2023 Realistic PCNSE Dumps Questions To Gain Brilliant Result
Start your PCNSE Exam Questions Preparation with Updated 211 Questions
PCNSE Exam topics
Candidates must know the exam topics before they start of preparation. Because it will really help them in hitting the core. Our PCNSE exam dumps pdf will include the following topics:
- Deploying and Configure 23%
- Core Concepts 23%
- Operation 20%
- Configuration Troubleshooting 18%
- Planning 16%
Along with that, the following are some important aspects of the exam and covered in PCNSE exam dumps.
- Security Platform and Architecture
- GlobalProtect™
- Monitoring and Reporting
- Site-to-Site VPNs
- Active/Passive High Availability
- URL Filtering
- Initial Configuration
NEW QUESTION 10
What are the two behavior differences between Highlight Unused Rules and the Rule Usage Hit counter when a firewall is rebooted? (Choose two.)
- A. Rule Usage Hit counter will not be reset
- B. Highlight Unused Rules will highlight all rules.
- C. Highlight Unused Rules will highlight zero rules.
- D. Rule Usage Hit counter will reset.
Answer: A,B
Explanation:
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVICA0
"Notice how the rules looks after selecting "Highlight Unused Rules." You can now see exactly what rules have and have not been used since the last reboot."
NEW QUESTION 11
What are three reasons for excluding a site from SSL decryption? (Choose three.)
- A. mutual authentication
- B. unsupported ciphers
- C. unsupported browser version
- D. certificate pinning
- E. the website is not present in English
Answer: A,B,D
Explanation:
Explanation
Reasons that sites break decryption technically include pinned certificates, client authentication, incomplete certificate chains, and unsupported ciphers.
https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/decryption/decryption-exclusions/exclude-a-server
NEW QUESTION 12
Which CLI command enables an administrator to view details about the firewall including uptime, PAN-OS?version, and serial number?
- A. show system details
- B. show session info
- C. debug system details
- D. show system info
Answer: D
Explanation:
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClZuCAK
NEW QUESTION 13
If an administrator wants to decrypt SMTP traffic and possesses the server's certificate, which SSL decryption mode will allow the Palo Alto Networks NGFW to inspect traffic to the server?
- A. SSL Inbound Inspection
- B. TLS Bidirectional Inspection
- C. SSH Forward Proxy
- D. SMTP Inbound Decryption
Answer: A
Explanation:
Reference: https://www.paloaltonetworks.com/documentation/71/pan-os/pan- os/decryption/configure-ssl-inbound-inspection
NEW QUESTION 14
An administrator has created an SSL Decryption policy rule that decrypts SSL sessions on any port.
Which log entry can the administrator use to verify that sessions are being decrypted?
- A. In the details of the Traffic log entries
- B. In the details of the Threat log entries
- C. Decryption log
- D. Data Filtering log
Answer: A
Explanation:
Explanation/Reference:
Reference: https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Implement-and-Test-SSL- Decryption/ta-p/59719
NEW QUESTION 15
Given the following table.
Which configuration change on the firewall would cause it to use 10.66.24.88 as the next hop for the
192.168.93.0/30 network?
- A. Configuring the administrative Distance for RIP to be lower than that of OSPF Int.
- B. Configuring the administrative Distance for RIP to be higher than that of OSPF Ext.
- C. Configuring the metric for RIP to be higher than that of OSPF Int.
- D. Configuring the metric for RIP to be lower than that OSPF Ext.
Answer: A
NEW QUESTION 16
A network administrator wants to use a certificate for the SSL/TLS Service Profile Which type of certificate should the administrator use?
- A. certificate authority (CA) certificate
- B. machine certificate
- C. client certificate
- D. server certificate
Answer: A
NEW QUESTION 17
VPN traffic intended for an administrator's Palo Alto Networks NGFW is being maliciously intercepted and retransmitted by the interceptor. When creating a VPN tunnel, which protection profile can be enabled to prevent this malicious behavior?
- A. Replay
- B. Web Application
- C. DoS Protection
- D. Zone Protection
Answer: A
Explanation:
https://docs.paloaltonetworks.com/pan-os/8-0/pan-os-admin/vpns/set-up-site-to-site-vpn/set-up-an-ipsec-tunnel#
NEW QUESTION 18
An administrator is attempting to create policies tor deployment of a device group and template stack.
When creating the policies, the zone drop down list does not include the required zone.
