer

   Answer: AD

   Next question

3. Question 23 · 101 in bank

   Select 2

   Considering the following information, what are two paths an engineer can follow to implement route tagging with 32-bit decimal notation on existing software firewalls? (Choose two.) • A network engineer has already deployed a few instances of it. • The consultant team has recommended using the advanced routing engine to support this functionality.

   • ASelect Device > Sessions, click "Advanced Routing" and click "Reboot Device"
   • Binit-cfg.txt op-command-modes=advance-routing:enable
   • Cset deviceconfig setting advanced-routing yes
   • DSelect Device > Setup > Sessions, click "ARE" and click "Reboot Device"

   Show answer

   Answer: BC

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

4. Question 24 · 101 in bank

   After how many days does a daily warning message start appearing within the system before a Palo Alto Networks VM-Series license expires?

   • A7
   • B14
   • C30
   • D60

   Show answer

   Answer: C

   Explanation

   "C" is the correct answer. When a license is within 30 days of expiration, a warning message displays in the system log daily until you renew the subscription or it expires. https://docs.paloaltonetworks.com/vm-series/11-1/vm-series-deployment/license-the-vm-series-firewall/what-happens-when-licenses-expire

   Source: Adapted from community discussion — Doobiedoo

   References

   • docs.paloaltonetworks.com documentation

   Next question

5. Question 25 · 101 in bank

   Select 3

   Which three traffic flows can protect against zero-day attacks? (Choose three.)

   • AOutbound
   • BNorth-south
   • CInbound
   • DInternal
   • EEast-west

   Show answer

   Answer: ACD

   Next question

6. Question 26 · 101 in bank

   Which component scans for threats in allowed traffic?

   • AIntelligent Traffic Offload
   • BTLS decryption
   • CSecurity profiles
   • DNAT

   Show answer

   Answer: C

   Next question

7. Question 27 · 101 in bank

   Select 2

   Which two deployment modes of VM-Series firewalls are supported across NSX-T? (Choose two.)

   • APrism Central
   • BBootstrap
   • CService Cluster
   • DHost-based

   Show answer

   Answer: CD

   References

   • docs.paloaltonetworks.com documentation

   Next question

8. Question 28 · 101 in bank

   A customer in a VMware ESXi environment wants to add a VM-Series firewall and partition an existing group of virtual machines (VMs) in the same subnet into two groups. One group requires no additional security, but the second group requires substantially more security. How can this partition be accomplished without editing the IP addresses or the default gateways of any of the guest VMs?

   • AEdit the IP address of all of the affected VMs.
   • BCreate a new virtual switch and use the VM-Series firewall to separate virtual switches using virtual wire mode. Then move the guests that require more security into the new virtual switch.
   • CCreate a Layer 3 interface in the same subnet as the VMs and then configure proxy Address Resolution Protocol (ARP).
   • DSend the VLAN out of the virtual environment into a hardware Palo Alto Networks firewall in Layer 3 mode. Use the same IP address as the old default gateway, then delete it.

   Show answer

   Answer: B

   Next question

9. Question 29 · 101 in bank

   How must a Palo Alto Networks Next-Generation Firewall (NGFW) be configured in order to secure traffic in a Cisco ACI environment?

   • AIt must be deployed as a member of a device cluster.
   • BIt must use a Layer 3 underlay network.
   • CIt must receive all forwarding lookups from the network controller.
   • DIt must be identified as a default gateway.

   Show answer

   Answer: B

   References

   • docs.paloaltonetworks.com documentation

   Next question

10. Question 30 · 101 in bank

    Which component allows the flexibility to add network resources but does not require making changes to existing policies and rules?

    • AContent-ID
    • BExternal dynamic list (EDL)
    • CApp-ID
    • DDynamic address group

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCSFE practice, question 21. 101 questions available.