Best Quality Palo Alto Networks PCNSE Exam Questions DumpStillValid Realistic Practice Exams [2021]
Critical Information To Palo Alto Networks Certified Security Engineer (PCNSE) PAN-OS 10.0 Pass the First Time
NEW QUESTION 17
A firewall administrator has completed most of the steps required to provision a standalone Palo Alto Networks Next-Generation Firewall. As a final step, the administrator wants to test one of the security policies.
Which CLI command syntax will display the rule that matches the test?
- A. show security-policy-match source <ip_address> destination <IP_address> destination port <port number> protocol <protocol number> test security-policy-match source test security-policy-match source <source IP> destination <destination IP> protocol <protocol number>
- B. test security -policy- match source <ip_address> destination <IP_address> destination port <port number> protocol <protocol number
- C. show security rule source <ip_address> destination <IP_address> destination port <port number> protocol <protocol number>
- D. test security rule source <ip_address> destination <IP_address> destination port <port number> protocol <protocol number>
Answer: B
Explanation:
https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Test-Which-Security-Policy-Applies-to-a-Traffic-Flow/ta-p/53693
NEW QUESTION 18
An administrator has been asked to configure active/passive HA for a pair of Palo Alto Networks NGFWs. The administrator assigns priority 100 to the active firewall.
Which priority is correct for the passive firewall?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: C
Explanation:
Reference:
https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/framemaker/71/pan- os/pan-os/section_5.pdf (page 9)
NEW QUESTION 19
Which URL Filtering Security Profile action logs the URL Filtering category to the URL Filtering log?
- A. Default
- B. Alert
- C. Allow
- D. Log
Answer: B
Explanation:
Explanation
https://www.paloaltonetworks.com/documentation/70/pan-os/pan-os/url-filtering/url-filtering-profile-actions
NEW QUESTION 20
A global corporate office has a large-scale network with only one User-ID agent, which creates a bottleneck near the User-ID agent server. Which solution in PAN-OS® software would help in this case?
- A. Content inspection
- B. Application override
- C. Redistribution of user mappings
- D. Virtual Wire mode
Answer: C
NEW QUESTION 21
Which URL Filtering Security Profile action logs the URL Filtering category to the URL Filtering log?
- A. Default
- B. Alert
- C. Allow
- D. Log
Answer: B
Explanation:
https://www.paloaltonetworks.com/documentation/70/pan-os/pan-os/url-filtering/url-filtering- profile-actions
NEW QUESTION 22
Decrypted packets from the website https://www.microsoft.com will appear as which application and service within the Traffic log?
- A. SSL and 80
- B. web-browsing and 443
- C. web-browsing and 80
- D. SSL and 443
Answer: B
Explanation:
Explanation
We know that SSL decryption is supposed to give us visibility of traffic that would otherwise be encrypted. Therefore, we'd expect decrypted traffic to be identified as the underlying applications, such as web-browsing, facebook-base or other, but not as SSL.
NEW QUESTION 23
In the image, what caused the commit warning?
- A. The CA certificate for FWDtrust has not been imported into the firewall.
- B. SSL Forward Proxy requires a public certificate to be imported into the firewall.
- C. The FWDtrust certificate does not have a certificate chain.
- D. The FWDtrust certificate has not been flagged as Trusted Root CA.
Answer: C
Explanation:
Explanation
NEW QUESTION 24
A spike in dangerous traffic is observed. Which of the following PanOS tabs would an administrator utilize to identify culpable users.
- A. Policies
- B. ACC
- C. Objects
- D. Device
- E. Network
- F. Monitor
Answer: B
NEW QUESTION 25
Which Captive Portal mode must be configured to support MFA authentication?
- A. NTLM
- B. Single Sign-On
- C. Transparent
- D. Redirect
Answer: D
Explanation:
Reference:
https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/authentication/configure-multi-factor-authentication
NEW QUESTION 26
A firewall administrator has been asked to configure a Palo Alto Networks NGFW to prevent against compromised hosts trying to phone-home or beacon out to external command-and-control (C2) servers.
Which security Profile type will prevent these behaviors?
