Try 2022 Free Palo Alto Networks PCNSE Certification Dumps

test2022-04-09T03:38:24+00:00

PCNSE certification validates your knowledge of the Security Operating Platform, ensuring you can make use of its full functionality to benefit your company and showcase your expertise. Our PCNSE certification dumps are up to date and feature actual test questions and answers, allowing you to pass your exam quickly. We ensure that if you use the most accurate PCNSE test dumps material from FreeTestShare, you will pass the exam on the first try!

Now is a great time to take a free practice test to see how well you know yourself!

Page 1 of 11

1. An administrator has configured PAN-OS SD-WAN and has received a request to find out the reason for a session failover for a session that has already ended

Where would you find this in Panorama or firewall logs?

Traffic Logs

System Logs

Session Browser

You cannot find failover details on closed sessions

2. A firewall is configured with SSL Forward Proxy decryption and has the following four enterprise certificate authorities (Cas)

i. Enterprise-Trusted-CA; which is verified as Forward Trust Certificate (The CA is also installed in the trusted store of the end-user browser and system)

ii. Enterpnse-Untrusted-CA, which is verified as Forward Untrust Certificate

iii. Enterprise-lntermediate-CA

iv. Enterprise-Root-CA which is verified only as Trusted Root CA

An end-user visits https //www example-website com/ with a server certificate Common Name (CN) www example-website com The firewall does the SSL Forward Proxy decryption for the website and the server certificate is not trusted by the firewall

The end-user's browser will show that the certificate for www.example-website.com was issued by which of the following?

Enterprise-Untrusted-CA which is a self-signed CA

Enterprise-Trusted-CA which is a self-signed CA

Enterprise-lntermediate-CA which was. in turn, issued by Enterprise-Root-CA

Enterprise-Root-CA which is a self-signed CA

3. An administrator is defining protection settings on the Palo Alto Networks NGFW to guard against resource exhaustion.

When platform utilization is considered, which steps must the administrator take to configure and apply packet buffer protection?

Enable and configure the Packet Buffer protection thresholds. Enable Packet Buffer Protection per ingress zone.

Enable and then configure Packet Buffer thresholds Enable Interface Buffer protection.

Create and Apply Zone Protection Profiles in all ingress zones. Enable Packet Buffer Protection per ingress zone.

Configure and apply Zone Protection Profiles for all egress zones. Enable Packet Buffer Protection pre egress zone.

Enable per-vsys Session Threshold alerts and triggers for Packet Buffer Limits. Enable Zone Buffer Protection per zone.

4. An organization is building a Bootstrap Package to deploy Palo Alto Networks VM-Series firewalls into their AWS tenant.

Which two statements are correct regarding the bootstrap package contents? (Choose two)

The /config /content and /software folders are mandatory while the /license and /plugin folders are optional

The bootstrap package is stored on an AFS share or a discrete container file bucket

The directory structure must include a /config /content, /software and /license folders

The init-cfg txt and bootstrap.xml files are both optional configuration items for the /config folder

The bootstrap.xml file allows for automated deployment of VM-Senes firewalls with full network and policy configurations.

5. A firewall administrator requires an A/P HA pair to fail over more quickly due to critical business application uptime requirements.

What is the correct setting?

Change the HA timer profile to "user-defined" and manually set the timers.

Change the HA timer profile to "fast".

Change the HA timer profile to "aggressive" or customize the settings in advanced profile.

Change the HA timer profile to "quick" and customize in advanced profile.

6. When you navigate to Network: > GlobalProtect > Portals > Method section, which three options are available? (Choose three)

user-logon (always on)

pre-logon then on-demand

on-demand (manual user initiated connection)

post-logon (always on)

certificate-logon

7. An existing NGFW customer requires direct interne! access offload locally at each site and iPSec connectivity to all branches over public internet. One requirement is mat no new SD-WAN hardware be introduced to the environment.

What is the best solution for the customer?

Configure a remote network on PAN-OS

Upgrade to a PAN-OS SD-WAN subscription

Deploy Prisma SD-WAN with Prisma Access

Configure policy-based forwarding

8. An engineer is in the planning stages of deploying User-ID in a diverse directory services environment.

Which server OS platforms can be used for server monitoring with User-ID?

