PCNSE v10 Practice Test – Cyber Security, Networking, Technology Courses and Blog

Certification Provider: Palo Alto Networks

Exam: Palo Alto Networks Certified Network Security Engineer (PCNSE)

Exam Code: PCNSE v10

Total Question: 181

Question per Quiz: 75

Updated On: 20 April 2023

Note: In order to practice all the Q/A's, you have to practice multiple time. Question's and Answer's will be presented randomly and will help you get hands-on for real exam.

What file type upload is supported as part of the basic WildFire service?

BAT

VBS

ELF

None

Which statement accurately describes service routes and virtual systems?

Virtual systems can only use one interface for all global service and service routes of the firewall.

Virtual systems that do not have specific service routes configured inherit the global service and service route settings for the firewall.

Virtual systems cannot have dedicated service routes configured; and virtual systems always use the global service and service route settings for the firewall.

The interface must be used for traffic to the required external services.

None

What is a correct statement regarding administrative authentication using external services with a local authorization method?

The administrative accounts you define locally on the firewall serve as references to the accounts defined on an external authentication server.

Prior to PAN-OS 10.2, an administrator used the firewall to manage role assignments, but access domains have not been supported by this method.

The administrative accounts you define on an external authentication server serve as references to the accounts defined locally on the firewall.

Starting with PAN-OS 10.2, an administrator needs to configure Cloud Identity Engine to use external authentication services for administrative authentication.

None

An administrator needs to troubleshoot a User-ID deployment. The administrator believes that there is an issue related to LDAP authentication. The administrator wants to create a packet capture on the management plane. Which CLI command should the administrator use to obtain the packet capture for validating the configuration?

> scp export poap-mgmt from poap.mgmt to (username@host:path)

> scp export pcap from pcap to (username@host:path)

> ftp export mgmt-pcap from mgmt.pcap to

> scp export mgmt-pcap from mgmt.pcap to (username@host:path)

None

Which option is part of the content inspection process?

IPsec tunnel encryption

SSL Proxy re-encrypt

Packet forwarding process

Packet egress process

None

Which CLI command is used to determine how much disk space is allocated to logs?

debug log-receiver show

show logging-status

show system info

show system logdb-quota

None

What happens when an A P firewall cluster synchronies IPsec tunnel security associations (SAs)?

Phase 1 and Phase 2 SAs are synchronized over HA2 links

Phase 1 and Phase 2 SAs are synchronized over HA3 links

Phase 2 SAs are synchronized over HA2 finks

Phase 1 SAs are synchronized over HA1 links

None

An engineer has been tasked with reviewing traffic logs to find applications the firewall is unable to identify with App-ID. Why would the application field display as incomplete?

There is insufficient application data after the TCP connection was established.

The TCP connection did not fully establish.

The TCP connection was terminated without identifying any application data.

The client sent a TCP segment with the PUSH flag set.

None

Which option describes the operation of the automatic commit recovery feature?

It enables a firewall to revert to the previous configuration if a commit causes HA partner connectivity failure.

It enables a firewall to revert to the previous configuration if a commit causes Panorama connectivity failure.

It enables a firewall to revert to the previous configuration if rule shadowing is detected.

It enables a firewall to revert to the previous configuration if application dependency errors are found.

None

10.

Which value in the Application column indicates UDP traffic that did not match an App-ID signature?

incomplete

unknown-ip

not-applicable

unknown-udp

None

11.

An administrator has a PA-820 firewall with an active Threat Prevention subscription. The administrator is considering adding a WildFire subscription. How does adding the WildFire subscription improve the security posture of the organization?

WildFire and Threat Prevention combine to minimize the attack surface.

Protection against unknown malware can be provided in near real-time.

WildFire and Threat Prevention combine to provide the utmost security posture for the firewall.

After 24 hours, WildFire signatures are included in the antivirus update.

None

12.

Panorama provides which two SD-WAN functions? (Choose two.)

control plane

physical network links

data plane

network monitoring

13.

An administrator receives the following error message: "IKE phase-2 negotiation failed when processing Proxy ID. Received local id 192. 168.33.33/24 type IPv4 address protocol 0 port 0, received remote id 172.16.33.33/24 type IPv4 address protocol 0 port 0." How should the administrator identify the root cause of this error message?

