PCSFE practice questions 71–80

1. Question 71 · 101 in bank

   With the Panorama plugin for VM-Series installed. Panorama can collect a predefined set of attributes from which services in Amazon Web Services (AWS) as tags and populate it in the VM-Series firewall?

   • ALoad balancers
   • BVPCs
   • CTransit gateways
   • DEC2 instances

   Show answer

   Answer: D

   References

   • docs.paloaltonetworks.com documentation

   Next question

2. Question 72 · 101 in bank

   Select 2

   Which two community-supported Palo Alto Networks templates will protect cloud workloads by using a CN-Series firewall on GKE? (Choose two.)

   • AMarketplace
   • BAnsible
   • CHelm
   • DTerraform

   Show answer

   Answer: CD

   Next question

3. Question 73 · 101 in bank

   Select 2

   Which two licensing options provide the application visibility and control feature in a VM-Series deployment? (Choose two.)

   • APalo Alto Networks Cloud Storage
   • BPAYG
   • CBYOL
   • DAWS Marketplace

   Show answer

   Answer: BC

   Explanation

   Correct: Palo Alto Networks currently supports two license types: Bring Your Own License (BYOL) and PAYG (Pay-As-You-Go, also called PayGo).

   Source: Adapted from community discussion — Redrum702

   Next question

4. Question 74 · 101 in bank

   A manager wants to enhance the performance of a Palo Alto Networks VM-Series firewall. How can the use of CLI increase the number of cores in the dataplane?

   • AUse init-cfg.txt with parameter "plugin-op-commands=dp-cores:<#-cores>.
   • BUse cfg.txt with parameter "plugin-op-commands=dp-cores:<#-cores>.
   • CRequest vm_series dp-cores <#-cores>.
   • DRequest plugins vm_series dp-cores <#-cores>.

   Show answer

   Answer: D

   Explanation

   If the VM-Series firewall is in initial deployment the answer would be A If it is a deployed firewall the answer is D. And for the question context I think that the correct answer in D. https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-new-features/virtualization-features/customize-dataplane-cores

   Source: Adapted from community discussion — javim

   References

   • docs.paloaltonetworks.com documentation

   Next question

5. Question 75 · 101 in bank

   What is created by the Panorama plugin as part of the infrastructure setup in Amazon Web Services (AWS) cloud?

   • ARoute tables and Security VPC with GWLB Endpoints only
   • BAWS Transit Gateway, route tables, and NAT Gateway subnets
   • CNAT Gateway subnets, Security VPC with GWLB Endpoints, and route tables
   • DSecurity VPC with GWLB endpoints, NAT Gateway subnets, and AWS Transit Gateway

   Show answer

   Answer: C

   Explanation

   Answer is C: As part of the infrastructure setup on the AWS cloud, the plugin creates Security VPC with GWLB Endpoints, firewalls, and NAT Gateway subnets and route tables. The plugin does not create AWS Transit Gateway (TGW). https://docs.paloaltonetworks.com/vm-series/10-1/vm-series-deployment/set-up-the-vm-series-firewall-on-aws/panorama-orchestrated-deployment-in-aws

   Source: Adapted from community discussion — Redrum702

   References

   • docs.paloaltonetworks.com documentation

   Next question

6. Question 76 · 101 in bank

   What is the valid command to setup the cluster for CN-series firewall HSF Deployment and to prepare the extend permissions for service account?

