[Apr-2023] The Palo Alto Networks PCNSE Exam Test For Brief Preparation [Q112-Q132]

NO.112 What happens, by default, when the GlobalProtect app fails to establish an IPSec tunnel to the GlobalProtect gateway?

It stops the tunnel-establishment processing to the GlobalProtect gateway immediately.

It tries to establish a tunnel to the GlobalProtect gateway using SSL/TLS.

It keeps trying to establish an IPSec tunnel to the GlobalProtect gateway.

It tries to establish a tunnel to the GlobalProtect portal using SSL/TLS.

NO.113 Which User-ID method maps IP addresses to usernames for users connecting through an 802.1x-enabled wireless network device that has no native integration with PAN-OS® software?

XML API

Port Mapping

Client Probing

Server Monitoring

NO.114 A customer is replacing their legacy remote access VPN solution The current solution is in place to secure internet egress and provide access to resources located in the main datacenter for the connected clients.
Prisma Access has been selected to replace the current remote access VPN solution. During onboarding the following options and licenses were selected and enabled

What must be configured on Prisma Access to provide connectivity to the resources in the datacenter?

Configure a mobile user gateway in the region closest to the datacenter to enable connectivity to the datacenter

Configure a remote network to provide connectivity to the datacenter

Configure Dynamic Routing to provide connectivity to the datacenter

Configure a service connection to provide connectivity to the datacenter

NO.115 Your company occupies one floor in a single building. You have two Active Directory domain controllers on a single network. The firewall’s management-plane resources are lightly utilized.
Given the size of this environment, which User-ID collection method is sufficient?

Citrix terminal server agent deployed on the network

Windows-based agent deployed on each domain controller

PAN-OS integrated agent deployed on the firewall

a syslog listener

NO.116 An administrator receives the following error message:
“IKE phase-2 negotiation failed when processing Proxy ID. Received local id 192. 168.33.33/24 type IPv4 address protocol 0 port 0, received remote id
172.16.33.33/24 type IPv4 address protocol 0 port 0.”
How should the administrator identify the root cause of this error message?

Verify that the IP addresses can be pinged and that routing issues are not causing the connection failure.

Check whether the VPN peer on one end is set up correctly using policy-based VPN.

In the IKE Gateway configuration, verify that the IP address for each VPN peer is accurate.

In the IPSec Crypto profile configuration, verify that PFS is either enabled on both VPN peers or disabled on both VPN peers.

NO.117 ESTION NO: 86
Which two options prevent the firewall from capturing traffic passing through it? (Choose two.)

The firewall is in multi-vsys mode.

The traffic is offloaded.

The traffic does not match the packet capture filter.

The firewall’s DP CPU is higher than 50%.

NO.118 A Palo Alto Networks firewall is being targeted by an NTP Amplification attack and is being flooded with tens thousands of bogus UDP connections per second to a single destination IP address and post.
Which option when enabled with the correction threshold would mitigate this attack without dropping legitirnate traffic to other hosts insides the network?

Zone Protection Policy with UDP Flood Protection

QoS Policy to throttle traffic below maximum limit

Security Policy rule to deny trafic to the IP address and port that is under attack

Classified DoS Protection Policy using destination IP only with a Protect action

NO.119 An administrator is configuring an IPSec VPN to a Cisco ASA at the administrator’s home and experiencing issues completing the connection. the following is the output from the command:

What could be the cause of this problem?

The dead peer detection settings do not match between the Palo Alto Networks Firewall and the ASA.

The Proxy IDs on the Palo Alto Networks Firewall do not match the setting on the ASA.

The public IP addresses do not match for both the Palo Alto Networks Firewall and the ASA.

The shared secrets do not match between the Palo Alto Networks Firewall and the ASA.

NO.120 Drag and Drop Question
Place the steps in the WildFire process workflow in their correct order.

