PCNSE v10 Practice Test – Cyber Security, Networking, Technology Courses and Blog

Certification Provider: Palo Alto Networks

Exam: Palo Alto Networks Certified Network Security Engineer (PCNSE)

Exam Code: PCNSE v10

Total Question: 181

Question per Quiz: 75

Updated On: 20 April 2023

Note: In order to practice all the Q/A's, you have to practice multiple time. Question's and Answer's will be presented randomly and will help you get hands-on for real exam.

What are three reasons for excluding a site from SSL decryption? (Choose three.)

unsupported ciphers

certificate pinning

the website is not present in English

mutual authentication

unsupported browser version

During the process of developing a decryption strategy and evaluating which websites are required for corporate users to access, several sites have been identified that cannot be decrypted due to technical reasons. In this case, the technical reason is unsupported ciphers. Traffic to these sites will therefore be blocked if decrypted How should the engineer proceed?

Allow the firewall to block the sites to improve the security posture

Create a Security policy to allow access to those sites

Add the sites to the SSL Decryption Exclusion list to exempt them from decryption

Install the unsupported cipher into the firewall to allow the sites to be decrypted

None

An administrator plans to deploy 15 firewalls to act as GlobalProtect gateways around the world Panorama will manage the firewalls. The firewalls will provide access to mobile users and act as edge locations to on-premises infrastructure. The administrator wants to scale the configuration out quickly and wants all of the firewalls to use the same template configuration. Which two solutions can the administrator use to scale this configuration? (Choose two.)

variables

collector groups

template stacks

virtual systems

An engineer is planning an SSL decryption implementation. Which of the following statements is a best practice for SSL decryption?

Obtain an enterprise CA-signed certificate for the Forward Trust certificate.

Use an enterprise CA-signed certificate for the Forward Untrust certificate.

Use the same Forward Trust certificate on all firewalls in the network.

Obtain a certificate from a publicly trusted root CA for the Forward Trust certificate.

None

An administrator receives the following error message. How should the administrator identify the root cause of this error message?

"IKE phase-2 negotiation failed when processing Proxy ID. Received local id 192. 168.33.33/24 type IPv4 address protocol 0 port 0, received remote id

172.16.33.33/24 type IPv4 address protocol 0 port 0."

In the IPSec Crypto profile configuration, verify that PFS is either enabled on both VPN peers or disabled on both VPN peers.

Verify that the IP addresses can be pinged and that routing issues are not causing the connection failure.

In the IKE Gateway configuration, verify that the IP address for each VPN peer is accurate.

Check whether the VPN peer on one end is set up correctly using policy-based VPN.

None

Which feature checks Panorama connectivity status after a commit?

HTTP Server profiles.

Automated commit recovery.

Scheduled config export.

Device monitoring data under Panorama settings.

None

Which three items are important considerations during SD-WAN configuration planning? (Choose three.)

link requirement

IP Address

branch and hub locations

the name of the ISP

An administrator is considering upgrading the Palo Alto Networks NGFW and central management Panorama version What is considered best practice for this scenario?

Export the device state, perform the update, and then import the device state.

Upgrade the firewall first, wait at least 24 hours, and then upgrade the Panorama version.

Perform the Panorama and firewall upgrades simultaneously.

Upgrade Panorama to a version at or above the target firewall version.

None

Which two features require another license on the NGFW? (Choose two.)

SSL Inbound Inspection

Decryption Broker

SSL Forward Proxy

Decryption Mirror

10.

An existing NGFW customer requires direct interne! access offload locally at each site and iPSec connectivity to all branches over public internet. One requirement is mat no new SD-WAN hardware be introduced to the environment. What is the best solution for the customer?

Configure policy-based forwarding

Deploy Prisma SD-WAN with Prisma Access

Upgrade to a PAN-OS SD-WAN subscription

Configure a remote network on PAN-OS

None

11.

What is the dependency for users to access services that require authentication?

An Authentication profile that includes those services.

A Security policy allowing users to access those services.

Disabling the authentication timeout.

An authentication sequence that includes those services.

None

12.