What must the administrator do to correct this issue?
- A. Enable "Share Unused Address and Service Objects with Devices" in Panorama settings
- B. Specify the target device as the master device in the device group
- C. Add the template as a reference template in the device group
- D. Add a firewall to both the device group and the template
Answer: D
NEW QUESTION 19
Refer to the exhibit.
Which certificates can be used as a Forwarded Trust certificate?
- A. Domain-Root-Cert
- B. Forward_Trust
- C. Domain Sub-CA
- D. Certificate from Default Trust Certificate Authorities
Answer: C
Explanation:
Domain Sub-CA as it is a CA and has a key which is required for a Forward Trust Certificate.
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClEZCA0
NEW QUESTION 20
Refer to Exhibit:
A firewall has three PDF rules and a default route with a next hop of 172.29.19.1 that is configured in the default VR. A user named XX-bes a PC with a 192.168.101.10 IP address.
He makes an HTTPS connection to 172.16.10.29.
What is the next hop IP address for the HTTPS traffic from Wills PC.
- A. 172.20.10.1
- B. 172.20.20.1
- C. 172.20.30.1
- D. 172.20.40.1
Answer: B
NEW QUESTION 21
Where can an administrator see both the management plane and data plane CPU utilization in the WebUI?
- A. CPU Utilization widget
- B. System Utilization log
- C. Resources widget
- D. System log
Answer: C
Explanation:
System Resources (widget) Displays the Management CPU usage, Data Plane usage, and the Session Count (the number of sessions established through the firewall or Panorama). https://docs.paloaltonetworks.com/pan-os/8-0/pan-os-web-interface-help/dashboard/dashboard-widgets#
NEW QUESTION 22
The web server is configured to listen for HTTP traffic on port 8080. The clients access the web server using the IP address 1.1.1.100 on TCP Port 80. The destination NAT rule is configured to translate both IP address and report to 10.1.1.100 on TCP Port 8080.
Which NAT and security rules must be configured on the firewall? (Choose two)
- A. A security policy with a source of any from untrust-I3 zone to a destination of 1.1.100 in dmz-I3 zone using web-browsing application.
- B. A security policy with a source of any from untrust-I3 Zone to a destination of 10.1.1.100 in dmz-I3 zone using web-browsing application
- C. A NAT rule with a source of any from untrust-I3 zone to a destination of 1.1.1.100 in untrust-I3 zone using service-http service.
- D. A NAT rule with a source of any from untrust-I3 zone to a destination of 10.1.1.100 in dmz-zone using service-http service.
Answer: A,D
NEW QUESTION 23
View the GlobalProtect configuration screen capture.
What is the purpose of this configuration?
- A. It enables a client to perform a reverse DNS lookup on 192.168.10.1 to detect that it is an internal client.
- B. It configures the tunnel address of all internal clients to an IP address range starting at 192.168.10.1.
- C. It forces the firewall to perform a dynamic DNS update, which adds the internal gateway's hostname and IP address to the DNS server.
- D. It forces an internal client to connect to an internal gateway at IP address 192.168.10.1.
Answer: A
Explanation:
Explanation/Reference:
Reference: https://www.paloaltonetworks.com/documentation/80/globalprotect/globalprotect-admin-guide/ globalprotect-portals/define-the-globalprotect-client-authentication-configurations/define-the-globalprotect- agent-configurations
NEW QUESTION 24
If an administrator wants to decrypt SMTP traffic and possesses the server's certificate, which SSL decryption mode will allow the Palo Alto Networks NGFW to inspect traffic to the server?
- A. SSL Inbound Inspection
- B. TLS Bidirectional Inspection
- C. SSH Forward Proxy
- D. SMTP Inbound Decryption
Answer: A
Explanation:
https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/decryption/configure-ssl- inbound-inspection
NEW QUESTION 25
Which two mechanisms help prevent a spilt brain scenario an Active/Passive High Availability (HA) pair? (Choose two)
- A. Configure Ethernet 1/1 as HA1 Backup
C Configure Ethernet 1/1 as HA2 Backup - B. Configure the management interface as HA1 Backup
- C. Configure the management interface as HA2 Backup
- D. Configure ethernet1/1 as HA3 Backup
- E. Configure the management interface as HA3 Backup
Answer: A,B
NEW QUESTION 26
Which steps should an engineer take to forward system logs to email?
