Certification Provider:Â Palo Alto Networks
Exam: Palo Alto Networks Certified Network Security Engineer (PCNSE)
Exam Code: PCNSE v10
Total Question: 181
Question per Quiz: 75
Updated On: 20 April 2023
Note: In order to practice all the Q/A's, you have to practice multiple time. Question's and Answer's will be presented randomly and will help you get hands-on for real exam.
1.
The decision to upgrade to PAN-OS 10.2 has been approved. The engineer begins the process by upgrading the Panorama servers, but gets an error when trying to install. When performing an upgrade on Panorama to PAN-OS 10.2, what is the potential cause of a failed install?
2.
Which function is handled by the management plane (control plane) of a Palo Alto Networks firewall?
3.
An administrator is considering upgrading the Palo Alto Networks NGFW and central management Panorama version What is considered best practice for this scenario?
4.
Which three statements accurately describe Decryption Mirror? (Choose three.)
5.
SD-WAN is designed to support which two network topology types? (Choose two.)
6.
A network administrator wants to use a certificate for the SSL/TLS Service Profile. Which type of certificate should the administrator use?
7.
A network security engineer needs to enable Zone Protection in an environment that makes use of Cisco TrustSec Layer 2 protections. What should the engineer configure within a Zone Protection profile to ensure that the TrustSec packets are identified and actions are taken upon them?
8.
What are two characteristic types that can be defined for a variable? (Choose two.)
9.
An engineer must configure the Decryption Broker feature Which Decryption Broker security chain supports bi-directional traffic flow?
10.
An Administrator is configuring Authentication Enforcement and they would like to create an exemption rule to exempt a specific group from authentication. Which authentication enforcement object should they select?
11.
What are three reasons for excluding a site from SSL decryption? (Choose three.)
12.
Which User-ID mapping method should be used in a high-security environment where all IP address-to-user mappings should always be explicitly known?
13.
An administrator plans to deploy 15 firewalls to act as GlobalProtect gateways around the world Panorama will manage the firewalls. The firewalls will provide access to mobile users and act as edge locations to on-premises infrastructure. The administrator wants to scale the configuration out quickly and wants all of the firewalls to use the same template configuration. Which two solutions can the administrator use to scale this configuration? (Choose two.)
14.
What are two common reasons to use a "No Decrypt" action to exclude traffic from SSL decryption? (Choose two.)
15.
When you import the configuration of an HA pair into Panorama, how do you prevent the import from affecting ongoing traffic?
16.
The SSL Forward Proxy decryption policy is configured. The following four certificate authority (CA) certificates are installed on the firewall. An end-user visits the untrusted website https://www.firewall-do-not-trust-website.com. Which certificate authority (CA) certificate will be used to sign the untrusted webserver certificate?
17.
Which three items are important considerations during SD-WAN configuration planning? (Choose three.)
18.
An engineer must configure a new SSL decryption deployment Which profile or certificate is required before any traffic that matches an SSL decryption rule is decrypted?
19.
What is a correct statement regarding administrative authentication using external services with a local authorization method?
20.
What are three types of Decryption Policy rules? (Choose three.)
21.
Which three items are import considerations during SD-WAN configuration planning? (Choose three.)
22.
Which statement accurately describes service routes and virtual systems?
23.
An engineer is bootstrapping a VM-Series Firewall other than the /config folder, which three directories are mandatory as part of the bootstrap package directory structure? (Choose three.)
24.
The following objects and policies are defined in a device group hierarchy. Dallas-Branch has Dallas-FW as a member of the Dallas-Branch device-group NYC-DC has NYC-FW as a member of the NYC-DC device-group What objects and policies will the Dallas-FW receive if "Share Unused Address and Service Objects" is enabled in Panorama?
25.
Which value in the Application column indicates UDP traffic that did not match an App-ID signature?
26.
A network administrator is troubleshooting an issue with Phase 2 of an IPSec VPN tunnel. The administrator determines that the lifetime needs to be changed to match the peer. Where should this change be made?
27.
An administrator has configured a pair of firewalls using high availability in Active/Passive mode. Link and Path Monitoring is enabled with the Failure Condition set to "any". There is one link group configured containing member interfaces ethernet1/1 and ethernet1/2 with a Group Failure Condition set to "all". Which HA state will the Active firewall go into if ethernet1/1 link goes down due to a failure?
28.
An engineer has been given approval to upgrade their environment 10 PAN-OS 10.2. The environment consists of both physical and virtual firewalls a virtual Panorama HA pair, and virtual log collectors. What is the recommended order when upgrading to PAN-OS 10.2?
29.
Cortex XDR notifies an administrator about grayware on the endpoints. There are no entries about grayware in any of the logs of the corresponding firewall. Which setting can the administrator configure on the firewall to log grayware verdicts?
30.
Panorama provides which two SD-WAN functions? (Choose two.)
31.
Match each GlobalProtect component to the purpose of that component
32.
An administrator wants to upgrade a firewall HA pair to PAN-OS 10.1. The firewalls are currently running PAN-OS 8.1.17. Which upgrade path maintains synchronization of the HA session (and prevents network outage)?
33.
During the packet flow process, which two processes are performed in application identification? (Choose two.)
34.
When an in-band data port is set up to provide access to required services, what is required for an interface that is assigned to service routes?
35.
An administrator notices that an interface configuration has been overridden locally on a firewall. They require an configuration to be managed from Panorama and overrides are not allowed. What is one way the administrator can meet this requirement?