When overriding a template configuration locally on a firewall, what should you consider?

Panorama will lose visibility into the overridden configuration.

Panorama will update the template with the overridden value.

Only Panorama can revert the override.

The firewall template will show that it is out of sync within Panorama.

None

13.

Place the steps to onboard a ZTP firewall into Panorama/CSP/ZTP-Service in the correct order.

None

14.

Which two are valid ACC GlobalProtect Activity tab widgets? (Choose two.)

Successful GlobalProtect Connection Activity

Successful GlobalProtect Deployed Activity

GlobalProtect Quarantine Activity

GlobalProtect Deployment Activity

15.

Given the following snippet of a WildFire submission log. did the end-user get access to the requested information and why or why not?

No because WildFire categorized a file with the verdict "malicious"

Yes. because the action is set to "allow ''

Yes because the action is set to "alert"

No because WildFire classified the seventy as "high."

None

16.

When an in-band data port is set up to provide access to required services, what is required for an interface that is assigned to service routes?

You must use a static IP address

You must enable DoS and zone protection

You must set the interface to Layer 2 Layer 3. or virtual wire

The interface must be used for traffic to the required services

None

17.

An organization has recently migrated its infrastructure and configuration to NGFWs, for which Panorama manages the devices. The organization is coming from a L2-L4 firewall vendor, but wants to use App-ID while identifying policies that are no longer needed. Which Panorama tool can help this organization?

Policy Optimizer

Application Groups

Config Audit

Test Policy Match

None

18.

What are two characteristic types that can be defined for a variable? (Choose two)

IP netmask

zone

path group

FQDN

19.

A firewall has been assigned to a new template stack that contains both "Global" and "Local" templates in Panorama, and a successful commit and push has been performed. While validating the configuration on the local firewall, the engineer discovers that some settings are not being applied as intended. The setting values from the "Global" template are applied to the firewall instead of the "Local" template that has different values for the same settings. What should be done to ensure that the settings in the "Local" template are applied while maintaining settings from both templates?

Perform a commit and push with the "Force Template Values" option selected.

Move the "Local" template above the "Global" template in the template stack.

Override the values on the local firewall and apply the correct settings for each value.

Move the "Global" template above the "Local" template in the template stack.

None

20.

A network administrator is troubleshooting an issue with Phase 2 of an IPSec VPN tunnel. The administrator determines that the lifetime needs to be changed to match the peer. Where should this change be made?

IKE Gateway profile.

IPSec Tunnel settings.

IPSec Crypto profile.

IKE Crypto profile.

None

21.

An administrator needs to assign a specific DNS server to one firewall within a device group. Where would the administrator go to edit a template variable at the device level?

Manage variables under Panorama > templates

Managed Devices > Device Association

Variable CSV export under Panorama > templates

PDF Export under Panorama > templates

None

22.

Which option is part of the content inspection process?

SSL Proxy re-encrypt

IPsec tunnel encryption

Packet forwarding process

Packet egress process

None

23.

An engineer is designing a deployment of multi-vsys firewalls. What must be taken into consideration when designing the device group structure?

Multiple vsys and firewalls can be assigned to a device group, and a multi-vsys firewall can have each vsys in a different device group.

Multiple vsys and firewalls can be assigned to a device group, and a multi-vsys firewall must have all its vsys in a single device group.

Only one vsys or one firewall can be assigned to a device group, except for a multi-vsys firewall, which must have all its vsys in a single device group.

Only one vsys or one firewall can be assigned to a device group, and a multi-vsys firewall can have each vsys in a different device group.

None

24.

An engineer must configure the Decryption Broker feature Which Decryption Broker security chain supports bi-directional traffic flow?

Transparent Proxy security chain

Layer 2 security chain

Layer 3 security chain

Transparent Bridge security chain

None

25.

PBF can address which two scenarios? (Choose two.)

providing application connectivity the primary circuit fails

routing FTP to a backup ISP link to save bandwidth on the primary ISP link

enabling the firewall to bypass Layer 7 inspection

forwarding all traffic by using source port 78249 to a specific egress interface

26.

