Pass Exam With Full Sureness – PCNSE Dumps with 125 Questions [Q60-Q81]

4.6/5 - (5 votes)

Pass Exam With Full Sureness – PCNSE Dumps with 125 Questions

Verified PCNSE dumps Q&As – 100% Pass from DumpTorrent

The PCNSE certification is a valuable asset for any cybersecurity professional who wants to stay competitive in the industry. It requires a rigorous training process and a comprehensive exam, but the rewards are well worth the effort. Whether you are a security engineer, consultant, or analyst, the PCNSE certification can help you take your career to the next level and make a significant contribution to the field of cybersecurity.

Q60. Which feature prevents the submission of corporate login information into website forms?

Data filtering

User-ID

File blocking

Credential phishing prevention

Q61. An administrator can not see any Traffic logs from the Palo Alto Networks NGFW in Panorama reports. The configuration problem seems to be on the firewall. Which settings, if configured incorrectly, most likely would stop only Traffic logs from being sent from the NGFW to Panorama?

Q62. What is the best description of the HA4 Keep-Alive Threshold (ms)?

the maximum interval between hello packets that are sent to verify that the HA functionality on the other firewall is operational.

The time that a passive or active-secondary firewall will wait before taking over as the active or active-primary firewall

the timeframe within which the firewall must receive keepalives from a cluster member to know that the cluster member is functional.

The timeframe that the local firewall wait before going to Active state when another cluster member is preventing the cluster from fully synchronizing.

Q63. When using the predefined default profile, the policy will inspect for viruses on the decoders. Match each decoder with its default action.
Answer options may be used more than once or not at all.

Q64. What are two prerequisites for configuring a pair of Palo Alto Networks firewalls in an active/passive High Availability (HA) pair? (Choose two.)

The management interfaces must be on the same network.

The firewalls must have the same set of licenses.

The peer HA1 IP address must be the same on both firewalls.

HA1 should be connected to HA1, either directly or with an intermediate Layer 2 device.

Q65. Based on the image, what caused the commit warning?

The CA certificate for FWDtrust has not been imported into the firewall.

The FWDtrust certificate has not been flagged as Trusted Root CA.

SSL Forward Proxy requires a public certificate to be imported into the firewall.

The FWDtrust certificate does not have a certificate chain.

Q66. Which User-ID mapping method should be used in a high-security environment where all IP address-to-user mappings should always be explicitly known?

PAN-OS integrated User-ID agent

GlobalProtect

Windows-based User-ID agent

LDAP Server Profile configuration

Q67. Which three fields can be included in a pcap filter? (Choose three)

Egress interface

Source IP

Rule number

Destination IP

Ingress interface

Q68. A firewall administrator is trying to identify active routes learned via BGP in the virtual router runtime stats within the GUI. Where can they find this information?

routes listed in the routing table with flags

routes listed in the routing table with flags A?

under the BGP Summary tab

routes listed in the forwarding table with BGP in the Protocol column

Q69. Starting with PAN-OS version 9.1, application dependency information is now reported in which new locations? (Choose two.)

On the App Dependency tab in the Commit Status window

On the Application tab in the Security Policy Rule creation window

On the Objects > Applications browsers pages

On the Policy Optimizer’s Rule Usage page

Q70. Review the screenshot of the Certificates page.

An administrator for a small LLC has created a series of certificates as shown, to use for a planned Decryption roll out. The administrator has also installed the self-signed root certificate in all client systems.
When testing, they noticed that every time a user visited an SSL site, they received unsecured website warnings.
What is the cause of the unsecured website warnings?

The forward untrust certificate has not been signed by the self-singed root CA certificate.

The forward trust certificate has not been installed in client systems.

The self-signed CA certificate has the same CN as the forward trust and untrust certificates.

The forward trust certificate has not been signed by the self-singed root CA certificate.

Q71. An engineer must configure a new SSL decryption deployment.
Which profile or certificate is required before any traffic that matches an SSL decryption rule is decrypted?