Microsoft Terminal Server, Red Hat Linux, and Microsoft Active Directory

Microsoft Active Directory, Red Hat Linux, and Microsoft Exchange

Microsoft Exchange, Microsoft Active Directory, and Novell eDirectory

Novell eDirectory, Microsoft Terminal Server, and Microsoft Active Directory

9. Which feature prevents the submission of corporate login information into website forms?

Data filtering

User-ID

File blocking

Credential phishing prevention

10. Which feature must you configure to prevent users form accidentally submitting their corporate credentials to a phishing website?

URL Filtering profile

Zone Protection profile

Anti-Spyware profile

Vulnerability Protection profile

Page 2 of 11

11. Which DoS protection mechanism detects and prevents session exhaustion attacks?

Packet Based Attack Protection

Flood Protection

Resource Protection

TCP Port Scan Protection

12. Which operation will impact the performance of the management plane?

WildFire Submissions

DoS Protection

decrypting SSL Sessions

Generating a SaaS Application Report.

13. What are two prerequisites for configuring a pair of Palo Alto Networks firewalls in an active/passive High Availability (HA) pair? (Choose two.)

The firewalls must have the same set of licenses.

The management interfaces must to be on the same network.

The peer HA1 IP address must be the same on both firewalls.

HA1 should be connected to HA1. Either directly or with an intermediate Layer 2 device.

14. Which User-ID method should be configured to map IP addresses to usernames for users connected through a terminal server?

port mapping

server monitoring

client probing

XFF headers

15. Updates to dynamic user group membership are automatic therefore using dynamic user groups instead of static group objects allows you to:

respond to changes in user behavior or potential threats using manual policy changes

respond to changes in user behavior or potential threats without automatic policy changes

respond to changes in user behavior and confirmed threats with manual policy changes

respond to changes in user behavior or potential threats without manual policy changes

16. An administrator cannot see any Traffic logs from the Palo Alto Networks NGFW in Panorama reports. The configuration problem seems to be on the firewall.

Which settings, if configured incorrectly, most likely would stop only Traffic logs from being sent from the NGFW to Panorama?

A)

Option A

Option B

Option C

Option D

17. An engineer is creating a security policy based on Dynamic User Groups (DUG) What benefit does this provide?

Automatically include users as members without having to manually create and commit policy or group changes

DUGs are used to only allow administrators access to the management interface on the Palo Alto Networks firewall

It enables the functionality to decrypt traffic and scan for malicious behaviour for User-ID based policies

Schedule commits at a regular intervals to update the DUG with new users matching the tags specified

18. Before an administrator of a VM-500 can enable DoS and zone protection, what actions need to be taken?

Measure and monitor the CPU consumption of the firewall data plane to ensure that each firewall is properly sized to support DoS and zone protection

Create a zone protection profile with flood protection configured to defend an entire egress zone against SY

ICMP ICMPv6, UD

and other IP flood attacks

Add a WildFire subscription to activate DoS and zone protection features

Replace the hardware firewall because DoS and zone protection are not available with VM-Series systems

19. How would an administrator monitor/capture traffic on the management interface of the Palo Alto Networks NGFW?

Use the debug dataplane packet-diag set capture stage firewall file command.

Enable all four stages of traffic capture (TX, RX, DROP, Firewall).

Use the debug dataplane packet-diag set capture stage management file command.

Use the tcpdump command.

20. What are three types of Decryption Policy rules? (Choose three.)

SSL Inbound Inspection

SSH Proxy

SSL Forward Proxy

Decryption Broker

Decryption Mirror

Page 3 of 11

21. How can a candidate or running configuration be copied to a host external from Panorama?

Commit a running configuration.

Save a configuration snapshot.

Save a candidate configuration.

Export a named configuration snapshot.

22. How can a Palo Alto Networks firewall be configured to send syslog messages in a format compatible with non-standard syslog servers?

Enable support for non-standard syslog messages under device management

Check the custom-format check box in the syslog server profile

Select a non-standard syslog server profile

Create a custom log format under the syslog server profile

23. Which tool provides an administrator the ability to see trends in traffic over periods of time, such as threats detected in the last 30 days?