36.
During a laptop-replacement project, remote users must be able to establish a GlobalProtect VPN connection to the corporate network before logging in to their new Windows 10 endpoints. The new laptops have the 5.2.10 GlobalProtect Agent installed, so the administrator chooses to use the Connect Before Logon feature to solve this issue. What must be configured to enable the Connect Before Logon feature?
37.
Four configuration choices are listed, and each could be used to block access to a specific URL. If you configured each choice to block the same URL, then which choice would be evaluated last in the processing order to block access to the URL?
38.
Starting with PAN-OS version 9.1, application dependency information is now reported in which two locations? (Choose two.)
39.
What are three reasons why an installed session can be identified with the application incomplete" tag? (Choose three.)
40.
What file type upload is supported as part of the basic WildFire service?
41.
Which two features require another license on the NGFW? (Choose two.)
42.
Which log type would provide information about traffic blocked by a Zone Protection profile?
43.
A network engineer has discovered that asymmetric routing is causing a Palo Alto Networks firewall to drop traffic. The network architecture cannot be changed to correct this. Which two actions can be taken on the firewall to allow the dropped traffic permanently? (Choose two.)
44.
Below are the steps in the workflow for creating a Best Practice Assessment in a firewall and Panorama configuration. Place the steps in order. Select and Place:
45.
An engineer is planning an SSL decryption implementation. Which of the following statements is a best practice for SSL decryption?
46.
Your company has to Active Directory domain controllers spread across multiple WAN links All users authenticate to Active Directory Each link has substantial network bandwidth to support all mission-critical applications. The firewalls management plane is highly utilized Given this scenario which type of User-ID agent is considered a best practice by Palo Alto Networks?
47.
To ensure that a Security policy has the highest priority, how should an administrator configure a Security policy in the device group hierarchy?
48.
In a security-first network what is the recommended threshold value for content updates to be dynamically updated?
49.
As a best practice, which URL category should you target first for SSL decryption?
50.
Which statement about High Availability timer settings is true?
51.
Which value in the Application column indicates UDP traffic that did not match an App-ID signature?
52.
Which option is part of the content inspection process?
53.
A firewall should be advertising the static route 10.2.0.0/24 into OSPF. The configuration on the neighbour is correct, but the route is not in the neighbour's routing table. Which two configurations should you check on the firewall? (Choose two.)
54.
A network security engineer has applied a File Blocking profile to a rule with the action of Block. The user of a Linux CLI operating system has opened a ticket. The ticket states that the user is being blocked by the firewall when trying to download a TAR file. The user is getting no error response on the system. Where is the best place to validate if the firewall is blocking the user's TAR file?
55.
The administrator for a small company has recently enabled decryption on their Palo Alto Networks firewall using a self-signed root certificate. They have also created a Forward Trust and Forward Untrust certificate and set them as such. The admin has not yet installed the root certificate onto client systems. What effect would this have on decryption functionality?
56.
How should an administrator enable the Advance Routing Engine on a Palo Alto Networks firewall?
57.
Given the following snippet of a WildFire submission log. did the end-user get access to the requested information and why or why not?
58.
What are two common reasons to use a "No Decrypt" action to exclude traffic from SSL decryption? (Choose two.)
59.
An existing NGFW customer requires direct interne! access offload locally at each site and iPSec connectivity to all branches over public internet. One requirement is mat no new SD-WAN hardware be introduced to the environment. What is the best solution for the customer?
60.
What happens when an A P firewall cluster synchronies IPsec tunnel security associations (SAs)?
61.
What is the dependency for users to access services that require authentication?
62.
The Aggregate Ethernet interface is showing down on a passive PA-7050 firewall of an active/passive HA pair. The HA Passive Link State is set to "Auto" under Device > High Availability > General > Active/Passive Settings. The AE interface is configured with LACP enabled and is up only on the active firewall. Why is the AE interface showing down on the passive firewall?
63.
An engineer is creating a template and wants to use variables to standardize the configuration across a large number of devices. Which two variable types can be defined? (Choose two.)
64.
When you navigate to Network: > GlobalProtect > Portals > Method section, which three options are available? (Choose three)
65.
When setting up a security profile, which three items can you use? (Choose three.)
66.
A network security engineer is attempting to peer a virtual router on a PAN-OS firewall with an external router using the BGP protocol. The peer relationship is not establishing. What command could the engineer run to see the current state of the BGP state between the two devices?
67.
Which GlobalProtect component must be configured to enable Clientless VPN?
68.
Place the steps in the WildFire process workflow in their correct order.
69.
An organization is building a Bootstrap Package to deploy Palo Alto Networks VM-Series firewalls into their Microsoft Azure. Which two statements are correct regarding the bootstrap package contents? (Choose two)
70.
An administrator has a PA-820 firewall with an active Threat Prevention subscription. The administrator is considering adding a WildFire subscription How does adding the WildFire subscription improve the security posture of the organization?
71.
What are two common reasons to use a "No Decrypt" action to exclude traffic from SSL decryption? (Choose two.)
72.
WildFire will submit for analysis blocked files that match which profile settings?
73.
An administrator needs to implement an NGFW between their DMZ and Core network EIGRP Routing between the two environments is required Which interface type would support this business requirement?
74.
Which configuration task is best for reducing load on the management plane?
75.
An administrator is attempting to create policies tor deployment of a device group and template stack When creating the policies, the zone drop down list does not include the required zone. What must the administrator do to correct this issue?
