Last PCNSE practice test reviews Practice Test Palo Alto Networks dumps [Q36-Q50]

Rate this post

Last PCNSE practice test reviews: Practice Test Palo Alto Networks dumps

Try PCNSE Free Now! Real Exam Question Answers Updated [May 29, 2023]

Q36. Which two methods can be configured to validate the revocation status of a certificate? (Choose two.)

CRL

CRT

OCSP

Cert-Validation-Profile

SSL/TLS Service Profile

Q37. An organization wishes to roll out decryption but gets some resistance from engineering leadership regarding the guest network.
What is a common obstacle for decrypting traffic from guest devices?

Guest devices may not trust the CA certificate used for the forward untrust certificate.

Guests may use operating systems that can’t be decrypted.

The organization has no legal authority to decrypt their traffic.

Guest devices may not trust the CA certificate used for the forward trust certificate.

Q38. Refer to the exhibit.

Which certificates can be used as a Forwarded Trust certificate?

Certificate from Default Trust Certificate Authorities

Domain Sub-CA

Forward_Trust

Domain-Root-Cert

Q39. A session in the Traffic log is reporting the application as “incomplete.” What does “incomplete” mean?

The three-way TCP handshake was observed, but the application could not be identified.

The three-way TCP handshake did not complete.

The traffic is coming across USP, and the application could not be identified.

Data was received but was instantly discarded because of a Deny policy was applied before App-ID could be applied.

Q40. View the GlobalProtect configuration screen capture.
What is the purpose of this configuration?

It configures the tunnel address of all internal clients to an IP address range starting at 192.168.10.1.

It forces an internal client to connect to an internal gateway at IP address 192.168.10.1.

It enables a client to perform a reverse DNS lookup on 192.168.10.1 to detect that it is an internal client.

It forces the firewall to perform a dynamic DNS update, which adds the internal gateway’s hostname and IP address to the DNS server.

Q41. Which log file can be used to identify SSL decryption failures?

Traffic

ACC

Configuration

Threats

Q42. Refer to exhibit.

An organization has Palo Alto Networks NGFWs that send logs to remote monitoring and security management platforms. The network team has reported excessive traffic on the corporate WAN.
How could the Palo Alto Networks NGFW administrator reduce WAN traffic while maintaining support for all existing monitoring/security platforms?

Forward logs from firewalls only to Panorama and have Panorama forward logs to other external services.

Forward logs from external sources to Panorama for correlation, and from Panorama send them to the NGFW.

Configure log compression and optimization features on all remote firewalls.

Any configuration on an M-500 would address the insufficient bandwidth concerns.

Q43. To more easily reuse templates and template stacks, you can create template variables in place of firewall-specific and appliance-specific IP literals in your configurations.
Which one is the correct configuration

&Panorama

@Panorama

$Panorama

#Panorama

Q44. A network security engineer has applied a File Blocking profile to a rule with the action of Block. The user of a Linux CLI operating system has opened a ticket. The ticket states that the user is being blocked by the firewall when trying to download a TAR file. The user is getting no error response on the system.
Where is the best place to validate if the firewall is blocking the user’s TAR file?

Threat log

Data Filtering log

WildFire Submissions log

URL Filtering log

Q45. What is exchanged through the HA2 link?

hello heartbeats

User-ID information

session synchronization

HA state information

Q46. An Administrator is configuring an IPSec VPN toa Cisco ASA at the administrator’s home and experiencing issues completing the connection. The following is th output from the command:

What could be the cause of this problem?

The public IP addresses do not match for both the Palo Alto Networks Firewall and the ASA.

The Proxy IDs on the Palo Alto Networks Firewall do not match the settings on the ASA.

The shared secrets do not match between the Palo Alto firewall and the ASA

The deed peer detection settings do not match between the Palo Alto Networks Firewall and the ASA

Q47. A customer wants to set up a VLAN interface for a Layer 2 Ethernet port.
Which two mandatory options are used to configure a VLAN interface? (Choose two.)

Virtual router

Security zone

ARP entries

Netflow Profile

Q48. Which three function are found on the dataplane of a PA-5050? (Choose three)

Protocol Decoder

Dynamic routing

Management

Network Processing

Signature Match

Q49. A distributed log collection deployment has dedicated Log Collectors. A developer needs a device to send logs to Panorama instead of sending logs to the Collector Group.
What should be done first?

Contact Palo Alto Networks Support team to enter kernel mode commands to allow adjustments

Revert to a previous configuration

Remove the device from the Collector Group

Remove the cable from the management interface. reload the Log Collector and then re-connect that cable

Q50. YouTube videos are consuming too much bandwidth on the network, causing delays in mission-critical traffic.
The administrator wants to throttle YouTube traffic. The following interfaces and zones are in use on the firewall:
* ethernet1/1, Zone: Untrust (Internet-facing)
* ethernet1/2, Zone: Trust (client-facing)
A QoS profile has been created, and QoS has been enabled on both interfaces. A QoS rule exists to put the YouTube application into QoS class 6. Interface Ethernet1/1 has a QoS profile called Outbound, and interface Ethernet1/2 has a QoS profile called Inbound.
Which setting for class 6 with throttle YouTube traffic?

Outbound profile with Guaranteed Ingress

Outbound profile with Maximum Ingress

Inbound profile with Guaranteed Egress

Inbound profile with Maximum Egress