[Jan 19, 2023] Get Unlimited Access to PCNSE Certification Exam Cert Guide
Reliable Study Materials for PCNSE Exam Success For Sure
NEW QUESTION 83
A global corporate office has a large-scale network with only one User-ID agent, which creates a bottleneck near the User-ID agent server.
Which solution in PAN-OS software would help in this case?
- A. content inspection
- B. Virtual Wire mode
- C. redistribution of user mappings
- D. application override
Answer: C
NEW QUESTION 84
Which option would an administrator choose to define the certificate and protocol that Panorama and its managed devices use for SSL/TLS services?
- A. Set up Security policy rule to allow SSL communication.
- B. Configure an SSL/TLS Profile.
- C. Set up SSL/TLS under Policies > Service/URL Category > Service.
- D. Configure a Decryption Profile and select SSL/TLS services.
Answer: B
Explanation:
Explanation/Reference: https://www.paloaltonetworks.com/documentation/80/pan-os/web-interface-help/device/device- certificate-management-ssltls-service-profile
NEW QUESTION 85
Place the steps in the WildFire process workflow in their correct order.
Answer:
Explanation:
NEW QUESTION 86
An administrator is configuring an IPSec VPN to a Cisco ASA at the administrator's home and experiencing issues completing the connection. the following is the output from the command:
What could be the cause of this problem?
- A. The shared secrets do not match between the Palo Alto Networks Firewall and the ASA.
- B. The Proxy IDs on the Palo Alto Networks Firewall do not match the setting on the ASA.
- C. The public IP addresses do not match for both the Palo Alto Networks Firewall and the ASA.
- D. The dead peer detection settings do not match between the Palo Alto Networks Firewall and the ASA.
Answer: C
NEW QUESTION 87
An enterprise has a large Palo Alto Networks footprint that includes onsite firewalls and Prisma Access for mobile users, which is managed by Panorama The enterprise already uses GlobalProtect with SAML authentication to obtain iP-to-user mapping information However information Security wants to use this information in Prisma Access for policy enforcement based on group mapping Information Security uses on-prermses Active Directory (AD) but is uncertain about what is needed for Prisma Access to learn groups from AD How can portaes based on group mapping be learned and enforced in Prisma Access?
- A. Create a group mapping configuration that references an LDAP profile that points to on-premises domain controllers
- B. Configure Prisma Access to learn group mapping via SAML assertion
- C. Assign a master device in Panorama through which Prisma Access learns groups
- D. Set up group mapping redistribution between an onsite Palo Alto Networks firewall and Prisma Access
Answer: C
Explanation:
Explanation
Step 3: Allow Panorama to use group mappings in security policies by configuring one or more next-generation on-premises or VM-series firewalls as a Master Device. If you don't configure a Master Device with a Prisma Access User-ID deployment, use long-form distributed name (DN) entries instead.
https://docs.paloaltonetworks.com/prisma/prisma-access/prisma-access-panorama-admin/configure-user-based-p
NEW QUESTION 88
An administrator plans to deploy 15 firewalls to act as GlobalProtect gateways around the world Panorama will manage the firewalls.
The firewalls will provide access to mobile users and act as edge locations to on-premises infrastructure The administrator wants to scale the configuration out quickly and wants all of the firewalls to use the same template configuration Which two solutions can the administrator use to scale this configuration? (Choose two.)
- A. virtual systems
- B. variables
- C. template stacks
- D. collector groups
Answer: D
NEW QUESTION 89
Which two options prevent the firewall from capturing traffic passing through it? (Choose two.)
- A. The traffic is offloaded.
- B. The firewall's DP CPU is higher than 50%.
- C. The firewall is in multi-vsys mode.
- D. The traffic does not match the packet capture filter.
Answer: A,D
NEW QUESTION 90
A global corporate office has a large-scale network with only one User-ID agent, which creates a bottleneck near the User-ID agent server. Which solution in PAN-OS software would help in this case?
- A. Application override
- B. Content inspection
- C. Redistribution of user mappings
- D. Virtual Wire mode
Answer: C
NEW QUESTION 91
A customer wants to set up a site-to-site VPN using tunnel interfaces?
Which two formats are correct for naming tunnel interfaces? (Choose two.)
- A. tunnel.1025
- B. vpn-tunnel.1
- C. vpn-tunnel.1024
- D. tunnel.1
Answer: A,D
NEW QUESTION 92
Which CLI command enables an administrator to check the CPU utilization of the dataplane?
- A. debug running resources
- B. show running resource-monitor
- C. show system resources
- D. debug data-plane dp-cpu
Answer: B
NEW QUESTION 93
Site-A and Site-B have a site-to-site VPN set up between them. OSPF is configured to dynamically create the routes between the sites. The OSPF configuration in Site-A is configured properly, but the route for the tunner is not being established. The Site-B interfaces in the graphic are using a broadcast Link Type. The administrator has determined that the OSPF configuration in Site-B is using the wrong Link Type for one of its interfaces.
