Palo Alto Networks PCNSE Premium Exam Engine pdf – Download Free Updated 211 Questions [Q67-Q91]

Rate this post

Palo Alto Networks PCNSE Premium Exam Engine pdf – Download Free Updated 211 Questions

Verified PCNSE Bundle Real Exam Dumps PDF

Palo Alto Networks PCNSE Practice Test Questions, Palo Alto Networks PCNSE Exam Practice Test Questions

The Palo Alto Networks company is the global leader in cybersecurity that provides innovations to ensure secure digital transformation even as the progress of change is rapid. Thus, if you want to validate your skills in designing, deploying, operating, managing, and troubleshooting Palo Alto Networks Next-Generation Firewalls, you can go for the Palo Alto Networks Certified Network Security Engineer (PCNSE) certificate. It also helps demonstrate your knowledge of the Palo Alto Networks product portfolio, so that you will be able to find your place in the industry.

Exam Details and Topics

The certification test is delivered through the official exam administrator, Pearson VUE. The candidates for the test can expect 75 questions to be completed within 80 minutes. The questions cover different formats, including matching, scenario-based with graphics, and multiple choice. The PCNSE exam is available in two languages: English and Japanese. The individuals should possess product competence as well as a good understanding of the unique areas of the product portfolio of Palo Alto Networks and know how to appropriately deploy at least one of them.

It is also recommended that the students explore other prep resources available at the Palo Alto Networks education website. The recommended tools include:

Preparation videos & tutorials
Administrator’s guide
Cybersecurity Skills Practice Lab
Palo Alto PCNSE Study Guide & Practice Exam

Q67. An engines must configure the Decryption Broker feature To which router must the engineer assign the decryption forwarding interfaces that are used m the Decryption Broker security Chain?

a virtual router that has no additional interfaces for passing data-plane traffic and no other configured routes than those used in for the security chain

the virtual router that routes the traffic that the Decryption Broker security chain inspects

a virtual router that is configured with at least one dynamic routing protocol and has at least one entry in the RIB

the default virtual router (If there is no default virtual router the engineer must create one during setup)

Q68. To ensure that a Security policy has the highest priority, how should an administrator configure a Security policy in the device group hierarchy?

Add the policy in the shared device group as a pre-rule

Reference the targeted device’s templates in the target device group

Add the policy to the target device group and apply a master device to the device group

Clone the security policy and add it to the other device groups

Q69. An administrator needs to evaluate a recent policy change that was committed and pushed to a firewall device group.
How should the administrator identify the configuration changes?

review the configuration logs on the Monitor tab

click Preview Changes under Push Scope

use Test Policy Match to review the policies in Panorama

context-switch to the affected firewall and use the configuration audit tool

Q70.

Pre-existing logs from the firewalls are not appearing in PanoramA.
Which action would enable the firewalls to send their pre-existing logs to Panorama?

Use the import option to pull logs into Panorama.

A CLI command will forward the pre-existing logs to Panorama.

Use the ACC to consolidate pre-existing logs.

The log database will need to exported form the firewalls and manually imported into Panorama.

Q71. The decision to upgrade to PAN-OS 10.2 has been approved. The engineer begins the process by upgrading the Panorama servers, but gets an error when trying to install.
When performing an upgrade on Panorama to PAN-OS 10.2, what is the potential cause of a failed install?

Management only mode

Expired certificates

Outdated plugins

GlobalProtect agent version

Q72. Which User-ID method maps IP address to usernames for users connecting through a web proxy that has already authenticated the user?

Client Probing

Port mapping

Server monitoring

Syslog listening

Q73. On the NGFW. how can you generate and block a private key from export and thus harden your security posture and prevent rogue administrators or other bad actors from misusing keys?

1.Select Device > Certificate Management > Certificates >Devace > Certificates
2. Import the certificate.
3 Select Import Private Key
4 Click Generate to generate the new certificate

1 Select Device > Certificates
2 Select Certificate Profile
3 Generate the certificate
4 Select Block Private Key Export.

1 Select Device > Certificates
2 Select Certificate Profile.
3 Generate the certificate
4 Select Block Private Key Export

1 Select Device > Certificate Management > Certificates > Device > Certificates
2 Generate the certificate
3 Select Block Private Key Export
4 Click Genet ale to generate the new certificate.

Q74. View the GlobalProtect configuration screen capture.

What is the purpose of this configuration?

It configures the tunnel address of all internal clients to an IP address range starting at 192.168.10.1.

It forces an internal client to connect to an internal gateway at IP address 192.168.10.1.

It enables a client to perform a reverse DNS lookup on 192.168.10.1 to detect that it is an internal client.

It forces the firewall to perform a dynamic DNS update, which adds the internal gateway’s hostname and IP address to the DNS server.

Q75. Refer to the exhibit.

A web server in the DMZ is being mapped to a public address through DNAT.
Which Security policy rule will allow traffic to flow to the web server?

Untrust (any) to Untrust (10. 1.1. 100), web browsing – Allow

Untrust (any) to Untrust (1. 1. 1. 100), web browsing – Allow

Untrust (any) to DMZ (1. 1. 1. 100), web browsing – Allow

Untrust (any) to DMZ (10. 1. 1. 100), web browsing – Allow

Q76. In SSL Forward Proxy decryption, which two certificates can be used for certificate signing?
(Choose two.)

wildcard server certificate

enterprise CA certificate

client certificate

server certificate

self-signed CA certificate

Q77. Which of the following commands would you use to check the total number of the sessions that are currently going through SSL Decryption processing?

show session all filter ssl-decryption yes total-count yes

show session all ssl-decrypt yes count yes

show session all filter ssl-decrypt yes count yes

show session filter ssl-decryption yes total-count yes

Q78. When configuring a GlobalProtect Portal, what is the purpose of specifying an Authentication Profile?