Session Browser

Application Command Center

TCP Dump

Packet Capture

24. An administrator accidentally closed the commit window/screen before the commit was finished.

Which two options could the administrator use to verify the progress or success of that commit task? (Choose two.)

Configuration Logs

System Logs

Task Manager

Traffic Logs

25. Which three authentication services can administrator use to authenticate admins into the Palo Alto Networks NGFW without defining a corresponding admin account on the local firewall? (Choose three.)

Kerberos

PAP

SAML

TACACS+

RADIUS

LDAP

26. An administrator is building Security rules within a device group to block traffic to and from malicious locations

How should those rules be configured to ensure that they are evaluated with a high priority?

Create the appropriate rules with a Block action and apply them at the top of the Default Rules

Create the appropriate rules with a Block action and apply them at the top of the Security Post-Rules.

Create the appropriate rules with a Block action and apply them at the top of the local firewall Security rules.

Create the appropriate rules with a Block action and apply them at the top of the Security Pre-Rules

27. Which three options does the WF-500 appliance support for local analysis? (Choose three)

E-mail links

APK files

jar files

PNG files

Portable Executable (PE) files

28. Which two logs on the firewall will contain authentication-related information useful for troubleshooting purpose (Choose two)

ms.log

traffic.log

system.log

dp-monitor.log

authd.log

29. What is the function of a service route?

The service route is the method required to use the firewall's management plane to provide services to applications

The service packets enter the firewall on the port assigned from the external service. The server sends its response to the configured destination interface and destination IP address

The service packets exit the firewall on the port assigned for the external service. The server sends its response to the configured source interface and source IP address

Service routes provide access to external services such as DNS servers external authentication servers or Palo Alto Networks services like the Customer Support Portal

30. An administrator plans to deploy 15 firewalls to act as GlobalProtect gateways around the world Panorama will manage the firewalls.

The firewalls will provide access to mobile users and act as edge locations to on-premises infrastructure. The administrator wants to scale the configuration out quickly and wants all of the firewalls to use the same template configuration

Which two solutions can the administrator use to scale this configuration? (Choose two.)

variables

template stacks

collector groups

virtual systems

Page 4 of 11

31. Which statement regarding HA timer settings is true?

Use the Recommended profile for typical failover timer settings

Use the Moderate profile for typical failover timer settings

Use the Aggressive profile for slower failover timer settings.

Use the Critical profile for faster failover timer settings.

32. Which two actions would be part of an automatic solution that would block sites with untrusted certificates without enabling SSL Forward Proxy? (Choose two.)

Create a no-decrypt Decryption Policy rule.

Configure an EDL to pull IP addresses of known sites resolved from a CR

Create a Dynamic Address Group for untrusted sites

Create a Security Policy rule with vulnerability Security Profile attached.

Enable the “Block sessions with untrusted issuers” setting.

33. What are three possible verdicts that WildFire can provide for an analyzed sample? (Choose three)

Clean

Bengin

Adware

Suspicious

Grayware

Malware

34. Refer to the exhibit.

Which will be the egress interface if the traffic’s ingress interface is ethernet 1/7 sourcing from 192.168.111.3 and to the destination 10.46.41.113?

ethernet1/6

ethernet1/3

ethernet1/7

ethernet1/5

35. Based on the image, what caused the commit warning?

The CA certificate for FWDtrust has not been imported into the firewall.

The FWDtrust certificate has not been flagged as Trusted Root C

SSL Forward Proxy requires a public certificate to be imported into the firewall.

The FWDtrust certificate does not have a certificate chain.

36. What are the differences between using a service versus using an application for Security Policy match?

Use of a "service" enables the firewall to take action after enough packets allow for App-ID identification

Use of a "service" enables the firewall to take immediate action with the first observed packet based on port numbers Use of an "application" allows the firewall to take action after enough packets allow for App-ID identification regardless of the ports being used.

There are no differences between "service" or "application” Use of an "application" simplifies configuration by allowing use of a friendly application name instead of port numbers.