There must be a certificate with both the Forward Trust option and Forward Untrust option selected

A Decryption profile must be attached to the Decryption policy that the traffic matches

A Decryption profile must be attached to the Security policy that the traffic matches

There must be a certificate with only the Forward Trust option selected

Q72. Which statement accurately describes service routes and virtual systems?

Virtual systems that do not have specific service routes configured inherit the global service and service route settings for the firewall.

Virtual systems can only use one interface for all global service and service routes of the firewall.

Virtual systems cannot have dedicated service routes configured; and virtual systems always use the global service and service route settings for the firewall.

The interface must be used for traffic to the required external services.

Q73. For which two reasons would a firewall discard a packet as part of the packet flow sequence? (Choose two )

equal-cost multipath

ingress processing errors

rule match with action “allow”

rule match with action “deny”

Q74. An engineer is pushing configuration from Panorama lo a managed firewall.
What happens when the pushed Panorama configuration has Address Object names that duplicate the Address Objects already configured on the firewall?

The firewall rejects the pushed configuration, and the commit fails.

The firewall renames the duplicate local objects with “-1” at the end signifying they are clones; it will update the references to the objects accordingly and fully commit the pushed configuration.

The firewall fully commits all of the pushed configuration and overwrites its locally configured objects

The firewall ignores only the pushed objects that have the same name as the locally configured objects, and it will commit the rest of the pushed configuration.

Q75. What should an administrator consider when planning to revert Panorama to a pre-PAN-OS 8.1 version?

Panorama cannot be reverted to an earlier PAN-OS release if variables are used in templates or template stacks.

An administrator must use the Expedition tool to adapt the configuration to the pre-PAN-OS 8.1 state.

When Panorama is reverted to an earlier PAN-OS release, variables used in templates or template stacks will be removed automatically.

Administrators need to manually update variable characters to those used in pre-PAN-OS 8.1.

Q76. Using multiple templates in a stack to manage many firewalls provides which two advantages? (Choose two.)

inherit address-objects from templates

define a common standard template configuration for firewalls

standardize server profiles and authentication configuration across all stacks

standardize log-forwarding profiles for security polices across all stacks

Q77. Refer to the exhibit.

An administrator is using DNAT to map two servers to a single public IP address. Traffic will be steered to the specific server based on the application, where Host A (10.1.1.100) received HTTP traffic and host B(10.1.1.101) receives SSH traffic.
Which two security policy rules will accomplish this configuration? (Choose two)

Untrust (Any) to Untrust (10.1.1.1) Ssh-Allow

Untrust (Any) to DMZ (1.1.1.100) Ssh-Allow

Untrust (Any) to DMZ (1.1.1.100) Web-browsing -Allow

Untrust (Any) to Untrust (10.1.1.1) Web-browsing -Allow

Q78. You have upgraded your Panorama and Log Collectors lo 10.2 x. Before upgrading your firewalls using Panorama, what do you need do?

Refresh your licenses with Palo Alto Network Support – Panorama/Licenses/Retrieve License Keys from License Server.

Re-associate the firewalls in Panorama/Managed Devices/Summary.

Commit and Push the configurations to the firewalls.

Refresh the Mastor Key in Panorama/Master Key and Diagnostic

Q79. A firewall administrator requires an A/P HA pair to fail over more quickly due to critical business application uptime requirements.
What is the correct setting?

Change the HA timer profile to “aggressive” or customize the settings in advanced profile.

Change the HA timer profile to “fast”.

Change the HA timer profile to “user-defined” and manually set the timers.

Change the HA timer profile to “quick” and customize in advanced profile.

Q80. Decrypted packets from the website https://www.microsoft.com will appear as which application and service within the Traffic log?

web-browsing and 443

SSL and 80

SSL and 443

web-browsing and 80

Q81. Refer to the diagram.

An administrator needs to create an address object that will be useable by the NYC. MA, CA and WA device groups Where will the object need to be created within the device-group hierarchy?