To enable Gateway authentication to the Portal

To enable Portal authentication to the Gateway

To enable user authentication to the Portal

To enable client machine authentication to the Portal

Q79. A client has a sensitive application server in their data center and is particularly concerned about resource exhaustion because of distributed denial-of-service attacks.
How can the Palo Alto Networks NGFW be configured to specifically protect this server against resource exhaustion originating from multiple IP addresses (DDoS attack)?

Define a custom App-ID to ensure that only legitimate application traffic reaches the server.

Add a Vulnerability Protection Profile to block the attack.

Add QoS Profiles to throttle incoming requests.

Add a DoS Protection Profile with defined session count.

Q80. A client is concerned about resource exhaustion because of denial-of-service attacks against their DNS servers. Which option will protect the individual servers?

Enable packet buffer protection on the Zone Protection Profile.

Apply an Anti-Spyware Profile with DNS sinkholing.

Use the DNS App-ID with application-default.

Apply a classified DoS Protection Profile.

Q81. Given the following diagram:

A VPN connection has been created to allow traffic from the Trust-L3 zone of Site A to reach the Trust-L3 zone of Site B.
Each site is using tunnel.1 in the Untrust-L3 zone for the VPN connection. A static route needs to be added to the default virtual router in the Site A firewall to enable traffic from Site A to reach all workstations in Site B.
Which static route configuration will satisfy the requirement?

Name: Route-to-Site-B
Destination: 172.16.20.0/24
Interface: tunnel.1
Next Hop: None

Name: Route-to-Site-B
Destination: 172.16.20.0/24
Interface: none
Next Hop: 192.0.0.2

Name: Route-to-Site-B
Destination: 172.16.20.1/24
Interface: tunnel.1
Next Hop: None

Name: Route-to-Site-B
Destination: 172.16.20.0/24
Interface: ethernet1/1
Next Hop: 192.0.0.1

Q82. An administrator wants a new Palo Alto Networks NGFW to obtain automatic application updates daily, so it is configured to use a scheduler for the application database. Unfortunately, they required the management network to be isolated so that it cannot reach the internet. Which configuration will enable the firewall to download and install application updates automatically?

Configure a Policy Based Forwarding policy rule for the update server IP address so that traffic sourced from themanagement interfaced destined for the update servers goes out of the interface acting as your internet connection.

Configure a security policy rule to allow all traffic to and from the update servers.

Download and install application updates cannot be done automatically if the MGT port cannot reach the internet.

Configure a service route for Palo Alto networks services that uses a dataplane interface that can route traffic to the internet, and create a security policy rule to allow the traffic from that interface to the update servers if necessary.

Q83. Decrypted packets from the website https://www.microsoft.com will appear as which application and service within the Traffic log?

web-browsing and 443

SSL and 80

SSL and 443

web-browsing and 80

Q84. SAML SLO is supported for which two firewall features? (Choose two.)

GlobalProtect Portal

CaptivePortal

WebUI

CLI

Q85. The following objects and policies are defined in a device group hierarchy.

Dallas-Branch has Dallas-FW as a member of the Dallas-Branch device-group NYC-DC has NYC-FW as a member of the NYC-DC device-group What objects and policies will the Dallas-FW receive if “Share Unused Address and Service Objects” is enabled in Panorama?

Address Objects
– Shared Address1
– Branch Address1
Policies
– Shared Policy1
– Branch Policy1

Address Objects
– Shared Address1
– Shared Address2
– Branch Address1
Policies
– Shared Policy1
– Shared Policy2
– Branch Policy1

Address Objects
– Shared Address1
– Shared Address2
– Branch Address1
– DC Address1
Policies
– Shared Policy1
– Shared Policy2
– Branch Policy1

Address Objects
– Shared Address1
– Shared Address2
– Branch Address1
Policies
– Shared Policy1
– Branch Policy1

Q86. An administrator deploys PA-500 NGFWs as an active/passive high availability pair. The devices are not participating in dynamic routing and preemption is disabled.
What must be verified to upgrade the firewalls to the most recent version of PAN-OS software?

Wildfire update package

User-ID agent

Anti virus update package

Application and Threats update package

Q87. Which two options prevent the firewall from capturing traffic passing through it? (Choose two.)

The firewall is in multi-vsys mode.

The traffic is offloaded.

The traffic does not match the packet capture filter.

The firewall’s DP CPU is higher than 50%.

Q88. Refer to the exhibit.

An administrator cannot see any of the Traffic logs from the Palo Alto Networks NGFW on Panorama. The configuration problem seems to be on the firewall side. Where is the best place on the Palo Alto Networks NGFW to check whether the configuration is correct?
A)

B)

C)

D)

Option A

Option B

Option C

Option D

Q89. An administrator is using Panorama and multiple Palo Alto Networks NGFWs. After upgrading all devices to the latest PAN-OS software, the administrator enables log forwarding from the firewalls to Panoram A.
Pre-existing logs from the firewalls are not appearing in PanoramA.
Which action would enable the firewalls to send their pre-existing logs to Panorama?

Use the import option to pull logs into Panorama.

A CLI command will forward the pre-existing logs to Panorama.

Use the ACC to consolidate pre-existing logs.

The log database will need to exported form the firewalls and manually imported into Panorama.

Q90. A network security engineer needs to configure a virtual router using IPv6 addresses.
Which two routing options support these addresses? (Choose two)

BGP not sure

OSPFv3

RIP

Static Route

Q91. Refer to the exhibit.

Which certificates can be used as a Forwarded Trust certificate?