Use of a "service" enables the firewall to take immediate action with the first observed packet based on port numbers. Use of an "application" allows the firewall to take immediate action it the port being used is a member of the application standard port list

37. Which log file can be used to identify SSL decryption failures?

Configuration

Threats

ACC

Traffic

38. SD-WAN is designed to support which two network topology types? (Choose two.)

ring

point-to-point

hub-and-spoke

full-mesh

39. Which action disables Zero Touch Provisioning (ZTP) functionality on a ZTP firewall during the onboarding process?

performing a local firewall commit

removing the firewall as a managed device in Panorama

performing a factory reset of the firewall

removing the Panorama serial number from the ZTP service

40. To connect the Palo Alto Networks firewall to AutoFocus, which setting must be enabled?

Device>Setup>Services>AutoFocus

Device> Setup>Management >AutoFocus

AutoFocus is enabled by default on the Palo Alto Networks NGFW

Device>Setup>WildFire>AutoFocus

Device>Setup> Management> Logging and Reporting Settings

Page 5 of 11

41. Based on the graphic, which statement accurately describes the output shown in the Server Monitoring panel?

The User-ID agent is connected to a domain controller labeled lab-client.

The host lab-client has been found by the User-ID agent.

The host lab-client has been found by a domain controller.

The User-ID agent is connected to the firewall labeled lab-client.

42. When using certificate authentication for firewall administration, which method is used for authorization?

Radius

LDAP

Kerberos

Local

43. An administrator has configured a QoS policy rule and a QoS profile that limits the maximum allowable bandwidth for the YouTube application. However, YouTube is consuming more than the maximum bandwidth allotment configured.

Which configuration step needs to be configured to enable QoS?

Enable QoS Data Filtering Profile

Enable QoS monitor

Enable Qos interface

Enable Qos in the interface Management Profile.

44. Which three firewall states are valid? (Choose three.)

Active

Functional

Pending

Passive

Suspended

45. A customer is replacing their legacy remote access VPN solution The current solution is in place to secure internet egress and provide access to resources located in the main datacenter for the connected clients.

Prisma Access has been selected to replace the current remote access VPN solution. During onboarding the following options and licenses were selected and enabled

What must be configured on Prisma Access to provide connectivity to the resources in the datacenter?

Configure a mobile user gateway in the region closest to the datacenter to enable connectivity to the datacenter

Configure a remote network to provide connectivity to the datacenter

Configure Dynamic Routing to provide connectivity to the datacenter

Configure a service connection to provide connectivity to the datacenter

46. A organizations administrator has the funds available to purchase more firewalls to increase the organization's security posture.

The partner SE recommends placing the firewalls as close as possible to the resources that they protect

Is the SE's advice correct and why or why not?

Yes Firewalls are session based so they do not scale to millions of CPS

No Placing firewalls m front of perimeter DDoS devices provides greater protection tor sensitive devices inside the network

Yes Zone Protection profiles can be tailored to the resources that they protect via the configuration of specific device types and operating systems

No Firewalls provide new defense and resilience to prevent attackers at every stage of the cyberattack lifecycle independent of placement

47. To more easily reuse templates and template slacks, you can create term plate variables in place of firewall-specific and appliance-specific IP literals in your configurations

Which one is the correct configuration?

@Panorama

#Pancrama

&Panorama

$Panorama

48. Which Captive Portal mode must be configured to support MFA authentication?

NTLM

Redirect

Single Sign-On

Transparent

49. An administrator has enabled OSPF on a virtual router on the NGFW. OSPF is not adding new routes to the virtual router.

Which two options enable the administrator to troubleshoot this issue? (Choose two.)

View Runtime Stats in the virtual router.

View System logs.

Add a redistribution profile to forward as BGP updates.

Perform a traffic pcap at the routing stage.

50. A remote administrator needs access to the firewall on an untrust interlace.

Which three options would you configure on an interface Management profile lo secure management access? (Choose three)

HTTP

User-ID

SSH

HTTPS

Permitted IP Addresses

Page 6 of 11

51. An administrator is using Panorama and multiple Palo Alto Networks NGFWs. After upgrading all devices to the latest PAN-OS® software, the administrator enables log forwarding from the firewalls to PanoramA. Pre-existing logs from the firewalls are not appearing in PanoramA.

Which action would enable the firewalls to send their pre-existing logs to Panorama?

