Free PCNSE Sample Questions and 100% Cover Real Exam Questions (Updated 363 Questions)
Download Real Palo Alto Networks PCNSE Exam Dumps Test Engine Exam Questions
NEW QUESTION 51
What are two characteristic types that can be defined for a variable? (Choose two )
- A. IP netmask
- B. path group
- C. FQDN
- D. zone
Answer: A,C
Explanation:
Explanation
https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-web-interface-help/panorama-web-interface/panorama-tem
NEW QUESTION 52
If the firewall has the link monitoring configuration, what will cause a failover?
- A. ethernet1/3 or Ethernet1/6 going down
- B. ethernet1/3 going down
- C. ethernet1/6 going down
- D. ethernet1/3 and ethernet1/6 going down
Answer: D
NEW QUESTION 53
An administrator has been asked to configure a Palo Alto Networks NGFW to provide protection against external hosts attempting to exploit a flaw in an operating system on an internal system.
Which Security Profile type will prevent this attack?
- A. URL Filtering
- B. Antivirus
- C. Vulnerability Protection
- D. Anti-Spyware
Answer: C
Explanation:
Explanation/Reference:
Reference: https://www.paloaltonetworks.com/documentation/80/pan-os/web-interface-help/objects/ objects-security-profiles-vulnerability-protection
NEW QUESTION 54
Which Captive Portal mode must be configured to support MFA authentication?
- A. Single Sign-On
- B. Redirect
- C. NTLM
- D. Transparent
Answer: B
Explanation:
Explanation/Reference: https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/authentication/configure- multi-factor-authentication
NEW QUESTION 55
In High Availability, which information is transferred via the HA data link?
- A. HA state information
- B. heartbeats
- C. session information
- D. User-ID information
Answer: C
Explanation:
Explanation/Reference:
Reference: https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/high-availability/ha-links- and-backup-links
NEW QUESTION 56
Which URL Filtering Security Profile action logs the URL Filtering category to the URL Filtering log?
- A. Log
- B. Allow
- C. Alert
- D. Default
Answer: C
Explanation:
https://www.paloaltonetworks.com/documentation/70/pan-os/pan-os/url-filtering/url-filtering- profile-actions
NEW QUESTION 57
Decrypted packets from the website https://www.microsoft.com will appear as which application and service within the Traffic log?
- A. web-browsing and 80
- B. web-browsing and 443
- C. SSL and 443
- D. SSL and 80
Answer: B
Explanation:
Explanation
We know that SSL decryption is supposed to give us visibility of traffic that would otherwise be encrypted.
Therefore, we'd expect decrypted traffic to be identified as the underlying applications, such as web-browsing, facebook-base or other, but not as SSL.
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CmdLCAS
NEW QUESTION 58
SSL Forward Proxy decryption is configured but the firewall uses Untrusted-CA to sign the website https
//www important-website com certificate End-users are receiving me "security certificate is not trusted is warning Without SSL decryption the web browser shows that the website certificate is trusted and signed by a well-known certificate chain Well-Known-lntermediate and Well-Known-Root- CA.
The network security administrator who represents the customer requires the following two behaviors when SSL Forward Proxy is enabled:
1 End-users must not get the warning for the https://www.very-important-website.com website.
2 End-users should get the warning for any other untrusted website
Which approach meets the two customer requirements?
- A. Navigate to Device > Certificate Management > Certificates > Device Certificates import Well-Known-lntermediate-CA and Well-Known-Root-CA select the Trusted Root CA checkbox and commit the configuration
- B. Install the Well-Known-lntermediate-CA and Well-Known-Root-CA certificates on all end-user systems m the user and local computer stores
- C. Navigate to Device > Certificate Management - Certificates s Default Trusted Certificate Authorities import Well-Known-intermediate-CA and Well-Known-Root-CA select the Trusted Root CA check box and commit the configuration
- D. Clear the Forward Untrust Certificate check box on the Untrusted-CA certificate and commit the configuration
Answer: C
NEW QUESTION 59
When using the predefined default profile, the policy will inspect for viruses on the decoders. Match each decoder with its default action.
Answer options may be used more than once or not at all.
IMAP , POP3 , SMTP - > Alert
HTTP,FTP,SMB -> Reset-both
Answer:
Explanation:
NEW QUESTION 60
An administrator wants to enable zone protection
Before doing so, what must the administrator consider?
- A. Activate a zone protection subscription.
- B. The zone protection profile will apply to all interfaces within that zone
- C. To increase bandwidth no more than one firewall interface should be connected to a zone
- D. Security policy rules do not prevent lateral movement of traffic between zones
Answer: C
NEW QUESTION 61
Refer to the exhibit.
An administrator is using DNAT to map two servers to a single public IP address. Traffic will be steered to the specific server based on the application, where Host A (10.1.1.100) receives HTTP traffic and HOST B (10.1.1.101) receives SSH traffic.) Which two security policy rules will accomplish this configuration? (Choose two.)
