[Apr-2023] PCNSE Dumps are Available for Instant Access using ITPassLeader
PCNSE Dumps 2023 - New Palo Alto Networks PCNSE Exam Questions
PCNSE Exam topics
Candidates must know the exam topics before they start of preparation. Because it will really help them in hitting the core. Our PCNSE exam dumps pdf will include the following topics:
- Core Concepts 23%
- Planning 16%
- Configuration Troubleshooting 18%
- Operation 20%
- Deploying and Configure 23%
Along with that, the following are some important aspects of the exam and covered in PCNSE exam dumps.
- Security and NAT Policies
- Initial Configuration
- Next Generation Security Practices
- Interface Configuration
- Security Platform and Architecture
- URL Filtering
- Monitoring and Reporting
- User-ID™
- Active/Passive High Availability
- WildFire™
- Content-ID™
- GlobalProtect™
- Decryption
- App-ID™
NEW QUESTION 110
Which two benefits come from assigning a Decryption Profile to a Decryption policy rule with a "No Decrypt" action? (Choose two.)
- A. Block sessions with expired certificates
- B. Block sessions with untrusted issuers
- C. Block credential phishing
- D. Block sessions with client authentication
- E. Block sessions with unsupported cipher suites
Answer: A,B
Explanation:
Explanation
https://www.paloaltonetworks.com/documentation/71/pan-os/
pan-os/decryption/configure-decryption-exceptions
NEW QUESTION 111
Which statement accurately describes service routes and virtual systems?
- A. Virtual systems cannot have dedicated service routes configured: and virtual systems always use the global service and service route settings for the firewall
- B. The interface must be used for traffic to the required external services
- C. Virtual systems that do not have specific service routes configured inherit the global service and service route settings for the firewall
- D. Virtual systems can only use one interface for all global service and service routes of the firewall
Answer: C
Explanation:
"When a firewall is enabled for multiple virtual systems, the virtual systems inherit the global service and service route settings." So you can define specific service routes if you want, but they start out as inherited from the global settings.
NEW QUESTION 112
A network design calls for a "router on a stick" implementation with a PA-5060 performing inter-VLAN routing All VLAN-tagged traffic will be forwarded to the PA-5060 through a single dot1q trunk interface Which interface type and configuration setting will support this design?
- A. Layer 3 interface type with specified tag
- B. Trunk interface type with specified tag
- C. Layer 3 subinterface type with specified tag
- D. Layer 2 interface type with a VLAN assigned
Answer: C
NEW QUESTION 113
Which two mechanisms help prevent a spilt brain scenario an Active/Passive High Availability (HA) pair? (Choose two)
- A. Configure Ethernet 1/1 as HA2 Backup
- B. Configure Ethernet 1/1 as HA1 Backup
- C. Configure the management interface as HA3 Backup
- D. Configure the management interface as HA1 Backup
- E. Configure the management interface as HA2 Backup
- F. Configure ethernet1/1 as HA3 Backup
Answer: B,D
Explanation:
E: For firewalls without dedicated HA ports, select two data interfaces for the HA2 link and the backup HA1 link. Then, use an Ethernet cable to connect these in-band HA interfaces across both firewalls.
Use the management port for the HA1 link and ensure that the management ports can connect to each other across your network.
B:
1. In Device > High Availability > General, edit the Control Link (HA1) section.
2. Select the interface that you have cabled for use as the HA1 link in the Port drop down menu.
Set the IP address and netmask. Enter a Gateway IP address only if the HA1 interfaces are on separate subnets. Do not add a gateway if the devices are directly connected.
https://www.paloaltonetworks.com/documentation/60/pan-os/pan-os/high-availability/configure- active-passive-ha
NEW QUESTION 114
Match each type of DoS attack to an example of that type of attack
Answer:
Explanation:
NEW QUESTION 115
An administrator has created an SSL Decryption policy rule that decrypts SSL sessions on any port. Which log entry can the administrator use to verify that sessions are being decrypted?
- A. In the details of the Traffic log entries
- B. Decryption log
- C. Data Filtering log
- D. In the details of the Threat log entries
Answer: A
Explanation:
Reference:
https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Implement-and-Test-SSL-Decryption/ta-p/59719
NEW QUESTION 116
Which URL Filtering Security Profile action togs the URL Filtering category to the URL Filtering log?
