Palo Alto Networks PCNSE Exam Questions Instant Access

Question 1

A firewall engineer creates a destination static NAT rule to allow traffic from the internet to a webserver hosted behind the edge firewall. The pre-NAT IP address of the server is 153.6 12.10, and the post-NAT IP address is 192.168.10.10. Refer to the routing and interfaces information below.

What should the NAT rule destination zone be set to?

ANone

BOutside

CDMZ

DInside

Answer : B

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-networking-admin/nat/nat-configuration-examples/destination-nat-exampleone-to-one-mapping

Question 2

An administrator accidentally closed the commit window/screen before the commit was finished. Which two options could the administrator use to verify the progress or success of that commit task? (Choose two.)

AExhibit A

BExhibit B

CExhibit C

DExhibit D

Answer : A, D

Question 3

If a template stack is assigned to a device and the stack includes three templates with overlapping settings, which settings are published to the device when the template stack is pushed?

AThe settings assigned to the template that is on top of the stack.

BThe administrator will be promoted to choose the settings for that chosen firewall.

CAll the settings configured in all templates.

DDepending on the firewall location, Panorama decides with settings to send.

Answer : A

Question 4

A network security administrator has been tasked with deploying User-ID in their organization.

What are three valid methods of collecting User-ID information in a network? (Choose three.)

AWindows User-ID agent

BGlobalProtect

CXMLAPI

DExternal dynamic list

EDynamic user groups

Answer : A, B, C

User-ID is a feature that allows the firewall to identify and classify users and groups on the network based on their usernames, IP addresses, and other attributes1. User-ID information can be collected from various sources, such as:

A: Windows User-ID agent: A software agent that runs on a Windows server and collects user information from Active Directory domain controllers, Exchange servers, or eDirectory servers2.The agent then sends the user information to the firewall or Panorama for user mapping2.

B: GlobalProtect: A software agent that runs on the endpoints and provides secure VPN access to the network3.GlobalProtect also collects user information from the endpoints and sends it to the firewall or Panorama for user mapping4.

C: XMLAPI: An application programming interface that allows external systems or scripts to send user information to the firewall or Panorama in XML format. The XMLAPI can be used to integrate with third-party systems, such as identity providers, captive portals, or custom applications.

Question 5

Which action can be taken to immediately remediate the issue of application traffic with a valid use case triggering the decryption log message, "Received fatal alert UnknownCA from client"?

AEnable certificate revocation checking to deny access to sites with revoked certificates

BAdd the certificate CN to the SSL Decryption Exclusion List to allow traffic without decryption

CCheck for expired certificates and take appropriate actions to block or allow access based on business needs

DContact the site administrator with the expired certificate to request updates or renewal

Answer : B

The 'Received fatal alert UnknownCA from client' log indicates the client rejects the firewall's decryption certificate because it doesn't trust the CA. For a valid use case, adding the certificate's Common Name (CN) to the SSL Decryption Exclusion List (Option B) bypasses decryption for that site, allowing traffic to proceed without interruption. This is an immediate fix within the firewall's control.

Option A (revocation checking) addresses different issues. Option C (check expired certificates) is diagnostic, not immediate. Option D (contact site admin) is external and slow. Documentation recommends exclusions for such errors.

Question 6

What does SSL decryption require to establish a firewall as a trusted third party and to establish trust between a client and server to secure an SSL/TLS connection'?

Acertificates

Bprofiles

Clink state

Dstateful firewall connection

Answer : A

Question 7

An administrator pushes a new configuration from Panorama to a pair of firewalls that are configured as an active/passive HA pair. Which NGFW receives the configuration from Panorama?

AThe Passive firewall, which then synchronizes to the active firewall

BThe active firewall, which then synchronizes to the passive firewall

CBoth the active and passive firewalls, which then synchronize with each other

DBoth the active and passive firewalls independently, with no synchronization afterward

Answer : D

Palo Alto NetworksPanorama 7.0 Administrator's Guide *77Manage FirewallsManage Device GroupsManage Device GroupsAdd a Device GroupCreate a Device Group HierarchyCreate Objects for Use in Shared or Device Group PolicyRevert to Inherited Object ValuesManage Unused Shared ObjectsManage Precedence of Inherited ObjectsMove or Clone a Policy Rule or Object to a Different Device GroupSelect a URL Filtering Vendor on PanoramaPush a Policy Rule to a Subset of FirewallsManage the Rule HierarchyAdd a Device GroupAfter adding firewalls (see Add a Firewall as a Managed Device), you can group them into Device Groups (up to 256), as follows. Be sure to assign both firewalls in an active-passive high availability (HA) configuration to the same device group so that Panorama will push the same policy rules and objects to those firewalls. #############PAN-OS doesn't synchronize pushed rules across HA peers.######### To manage rules and objects at different administrative levels in your organization, Create a Device Group Hierarchy.

https://docs.paloaltonetworks.com/panorama/8-0/panorama-admin/manage-firewalls/transition-a-firewall-to-panorama-management/migrate-a-firewall-ha-pair-to-panorama-management

Palo Alto Networks Certified Security Engineer PAN-OS 11.0 PCNSE Exam Questions