- A. Antivirus
- B. Anti-Spyware
- C. Vulnerability Protection
- D. WildFire
Answer: A
NEW QUESTION 27
An administrator sees several inbound sessions identified as unknown-tcp in the Traffic logs. The administrator determines that these sessions are form external users accessing the company's proprietary accounting application. The administrator wants to reliably identify this traffic as their accounting application and to scan this traffic for threats.
Which option would achieve this result?
- A. Create an Application Override policy and custom threat signature for the application.
- B. Create a custom App-ID and use the "ordered conditions" check box.
- C. Create a custom App-ID and enable scanning on the advanced tab.
- D. Create an Application Override policy.
Answer: C
Explanation:
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRoCAK
NEW QUESTION 28
Which three authentication services can administrator use to authenticate admins into the Palo Alto Networks NGFW without defining a corresponding admin account on the local firewall? (Choose three.)
- A. SAML
- B. PAP
- C. RADIUS
- D. LDAP
- E. Kerberos
- F. TACACS+
Answer: A,D,E
Explanation:
Explanation
https://docs.paloaltonetworks.com/pan-os/8-0/pan-os-admin/firewall-administration/manage-firewall-administrat The administrative accounts are defined on an external SAML, TACACS+, or RADIUS server. The server performs both authentication and authorization. For authorization, you define Vendor-Specific Attributes (VSAs) on the TACACS+ or RADIUS server, or SAML attributes on the SAML server.
PAN-OS maps the attributes to administrator roles, access domains, user groups, and virtual systems that you define on the firewall. For details, see:
Configure SAML AuthenticationConfigure TACACS+ AuthenticationConfigure RADIUS Authentication
NEW QUESTION 29
An Administrator is configuring an IPSec VPN toa Cisco ASA at the administrator's home and experiencing issues completing the connection. The following is th output from the command:
less mp-log ikemgr.log:
What could be the cause of this problem?
- A. The public IP addresse do not match for both the Palo Alto Networks Firewall and the ASA.
- B. The shared secerts do not match between the Palo Alto firewall and the ASA
- C. The deed peer detection settings do not match between the Palo Alto Networks Firewall and the ASA
- D. The Proxy IDs on the Palo Alto Networks Firewall do not match the settings on the ASA.
Answer: D
NEW QUESTION 30
An administrator has a requirement to export decrypted traffic from the Palo Alto Networks NGFW to a
third-party, deep-level packet inspection appliance.
Which interface type and license feature are necessary to meet the requirement?
- A. Decryption Mirror interface with the associated Decryption Port Mirror license
- B. Decryption Mirror interface with the Threat Analysis license
- C. Virtual Wire interface with the Decryption Port Export license
- D. Tap interface with the Decryption Port Mirror license
Answer: A
Explanation:
Explanation/Reference:
Reference: https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/decryption/decryption-
concepts/decryption-mirroring
NEW QUESTION 31
Which two methods can be used to verify firewall connectivity to AutoFocus? (Choose two.)
- A. Check for WildFire forwarding logs.
- B. Check the WebUI Dashboard AutoFocus widget.
- C. Verify AutoFocus status using CLI.
- D. Check the license
- E. Verify AutoFocus is enabled below Device Management tab.
Answer: D,E
Explanation:
Reference:
https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/getting-started/enable-autofocus-threat-intelligence
NEW QUESTION 32
......
Prerequisites for Taking PCNSE Certification Exam
The PCNSE certification has no prerequisites. However, to ensure that you’re well prepared for the real exam, Palo Alto recommends a couple of training sessions you should take. These courses were developed and authorized by the vendor itself:
- The PCNSE Study Guide.
- The Firewall: Troubleshooting (330);
- The Firewall Essentials: Configuration and Management (EDU-210);
- The Panorama: Managing Firewalls at Scale (EDU-220);
In addition to this, you’re expected to have six months of hands-on experience with the product being deployed.
PCNSE EXAM DUMPS WITH GUARANTEED SUCCESS: https://www.dumpstillvalid.com/PCNSE-prep4sure-review.html
Best Quality Palo Alto Networks PCNSE Exam Questions: https://drive.google.com/open?id=1KgUZt7-YinmeCyL89tHWNL2PbInIRKi0