- A. Log
- B. Alert
- C. Default
- D. Allow
Answer: B
NEW QUESTION 117
Which feature must you configure to prevent users from accidentally submitting their corporate credentials to a phishing website?
- A. URL Filtering profile
- B. Vulnerability Protection profile
- C. Anti-Spyware profile
- D. Zone Protection profile
Answer: A
Explanation:
Explanation/Reference: https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/threat-prevention/prevent- credential-phishing
NEW QUESTION 118
Before an administrator of a VM-500 can enable DoS and zone protection, what actions need to be taken?
- A. Create a zone protection profile with flood protection configured to defend an entire egress zone against SYN. ICMP ICMPv6, UDP. and other IP flood attacks
- B. Measure and monitor the CPU consumption of the firewall data plane to ensure that each firewall is properly sized to support DoS and zone protection
- C. Add a WildFire subscription to activate DoS and zone protection features
- D. Replace the hardware firewall because DoS and zone protection are not available with VM-Series systems
Answer: B
Explanation:
Explanation
1 -
https://docs.paloaltonetworks.com/best-practices/8-1/dos-and-zone-protection-best-practices/dos-and-zone-prote
2 -
https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/zone-protection-and-dos-protection/zone-defense/ta
https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/zone-protection-and-dos-protection.html
NEW QUESTION 119
Which operation will impact performance of the management plane?
- A. WildFire submissions
- B. decrypting SSL sessions
- C. generating a SaaS Application report
- D. DoS protection
Answer: C
NEW QUESTION 120
Which two events trigger the operation of automatic commit recovery? (Choose two.)
- A. when Panorama pushes a configuration
- B. when a firewall HA pair fails over
- C. when a firewall performs a local commit
- D. when an aggregate Ethernet interface component fails
Answer: A,C
Explanation:
https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-new-features/panorama-features/automatic-panorama-connection-recovery.html
Automatic commit recovery allows you to configure the firewall to attempt a specified number of connectivity tests after:
1- you push a configuration from Panorama or
2- commit a configuration change locally on the firewall.
Additionally, the firewall checks connectivity to Panorama every hour to ensure consistent communication in the event unrelated network configuration changes have disrupted connectivity between the firewall and Panorama or if implications to a pushed committed configuration may have affected connectivity.
NEW QUESTION 121
An administrator using an enterprise PKI needs to establish a unique chain of trust to ensure mutual authentication between Panorama and the managed firewalls and Log Collectors.
How would the administrator establish the chain of trust?
- A. Configure strong password authentication
- B. Use custom certificates
- C. Enable LDAP or RADIUS integration
- D. Set up multi-factor authentication
Answer: B
Explanation:
Reference:
https://www.paloaltonetworks.com/documentation/80/panorama/panorama_adminguide/panora ma-overview/plan-your- panorama-deployment
NEW QUESTION 122
An Administrator is configuring Authentication Enforcement and they would like to create an exemption rule to exempt a specific group from authentication. Which authentication enforcement object should they select?
- A. default-authentication-bypass
- B. default-web-form
- C. default-browser-challenge
- D. default-no-captive-portal
Answer: D
Explanation:
Explanation/Reference: https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-web-interface-help/objects/objects- authentication
NEW QUESTION 123
An administrator is attempting to create policies for deployment of a device group and template stack. When creating the policies, the zone drop-down list does not include the required zone.
What can the administrator do to correct this issue?
- A. Add a firewall to both the device group and the template.
- B. Add the template as a reference template in the device group.
- C. Specify the target device as the master device in the device group.
- D. Enable "Share Unused Address and Service Objects with Devices" in Panorama settings.
Answer: B
NEW QUESTION 124
An administrator is using Panorama and multiple Palo Alto Networks NGFWs. After upgrading all devices to the latest PAN-OS® software, the administrator enables log forwarding from the firewalls to Panoram A.
Pre-existing logs from the firewalls are not appearing in PanoramA.
Which action would enable the firewalls to send their pre-existing logs to Panorama?
- A. Use the import option to pull logs into Panorama.
- B. The log database will need to exported form the firewalls and manually imported into Panorama.