In the IPSec Crypto profile configuration, verify that PFS is either enabled on both VPN peers or disabled on both VPN peers.

In the IKE Gateway configuration, verify that the IP address for each VPN peer is accurate.

Verify that the IP addresses can be pinged and that routing issues are not causing the connection failure.

Check whether the VPN peer on one end is set up correctly using policy-based VPN.

None

14.

What are two best practices for incorporating new and modified App-IDs? (Choose two.)

Run the latest PAN-OS version in a supported release tree to have the best performance for the new App-IDs

Configure a security policy rule to allow new App-IDs that might have network-wide impact

Study the release notes and install new App-IDs if they are determined to have low impact

Perform a Best Practice Assessment to evaluate the impact of the new or modified App-IDs

15.

An engineer needs to configure SSL Forward Proxy to decrypt traffic on a PA-5260. The engineer uses a forward trust certificate from the enterprise PKI that expires December 31, 2025. The validity date on the PA-generated certificate is taken from what?

Trusted certificate.

Untrusted certificate.

Root CA

Server certificate.

None

16.

When you configure an active/active high availability pair which two links can you use? (Choose two)

HSCI-C

HA3

HA2 backup

Console Backup

17.

When you import the configuration of an HA pair into Panorama, how do you prevent the import from affecting ongoing traffic?

Set the passive link state to 'shutdown'

Disable the HA2 link

Disable HA

Disable config Sync

None

18.

Which function is handled by the management plane (control plane) of a Palo Alto Networks firewall?

IPSec tunnel standup

logging

signature matching for content inspection

Quality of Service

None

19.

What are two common reasons to use a "No Decrypt" action to exclude traffic from SSL decryption? (Choose two.)

the website matches a high-risk category

the website matches a category that is not allowed for most users

the web server requires mutual authentication

the website matches a sensitive category

20.

An administrator notices that an interface configuration has been overridden locally on a firewall. They require an configuration to be managed from Panorama and overrides are not allowed. What is one way the administrator can meet this requirement?

Reload the running configuration and perform a Firewall local commit.

Perform a template commit push from Panorama using the "Force Template Values'' option

Perform a device-group commit push from Panorama using the "Include Device and Network Templates" option.

Perform a commit force from the CLI of the firewall.

None

21.

An administrator plans to deploy 15 firewalls to act as GlobalProtect gateways around the world Panorama will manage the firewalls. The firewalls will provide access to mobile users and act as edge locations to on-premises infrastructure. The administrator wants to scale the configuration out quickly and wants all of the firewalls to use the same template configuration. Which two solutions can the administrator use to scale this configuration? (Choose two.)

variables

template stacks

virtual systems

collector groups

22.

In a security-first network what is the recommended threshold value for content updates to be dynamically updated?

36 hours

24 hours

6 to 12 hours

1 to 4 hours

None

23.

A network security engineer is attempting to peer a virtual router on a PAN-OS firewall with an external router using the BGP protocol. The peer relationship is not establishing. What command could the engineer run to see the current state of the BGP state between the two devices?

show routing protocol bgp summary

show routing protocol bgp rib-out

show routing protocol bgp state

show routing protocol bgp peer

None

24.

What is the dependency for users to access services that require authentication?

A Security policy allowing users to access those services.

Disabling the authentication timeout.

An Authentication profile that includes those services.

An authentication sequence that includes those services.

None

25.

Which two statements correctly identify the number of Decryption Broker security chains that are supported on a pair of decryption-forwarding interfaces'? (Choose two)

A single transparent bridge security chain is supported per firewall

L3 security chains support up to 32 security chains

A single transparent bridge security chain is supported per pair of interfaces

L3 security chains support up to 64 security chains

26.

Before you upgrade a Palo Alto Networks NGFW, what must you do?

Make sure that the PAN-OS support contract is valid for at least another year

Make sure that the firewall is running a supported version of the app + threat update

Make sure that the firewall is running a version of antivirus software and a version of WildFire that support the licensed subscriptions.

Export a device state of the firewall

None

27.