An administrator needs to troubleshoot a User-ID deployment. The administrator believes that there is an issue related to LDAP authentication. The administrator wants to create a packet capture on the management plane. Which CLI command should the administrator use to obtain the packet capture for validating the configuration?

> scp export poap-mgmt from poap.mgmt to (username@host:path)

> scp export mgmt-pcap from mgmt.pcap to (username@host:path)

> scp export pcap from pcap to (username@host:path)

> ftp export mgmt-pcap from mgmt.pcap to

None

27.

The following objects and policies are defined in a device group hierarchy. Dallas-Branch has Dallas-FW as a member of the Dallas-Branch device-group NYC-DC has NYC-FW as a member of the NYC-DC device-group What objects and policies will the Dallas-FW receive if "Share Unused Address and Service Objects" is enabled in Panorama?

Address Objects -Shared Address1 -Branch Address1 Policies -Shared Policy1 -Branch Policy1

Address Objects -Shared Address1 -Shared Address2 -Branch Address1 Policies -Shared Policy1 -Shared Policy2 -Branch Policy1

Address Objects -Shared Address1 -Shared Address2 -Branch Address1 -DC Address1 Policies -Shared Policy1 -Shared Policy2 -Branch Policy1

Address Objects -Shared Address1 -Shared Address2 -Branch Address1 Policies -Shared Policy1 -Branch Policy1

None

28.

Which option describes the operation of the automatic commit recovery feature?

It enables a firewall to revert to the previous configuration if a commit causes Panorama connectivity failure.

It enables a firewall to revert to the previous configuration if rule shadowing is detected.

It enables a firewall to revert to the previous configuration if a commit causes HA partner connectivity failure.

It enables a firewall to revert to the previous configuration if application dependency errors are found.

None

29.

Before an administrator of a VM-500 can enable DoS and zone protection, what actions need to be taken?

Measure and monitor the CPU consumption of the firewall data plane to ensure that each firewall is properly sized to support DoS and zone protection.

Replace the hardware firewall, because DoS and zone protection are not available with VM-Series systems.

Create a zone protection profile with flood protection configured to defend an entire egress zone against SYN, ICMP, ICMPv6, UDP, and other IP flood attacks.

Add a WildFire subscription to activate DoS and zone protection features.

None

30.

Which Security Policy Rule configuration option disables antivirus and anti-spyware scanning of server-to-client flows only?

Disable HIP Profile

Apply an Application Override

Add server IP Security Policy exception

Disable Server Response Inspection

None

31.

An administrator wants to upgrade a firewall HA pair to PAN-OS 10.1. The firewalls are currently running PAN-OS 8.1.17. Which upgrade path maintains synchronization of the HA session (and prevents network outage)?

Upgrade two major versions at a time

Upgrade directly to the target major version

Upgrade one major version at a time

None

32.

What is a correct statement regarding administrative authentication using external services with a local authorization method?

The administrative accounts you define on an external authentication server serve as references to the accounts defined locally on the firewall.

The administrative accounts you define locally on the firewall serve as references to the accounts defined on an external authentication server.

Prior to PAN-OS 10.2, an administrator used the firewall to manage role assignments, but access domains have not been supported by this method.

Starting with PAN-OS 10.2, an administrator needs to configure Cloud Identity Engine to use external authentication services for administrative authentication.

None

33.

An engineer needs to configure SSL Forward Proxy to decrypt traffic on a PA-5260. The engineer uses a forward trust certificate from the enterprise PKI that expires December 31, 2025. The validity date on the PA-generated certificate is taken from what?

Server certificate.

Trusted certificate.

Root CA

Untrusted certificate.

None

34.

Refer to the exhibit. An administrator cannot see any if the Traffic logs from the Palo Alto Networks NGFW on Panorama. The configuration problem seems to be on the firewall side. Where is the best place on the Palo Alto Networks NGFW to check whether the configuration is correct?

None

35.

In an HA failover scenario what occurs when sessions match an SSL Forward Proxy Decryption policy?

HA Sync occurs the session is sent to testpath

HA Sync does not occur the firewall drops the session.