- C. Use the ACC to consolidate pre-existing logs.
- D. A CLI command will forward the pre-existing logs to Panorama.
Answer: D
Explanation:
https://docs.paloaltonetworks.com/pan-os/8-0/pan-os-new-features/management-features/pa-7000-series-firewall-log-forwarding-to-panorama
NEW QUESTION 125
A Security policy rule is configured with a Vulnerability Protection Profile and an action of "Deny".
Which action will this cause configuration on the matched traffic?
- A. The configuration is valid. It will cause the firewall to deny the matched sessions. Any configured Security Profiles have no effect if the Security policy rule action is set to "Deny".
- B. The configuration will allow the matched session unless a vulnerability signature is detected. The "Deny" action will supersede the per-severity defined actions defined in the associated Vulnerability Protection Profile.
- C. The configuration is invalid. The Profile Settings section will be grayed out when the Action is set to "Deny".
- D. The configuration is invalid. It will cause the firewall to skip this Security policy rule. A warning will be displayed during a commit.
Answer: B
NEW QUESTION 126
A remote administrator needs access to the firewall on an untrust interlace. Which three options would you configure on an interface Management profile lo secure management access? (Choose three)
- A. HTTPS
- B. HTTP
- C. Permitted IP Addresses
- D. User-ID
- E. SSH
Answer: A,D,E
Explanation:
Explanation
https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/networking/configure-interfaces/use-interface-mana
NEW QUESTION 127
A firewall administrator needs to be able to inspect inbound HTTPS traffic on servers hosted in their DMZ to prevent the hosted service from being exploited. Which combination of features can allow PAN-OS to detect exploit traffic in a session with TLS encapsulation?
- A. Decryption policy and a Data Filtering profile
- B. Vulnerability Protection profile and a Decryption policy
- C. a WildFire profile and a File Blocking profile
- D. a Vulnerability Protection profile and a QoS policy
Answer: B
NEW QUESTION 128
Which four NGFW multi-factor authentication factors are supported by PAN-OS? (Choose four.)
- A. One-Time Password
- B. Short message service
- C. Push
- D. User logon
- E. Voice
- F. SSH key
Answer: A,B,C,E
Explanation:
Explanation
https://docs.paloaltonetworks.com/pan-os/8-0/pan-os-admin/authentication/authentication-types/multi-factor-auth
NEW QUESTION 129
Refer to the exhibit. A web server in the DMZ is being mapped to a public address through DNAT.
Which Security policy rule will allow traffic to flow to the web server?
- A. Untrust (any) to Untrust (10.1.1.100), web browsing - Allow
- B. Untrust (any) to Untrust (1.1.1.100), web browsing - Allow
- C. Untrust (any) to DMZ (10.1.1.100), web browsing - Allow
- D. Untrust (any) to DMZ (1.1.1.100), web browsing - Allow
Answer: D
NEW QUESTION 130
Which action disables Zero Touch Provisioning (ZTP) functionality on a ZTP firewall during the onboarding process?
- A. removing the Panorama serial number from the ZTP service
- B. removing the firewall as a managed device in Panorama
- C. performing a factory reset of the firewall
- D. performing a local firewall commit
Answer: D
Explanation:
https://docs.paloaltonetworks.com/panorama/10-0/panorama-admin/manage-firewalls/set-up-zero-touch-provisioning/add-ztp-firewalls-to-panorama/add-a-ztp-firewall-to-panorama.html#id182211ac-a31c-4122-a11f-19450ec9ca4e
NEW QUESTION 131
A company wants to use their Active Directory groups to simplify their Security policy creation from Panorama.
Which configuration is necessary to retrieve groups from Panorama?
- A. Configure an LDAP Server profile and enable the User-ID service on the management interface.
- B. Configure a Data Redistribution Agent to receive IP User Mappings from User-ID agents.
- C. Configure a master device within the device groups.
- D. Configure a group mapping profile to retrieve the groups in the target template.
Answer: C
Explanation:
Reference:
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PMtpCAG
NEW QUESTION 132
A company has a policy that denies all applications it classifies as bad and permits only application it classifies as good. The firewall administrator created the following security policy on the company's firewall.
Which interface configuration will accept specific VLAN IDs?