Use the import option to pull logs into Panorama.

A CLI command will forward the pre-existing logs to Panorama.

Use the ACC to consolidate pre-existing logs.

The log database will need to exported form the firewalls and manually imported into Panorama.

52. With the default TCP and UDP settings on the firewall what will be me identified application in the following session?

incomplete

unknown-tcp

insufficient-data

unknown-udp

53. What file type upload is supported as part of the basic WildFire service?

BAT

VBS

ELF

54. A company has a policy that denies all applications it classifies as bad and permits only application it classifies as good.

The firewall administrator created the following security policy on the company's firewall.

Which interface configuration will accept specific VLAN IDs?

Which two benefits are gained from having both rule 2 and rule 3 presents? (choose two)

A report can be created that identifies unclassified traffic on the network.

Different security profiles can be applied to traffic matching rules 2 and 3.

Rule 2 and 3 apply to traffic on different ports.

Separate Log Forwarding profiles can be applied to rules 2 and 3.

55. Which two statements are true for the DNS Security service? (Choose two.)

It eliminates the need for dynamic DNS updates

It functions like PAN-DB and requires activation through the app portal

It removes the 100K limit for DNS entries for the downloaded DNS updates

It is automatically enabled and configured

56. Which two virtualization platforms officially support the deployment of Palo Alto Networks VM-Series firewalls? (Choose two.)

Red Hat Enterprise Virtualization (RHEV)

Kernel Virtualization Module (KVM)

Boot Strap Virtualization Module (BSVM)

Microsoft Hyper-V

57. An administrator is using Panorama and multiple Palo Alto Networks NGFWs. After upgrading all devices to the latest PAN-OS® software, the administrator enables log forwarding from the firewalls to PanoramA. Pre-existing logs from the firewalls are not appearing in PanoramA.

Which action would enable the firewalls to send their pre-existing logs to Panorama?

Use the import option to pull logs.

Export the log database

Use the scp logdb export command

Use the ACC to consolidate the logs

58. In High Availability, which information is transferred via the HA data link?

session information

heartbeats

HA state information

User-ID information

59. in URL filtering, which component matches URL patterns?

live URL feeds on the management plane

security processing on the data plane

signature matching on the data plane

single-pass pattern matching on the data plane

60. A client is concerned about resource exhaustion because of denial-of-service attacks against their DNS servers.

Which option will protect the individual servers?

Enable packet buffer protection on the Zone Protection Profile.

Apply an Anti-Spyware Profile with DNS sinkholing.

Use the DNS App-ID with application-default.

Apply a classified DoS Protection Profile.

Page 7 of 11

61. A VPN connection is set up between Site-A and Site-B, but no traffic is passing in the system log of Site-A, there is an event logged as like-nego-p1-fail-psk.

What action will bring the VPN up and allow traffic to start passing between the sites?

Change the Site-B IKE Gateway profile version to match Site-A,

Change the Site-A IKE Gateway profile exchange mode to aggressive mode.

Enable NAT Traversal on the Site-A IKE Gateway profile.

Change the pre-shared key of Site-B to match the pre-shared key of Site-A

62. What happens when an A P firewall cluster synchronies IPsec tunnel security associations (SAs)?

Phase 2 SAs are synchronized over HA2 finks

Phase 1 and Phase 2 SAs are synchronized over HA2 links

Phase 1 SAs are synchronized over HA1 links

Phase 1 and Phase 2 SAs are synchronized over HA3 links

63. Where can an administrator see both the management plane and data plane CPU utilization in the WebUI?

System log

CPU Utilization widget

Resources widget

System Utilization log

64. An administrator has purchased WildFire subscriptions for 90 firewalls globally.

What should the administrator consider with regards to the WildFire infrastructure?

To comply with data privacy regulations, WildFire signatures and verdicts are not shared globally.

Palo Alto Networks owns and maintains one global cloud and four WildFire regional clouds.

Each WildFire cloud analyzes samples and generates malware signatures and verdicts independently of the other WildFire clouds.

The WildFire Global Cloud only provides bare metal analysis.

65. Which Public Key infrastructure component is used to authenticate users for GlobalProtect when the Connect Method is set to pre-logon?

