Enhance your career with PCNSE PDF Dumps - True Palo Alto Networks Exam Questions [Q135-Q159] : Exams Labs Braindumps : http://blog.examslabs.com

This page was exported from Exams Labs Braindumps [ http://blog.examslabs.com ]
Export date: Thu Dec 26 22:07:11 2024 / +0000 GMT

Enhance your career with PCNSE PDF Dumps - True Palo Alto Networks Exam Questions [Q135-Q159]

Enhance your career with PCNSE PDF Dumps - True Palo Alto Networks Exam Questions

New (2024) Download free PCNSE PDF for Palo Alto Networks Practice Tests

QUESTION 135
An administrator needs to evaluate a recent policy change that was committed and pushed to a firewall device group.
How should the administrator identify the configuration changes?

review the configuration logs on the Monitor tab

click Preview Changes under Push Scope

use Test Policy Match to review the policies in Panorama

context-switch to the affected firewall and use the configuration audit tool

QUESTION 136
You have upgraded Panorama to 10.2 and need to upgrade six Log Collectors. When upgrading Log Collectors to 10.2, you must do what?

Upgrade the Log Collectors one at a time.

Add Panorama Administrators to each Managed Collector.

Add a Global Authentication Profile to each Managed Collector.

Upgrade all the Log Collectors at the same time.

QUESTION 137
Which User-ID method should be configured to map IP addresses to username for users connected through a terminal server?

port mapping

server monitoring

client probing

XFF headers

QUESTION 138
Exhibit:

What will be the source address in the ICMP packet?

10.30.0.93

10.46.72.93

10.46.64.94

192.168.93.1

QUESTION 139
What happens when an A/P firewall cluster synchronizes IPsec tunnel security associations (SAs)?

Phase 2 SAs are synchronized over HA2 links.

Phase 1 and Phase 2 SAs are synchronized over HA2 links.

Phase 1 SAs are synchronized over HA1 links.

Phase 1 and Phase 2 SAs are synchronized over HA3 links.

QUESTION 140
A company wants to install a PA-3060 firewall between two core switches on a VLAN trunk link. They need to assign each VLAN to its own zone and to assign untagged (native) traffic to its own zone which options differentiates multiple VLAN into separate zones?

Create V-Wire objects with two V-Wire interfaces and define a range of “0-4096 in the “Tag Allowed” field of the V-Wire object.

Create V-Wire objects with two V-Wire subinterfaces and assign only a single VLAN ID to the Tag Allowed” field of the V-Wire object. Repeat for every additional VLAN and use a VLAN ID of 0 for untagged traffic. Assign each iinterface/sub interface to a unique zone.

Create Layer 3 subinterfaces that are each assigned tA. single VLAN ID and a common virtual router.
The physical Layer 3 interface would handle untagged traffic. Assign each interface/subinterface tA.
unique zone. Do not assign any interface an IP address.

Create VLAN objects for each VLAN and assign VLAN interfaces matching each VLAN ID. Repeat for every additional VLAN and use a VLAN ID of 0 for untagged traffic. Assign each interface/sub interface to a unique zone.

QUESTION 141
How does Panorama prompt VMWare NSX to quarantine an infected VM?

HTTP Server Profile

Syslog Server Profile

Email Server Profile

SNMP Server Profile

QUESTION 142
An Administrator is configuring an IPSec VPN toa Cisco ASA at the administrator’s home and experiencing issues completing the connection. The following is th output from the command:
less mp-log ikemgr.log:

What could be the cause of this problem?

The public IP addresse do not match for both the Palo Alto Networks Firewall and the ASA.

The Proxy IDs on the Palo Alto Networks Firewall do not match the settings on the ASA.

The shared secerts do not match between the Palo Alto firewall and the ASA

The deed peer detection settings do not match between the Palo Alto Networks Firewall and the ASA

QUESTION 143
Refer to Exhibit:

An administrator can not see any Traffic logs from the Palo Alto Networks NGFW in Panorama reports. The configuration problem seems to be on the firewall. Which settings, if configured incorrectly, most likely would stop only Traffic logs from being sent from the NGFW to Panorama?

QUESTION 144
Exhibit:

What will be the egress interface if the traffic’s ingress interface is ethernet1/6 sourcing from 192.168.111.3 and to the destination 10.46.41.113 during the time shown in the image?

ethernet1/7

ethernet1/5

ethernet1/6

ethernet1/3

QUESTION 145
Review the screenshot of the Certificates page.

An administrator for a small LLC has created a series of certificates as shown, to use for a planned Decryption roll out. The administrator has also installed the self-signed root certificate in all client systems.
When testing, they noticed that every time a user visited an SSL site, they received unsecured website warnings.
What is the cause of the unsecured website warnings?

The forward trust certificate has not been signed by the set-singed root CA certificate

The self-signed CA certificate has the same CN as the forward trust and untrust certificates

The forward untrust certificate has not been signed by the self-singed root CA certificate

The forward trust certificate has not been installed in client systems

QUESTION 146
When backing up and saving configuration files, what is achieved using only the firewall and is not
available in Panorama?

Load configuration version

Save candidate config

Export device state

Load named configuration snapshot

QUESTION 147
A client has a sensitive application server in their data center and is particularly concerned about resource exhaustion because of distributed denial-of-service attacks.
How can the Palo Alto Networks NGFW be configured to specifically protect this server against resource exhaustion originating from multiple IP addresses (DDoS attack)?

Define a custom App-ID to ensure that only legitimate application traffic reaches the server.