- A. Create a new email profile under Device > server profiles; then navigate to Objects > Log Forwarding profile > set log type to system and the add email profile.
- B. Create a new email profile under Device > server profiles: then navigate to Device > Log Settings > System and add the email profile under email.
- C. Enable log forwarding under the email profile in the Device tab.
- D. Enable log forwarding under the email profile in the Objects tab.
Answer: B
NEW QUESTION 27
An administrator deploys PA-500 NGFWs as an active/passive high availability pair. The devices are not participating in dynamic routing and preemption is disabled.
What must be verified to upgrade the firewalls to the most recent version of PAN-OS software?
- A. User-ID agent
- B. Application and Threats update package
- C. Wildfire update package
- D. Anti virus update package
Answer: B
Explanation:
Dependencies : Before upgrade, make sure the firewall is running a version of app + threat (content version) that meets the minimum requirement of the new PAN-OS Upgrade.
Reference: https://live.paloaltonetworks.com/t5/Featured-Articles/Best-Practices-for-PAN-OS-Upgrade/ta-p/111045
NEW QUESTION 28
A network security administrator wants to begin inspecting bulk user HTTPS traffic flows egressing out of the internet edge firewall. Which certificate is the best choice to configure as an SSL Forward Trust certificate?
- A. A self-signed Certificate Authority certificate generated by the firewall
- B. A subordinate Certificate Authority certificate signed by the organization's PKI
- C. A Machine Certificate for the firewall signed by the organization's PKI
- D. A web server certificate signed by the organization's PKI
Answer: A
NEW QUESTION 29
An administrator has configured the Palo Alto Networks NGFW's management interface to connect to the internet through a dedicated path that does not traverse back through the NGFW itself.
Which configuration setting or step will allow the firewall to get automatic application signature updates?
- A. A service route will need to be configured.
- B. A scheduler will need to be configured for application signatures.
- C. A Threat Prevention license will need to be installed.
- D. A Security policy rule will need to be configured to allow the update requests from the firewall to the update servers.
Answer: B
Explanation:
The MGMT interface does not use Security Policies. A Service Route is needed if you are using interfaces other than the MGMT interface.
NEW QUESTION 30
An administrator pushes a new configuration from Panorama to a pair of firewalls that are configured as an active/passive HA pair. Which NGFW receives the configuration from Panorama?
- A. The active firewall, which then synchronizes to the passive firewall
- B. Both the active and passive firewalls independently, with no synchronization afterward
- C. The Passive firewall, which then synchronizes to the active firewall
- D. Both the active and passive firewalls, which then synchronize with each other
Answer: B
Explanation:
Explanation
Palo Alto NetworksPanorama 7.0 Administrator's Guide *77Manage FirewallsManage Device GroupsManage Device GroupsAdd a Device GroupCreate a Device Group HierarchyCreate Objects for Use in Shared or Device Group PolicyRevert to Inherited Object ValuesManage Unused Shared Objects Manage Precedence of Inherited ObjectsMove or Clone a Policy Rule or Object to a Different Device GroupSelect a URL Filtering Vendor on PanoramaPush a Policy Rule to a Subset of FirewallsManage the Rule HierarchyAdd a Device GroupAfter adding firewalls (see Add a Firewall as a Managed Device), you can group them into Device Groups (up to 256), as follows. Be sure to assign both firewalls in an active-passive high availability (HA) configuration to the same device group so that Panorama will push the same policy rules and objects to those firewalls. #############PAN-OS doesn't synchronize pushed rules across HA peers.######### To manage rules and objects at different administrative levels in your organization, Create a Device Group Hierarchy.
https://docs.paloaltonetworks.com/panorama/8-0/panorama-admin/manage-firewalls/transition-a-firewall-to-pano
NEW QUESTION 31
Click the Exhibit button
An administrator has noticed a large increase in bittorrent activity. The administrator wants to determine where the traffic is going on the company.
What would be the administrator's next step?
- A. Click on the bittorrent application link to view network activity
- B. Create a global filter for bittorrent traffic and then view Traffic logs.
- C. Create local filter for bittorrent traffic and then view Traffic logs.
- D. Right-Click on the bittorrent link and select Value from the context menu
Answer: A
NEW QUESTION 32
......
Easy Success Palo Alto Networks PCNSE Exam in First Try: https://surepass.actualtests4sure.com/PCNSE-practice-quiz.html