A network engineer has discovered that asymmetric routing is causing a Palo Alto Networks firewall to drop traffic. The network architecture cannot be changed to correct this. Which two actions can be taken on the firewall to allow the dropped traffic permanently? (Choose two.)

Navigate to Network > Zone Protection Click Add Select Packet Based Attack Protection > TCP/IP Drop Set "Reject Non-syn-TCP" to Global Set ג€Asymmetric Path" to Global

Navigate to Network > Zone Protection Click Add Select Packet Based Attack Protection > TCP/IP Drop Set "Reject Non-syn-TCP" to No Set "Asymmetric Path" to Bypass

#set deviceconfig setting session tcp-reject-non-syn no

> set session tcp-reject-non-syn no

28.

An existing NGFW customer requires direct interne! access offload locally at each site and iPSec connectivity to all branches over public internet. One requirement is mat no new SD-WAN hardware be introduced to the environment. What is the best solution for the customer?

Configure a remote network on PAN-OS

Deploy Prisma SD-WAN with Prisma Access

Upgrade to a PAN-OS SD-WAN subscription

Configure policy-based forwarding

None

29.

An administrator is building Security rules within a device group to block traffic to and from malicious locations. How should those rules be configured to ensure that they are evaluated with a high priority?

Create the appropriate rules with a Block action and apply them at the top of the Default Rules

Create the appropriate rules with a Block action and apply them at the top of the local firewall Security rules

Create the appropriate rules with a Block action and apply them at the top of the Security Pre-Rules

Create the appropriate rules with a Block action and apply them at the top of the Security Post-Rules

None

30.

When configuring forward error correction (FEC) for PAN-OS SD-WAN, an administrator would turn on the feature inside which type of SD-WAN profile?

Traffic Distribution profile

Certificate profile

Path Quality profile

SD-WAN interface profile

None

31.

An engineer must configure a new SSL decryption deployment. Which profile or certificate is required before any traffic that matches an SSL decryption rule is decrypted?

A Decryption profile must be attached to the Security policy that the traffic matches.

There must be a certificate with only the Forward Trust option selected.

There must be a certificate with both the Forward Trust option and Forward Untrust option selected.

A Decryption profile must be attached to the Decryption policy that the traffic matches.

None

32.

Match each type of DoS attack to an example of that type of attack

Protocol Based SYN flood Attack

Volumetric Based SYN Flood Attack

Application Based Slowris

Volumetric Based UDP Flood Attack

33.

A company with already deployed Palo Alto firewalls has purchased their first Panorama server. The security team has already configured all firewalls with the Panorama IP address and added all the firewall serial numbers in Panorama. What are the next steps to migrate configuration from the firewalls to Panorama?

Import Device Configuration to Panorama, followed by Export or Push Device Config Bundle.

Use API calls to retrieve the configuration directly from the managed devices.

Use the Firewall Migration plugin to retrieve the configuration directly from the managed devices.

Export Named Configuration Snapshot on each firewall, followed by Impart Named Configuration Snapshot in Panorama.

None

34.

An administrator is required to create an application-based Security policy rule to allow Evernote. The Evernote application implicitly uses SSL and web browsing. What is the minimum the administrator needs to configure in the Security rule to allow only Evernote?

Add the Evernote application to the Security policy rule, then add a second Security policy rule containing both HTTP and SSL.

Create an Application Override using TCP ports 443 and 80.

Add the HTPP, SSL, and Evernote applications to the same Security policy.

Add only the Evernote application to the Security policy rule.

None

35.

When an in-band data port is set up to provide access to required services, what is required for an interface that is assigned to service routes?

You must set the interface to Layer 2 Layer 3. or virtual wire

You must use a static IP address

The interface must be used for traffic to the required services

You must enable DoS and zone protection

None

36.

What are two common reasons to use a "No Decrypt" action to exclude traffic from SSL decryption? (Choose two.)

the website matches a category that is not allowed for most users

the website matches a sensitive category

the web server requires mutual authentication

the website matches a high-risk category

37.

In an HA failover scenario what occurs when sessions match an SSL Forward Proxy Decryption policy?

