[Mar 30, 2024] Fast Exam Updates PCNSE dumps with PDF Test Engine Practice
Exam Valid Dumps with Instant Download Free Updates
NEW QUESTION # 57
Which Panorama feature allows for logs generated by Panorama to be forwarded to an external Security Information and Event Management(SIEM) system?
- A. Panorama Log Settings
- B. Panorama Device Group Log Forwarding
- C. Collector Log Forwarding for Collector Groups
- D. Panorama Log Templates
Answer: A
Explanation:
https://www.paloaltonetworks.com/documentation/61/panorama/panorama_adminguide/ma nage-log-collection/enable-log-forwarding-from-panorama-to-external-destinations
NEW QUESTION # 58
ln a security-first network, what is the recommended threshold value for apps and threats to be dynamically updated?
- A. 1 to 4 hours
- B. 6 to 12 hours
- C. 36 hours
- D. 24 hours
Answer: A
Explanation:
Explanation
According to the best practices for content updates for security-first networks, the recommended threshold value for apps and threats to be dynamically updated is 1 to 4 hours. This ensures that the network is protected against the latest threats and exploits as soon as possible. References: Best Practices for Content Updates-Security-First - Palo Alto Networks
https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/software-and-content-updates/best-practices-for-app
NEW QUESTION # 59
What type of address object would be useful for internal devices where the addressing structure assigns meaning to certain bits in the address, as illustrated in the diagram?
- A. IP Netmask
- B. IP Wildcard Mask
- C. IP Range
- D. IP Address
Answer: B
Explanation:
https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/policy/use-address-object-to-represent-ip-addresses/address-objects An IP Wildcard Mask address object is useful for internal devices where the addressing structure assigns meaning to certain bits in the address, as illustrated in the diagram. An IP Wildcard Mask address object specifies which source or destination addresses are subject to a Security policy rule. A zero ( 0 ) bit in the mask indicates that the bit being compared must match the bit in the IP address that is covered by the zero. A one ( 1 ) bit in the mask (a wildcard bit) indicates that the bit being compared need not match the bit in the IP address1. For example, if you want to match all cash registers in the northeastern U.S., you can use an IP Wildcard Mask address object of 10.132.1.0/0.0.2.255, which will match any IP address from 10.132.1.0 to 10.132.3.255. Reference: 1: https://docs.paloaltonetworks.com/network-security/security-policy/objects/addresses
NEW QUESTION # 60
A network administrator troubleshoots a VPN issue and suspects an IKE Crypto mismatch between peers.
Where can the administrator find the corresponding logs after running a test command to initiate the VPN?
- A. Tunnel Inspection logs
- B. Configuration logs
- C. System logs
- D. Traffic logs
Answer: C
Explanation:
Explanation
According to the Palo Alto Networks documentation, "To view IKE and IPSec Crypto profiles in the logs, filter the System log for eventid equal to vpn (Monitor > Logs > System)." References:
https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/vpn/set-up-site-to-site-vpn/set-up-ike-crypto-profil
NEW QUESTION # 61
Please match the terms to their corresponding definitions.
Answer:
Explanation:
Explanation
Graphical user interface Description automatically generated with medium confidence
NEW QUESTION # 62
Which processing order will be enabled when a Panorama administrator selects the setting "Objects defined in ancestors will take higher precedence?"
- A. Ancestor objects will have precedence over descendant objects.
- B. Ancestor objects will have precedence over other ancestor objects.
- C. Descendant objects will take precedence over other descendant objects.
- D. Descendant objects will take precedence over ancestor objects.
Answer: A
Explanation:
Explanation/Reference:
Reference: https://www.paloaltonetworks.com/documentation/71/pan-os/web-interface-help/device/device- setup-management
NEW QUESTION # 63
A organizations administrator has the funds available to purchase more firewalls to increase the organization's security posture.
The partner SE recommends placing the firewalls as close as possible to the resources that they protect Is the SE's advice correct and why or why not?
- A. No Placing firewalls m front of perimeter DDoS devices provides greater protection tor sensitive devices inside the network
- B. Yes Firewalls are session based so they do not scale to millions of CPS
- C. No Firewalls provide new defense and resilience to prevent attackers at every stage of the cyberattack lifecycle independent of placement
- D. Yes Zone Protection profiles can be tailored to the resources that they protect via the configuration of specific device types and operating systems
Answer: C
NEW QUESTION # 64
The firewall determines if a packet is the first packet of a new session or if a packet is part of an existing session using which kind of match?
- A. 6-tuple match:
Source IP Address, Destination IP Address, Source port, Destination Port, Protocol, and Source Security Zone - B. 5-tuple match:
Source IP Address, Destination IP Address, Source port, Destination Port, Protocol - C. 9-tuple match:
Source IP Address, Destination IP Address, Source port, Destination Port, Source User, Source Security Zone, Destination Security Zone, Application, and URL Category - D. 7-tuple match:
Source IP Address, Destination IP Address, Source port, Destination Port, Source User, URL Category, and Source Security Zone
Answer: A
Explanation:
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVECA0
NEW QUESTION # 65
How does Panorama prompt VMWare NSX to quarantine an infected VM?