Certificate revocation list

Trusted root certificate

Machine certificate

Online Certificate Status Protocol

66. A network security engineer has been asked to analyze Wildfire activity. However, the Wildfire Submissions item is not visible form the Monitor tab.

What could cause this condition?

The firewall does not have an active WildFire subscription.

The engineer's account does not have permission to view WildFire Submissions.

A policy is blocking WildFire Submission traffic.

Though WildFire is working, there are currently no WildFire Submissions log entries.

67. An enterprise has a large Palo Alto Networks footprint that includes onsite firewalls and Prisma Access for mobile users, which is managed by Panorama The enterprise already uses GlobalProtect with SAML authentication to obtain iP-to-user mapping information

However information Security wants to use this information in Prisma Access for policy enforcement based on group mapping Information Security uses on-prermses Active Directory (AD) but is uncertain about what is needed for Prisma Access to learn groups from AD

How can portaes based on group mapping be learned and enforced in Prisma Access?

Configure Prisma Access to learn group mapping via SAML assertion

Assign a master device in Panorama through which Prisma Access learns groups

Set up group mapping redistribution between an onsite Palo Alto Networks firewall and Prisma Access

Create a group mapping configuration that references an LDAP profile that points to on-premises domain controllers

68. A company wants to use their Active Directory groups to simplify their Security policy creation from Panorama.

Which configuration is necessary to retrieve groups from Panorama?

Configure an LDAP Server profile and enable the User-ID service on the management interface.

Configure a group mapping profile to retrieve the groups in the target template.

Configure a Data Redistribution Agent to receive IP User Mappings from User-ID agents.

Configure a master device within the device groups.

69. A variable name must start with which symbol?

70. Which version of GlobalProtect supports split tunneling based on destination domain, client process, and HTTP/HTTPS video streaming application?

GlobalProtect version 4.0 with PAN-OS 8.1

GlobalProtect version 4.1 with PAN-OS 8.1

GlobalProtect version 4.1 with PAN-OS 8.0

GlobalProtect version 4.0 with PAN-OS 8.0

Page 8 of 11

71. What are two common reasons to use a "No Decrypt" action to exclude traffic from SSL decryption? (Choose two.)

the website matches a category that is not allowed for most users

the website matches a high-risk category

the web server requires mutual authentication

the website matches a sensitive category

72. When setting up a security profile which three items can you use? (Choose three)

Wildfire analysis

anti-ransom ware

antivirus

URL filtering

decryption profile

73. A network administrator wants to deploy GlobalProtect with pre-logon for Windows 10 endpoints and follow Palo Alto Networks best practices.

To install the certificate and key for an endpoint, which three components are required? (Choose three.)

server certificate

local computer store

private key

self-signed certificate

machine certificate

74. What is considered the best practice with regards to zone protection?

Review DoS threat activity (ACC > Block Activity) and look for patterns of abuse

Use separate log-forwarding profiles to forward DoS and zone threshold event logs separately from other threat logs

If the levels of zone and DoS protection consume too many firewall resources, disable zone protection

Set the Alarm Rate threshold for event-log messages to high severity or critical severity

75. What are the two behavior differences between Highlight Unused Rules and the Rule Usage Hit counter when a firewall is rebooted? (Choose two.)

Rule Usage Hit counter will not be reset

Highlight Unused Rules will highlight all rules.

Highlight Unused Rules will highlight zero rules.

Rule Usage Hit counter will reset.

76. Which interface configuration will accept specific VLAN IDs?

Tab Mode

Subinterface

Access Interface

Trunk Interface

77. Which User-ID method maps IP address to usernames for users connecting through a web proxy that has already authenticated the user?

Client Probing

Port mapping

Server monitoring

Syslog listening

78. An administrator needs firewall access on a trusted interface.

Which two components are required to configure certificate based, secure authentication to the web Ul? (Choose two)

certificate profile

server certificate

SSH Service Profile

SSL/TLS Service Profile

79. The firewall identifies a popular application as an unknown-tcp.

Which two options are available to identify the application? (Choose two.)

Create a custom application.

Create a custom object for the custom application server to identify the custom application.