   • Akubectl -n kube-system get secrets kubectl -n kube-system get secrets (secrets-from-above-command) -o json >> cred.json kubectl apply -f plugin-deploy-serviceaccount.yaml kubectl apply -f pan-mgmt-serviceaccount.yaml
   • Bkubectl apply -f plugin-deploy-serviceaccount.yaml kubectl apply -f pan-mgmt-serviceaccount.yaml kubectl -n kube-system get secrets kubectl -n kube-system get secrets (secrets-from-above-command) -o json >> cred.json
   • Ckubectl apply -f plugin-deploy-serviceaccount.yaml kubectl -n kube-system get secrets kubectl apply -f pan-mgmt-serviceaccount.yaml kubectl -n kube-system get secrets (secrets-from-above-command) -o json >> cred.json
   • Dkubectl -n kube-system get secrets kubectl -n kube-system get secrets (secrets-from-above-command) -o json >> cred.json kubectl apply -f pan-mgmt-serviceaccount.yaml kubectl apply -f plugin-deploy-serviceaccount.yaml

   Show answer

   Answer: B

   References

   • docs.paloaltonetworks.com documentation

   Next question

7. Question 77 · 101 in bank

   To list NGFW pods connected to a management plane, which Panorama CLI command should be used?

   • Arequests plugins kubernetes get-node-license-info
   • Brequests plugins kubernetes get-license-tokens
   • Crequests plugins vm-series list-dp-pods
   • Drequests tech-support dump

   Show answer

   Answer: A

   Explanation

   "A" is the closets to the real answer. There is no documentation on this, so I installed the kubernetes plugin on my lab Panorama. The real command is "request plugins kubernetes get-license-info". The description for this command is "Get the number of tokens and pods running in all clusters". If you're curious, install the plugin yourself and browse to the API operational commands for the plugin: https://{youPanoramaIP}/php/rest/browse.php/op::request::plugins::kubernetes

   Source: Adapted from community discussion — Doobiedoo

   References

   • docs.paloaltonetworks.com documentation

   Next question

8. Question 78 · 101 in bank

   Which plugin is used to create and push device group-based policies to the Cloud NGFW?

   • APanorama AWS
   • BZero Touch Provisioning (ZTP)
   • CPanorama Interconnect «•
   • DCloud Services

   Show answer

   Answer: A

   Explanation

   "A" is correct. Read the "New Features" for the CloudConnector plugin for version 2.0.0. It explicitly states "[CloudConnector 2.0.0] Enables you to use the Panorama AWS plugin 5.0.0 to author and push device group based policies to Cloud NGFW for AWS resources." https://docs.paloaltonetworks.com/compatibility-matrix/panorama/plugins#idb0212b0e-3222-4cd0-b386-de4ff45987f4

   Source: Adapted from community discussion — Doobiedoo

   References

   • docs.paloaltonetworks.com documentation

   Next question

9. Question 79 · 101 in bank

   Select 2

   Using what two commands can an engineer confirm that the installation of the CN-series firewall as a K8S service on the production GKE cluster was successful after it was protected by the cloud workloads on GKE and YAML was downloaded to completed the setup? (Choose two.)

   • Akubectl get pods -f app=pan-cn-mgmt -n kube-system
   • Bkubectl get pods -l app=pan-mgmt -n kube-system
   • Ckubectl get pods -n kube-system -l app=pan-ngfw -o wide
   • Dkubectl get pods app=pan-cn-ngfw -o wide

   Show answer

   Answer: BC

   References

   • docs.paloaltonetworks.com documentation

   Next question

10. Question 80 · 101 in bank

    When deploying a firewall in Amazon Web Services (AWS) utilizing the orchestration through Panorama, which plugin is required?

    • Avm_series-2.0.1 or later
    • Bcloud_services-3.2.0 or later
    • Caws-3.0.1 or later
    • Daws-5.0.1 or later

    Show answer

    Answer: C

    Explanation

    "C" is correct answer. In the plugin compatibility matrix, AWS plugin version 3.0.0 explicitly says it "Introduces Panorama Orchestration and new monitoring parameters.". https://docs.paloaltonetworks.com/compatibility-matrix/panorama/plugins#idb0212b0e-3222-4cd0-b386-de4ff45987f4

    Source: Adapted from community discussion — Doobiedoo

    References

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCSFE practice, question 71. 101 questions available.