File Info
| Exam | Palo Alto Networks Certified Network Security Engineer |
| Number | PCNSE |
| File Name | Palo Alto Networks.PCNSE.VCEplus.2024-10-28.252q.vcex |
| Size | 11 MB |
| Posted | Oct 28, 2024 |
| Download | Palo Alto Networks.PCNSE.VCEplus.2024-10-28.252q.vcex |
How to open VCEX & EXAM Files?
Files with VCEX & EXAM extensions can be opened by ProfExam Simulator.
Coupon: MASTEREXAM
With discount: 20%
Demo Questions
Question 1
An administrator has configured the Palo Alto Networks NGFW's management interface to connect to the internet through a dedicated path that does not traverse back through the NGFW itself.
Which configuration setting or step will allow the firewall to get automatic application signature updates?
- A scheduler will need to be configured for application signatures.
- A Security policy rule will need to be configured to allow the update requests from the firewall to the update servers.
- A Threat Prevention license will need to be installed.
- A service route will need to be configured.
Correct answer: A
Explanation:
Reference: https://www.paloaltonetworks.com/documentation/80/pan-os/web-interface-help/device/device-dynamic-updates Reference: https://www.paloaltonetworks.com/documentation/80/pan-os/web-interface-help/device/device-dynamic-updates
Question 2
Before an administrator of a VM-500 can enable DoS and zone protection, what actions need to be taken?
- Measure and monitor the CPU consumption of the firewall data plane to ensure that each firewall is properly sized to support DoS and zone protection
- Create a zone protection profile with flood protection configured to defend an entire egress zone against SYN. ICMP ICMPv6, UDP. and other IP flood attacks
- Add a WildFire subscription to activate DoS and zone protection features
- Replace the hardware firewall because DoS and zone protection are not available with VM-Series systems
Correct answer: A
Explanation:
1 - https://docs.paloaltonetworks.com/best-practices/8-1/dos-and-zone-protection-best-practices/dos-and-zone-protection-best-practices/deploy-dos-and-zone-protection-usingbestpractices.html#:~:text=DoS%20and%20Zone%20Protection%20help,device%20at%20the%20internet%20perimeter.2 - https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/zone-protection-and-dosprotection/zone-defense/take-baseline-cps-measurements-for-setting-flood-thresholds/how-to-measure-cps.htmlhttps://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/zone-protection-and-dosprotection.html 1 - https://docs.paloaltonetworks.com/best-practices/8-1/dos-and-zone-protection-best-practices/dos-and-zone-protection-best-practices/deploy-dos-and-zone-protection-usingbestpractices.
html#:~:text=DoS%20and%20Zone%20Protection%20help,device%20at%20the%20internet%20perimeter.
2 - https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/zone-protection-and-dosprotection/zone-defense/take-baseline-cps-measurements-for-setting-flood-thresholds/how-to-measure-cps.html
https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/zone-protection-and-dosprotection.html
Question 3
An engineer wants to implement the Palo Alto Networks firewall in VWire mode on the internet gateway and wants to be sure of the functions that are supported on the vwire interface What are three supported functions on the VWire interface? (Choose three )
- NAT
- QoS
- IPSec
- OSPF
- SSL Decryption
Correct answer: ABE
Explanation:
virtual wire supports blocking or allowing traffic based on virtual LAN (VLAN) tags, in addition to supporting security policy rules, App-ID, Content-ID, User-ID, decryption, LLDP, active/passive and active/active HA, QoS, zone protection (with some exceptions), non-IP protocol protection, DoS protection, packet buffer protection, tunnel content inspection, and NAT." virtual wire supports blocking or allowing traffic based on virtual LAN (VLAN) tags, in addition to supporting security policy rules, App-ID, Content-ID, User-ID, decryption, LLDP, active/passive and active/active HA, QoS, zone protection (with some exceptions), non-IP protocol protection, DoS protection, packet buffer protection, tunnel content inspection, and NAT."
Question 4
An engineer decides to use Panorama to upgrade devices to PAN-OS 10.2.
Which three platforms support PAN-OS 10.2? (Choose three.)
- PA-5000 Series
- PA-500
- PA-3400Series
- PA-220
- PA-800 Series
Correct answer: CDE
Question 5
An engineer manages a high availability network and requires fast failover of the routing protocols. The engineer decides to implement BFD.