Submit an App-ID request to Palo Alto Networks.

Create a Security policy to identify the custom application.

80. Which three fields can be included in a pcap filter? (Choose three)

Egress interface

Source IP

Rule number

Destination IP

Ingress interface

Page 9 of 11

81. An administrator needs to gather information about the CPU utilization on both the management plane and the data plane

Where does the administrator view the desired data?

Monitor > Utilization

Resources Widget on the Dashboard

Support > Resources

Application Command and Control Center

82. Which feature can provide NGFWs with User-ID mapping information?

Web Captcha

Native 802.1q authentication

GlobalProtect

Native 802.1x authentication

83. Support for which authentication method was added in PAN-OS 8.0?

RADIUS

LDAP

Diameter

TACACS+

84. What would allow a network security administrator to authenticate and identify a user with a new BYOD-type device that is not joined to the corporate domain'?

a Security policy with 'known-user" selected in the Source User field

an Authentication policy with 'unknown' selected in the Source User field

a Security policy with 'unknown' selected in the Source User field

an Authentication policy with 'known-user' selected in the Source User field

85. PBF can address which two scenarios? (Select Two)

forwarding all traffic by using source port 78249 to a specific egress interface

providing application connectivity the primary circuit fails

enabling the firewall to bypass Layer 7 inspection

routing FTP to a backup ISP link to save bandwidth on the primary ISP link

86. If an administrator does not possess a website’s certificate, which SSL decryption mode will allow the Palo Alto networks NGFW to inspect when users browse to HTTP(S) websites?

SSL Forward Proxy

SSL Inbound Inspection

TLS Bidirectional proxy

SSL Outbound Inspection

87. In a virtual router, which object contains all potential routes?

MIB

RIB

SIP

FIB

88. How does Panorama prompt VMWare NSX to quarantine an infected VM?

HTTP Server Profile

Syslog Server Profile

Email Server Profile

SNMP Server Profile

89. Which Device Group option is assigned by default in Panorama whenever a new device group is created to manage a Firewall?

Master

Universal

Shared

Global

90. How can an administrator configure the NGFW to automatically quarantine a device using GlobalProtect?

by adding the device's Host ID to a quarantine list and configure GlobalProtect to prevent users from connecting to the GlobalProtect gateway from a quarantined device

by using security policies, log forwarding profiles, and log settings.

by exporting the list of quarantined devices to a pdf or csv file by selecting PDF/CSV at the bottom of the Device Quarantine page and leveraging the approbate XSOAR playbook

There is no native auto-quarantine feature so a custom script would need to be leveraged.

Page 10 of 11

91. Which three rule types are available when defining policies in Panorama? (Choose three.)

Pre Rules

Post Rules

Default Rules

Stealth Rules

Clean Up Rules

92. Which menu item enables a firewall administrator to see details about traffic that is currently active through the NGFW?

App Scope

ACC

Session Browser

System Logs

93. What is a key step in implementing WildFire best practices?

In a mission-critical network, increase the WildFire size limits to the maximum value

In a security-first network set the WildFire size limits to the minimum value

Configure the firewall to retrieve content updates every minute

Ensure that a Threat Prevention subscription is active

94. An administrator has a requirement to export decrypted traffic from the Palo Alto Networks NGFW to a third-party, deep-level packet inspection appliance.

Which interface type and license feature are necessary to meet the requirement?

Decryption Mirror interface with the Threat Analysis license

Virtual Wire interface with the Decryption Port Export license

Tap interface with the Decryption Port Mirror license

Decryption Mirror interface with the associated Decryption Port Mirror license

95. Which two features require another license on the NGFW? (Choose two.)

SSL Inbound Inspection

SSL Forward Proxy

Decryption Mirror

Decryption Broker

96. Given the following snippet of a WildFire submission log. did the end-user get access to the requested information and why or why not?

Yes. because the action is set to "allow ''

No because WildFire categorized a file with the verdict "malicious"

Yes because the action is set to "alert"

No because WildFire classified the seventy as "high."