Add a Vulnerability Protection Profile to block the attack.

Add QoS Profiles to throttle incoming requests.

Add a DoS Protection Profile with defined session count.

QUESTION 148
A network administrator configured a site-to-site VPN tunnel where the peer device will act as initiator None of the peer addresses are known What can the administrator configure to establish the VPN connection?

Set up certificate authentication.

Use the Dynamic IP address type.

Enable Passive Mode

Configure the peer address as an FQDN.

QUESTION 149
To connect the Palo Alto Networks firewall to AutoFocus, which setting must be enabled?

Device>Setup>Services>AutoFocus

Device> Setup>Management >AutoFocus

AutoFocus is enabled by default on the Palo Alto Networks NGFW

Device>Setup>WildFire>AutoFocus

Device>Setup> Management> Logging and Reporting Settings

QUESTION 150
When is the content inspection performed in the packet flow process?

after the application has been identified

before session lookup

before the packet forwarding process

after the SSL Proxy re-encrypts the packet

QUESTION 151
View the GlobalProtect configuration screen capture.

What is the purpose of this configuration?

It configures the tunnel address of all internal clients to an IP address range starting at 192.168.10.1.

It forces an internal client to connect to an internal gateway at IP address 192.168.10.1.

It enables a client to perform a reverse DNS lookup on 192.168.10.1 to detect that it is an internal client.

It forces the firewall to perform a dynamic DNS update, which adds the internal gateway’s hostname and IP address to the DNS server.

QUESTION 152
An administrator needs to assign a specific DNS server to one firewall within a device group. Where would the administrator go to edit a template variable at the device level?

Variable CSV export under Panorama > templates

PDF Export under Panorama > templates

Manage variables under Panorama > templates

Managed Devices > Device Association

QUESTION 153
What type of address object would be useful for internal devices where the addressing structure assigns meaning to certain bits in the address, as illustrated in the diagram?

IP Netmask

IP Wildcard Mask

IP Address

IP Range

QUESTION 154
A user at an external system with the IP address 65.124.57.5 queries the DNS server at 4. 2.2.2 for the IP address of the web server, www,xyz.com. The DNS server returns an address of 172.16.15.1 In order to reach Ire web server, which Security rule and NAT rule must be configured on the firewall?

QUESTION 155
Which User-ID method maps IP addresses to usernames for users connecting through an 802.1x-enabled wireless network device that has no native integration with PAN-OS software?

XML API

Port Mapping

Client Probing

Server Monitoring

QUESTION 156
Which command can be used to validate a Captive Portal policy?

eval captive-portal policy <criteria>

request cp-policy-eval <criteria>

test authentication-policy-match <criteria>

debug cp-policy <criteria>

QUESTION 157
SSL Forward Proxy decryption is configured but the firewall uses Untrusted-CA to sign the website https //www important-website com certificate End-users are receiving me “security certificate is not trusted is warning Without SSL decryption the web browser shows that the website certificate is trusted and signed by a well-known certificate chain Well-Known-lntermediate and Well-Known-Root- CA.
The network security administrator who represents the customer requires the following two behaviors when SSL Forward Proxy is enabled:
1 End-users must not get the warning for the https://www.very-important-website.com website.
2 End-users should get the warning for any other untrusted website
Which approach meets the two customer requirements?

Navigate to Device > Certificate Management > Certificates > Device Certificates import Well-Known-lntermediate-CA and Well-Known-Root-CA select the Trusted Root CA checkbox and commit the configuration

Install the Well-Known-lntermediate-CA and Well-Known-Root-CA certificates on all end-user systems m the user and local computer stores

Navigate to Device > Certificate Management – Certificates s Default Trusted Certificate Authorities import Well-Known-intermediate-CA and Well-Known-Root-CA select the Trusted Root CA check box and commit the configuration

Clear the Forward Untrust Certificate check box on the Untrusted-CA certificate and commit the configuration

QUESTION 158
Exhibit.

An organization has Palo Alto Networks NGFWs that send logs to remote monitoring and security management platforms The network team has reported excessive traffic on the corporate WAN How could the Palo Alto Networks NGFW administrator reduce WAN traffic while maintaining support for all the existing monitoring/security platforms?

Any configuration on an M-500 would address the insufficient bandwidth concerns

Forward logs from external sources to Panorama for correlation, and from Panorama send them to the NGFW

Configure log compression and optimization features on all remote firewalls

Forward logs from firewalls only to Panorama and have Panorama forward logs to other external services.

QUESTION 159
Given the following snippet of a WildFire submission log, did the end user successfully download a file?

No, because the URL generated an alert.

Yes, because both the web-browsing application and the flash file have the ‘alert” action.

Yes, because the final action is set to “allow.”

No, because the action for the wildfire-virus is “reset-both.”

The PCNSE Certification Exam is intended for security professionals who are responsible for designing, deploying, configuring, and managing Palo Alto Networks security solutions. Candidates are expected to have a strong understanding of network security concepts, firewall technologies, and the features and functionality of the Palo Alto Networks platform. They should also have experience in implementing security policies, configuring security profiles, and troubleshooting network security issues.

100% Free PCNSE Files For passing the exam Quickly: https://www.examslabs.com/Palo-Alto-Networks/PCNSE-PAN-OS/best-PCNSE-exam-dumps.html

Post date: 2024-11-28 09:30:59
Post date GMT: 2024-11-28 09:30:59
Post modified date: 2024-11-28 09:30:59
Post modified date GMT: 2024-11-28 09:30:59