Which three dynamic routing protocols support BFD? (Choose three.)
- OSPF
- RIP
- BGP
- IGRP
- OSPFv3 virtual link
Correct answer: ABC
Question 6
Refer to the exhibit.
Which will be the egress interface if the traffic's ingress interface is ethernet1/7 sourcing from 192.168.111.3 and to the destination 10.46.41.113?
- ethernet1/6
- ethernet1/3
- ethernet1/7
- ethernet1/5
Correct answer: D
Question 7
An engineer is configuring a template in Panorama which will contain settings that need to be applied to all firewalls in production.
Which three parts of a template an engineer can configure? (Choose three.)
- NTP Server Address
- Antivirus Profile
- Authentication Profile
- Service Route Configuration
- Dynamic Address Groups
Correct answer: ACD
Explanation:
NTP Server Address D.Service Route Configuration Short Explanation of Correct Answer Only: These parts of a template can be configured on Panorama1.An antivirus profile and an authentication profile are not parts of a template, but parts of a device group2. Reference:1: https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/manage-firewalls/manage-templates-and-template-stacks/templates-and-template-stacks-overview2: https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/manage-firewalls/manage-device-groups/device-group-overview NTP Server Address D.Service Route Configuration Short Explanation of Correct Answer Only: These parts of a template can be configured on Panorama1.An antivirus profile and an authentication profile are not parts of a template, but parts of a device group2.
Reference:
1: https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/manage-firewalls/manage-templates-and-template-stacks/templates-and-template-stacks-overview
2: https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/manage-firewalls/manage-device-groups/device-group-overview
Question 8
A security engineer needs firewall management access on a trusted interface.
Which three settings are required on an SSL/TLS Service Profile to provide secure Web UI authentication? (Choose three.)
- Minimum TLS version
- Certificate
- Encryption Algorithm
- Maximum TLS version
- Authentication Algorithm
Correct answer: ABD
Question 9
An administrator notices that an interface configuration has been overridden locally on a firewall. They require all configuration to be managed from Panorama and overrides are not allowed.
What is one way the administrator can meet this requirement?
- Perform a commit force from the CLI of the firewall.
- Perform a template commit push from Panorama using the 'Force Template Values' option.
- Perform a device-group commit push from Panorama using the 'Include Device and Network Templates' option.
- Reload the running configuration and perform a Firewall local commit
Correct answer: B
Explanation:
This option will overwrite any local configuration on the firewall with the template configuration from Panorama1.Performing a commit force from the CLI of the firewall will not remove the local override2.Performing a device-group commit push from Panorama using the ''Include Device and Network Templates'' option will not remove the local override3.Reloading the running configuration and performing a Firewall local commit will not remove the local override. Reference:1: https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/manage-firewalls/manage-templates-and-template-stacks/force-template-values2: https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-cli-quick-start/use-the-cli/commitchanges3: https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/manage-firewalls/manage-device-groups/push-policy-and-configuration-to-firewalls 4: https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/firewalladministration/manage-firewall-configurations/revert-to-a-previous-configuration This option will overwrite any local configuration on the firewall with the template configuration from Panorama1.Performing a commit force from the CLI of the firewall will not remove the local override2.Performing a device-group commit push from Panorama using the ''Include Device and Network Templates'' option will not remove the local override3.Reloading the running configuration and performing a Firewall local commit will not remove the local override.
Reference:
1: https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/manage-firewalls/manage-templates-and-template-stacks/force-template-values
2: https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-cli-quick-start/use-the-cli/commitchanges
3: https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/manage-firewalls/manage-device-groups/push-policy-and-configuration-to-firewalls
4: https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/firewalladministration/manage-firewall-configurations/revert-to-a-previous-configuration
Question 10
A firewall engineer reviews the PAN-OS GlobalProtect application and sees that it implicitly uses web-browsing and depends on SSL.
When creating a new rule, what is needed to allow the application to resolve dependencies?
- Add SSL and web-browsing applications to the same rule.
- Add web-browsing application to the same rule.
- Add SSL application to the same rule.
- SSL and web-browsing must both be explicitly allowed
Correct answer: C