A Sync does not occur the existing session is transferred to the active firewall.

HA Sync occurs the firewall allows the session Put does not decrypt the session.

None

36.

Which three statements accurately describe Decryption Mirror? (Choose three.)

Use of Decryption Mirror might enable malicious users with administrative access to the firewall to harvest sensitive information that is submitted via an encrypted channel

You should consult with your corporate counsel before activating and using Decryption Mirror in a production environment

Decryption, storage, inspection and use of SSL traffic are regulated in certain countries

Decryption Mirror requires a tap interface on the firewall

Only management consent is required to use the Decryption Mirror feature

37.

A network security engineer is attempting to peer a virtual router on a PAN-OS firewall with an external router using the BGP protocol. The peer relationship is not establishing. What command could the engineer run to see the current state of the BGP state between the two devices?

show routing protocol bgp summary

show routing protocol bgp peer

show routing protocol bgp rib-out

show routing protocol bgp state

None

38.

What does SSL decryption require to establish a firewall as a trusted third party and to establish trust between a client and server to secure an SSL/TLS connection?

link state

certificates

stateful firewall connection

profiles

None

39.

When configuring forward error correction (FEC) for PAN-OS SD-WAN, an administrator would turn on the feature inside which type of SD-WAN profile?

Certificate profile

Traffic Distribution profile

SD-WAN interface profile

Path Quality profile

None

40.

Which User-ID mapping method should be used in a high-security environment where all IP address-to-user mappings should always be explicitly known?

LDAP Server Profile configuration

PAN-OS integrated User-ID agent

GlobalProtect

Windows-based User-ID agent

None

41.

What are two best practices for incorporating new and modified App-IDs? (Choose two.)

Study the release notes and install new App-IDs if they are determined to have low impact

Configure a security policy rule to allow new App-IDs that might have network-wide impact

Perform a Best Practice Assessment to evaluate the impact of the new or modified App-IDs

Run the latest PAN-OS version in a supported release tree to have the best performance for the new App-IDs

42.

An administrator wants to enable WildFire inline machine learning. Which three file types does WildFire inline ML analyze? (Choose three.)

APK

Powershell scripts

MS Office

VBscripts

ELF

43.

Address Objects -Shared Address1 -Shared Address2 -Branch Address1 -DC Address1 Policies -Shared Policy1 -Shared Policy2 -Branch Policy1

Address Objects -Shared Address1 -Branch Address1 Policies -Shared Policy1 -Branch Policy1

Address Objects -Shared Address1 -Shared Address2 -Branch Address1 Policies -Shared Policy1 -Shared Policy2 -Branch Policy1

Address Objects -Shared Address1 -Shared Address2 -Branch Address1 Policies -Shared Policy1 -Branch Policy1

None

44.

A network security engineer has applied a File Blocking profile to a rule with the action of Block. The user of a Linux CLI operating system has opened a ticket. The ticket states that the user is being blocked by the firewall when trying to download a TAR file. The user is getting no error response on the system. Where is the best place to validate if the firewall is blocking the user's TAR file?

URL Filtering log

Data Filtering log

Threat log

WildFire Submissions log

None

45.

What are two common reasons to use a "No Decrypt" action to exclude traffic from SSL decryption? (Choose two.)

the website matches a high-risk category

the website matches a category that is not allowed for most users

the website matches a sensitive category

the web server requires mutual authentication

46.

Place the steps in the WildFire process workflow in their correct order. Select and Place:

First, Second, Third, Fourth

First, Second, Fourth, Third

First, Third, Fourth, Second

Second, Third, Fourth, First

None

47.

An administrator is attempting to create policies tor deployment of a device group and template stack When creating the policies, the zone drop down list does not include the required zone. What must the administrator do to correct this issue?

Add a firewall to both the device group and the template

Add the template as a reference template in the device group

Enable "Share Unused Address and Service Objects with Devices" in Panorama settings

Specify the target device as the master device in the device group

None

48.