NO.121 A firewall is configured with SSL Forward Proxy decryption and has the following four enterprise certificate authorities (Cas) i. Enterprise-Trusted-CA; which is verified as Forward Trust Certificate (The CA is also installed in the trusted store of the end-user browser and system ) ii. Enterpnse-Untrusted-CA, which is verified as Forward Untrust Certificate iii. Enterprise-lntermediate-CA iv. Enterprise-Root-CA which is verified only as Trusted Root CA An end-user visits https //www example-website com/ with a server certificate Common Name (CN) www example-website com The firewall does the SSL Forward Proxy decryption for the website and the server certificate is not trusted by the firewall The end-user’s browser will show that the certificate for www example-website com was issued by which of the following?

Enterprise-Untrusted-CA which is a self-signed CA

Enterprise-Trusted-CA which is a self-signed CA

Enterprise-lntermediate-CA which was. in turn, issued by Enterprise-Root-CA

Enterprise-Root-CA which is a self-signed CA

NO.122 Which two are valid ACC GlobalProtect Activity tab widgets? (Choose two)

Successful GlobalProtect Connection Activity

Successful GlobalProtect Deployed Activity

GlobalProtect Quarantine Activity

GlobalProtect Deployment Activity

NO.123 If a template stack is assigned to a device and the stack includes three templates with overlapping settings, which settings are published to the device when the template stack is pushed?

The settings assigned to the template that is on top of the stack.

The administrator will be promoted to choose the settings for that chosen firewall.

All the settings configured in all templates.

Depending on the firewall location, Panorama decides with settings to send.

NO.124 Which processing order will be enabled when a Panorama administrator selects the setting “Objects
defined in ancestors will take higher precedence?”

Descendant objects will take precedence over other descendant objects.

Descendant objects will take precedence over ancestor objects.

Ancestor objects will have precedence over descendant objects.

Ancestor objects will have precedence over other ancestor objects.

NO.125 An administrator has left a firewall to use the data of port for all management service which there functions are performed by the data face? (Choose three.)

NTP

Antivirus

Wildfire updates

NAT

File tracking

NO.126 Site-A and Site-B have a site-to-site VPN set up between them. OSPF is configured to dynamically create the routes between the sites. The OSPF configuration in Site-A is configured properly, but the route for the tunner is not being established. The Site-B interfaces in the graphic are using a broadcast Link Type. The administrator has determined that the OSPF configuration in Site-B is using the wrong Link Type for one of its interfaces.

Which Link Type setting will correct the error?

Set tunnel. 1 to p2p

Set tunnel. 1 to p2mp

Set Ethernet 1/1 to p2mp

Set Ethernet 1/1 to p2p

NO.127 Which three firewall states are valid? (Choose three.)

Active

Functional

Pending

Passive

Suspended

NO.128 Given the following table.

Which configuration change on the firewall would cause it to use 10.66.24.88 as the next hop for the
192.168.93.0/30 network?

Configuring the administrative Distance for RIP to be lower than that of OSPF Int.

Configuring the metric for RIP to be higher than that of OSPF Int.

Configuring the administrative Distance for RIP to be higher than that of OSPF Ext.

Configuring the metric for RIP to be lower than that OSPF Ext.

NO.129 Which CLI command enables an administrator to view details about the firewall including uptime, PAN-OS® version, and serial number?

debug system details

show session info

show system info

show system details

NO.130 Which feature must you configure to prevent users form accidentally submitting their corporate credentials to a phishing website?

URL Filtering profile

Zone Protection profile

Anti-Spyware profile

Vulnerability Protection profile

NO.131 Which three file types can be forwarded to WildFire for analysis as a part of the basic WildFire service? (Choose three.)

.dll

.exe

.fon

.apk

.pdf

.jar

NO.132 Refer to the exhibit.

An administrator is using DNAT to map two servers to a single public IP address. Traffic will be steered to the specific server based on the application, where Host A (10.1.1.100) receives HTTP traffic and HOST B (10.1.1.101) receives SSH traffic.) Which two security policy rules will accomplish this configuration? (Choose two.)