HA Sync occurs the firewall allows the session Put does not decrypt the session.

A Sync does not occur the existing session is transferred to the active firewall.

HA Sync does not occur the firewall drops the session.

HA Sync occurs the session is sent to testpath

None

38.

An administrator is considering upgrading the Palo Alto Networks NGFW and central management Panorama version What is considered best practice for this scenario?

Upgrade the firewall first, wait at least 24 hours, and then upgrade the Panorama version.

Perform the Panorama and firewall upgrades simultaneously.

Upgrade Panorama to a version at or above the target firewall version.

Export the device state, perform the update, and then import the device state.

None

39.

Which statement about High Availability timer settings is true?

Use the Critical timer for faster failover timer settings.

Use the Recommended timer for faster failover timer settings.

Use the Moderate timer for typical failover timer settings.

Use the Aggressive timer for faster failover timer settings.

None

40.

Which two features require another license on the NGFW? (Choose two.)

SSL Inbound Inspection

Decryption Broker

Decryption Mirror

SSL Forward Proxy

41.

A firewall administrator has been tasked with ensuring that all Panorama-managed firewalls forward traffic logs to Panorama. In which section is this configured?

Monitor > Logs > Traffic

Panorama > Managed Devices

Templates > Device > Log Settings

Device Groups > Objects > Log Forwarding

None

42.

An administrator needs firewall access on a trusted interface. Which two components are required to configure certificate based, secure authentication to the Web Ul? (Choose two )

server certificate

certificate authority (CA) certificate

certificate profile

client certificate

43.

As a best practice, which URL category should you target first for SSL decryption?

Financial Services

Online Storage and Backup

High Risk

Health and Medicine

None

44.

What are three reasons for excluding a site from SSL decryption? (Choose three.)

unsupported ciphers

unsupported browser version

mutual authentication

certificate pinning

the website is not present in English

45.

An organization is building a Bootstrap Package to deploy Palo Alto Networks VM-Series firewalls into their AWS tenant. Which two statements are correct regarding the bootstrap package contents? (Choose two.)

The /config, /content and /software folders are mandatory while the /license and /plugin folders are optional.

The bootstrap.xml file allows for automated deployment of VM-Series firewalls with full network and policy configurations.

The directory structure must include a /config, /content, /software and /license folders.

The bootstrap package is stored on an AFS share or a discrete container file bucket.

The init-cfg.txt and bootstrap.xml files are both optional configuration items for the /config folder.

None

46.

Starting with PAN-OS version 9.1, application dependency information is now reported in which two locations? (Choose two.)

on the Application tab in the Security Policy Rule creation window

on the App Dependency tab in the Commit Status window

on the Objects > Applications browser pages

on the Policy Optimizer's Rule Usage page

47.

During a laptop-replacement project, remote users must be able to establish a GlobalProtect VPN connection to the corporate network before logging in to their new Windows 10 endpoints. The new laptops have the 5.2.10 GlobalProtect Agent installed, so the administrator chooses to use the Connect Before Logon feature to solve this issue. What must be configured to enable the Connect Before Logon feature?

X-Auth Support in the GlobalProtect Gateway Tunnel Settings.

Registry keys on the Windows system.

The GlobalProtect Portal Agent App Settings Connect Method to Pre-logon then On-demand.

The Certificate profile in the GlobalProtect Portal Authentication Settings.

None

48.

What are three reasons why an installed session can be identified with the application incomplete" tag? (Choose three.)

There was no application data after the TCP connection was established

The TCP connection was terminated without identifying any application data

The TCP connection did not fully establish

The client sent a TCP segment with the PUSH flag set

There is not enough application data after the TCP connection was established

49.

Review the screenshot of the Certificates page. An administrator for a small LLC has created a series of certificates as shown, to use for a planned Decryption roll out. The administrator has also installed the self-signed root certificate in all client systems. When testing, they noticed that every time a user visited an SSL site, they received unsecured website warnings. What is the cause of the unsecured website warnings?

The forward trust certificate has not been installed in client systems.

The forward trust certificate has not been signed by the self-singed root CA certificate.

The self-signed CA certificate has the same CN as the forward trust and untrust certificates.

