PCSFE practice questions 41–50

1. Question 41 · 101 in bank

   What is a benefit of network runtime security?

   • AIt more narrowly focuses on one security area and requires careful customization, integration, and maintenance.
   • BIt removes vulnerabilities that have been baked into containers.
   • CIt is siloed to enhance workload security.
   • DIt identifies unknown vulnerabilities that cannot be identified by known Common Vulnerability and Exposure (CVE) lists.

   Show answer

   Answer: D

   Next question

2. Question 42 · 101 in bank

   What is a design consideration for a prospect who wants to deploy VM-Series firewalls in an Amazon Web Services (AWS) environment?

   • ASpecial AWS plugins are needed for load balancing.
   • BResources are shared within the cluster.
   • COnly active-passive high availability (HA) is supported.
   • DHigh availability (HA) clusters are limited to fewer than 8 virtual appliances.

   Show answer

   Answer: C

   Explanation

   C is the only answer that make sense, but Act/Pasv in this mode will function poorly (60 sec or more to switch). https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClD9CAK

   Source: Adapted from community discussion — djedeen

   References

   • docs.paloaltonetworks.com documentation

   Next question

3. Question 43 · 101 in bank

   Select 3

   Which three NSX features can be pushed from Panorama in PAN-OS? (Choose three.)

   • ASecurity group assignment of virtual machines (VMs)
   • BSecurity groups
   • CSteering rules
   • DUser IP mappings
   • EMultiple authorization codes

   Show answer

   Answer: ABC

   References

   • docs.paloaltonetworks.com documentation

   Next question

4. Question 44 · 101 in bank

   When implementing active-active high availability (HA), which feature must be configured to allow the HA pair to share a single IP address that may be used as the network's gateway IP address?

   • AARP load sharing
   • BFloating IP address
   • CHSRP
   • DVRRP

   Show answer

   Answer: A

   Explanation

   A) In a Layer 3 interface deployment and active/active HA configuration, ARP load-sharing allows the firewalls to share an IP address and provide gateway services. Use ARP load-sharing only when no Layer 3 device exists between the firewall and end hosts, that is, when end hosts use the firewall as their default gateway.

   Source: Adapted from community discussion — djedeen

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

5. Question 45 · 101 in bank

   Select 2

   Which two design options address split brain when configuring high availability (HA)? (Choose two.)

   • AAdding a backup HA1 interface
   • BUsing the heartbeat backup
   • CBundling multiple interfaces in an aggregated interface group and assigning HA2
   • DSending heartbeats across the HA2 interfaces

   Show answer

   Answer: AB

   Next question

6. Question 46 · 101 in bank

   Where do CN-Series devices obtain a VM-Series authorization key?

   • APanorama
   • BLocal installation
   • CGitHub
   • DCustomer Support Portal

   Show answer

   Answer: A

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

7. Question 47 · 101 in bank

   Which software firewall would help a prospect interested in securing an environment with Kubernetes?

   • AKN-Series
   • BML-Series
   • CVM-Series
   • DCN-Series

   Show answer

   Answer: D

   Explanation

   Answer D: Both VM-Series and CN-Series firewalls can be used to protect container environments. The major difference between the two is the granularity of visibility and control delivered by the CN-Series. VM-Series firewalls can enforce cluster-level security policies, which makes them good for basic perimeter security of an entire cluster.

   Source: Adapted from community discussion — Redrum702

   Next question

8. Question 48 · 101 in bank

   Select 2

   Which two valid components are used in installation of a VM-Series firewall in an OpenStack environment? (Choose two.)

   • AOpenStack heat template in JSON format
   • BOpenStack heat template in YAML Ain't Markup Language (YAML) format
   • CVM-Series VHD image
   • DVM-Series qcow2 image

   Show answer

   Answer: BD

   References

   • docs.paloaltonetworks.com documentation

   Next question

9. Question 49 · 101 in bank

   Which software firewall would assist a prospect who is interested in securing extensive DevOps deployments?

   • ACN-Series
   • BIon-Series
   • CCloud next-generation firewall (NGFW)
   • DVM-Series

   Show answer

   Answer: A

   Explanation

   Answers is A CN-Series is the container-native version of the ML-powered NGFW designed specifically for Kubernetes environments. The Palo Alto Networks CN-Series containerized firewall is the best-in-class next generation firewall purpose built to secure the Kubernetes environment from network based attacks. The CN-Series firewall enables network security teams to gain layer-7 visibility into Kubernetes environments, provide inline threat protection for containerized applications deployed anywhere, and dynamically scale security without compromising DevOps agility.

   Source: Adapted from community discussion — SyedHussain

   References

   • docs.paloaltonetworks.com documentation

   Next question

10. Question 50 · 101 in bank

    How does Prisma Cloud Compute offer workload security at runtime?

    • AIt automatically builds an allow-list security model for every container and service.
    • BIt quarantines containers that demonstrate increased CPU and memory usage.
    • CIt automatically patches vulnerabilities and compliance issues for every container and service.
    • DIt works with the identity provider (IdP) to identify overprivileged containers and services, and it restricts network access.

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCSFE practice, question 41. 101 questions available.