Palo Alto Networks PCNSE Exam Practice Test Instant Access

Question 1

A security team has enabled real-time WildFire signature lookup on all its firewalls. Which additional action will further reduce the likelihood of newly discovered malware being allowed through the firewalls?

Aincrease the frequency of the applications and threats dynamic updates.

BIncrease the frequency of the antivirus dynamic updates

CEnable the 'Hold Mode' option in Objects > Security Profiles > Antivirus.

DEnable the 'Report Grayware Files' option in Device > Setup > WildFire.

Answer : B

Question 2

An administrator notices interface ethernet1/2 failed on the active firewall in an active / passive firewall high availability (HA) pair Based on the image below what - if any - action was taken by the active firewall when the link failed?

AThe active firewall failed over to the passive HA member because 'any' is selected for the Link Monitoring

BNo action was taken because Path Monitoring is disabled

CNo action was taken because interface ethernet1/1 did not fail

DThe active firewall failed over to the passive HA member due to an AE1 Link Group failure

Answer : C

Question 3

All firewall at a company are currently forwarding logs to Palo Alto Networks log collectors. The company also wants to deploy a sylog server and forward all firewall logs to the syslog server and to the log collectors. There is known logging peak time during the day, and the security team has asked the firewall engineer to determined how many logs per second the current Palo Alto Networking log processing at that particular time. Which method is the most time-efficient to complete this task?

ANavigate to Panorama > Managed Collectors, and open the Statistics windows for each Log Collector during the peak time.

BNavigate to Monitor > Unified logs, set the filter to the peak time, and browse to the last page to find out how many logs have been received.

CNavigate to Panorama> Managed Devices> Health, open the Logging tab for each managed firewall and check the log rates during the peak time.

DNavigate to ACC> Network Activity, and determine the total number of sessions and threats during the peak time.

Answer : A

Question 4

A firewall engineer supports a mission-critical network that has zero tolerance for application downtime. A best-practice action taken by the engineer is configure an applications and Threats update schedule with a new App-ID threshold of 48 hours. Which two additional best-practice guideline actions should be taken with regard to dynamic updates? (Choose two.)

ACreate a Security policy rule with an application filter to always allow certain categories of new App-IDs.

BClick 'Review Apps' after application updates are installed in order to assess how the changes might impact Security policy.

CSelect the action 'download-only' when configuring an Applications and Threats update schedule.

DConfigure an Applications and Threats update schedule with a threshold of 24 to 48 hours

Answer : B, C

Question 5

What does SSL decryption require to establish a firewall as a trusted third party and to establish trust between a client and server to secure an SSL/TLS connection'?

Acertificates

Bprofiles

Clink state

Dstateful firewall connection

Answer : A

Question 6

A firewall engineer is managing a Palo Alto Networks NGFW that does not have the DHCP server on DHCP agent configuration. Which interface mode can the broadcast DHCP traffic?

AVirtual ware

BTap

CLayer 2

DLayer 3

Answer : B

Question 7

A network security engineer is going to enable Zone Protection on several security zones How can the engineer ensure that Zone Protection events appear in the firewall's logs?

ASelect the check box 'Log packet-based attack events' in the Zone Protection profile

BNo action is needed Zone Protection events appear in the threat logs by default

CSelect the check box 'Log Zone Protection events' in the Content-ID settings of the firewall

DAccess the CLI in each firewall and enter the command set system setting additional-threat-log on

Answer : A

Palo Alto Networks PCNSE Palo Alto Networks Certified Security Engineer PAN-OS 11.0 Exam Practice Test