Which two benefits are gained from having both rule 2 and rule 3 presents? (choose two)
- A. Separate Log Forwarding profiles can be applied to rules 2 and 3.
- B. Rule 2 and 3 apply to traffic on different ports.
- C. A report can be created that identifies unclassified traffic on the network.
- D. Different security profiles can be applied to traffic matching rules 2 and 3.
Answer: A,D
NEW QUESTION 133
A firewall administrator requires an A/P HA pair to fail over more quickly due to critical business application uptime requirements.
What is the correct setting?
- A. Change the HA timer profile to "quick" and customize in advanced profile.
- B. Change the HA timer profile to "user-defined" and manually set the timers.
- C. Change the HA timer profile to "fast".
- D. Change the HA timer profile to "aggressive" or customize the settings in advanced profile.
Answer: B
Explanation:
Explanation
https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/high-availability/set-up-activepassive-ha/configure In an A/P HA pair, HA (High Availability) timers are used to determine how quickly the firewall should fail over in case of a failure. Typically, the firewall administrator can choose between several predefined timer profiles such as "normal", "aggressive", and "fast".
Changing the HA timer profile to "user-defined" and manually setting the timers would allow the administrator to fine-tune the failover timing and make sure it meets the uptime requirements for the critical business applications. This approach allows the administrator to set the timers to the lowest possible value without compromising the stability and security of the firewall.
NEW QUESTION 134
A company needs to preconfigure firewalls to be sent to remote sites with the least amount of reconfiguration. Once deployed, each firewall must establish secure tunnels back to multiple regional data centers to include the future regional data centers.
Which VPN configuration would adapt to changes when deployed to the future site?
- A. Preconfigured PPTP Tunnels
- B. Preconfigured IPsec tunnels
- C. Preconfigured GlobalProtect satellite
- D. Preconfigured GlobalProtect client
Answer: C
NEW QUESTION 135
......
Certification Overview
The Palo Alto Networks Certified Network Security Engineer is an advanced-level certification. This formal certificate validates that one possesses in-depth knowledge of the Palo Alto Networks product portfolio and can deploy it in a vast number of implementations. Commonly, the Palo Alto Networks product portfolio comprises multiple separate technologies working in unison to ward off cyber attacks. To a security-conscious employer, being PCNSE-certified provides additional assurance of one’s ability to correctly deploy the Palo Alto Networks Next-Generation Firewalls and manage the Palo Alto Networks technology. The Palo Alto Network’s reputation as a high-end security provider makes their validations highly valued by many organizations. This is why all of their certifications are considered prestigious. Are you wondering what the earnings potential and opportunities for IT specialists with the PCNSE certification look like? Well, PCNSE-certified IT professionals can expect to earn around $94,000 annually, according to Payscale.
The benefit in Obtaining the PCNSE Exam Certification
- Becoming Palo Alto Networks Certified Network Security Engineer means one thing you are worth more to the company and therefore more to yourself in the form of an upgraded pay package. On average a Palo Alto Networks Certified Network Security Engineer member of staff is estimated to be worth 30% more to a company than their uncertified professionals.
- Candidates will get in-depth knowledge by completing the courses along with the access to revision materials for 6 months upon completion means they will have a wider skill set when it comes to the various technologies and systems than an uncertified professional. Certified Professional in this particular skill set is 74% more efficient when it comes to completing their tasks in a timely well-executed manner.
- Organization owners invest a lot in their employees when it comes to their training with the goal of making them quicker, more efficient, and more knowledgeable about their role. Certified Professional will reduce the time he spends on tasks, meaning he can get more done this could help reduce company downtime when repairing faults on a system or fixing hardware problems.
- After completion of Palo Alto Networks Certified Network Security Engineer Certification candidates receive official confirmation from Palo Alto that you are now fully certified in their chosen field. This can be now added to their CV, cover letters and job applications.
- When Candidates applying for a job or looking to promotion in their current position, an Palo Alto Networks Certified Network Security Engineer certification in the field in which Candidates are applying will put you at the top of the list and make them a desirable candidate for employers.
Palo Alto Networks PCNSE Exam Practice Test Questions: https://exam-labs.itpassleader.com/Palo-Alto-Networks/PCNSE-dumps-pass-exam.html