- A. Untrust (Any) to DMZ (10.1.1.100), ssh -Allow
- B. Untrust (Any) to Untrust (10.1.1.100), web-browsing -Allow
- C. Untrust (Any) to Untrust (10.1.1.101), ssh -Allow
- D. Untrust (Any) to DMZ (10.1.1.100), web-browsing -Allow
- E. Untrust (Any) to DMZ (10.1.1.100.10.1.1.101), ssh, web-browsing -Allow
Answer: A,D
NEW QUESTION 62
Refer to exhibit.
An organization has Palo Alto Networks NGFWs that send logs to remote monitoring and security management platforms. The network team has reported excessive traffic on the corporate WAN.
How could the Palo Alto Networks NGFW administrator reduce WAN traffic while maintaining support for all existing monitoring/ security platforms?
- A. Forward logs from external sources to Panorama for correlation, and from Panorama send them to the NGFW.
- B. Configure log compression and optimization features on all remote firewalls.
- C. Any configuration on an M-500 would address the insufficient bandwidth concerns.
- D. Forward logs from firewalls only to Panorama and have Panorama forward logs to other external services.
Answer: D
Explanation:
https://docs.paloaltonetworks.com/panorama/8-1/panorama-admin/panorama-overview/centralized-logging-and-reporting
NEW QUESTION 63
Which three settings are defined within the Templates object of Panorama? (Choose three.)
- A. Interfaces
- B. Security
- C. Application Override
- D. Virtual Routers
- E. Setup
Answer: A,D,E
NEW QUESTION 64
Which hardware firewall platforms include both built-in front-to-back airflow and redundant power supplies?
- A. The PA-7000 series firewall platforms
- B. The PA-3060 firewall platform
- C. All PA-5000 and PA-7000 series firewall platforms
- D. All Palo Alto Networks hardware firewall platforms
Answer: B
NEW QUESTION 65
Which CLI command is used to simulate traffic going through the firewall and determine which Security
policy rule, NAT translation, static route, or PBF rule will be triggered by the traffic?
- A. check
- B. test
- C. sim
- D. find
Answer: B
Explanation:
Explanation/Reference:
Reference: http://www.shanekillen.com/2014/02/palo-alto-useful-cli-commands.html
NEW QUESTION 66
Which CLI command enables an administrator to check the CPU utilization of the dataplane?
- A. show system resources
- B. show running resource-monitor
- C. debug running resources
- D. debug data-plane dp-cpu
Answer: B
Explanation:
Explanation
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClXwCAK
NEW QUESTION 67
......
How to Prepare for Palo Alto Networks Certified Network Security Engineer PCNSE Exam
Preparation Guide for Palo Alto Networks Certified Network Security Engineer PCNSE Exam
Introduction
Palo Alto Networks Certified Network Security Engineer PCNSE Exam is related to Palo Alto Networks Certification. This exam validates the Candidate ability to design, deploy, configure and maintain the vast majority of power Alto Networks base network security implementations. System Configuration Engineer, Pre-sales System Engineers, System Integrators usually hold or pursue this certification and you can expect the same job role after completion of this certification.
The Palo Alto Networks Certified Network Security Engineer (PCNSE) is a formal, third-party proctored certification that indicates that those who have achieved it possess the in-depth knowledge to design, install, configure, maintain, and troubleshoot most implementations based on the Palo Alto Networks platform.
This exam will certify that the successful candidate has the knowledge and skills necessary to implement the Palo Alto Networks Next-Generation Firewall PAN-OS 10.0 platform in any environment.
The PCNSE exam should be taken by anyone who wants to demonstrate a deep understanding of Palo Alto Networks technologies, including customers who use Palo Alto Networks products, value-added resellers, pre-sales system engineers, system integrators, and support staff.
Candidate should have three to five yearsâ experience working in the Networking or Security industries and the equivalent of 6 to 12 monthsâ experience deploying and configuring Palo Alto Networks NGFW within the Palo Alto Networks product portfolio.
- You understand networking and Security policies used by PAN-OS software.
- You can plan, deploy, configure, operate, and troubleshoot Palo Alto Networks Product portfolio components.
- You have product expertise and understand the unique aspects of the Palo Alto Networks product portfolio and how to deploy one appropriately.
You will need to gather the public IP addresses, private network prefixes, and serial numbers of your branch and hub firewalls. The firewall must have an internet-routable, public IP address to initiate and terminate IPsec tunnels and route application traffic to and from the internet.
As part of the planning process you will decide on the naming conventions for your sites and SD-WAN devices. If you already have zones in place before configuring SD-WAN, you should decide how to map those zones to the predefined zones that SD-WAN uses for path selection. You will map an existing zone to a predefined zone named zone-internal, To_Hub, To_Branch, or zone-internet.
New PCNSE exam dumps Use Updated Palo Alto Networks Exam: https://www.prep4sureexam.com/PCNSE-dumps-torrent.html
Verified PCNSE Dumps Q&As - PCNSE Test Engine with Correct Answers: https://drive.google.com/open?id=11GgLin0V0VzI5EUXXeaLUibeGQGUWJdx