The forward untrust certificate has not been signed by the self-singed root CA certificate.

None

50.

An administrator wants to enable Palo Alto Networks cloud services for Device Telemetry and IoT. Which type of certificate must be installed?

Server certificate

Device certificate

External CA certificate

Self-signed root CA certificate

None

51.

What are the two behavior differences between Highlight Unused Rules and the Rule Usage Hit counter when a firewall is rebooted? (Choose two.)

Highlight Unused Rules will highlight all rules.

Rule Usage Hit counter will not be reset

Rule Usage Hit counter will reset.

Highlight Unused Rules will highlight zero rules.

52.

Which feature checks Panorama connectivity status after a commit?

Device monitoring data under Panorama settings.

Automated commit recovery.

Scheduled config export.

HTTP Server profiles.

None

53.

Updates to dynamic user group membership are automatic therefore using dynamic user groups instead of static group objects allows you to:

respond to changes in user behaviour or potential threats using manual policy changes

respond to changes in user behaviour or potential threats without automatic policy changes

respond to changes in user behaviour or potential threats without manual policy changes

respond to changes in user behaviour and confirmed threats with manual policy changes

None

54.

When you navigate to Network: > GlobalProtect > Portals > Method section, which three options are available? (Choose three)

post-logon (always on)

user-logon (always on)

pre-logon then on-demand

certificate-logon

on-demand (manual user initiated connection)

55.

An administrator wants to upgrade a firewall HA pair to PAN-OS 10.1. The firewalls are currently running PAN-OS 8.1.17. Which upgrade path maintains synchronization of the HA session (and prevents network outage)?

Upgrade two major versions at a time.

Upgrade the HA pair to a base image.

Upgrade directly to the target major version.

Upgrade one major version at a time.

None

56.

A company requires that a specific set of ciphers be used when remotely managing their Palo Alto Networks appliances. Which profile should be configured in order to achieve this?

SSL/TLS Service profile

Decryption profile

Certificate profile

SSH Service profile

None

57.

An engineer must configure a new SSL decryption deployment Which profile or certificate is required before any traffic that matches an SSL decryption rule is decrypted?

A Decryption profile must be attached to the Decryption policy that the traffic matches

There must be a certificate with both the Forward Trust option and Forward Untrust option selected

A Decryption profile must be attached to the Security policy that the traffic matches

There must be a certificate with only the Forward Trust option selected

None

58.

An internal system is not functioning. The firewall administrator has determined that the incorrect egress interface is being used After looking at the configuration, the administrator believes that the firewall is not using a static route What are two reasons why the firewall might not use a static route"? (Choose two.)

path monitoring on the static route

disabling of the static route

duplicate static route

no install on the route

59.

An engineer wants to configure aggregate interfaces to increase bandwidth and redundancy between the firewall and switch. Which statement is correct about the configuration of the interfaces assigned to an aggregate interface group?

They can have a different bandwidth.

They can have different hardware media such as the ability to mix fiber optic and copper.

They can have a different interface type such as Layer 3 or Layer 2.

They can have a different interface type from an aggregate interface group.

None

60.

An organization wishes to roll out decryption but gets some resistance from engineering leadership regarding the guest network. What is a common obstacle for decrypting traffic from guest devices?

The organization has no legal authority to decrypt their traffic

Guest devices may not trust the CA certificate used for the forward untrust certificate

Guest devices may not trust the CA certificate used for the forward trust certificate

Guests may use operating systems that can't be decrypted

None

61.

What are two valid deployment options for Decryption Broker? (Choose two)

Transparent Bridge Security Chain

Layer 3 Security Chain

Layer 2 Security Chain

Transparent Mirror Security Chain

62.

The SSL Forward Proxy decryption policy is configured. The following four certificate authority (CA) certificates are installed on the firewall. An end-user visits the untrusted website https://www.firewall-do-not-trust-website.com. Which certificate authority (CA) certificate will be used to sign the untrusted webserver certificate?

Forward-Trust-Certificate

Firewall-CA

Firewall-Trusted-Root-CA

Forward-Untrust-Certificate

None

63.