Match each type of DoS attack to an example of that type of attack

Volumetric Based UDP Flood Attack

Volumetric Based SYN Flood Attack

Protocol Based SYN flood Attack

Application Based Slowris

49.

Which two features require another license on the NGFW? (Choose two.)

Decryption Mirror

Decryption Broker

SSL Forward Proxy

SSL Inbound Inspection

50.

When setting up a security profile, which three items can you use? (Choose three.)

URL filtering

Wildfire analysis

antivirus

anti-ransomware

decryption profile

51.

You have upgraded your Panorama with Log Collectors to 10.2. Before upgrading your firewalls using Panorama, what do you need do?

Refresh your licenses with Palo Alto Network Support - Panorama/Licenses/Retrieve License Keys from License Server.

Commit and Push the configurations to the firewalls.

Re-associate the firewalls in Panorama/Managed Devices/Summary.

None

52.

An administrator needs to implement an NGFW between their DMZ and Core network EIGRP Routing between the two environments is required Which interface type would support this business requirement?

Layer 3 interfaces but configuring EIGRP on the attached virtual router

Virtual Wire interfaces to permit EIGRP routing to remain between the Core and DMZ

Layer 3 or Aggregate Ethernet interfaces but configuring EIGRP on sub interfaces only

Tunnel interfaces to terminate EIGRP routing on an IPsec tunnel {with the GlobalProtect License to support LSVPN and EIGRP protocols)

None

53.

Which three statements accurately describe Decryption Mirror? (Choose three.)

Decryption, storage, inspection, and use of SSL traffic regulated in certain countries.

You should consult with your corporate counsel before activating and using Decryption Mirror in a production environment.

Use of Decryption Mirror might enable malicious users with administrative access to the firewall to harvest sensitive information that is submitted via an encrypted channel.

Decryption Mirror requires a tap interface on the firewall.

Only management consent is required to use the Decryption Mirror future.

54.

A network administrator wants to use a certificate for the SSL/TLS Service Profile. Which type of certificate should the administrator use?

certificate authority (CA) certificate

machine certificate

client certificate

server certificate

None

55.

What are two common reasons to use a "No Decrypt" action to exclude traffic from SSL decryption? (Choose two.)

the website matches a sensitive category

the web server requires mutual authentication

the website matches a high-risk category

the website matches a category that is not allowed for most users

56.

An administrator needs firewall access on a trusted interface. Which two components are required to configure certificate based, secure authentication to the Web Ul? (Choose two )

client certificate

certificate profile

certificate authority (CA) certificate

server certificate

57.

Which two statements correctly identify the number of Decryption Broker security chains that are supported on a pair of decryption-forwarding interfaces'? (Choose two)

A single transparent bridge security chain is supported per pair of interfaces

L3 security chains support up to 32 security chains

L3 security chains support up to 64 security chains

A single transparent bridge security chain is supported per firewall

58.

An organization wishes to roll out decryption but gets some resistance from engineering leadership regarding the guest network. What is a common obstacle for decrypting traffic from guest devices?

Guests may use operating systems that can't be decrypted

The organization has no legal authority to decrypt their traffic

Guest devices may not trust the CA certificate used for the forward trust certificate

Guest devices may not trust the CA certificate used for the forward untrust certificate

None

59.

Which two events trigger the operation of automatic commit recovery? (Choose two.)

when an aggregate Ethernet interface component fails

when a firewall performs a local commit

when a firewall HA pair fails over

when Panorama pushes a configuration

60.

An organization is building a Bootstrap Package to deploy Palo Alto Networks VM-Series firewalls into their Microsoft Azure. Which two statements are correct regarding the bootstrap package contents? (Choose two)

The init-cfg txt and bootstrap.xml files are both optional configuration items for the /config folder

The directory structure must include a /config /content, /software and /license folders

The bootstrap xml file allows for automated deployment of VM-Series firewalls with full network and policy configurations.

The /config /content and /software folders are mandatory while the /license and /plugin folders are optional

The bootstrap package is stored on an AFS share or a discrete container file bucket

61.

Match each GlobalProtect component to the purpose of that component

None

62.