97. Which of the following commands would you use to check the total number of the sessions that are currently going through SSL Decryption processing?

show session all ssI-decrypt yes count yes

show session filter ssl-decryption yes total-count yes

show session all filter ssl-decrypt yes count yes

show session all filter ssl-decryption yes total-count yes

98. When configuring a GlobalProtect Portal, what is the purpose of specifying an Authentication Profile?

To enable Gateway authentication to the Portal

To enable Portal authentication to the Gateway

To enable user authentication to the Portal

To enable client machine authentication to the Portal

99. The IT department has received complaints abou VoIP call jitter when the sales staff is making or receiving calls. QoS is enabled on all firewall interfaces, but there is no QoS policy written in the rulebase. The IT manager wants to find out what traffic is causing the jitter in real time when a user reports the jitter.

Which feature can be used to identify, in real time, the applications taking up the most bandwidth?

QoS Statistics

Applications Report

Application Command Center (ACC)

QoS Log

100. A customer wants to spin their session load equally across two SD-WAN-enabled interfaces.

Where would you configure this setting?

Path Quality profile

ECMP setting on virtual router

Traffic Dtstnbution profile

SD-WAN Interface profile

Page 11 of 11

101. How can packet butter protection be configured?

at me device level (globally to protect firewall resources and ingress zones, but not at the zone level

at the device level (globally) and it enabled globally, at the zone level

at the interlace level to protect firewall resources

at zone level to protect firewall resources and ingress zones but not at the device level

102. A network-security engineer attempted to configure a bootstrap package on Microsoft Azure, but the virtual machine provisioning process failed. In reviewing the bootstrap package, the engineer only had the following directories: /config, /license and /software

Why did the bootstrap process fail for the VM-Series firewall in Azure?

All public cloud deployments require the /plugins folder to support proper firewall native integrations

The /content folder is missing from the bootstrap package

The VM-Series firewall was not pre-registered in Panorama and prevented the bootstrap process from successfully completing

The /config or /software folders were missing mandatory files to successfully bootstrap

103. Which method does an administrator use to integrate all non-native MFA platforms in PAN-OS® software?

Okta

DUO

RADIUS

PingID

104. An administrator sees several inbound sessions identified as unknown-tcp in the Traffic logs. The administrator determines that these sessions are form external users accessing the company’s proprietary accounting application. The administrator wants to reliably identify this traffic as their accounting application and to scan this traffic for threats.

Which option would achieve this result?

Create a custom App-ID and enable scanning on the advanced tab.

Create an Application Override policy.

Create a custom App-ID and use the “ordered conditions” check box.

Create an Application Override policy and custom threat signature for the application.

105. A client has a sensitive application server in their data center and is particularly concerned about session flooding because of denial of-service attacks.

How can the Palo Alto Networks NGFW be configured to specifically protect this server against session floods originating from a single IP address?

Define a custom App-ID to ensure that only legitimate application traffic reaches the server

Add QoS Profiles to throttle incoming requests

Add a tuned DoS Protection Profile

Add an Anti-Spyware Profile to block attacking IP address

106. What are three valid actions in a File Blocking Profile? (Choose three)

Forward

Block

Alret

Upload

Reset-both

Continue

107. If the firewall has the link monitoring configuration, what will cause a failover?

ethernet1/3 and ethernet1/6 going down

ethernet1/3 going down

ethernet1/3 or Ethernet1/6 going down

ethernet1/6 going down

108. Which operation will impact performance of the management plane?

DoS protection

WildFire submissions

generating a SaaS Application report

decrypting SSL sessions

109. To support a new compliance requirement, your company requires positive username attribution of every IP address used by wireless devices You must collect IP address-to-username mappings as soon as possible with minimal downtime and minimal configuration changes to the wireless devices themselves The wireless devices are from various manufacturers

Given the scenario, choose the option for sending IP address-to-username mappings to the firewall

UID redistribution

RADIUS

syslog listener

XFF headers

110. Your company has to Active Directory domain controllers spread across multiple WAN links All users authenticate to Active Directory Each link has substantial network bandwidth to support all mission-critical applications. The firewalls management plane is highly utilized

Given this scenario which type of User-ID agent is considered a best practice by Palo Alto Networks?

PAN-OS integrated agent

Captive Portal

Citrix terminal server agent with adequate data-plane resources

Windows-based User-ID agent on a standalone server