To protect your firewall and network from single source denial of service (DoS) attacks that can overwhelm its packet buffer and cause legitimate traffic to drop, you can configure:

BGP (Border Gateway Protocol)

PGP (Packet Gateway Protocol)

PBP (Packet Buffer Protection)

PBP (Protocol Based Protection)

None

64.

An engineer is bootstrapping a VM-Series Firewall other than the /config folder, which three directories are mandatory as part of the bootstrap package directory structure? (Choose three.)

/plugins

/opt

/license

/software

/content

65.

The UDP-4501 protocol-port is used between which two GlobalProtect components?

GlobalProtect app and GlobalProtect satellite

GlobalProtect app and GlobalProtect portal

GlobalProtect app and GlobalProtect gateway

GlobalProtect portal and GlobalProtect gateway

None

66.

Cortex XDR notifies an administrator about grayware on the endpoints. There are no entries about grayware in any of the logs of the corresponding firewall. Which setting can the administrator configure on the firewall to log grayware verdicts?

in Threat General Settings, select "Report Grayware Files"

in WildFire General Settings, select "Report Grayware Files"

within the log forwarding profile attached to the Security policy rule

within the log settings option in the Device tab

None

67.

How should an administrator enable the Advance Routing Engine on a Palo Alto Networks firewall?

Enable Advanced Routing in Network > Virtual Routers > Redistribution Profiles and then commit.

Enable Advanced Routing in Network > Virtual Routers > Router Settings > General, then commit and reboot.

Enable Advanced Routing in General Settings of Device > Setup > Management, then commit and reboot.

Enable Advanced Routing Engine in Device > Setup > Session > Session Settings, then commit and reboot.

None

68.

An engineer is creating a template and wants to use variables to standardize the configuration across a large number of devices. Which two variable types can be defined? (Choose two.)

Zone

IP netmask

FQDN

Path group

69.

What are two characteristic types that can be defined for a variable? (Choose two)

FQDN

IP netmask

zone

path group

70.

Upgrade one major version at a time

Upgrade directly to the target major version

Upgrade one major version at a time

Upgrade two major versions at a time

None

71.

When overriding a template configuration locally on a firewall, what should you consider?

The firewall template will show that it is out of sync within Panorama

Panorama will update the template with the overridden value

Panorama will lose visibility into the overridden configuration

Only Panorama can revert the override

None

72.

Which three statements accurately describe Decryption Mirror? (Choose three.)

Only management consent is required to use the Decryption Mirror feature

Decryption, storage, inspection and use of SSL traffic are regulated in certain countries

Decryption Mirror requires a tap interface on the firewall

You should consult with your corporate counsel before activating and using Decryption Mirror in a production environment

Use of Decryption Mirror might enable malicious users with administrative access to the firewall to harvest sensitive information that is submitted via an encrypted channel

73.

An administrator plans to deploy 15 firewalls to act as GlobalProtect gateways around the world. Panorama will manage the firewalls. The firewalls will provide access to mobile users and act as edge locations to on-premises infrastructure. The administrator wants to scale the configuration out quickly and wants all of the firewalls to use the same template configuration. Which two solutions can the administrator use to scale this configuration? (Choose two.)

variables

virtual systems

collector groups

template stacks

74.

An engineer is pushing configuration from Panorama to a managed firewall. What happens when the pushed Panorama configuration has Address Object names that duplicate the Address Objects already configured on the firewall?

The firewall rejects the pushed configuration, and the commit fails.

The firewall renames the duplicate local objects with "-1" at the end signifying they are clones; it will update the references to the objects accordingly and fully commit the pushed configuration.

The firewall ignores only the pushed objects that have the same name as the locally configured objects, and it will commit the rest of the pushed configuration.

The firewall fully commits all of the pushed configuration and overwrites its locally configured objects.

None

75.

A network security engineer needs to enable Zone Protection in an environment that makes use of Cisco TrustSec Layer 2 protections. What should the engineer configure within a Zone Protection profile to ensure that the TrustSec packets are identified and actions are taken upon them?

Ethernet SGT Protection

Stream ID in the IP Option Drop options

TCP Fast Open in the Strip TCP options

Record Route in IP Option Drop options

None