The SSL Forward Proxy decryption policy is configured. The following four certificate authority (CA) certificates are installed on the firewall. An end-user visits the untrusted website https://www.firewall-do-not-trust-website.com. Which certificate authority (CA) certificate will be used to sign the untrusted webserver certificate?

Firewall-CA

Forward-Untrust-Certificate

Forward-Trust-Certificate

Firewall-Trusted-Root-CA

None

63.

What are two valid deployment options for Decryption Broker? (Choose two)

Transparent Bridge Security Chain

Layer 2 Security Chain

Transparent Mirror Security Chain

Layer 3 Security Chain

64.

An administrator wants to enable Palo Alto Networks cloud services for Device Telemetry and IoT. Which type of certificate must be installed?

External CA certificate

Device certificate

Self-signed root CA certificate

Server certificate

None

65.

Which two features can be used to tag a username so that it is included in a dynamic user group? (Choose two.)

User-ID Windows-based agent

log forwarding auto-tagging

XML API

GlobalProtect agent

66.

An administrator receives the following error message. How should the administrator identify the root cause of this error message?

"IKE phase-2 negotiation failed when processing Proxy ID. Received local id 192. 168.33.33/24 type IPv4 address protocol 0 port 0, received remote id

172.16.33.33/24 type IPv4 address protocol 0 port 0."

In the IPSec Crypto profile configuration, verify that PFS is either enabled on both VPN peers or disabled on both VPN peers.

Check whether the VPN peer on one end is set up correctly using policy-based VPN.

Verify that the IP addresses can be pinged and that routing issues are not causing the connection failure.

In the IKE Gateway configuration, verify that the IP address for each VPN peer is accurate.

None

67.

What are two characteristic types that can be defined for a variable? (Choose two.)

Zone

FDQN

IP Netmask

Path group

68.

An engineer is planning an SSL decryption implementation Which of the following statements is a best practice for SSL decryption?

Obtain an enterprise CA-signed certificate for the Forward Trust certificate

Use an enterprise CA-signed certificate for the Forward Untrust certificate

Use the same Forward Trust certificate on all firewalls in the network

Obtain a certificate from a publicly trusted root CA for the Forward Trust certificate

None

69.

Updates to dynamic user group membership are automatic therefore using dynamic user groups instead of static group objects allows you to:

respond to changes in user behaviour or potential threats using manual policy changes

respond to changes in user behaviour and confirmed threats with manual policy changes

respond to changes in user behaviour or potential threats without manual policy changes

respond to changes in user behaviour or potential threats without automatic policy changes

None

70.

Which rule type controls end user SSL traffic to external websites?

SSL Outbound Proxyless Inspection

SSL Inbound Inspection

SSL Forward Proxy

SSH Proxy

None

71.

Which User-ID mapping method should be used in a high-security environment where all IP address-to-user mappings should always be explicitly known?

GlobalProtect

Windows-based User-ID agent

LDAP Server Profile configuration

PAN-OS integrated User-ID agent

None

72.

What are three types of Decryption Policy rules? (Choose three.)

SSH Proxy

Decryption Mirror

Decryption Broker

SSL Forward Proxy

SSL Inbound Inspection

73.

Which two mechanisms help prevent a spilt brain scenario an Active/Passive High Availability (HA) pair? (Choose two)

Configure the management interface as HA3 Backup

Configure Ethernet 1/1 as HA2 Backup

Configure Ethernet 1/1 as HA1 Backup

Configure the management interface as HA1 Backup

Configure the management interface as HA2 Backup

74.

An administrator has a PA-820 firewall with an active Threat Prevention subscription. The administrator is considering adding a WildFire subscription How does adding the WildFire subscription improve the security posture of the organization?

WildFire and Threat Prevention combine to minimize the attack surface

WildFire and Threat Prevention combine to provide the utmost security posture for the firewall

Protection against unknown malware can be provided in near real-time

After 24 hours WildFire signatures are included in the antivirus update

None

75.

Which Device Group option is assigned by default in Panorama whenever a new device group is created to manage a Firewall?

Universal

Shared

Global

Master

None