Which Link Type setting will correct the error?
- A. Set tunnel. 1 to p2mp
- B. Set tunnel. 1 to p2p
- C. Set Ethernet 1/1 to p2mp
- D. Set Ethernet 1/1 to p2p
Answer: B
NEW QUESTION 94
View the GlobalProtect configuration screen capture.
What is the purpose of this configuration?
- A. It forces an internal client to connect to an internal gateway at IP address 192.168.10.1.
- B. It enables a client to perform a reverse DNS lookup on 192.168.10.1 to detect that it is an internal client.
- C. It forces the firewall to perform a dynamic DNS update, which adds the internal gateway's hostname and IP address to the DNS server.
- D. It configures the tunnel address of all internal clients to an IP address range starting at
192.168.10.1.
Answer: B
NEW QUESTION 95
Refer to the exhibit.
An administrator is using DNAT to map two servers to a single public IP address. Traffic will be steered to the specific server based on the application, where Host A (10.1.1.100) received HTTP traffic and host B(10.1.1.101) receives SSH traffic.
Which two security policy rules will accomplish this configuration? (Choose two)
- A. Untrust (Any) to DMZ (1.1.1.100) Web-browsing -Allow
- B. Untrust (Any) to DMZ (1.1.1.100) Ssh-Allow
- C. Untrust (Any) to Untrust (10.1.1.1) Web-browsing -Allow
- D. Untrust (Any) to Untrust (10.1.1.1) Ssh-Allow
Answer: A,C
NEW QUESTION 96
What are two best practices for incorporating new and modified App-IDs? (Choose two.)
- A. Run the latest PAN-OS version in a supported release tree to have the best performance for the new App-IDs
- B. Study the release notes and install new App-IDs if they are determined to have low impact
- C. Perform a Best Practice Assessment to evaluate the impact of the new or modified App-IDs
- D. Configure a security policy rule to allow new App-IDs that might have network-wide impact
Answer: B,C
Explanation:
Explanation
https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/app-id/manage-new-app-ids-introduced-in-content-r
NEW QUESTION 97
A bootstrap USB flash drive has been prepared using a Windows workstation to load the initial configuration of a Palo Alto Networks firewall that was previously being used in a lab. The USB flash drive was formatted using file system FAT32 and the initial configuration is stored in a file named init-cfg txt. The firewall is currently running PAN-OS 10.0 and using a lab config The contents of init-cfg txi in the USB flash drive are as follows:
The USB flash drive has been inserted in the firewalls' USB port, and the firewall has been restarted using command:> request resort system Upon restart, the firewall fails to begin the bootstrapping process. The failure is caused because
- A. The hostname is a required parameter, but it is missing in imt-cfg txt
- B. PANOS version must be 91.x at a minimum but the firewall is running 10.0.x
- C. Firewall must be in factory default state or have all private data deleted for bootstrapping
- D. The bootstrap.xml file is a required file but it is missing
- E. The USB must be formatted using the ext3 file system, FAT32 is not supported
Answer: C
Explanation:
https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/firewall-administration/bootstrap-the-firewall/bootstrap-a-firewall-using-a-usb-flash-drive.html#id8378007f-d6e5-4f2d-84a4-5d50b0b3ad7d
NEW QUESTION 98
Which method does an administrator use to integrate all non-native MFA platforms in PAN-OS® software?
- A. RADIUS
- B. PingID
- C. DUO
- D. Okta
Answer: A
Explanation:
https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/authentication/authentication-types/multi-factor-authentication
NEW QUESTION 99
Refer to the exhibit.
An administrator is using DNAT to map two servers to a single public IP address. Traffic will be steered to the specific server based on the application, where Host A (10.1.1.100) received HTTP traffic and host B(10.1.1.101) receives SSH traffic.
Which two security policy rules will accomplish this configuration? (Choose two)
- A. Untrust (Any) to DMZ (1.1.1.100) Web-browsing -Allow
- B. Untrust (Any) to DMZ (1.1.1.100) Ssh-Allow
- C. Untrust (Any) to Untrust (10.1.1.1) Web-browsing -Allow
- D. Untrust (Any) to Untrust (10.1.1.1) Ssh-Allow
Answer: A,C
NEW QUESTION 100
In High Availability, which information is transferred via the HA data link?
- A. heartbeats
- B. User-ID information
- C. session information
- D. HA state information
Answer: C
Explanation:
Explanation/Reference: https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/high-availability/ha- concepts/ha-links-and-backup-links
NEW QUESTION 101
What will be the egress interface if the traffic's ingress interface is ethernet1/6 sourcing from 192.168.111.3 and to the destination 10.46.41.113 during the time shown in the image?
- A. ethernet1/5
- B. ethernet1/7
- C. ethernet1/3
- D. ethernet1/6
Answer: C
NEW QUESTION 102
......
New Palo Alto Networks PCNSE Dumps & Questions: https://examtorrent.actual4test.com/PCNSE_examcollection.html