- A. HTTP Server Profile
- B. SNMP Server Profile
- C. Syslog Server Profile
- D. Email Server Profile
Answer: A
Explanation:
Explanation/Reference:
Reference: https://www.paloaltonetworks.com/documentation/80/virtualization/virtualization/set-up-the-vm-
series-firewall-on-vmware-nsx/dynamically-quarantine-infected-guests
NEW QUESTION # 66
A client has a sensitive application server in their data center and is particularly concerned about session flooding because of denial of-service attacks.
How can the Palo Alto Networks NGFW be configured to specifically protect this server against session floods originating from a single IP address?
- A. Add a tuned DoS Protection Profile
- B. Add an Anti-Spyware Profile to block attacking IP address
- C. Define a custom App-ID to ensure that only legitimate application traffic reaches the server
- D. Add QoS Profiles to throttle incoming requests
Answer: A
Explanation:
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClmTCAS
DoS Protection Profiles set the protection thresholds to provide DoS protection against flooding of new sessions for IP floods (CPS limits) to provide resource protection (maximum concurrent session limits for specified endpoints and resources) and to configure whether the profile applies to aggregate or classified traffic. DoS Protection policy rules control where to apply DoS protection and which action to take when traffic matches the criteria defined in the rule. Unlike a Zone Protection Profile, which protects only the ingress zone, DoS Protection Profiles and policy rules can protect specific resources inside a zone and traffic flowing between different endpoints and areas. Unlike the case with a Zone Protection Profile, which supports only aggregate traffic, you can configure aggregate or classified DoS Protection Profiles and policy rules.
NEW QUESTION # 67
An administrator has been asked to create 100 virtual firewalls in a local, on-premise lab environment (not in
"the cloud"). Bootstrapping is the most expedient way to perform this task.
Which option describes deployment of a bootstrap package in an on-premise virtual environment?
- A. Use an S3 bucket with an ISO.
- B. Create and attach a virtual hard disk (VHD).
- C. Use config-drive on a USB stick.
- D. Use a virtual CD-ROM with an ISO.
Answer: D
Explanation:
Reference:
https://www.paloaltonetworks.com/documentation/71/pan-os/newfeaturesguide/management-features/bootstrapp firewalls-for-rapid-deployment.html
NEW QUESTION # 68
Which statement about High Availability timer settings is true?
- A. Use the Moderate timer for typical failover timer settings.
- B. Use the Critical timer for taster failover timer settings.
- C. Use the Aggressive timer for taster failover timer settings
- D. Use the Recommended timer for faster failover timer settings.
Answer: D
Explanation:
Explanation
https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/high-availability/ha-concepts/ha-timers
NEW QUESTION # 69
Which CLI command enables an administrator to view details about the firewall including uptime, PAN-OS version, and serial number?
- A. show session info
- B. show system info
- C. show system details
- D. debug system details
Answer: B
Explanation:
Reference: https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/technical- documentation/pan-os-60/PAN-OS-6.0- CLI-ref.pdf
NEW QUESTION # 70
Refer to the exhibit. A web server in the DMZ is being mapped to a public address through DNAT.
Which Security policy rule will allow traffic to flow to the web server?
- A. Untrust (any) to Untrust (1.1.1.100), web browsing - Allow
- B. Untrust (any) to DMZ (10.1.1.100), web browsing - Allow
- C. Untrust (any) to DMZ (1.1.1.100), web browsing - Allow
- D. Untrust (any) to Untrust (10.1.1.100), web browsing - Allow
Answer: C
NEW QUESTION # 71
Phase two of a VPN will not establish a connection. The peer is using a policy-based VPN configuration.
What part of the configuration should the engineer verify?
- A. PAN-OS versions
- B. IKE Crypto Profile
- C. Proxy-IDs
- D. Security policy
Answer: C
Explanation:
Explanation
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClbXCAS
https://live.paloaltonetworks.com/t5/general-topics/phase-2-tunnel-is-not-up/td-p/424789
NEW QUESTION # 72
A firewall administrator notices that many Host Sweep scan attacks are being allowed through the firewall sourced from the outside zone. What should the firewall administrator do to mitigate this type of attack?
- A. Create a Zone Protection profile, enable reconnaissance protection, set action to Block, and apply it to the outside zone.
- B. Enable packet buffer protection in the outside zone.
- C. Create a Security rule to deny all ICMP traffic from the outside zone.
- D. Create a DOS Protection profile with SYN Flood protection enabled and apply it to all rules allowing traffic from the outside zone
Answer: A
Explanation:
https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/zone-protection-and-dos-protection/configure-zone-protection-to-increase-network-security/configure-reconnaissance-protection
NEW QUESTION # 73
A remote administrator needs firewall access on an untrusted interface Which two components are required on the firewall to configure certificate-based administrator authentication to the web Ul? (Choose two)
- A. server certificate
- B. certificate authority (CA) certificate
- C. certificate profile
- D. client certificate
Answer: C,D
Explanation:
Explanation
https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/firewall-administration/manage-firewall-administrat
NEW QUESTION # 74
An Administrator is configuring an IPSec VPN toa Cisco ASA at the administrator's home and experiencing issues completing the connection. The following is th output from the command:
What could be the cause of this problem?
- A. The public IP addresses do not match for both the Palo Alto Networks Firewall and the ASA.
- B. The deed peer detection settings do not match between the Palo Alto Networks Firewall and the ASA
- C. The Proxy IDs on the Palo Alto Networks Firewall do not match the settings on the ASA.
- D. The shared secrets do not match between the Palo Alto firewall and the ASA
Answer: A
Explanation:
https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/vpns/interpret-vpn-error- messages
NEW QUESTION # 75
A global corporate office has a large-scale network with only one User-ID agent, which creates a bottleneck near the User-ID agent server.
Which solution in PAN-OS® software would help in this case?
- A. Application override
- B. Virtual Wire mode
- C. Content inspection
- D. Redistribution of user mappings
Answer: D
NEW QUESTION # 76
Which two actions would be part of an automatic solution that would block sites with untrusted certificates without enabling SSL Forward Proxy? (Choose two.)
- A. Create a Security Policy rule with vulnerability Security Profile attached.
- B. Configure an EDL to pull IP addresses of known sites resolved from a CRL.
- C. Create a no-decrypt Decryption Policy rule.
- D. Create a Dynamic Address Group for untrusted sites
- E. Enable the "Block sessions with untrusted issuers" setting.
Answer: A,C
Explanation:
You can use the No Decryption tab to enable settings to block traffic that is matched to a decryption policy configured with the No Decrypt action ( Policies > Decryption > Action). Use these options to control server certificates for the session, though the firewall does not decrypt and inspect the session traffic. https://docs.paloaltonetworks.com/pan-os/7-1/pan-os-web-interface-help/objects/objects-decryption-profile
NEW QUESTION # 77
Match each type of DoS attack to an example of that type of attack
Answer:
Explanation:
Explanation
Plan to defend your network against different types of DoS attacks:
* Application-Based Attacks
-Target weaknesses in a particular application and try to exhaust its resources so legitimate users can't use it.
An example of this is the Slowloris attack.
* Protocol-Based Attacks
-Also known as state-exhaustion attacks, these attacks target protocol weaknesses. A common example is a SYN flood attack.
* Volumetric Attacks
-High-volume attacks that attempt to overwhelm the available network resources, especially bandwidth, and bring down the target to prevent legitimate users from accessing those resources. An example of this is a UDP flood attack.
https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/zone-protection-and-dos-protection/zone-defense.ht
NEW QUESTION # 78
A company has configured a URL Filtering profile with override action on their firewall. Which two profiles are needed to complete the configuration? (Choose two)
- A. Interface Management
- B. Decryption
- C. HTTP Server
- D. SSL/TLS Service
Answer: A,D
Explanation:
Explanation
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRdCAK
https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/url-filtering/configure-url-filtering
https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/url-filtering/allow-password-access-to-certain-sites
NEW QUESTION # 79
An administrator wants multiple web servers in the DMZ to receive connections initiated from the internet. Traffic destined for 206.15.22.9 port 80/TCP needs to be forwarded to the server at 10.1.1.22
Based on the information shown in the image, which NAT rule will forward web-browsing traffic correctly?
- A. Option
- B. Option
- C. Option
- D. Option
Answer: A
NEW QUESTION # 80
An administrator device-group commit push is tailing due to a new URL category
How should the administrator correct this issue?
- A. ensure that the firewall can communicate with the URL cloud
- B. change the new category action to alert" and push the configuration again
- C. verify that the URL seed Tile has been downloaded and activated on the firewall
- D. update the Firewall Apps and Threat version to match the version of Panorama
Answer: D
Explanation:
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PNqw
NEW QUESTION # 81
Which Palo Alto Networks VM-Series firewall is supported for VMware NSX?
- A. VM-300
- B. VM-200
- C. VM-100
- D. VM-1000-HV
Answer: D
Explanation:
Licenses for the VM-Series NSX Edition Firewall
In order to automate the provisioning and licensing of the VM-Series NSX Edition firewall in the VMware integrated NSX solution, two license bundles are available:
One bundle includes the VM-Series capacity license (VM-1000-HV only), Threat Prevention license and a premium support entitlement.
Another bundle includes the VM-Series capacity license (VM-1000-HV only) with the complete suite of licenses that include Threat Prevention, GlobalProtect, WildFire, PAN-DB URL Filtering, and a premium support entitlement.
https://www.paloaltonetworks.com/documentation/70/virtualization/virtualization/about-the-vm- series-firewall/license-types-vm-series-firewalls.html
NEW QUESTION # 82
......
Download PCNSE Exam Dumps PDF Q&A: https://www.real4prep.com/PCNSE-exam.html
PCNSE Dumps First Attempt Guaranteed Success: https://drive.google.com/open?id=1jm7ZEg7cVR8p03VL53WqJuVJPBiFbY28