Palo Alto Networks PCNSE Exam Questions Instant Access

Question 1

For company compliance purposes, three new contractors will be working with different device-groups in their hierarchy to deploy policies and objects.

Which type of role-based access is most appropriate for this project?

ACreate a Device Group and Template Admin.

BCreate a Custom Panorama Admin.

CCreate a Dynamic Admin with the Panorama Administrator role.

DCreate a Dynamic Read only superuser.

Answer : A

Question 2

A company needs to preconfigure firewalls to be sent to remote sites with the least amount of reconfiguration. Once deployed, each firewall must establish secure tunnels back to multiple regional data centers to include the future regional data centers.

Which VPN configuration would adapt to changes when deployed to the future site?

APreconfigured GlobalProtect satellite

BPreconfigured GlobalProtect client

CPreconfigured IPsec tunnels

DPreconfigured PPTP Tunnels

Answer : A

Question 3

An engineer is configuring secure web access (HTTPS) to a Palo Alto Networks firewall for management.

Which profile should be configured to ensure that management access via web browsers is encrypted with a trusted certificate?

AAn SSL/TLS Service profile with a certificate assigned.

BAn Interface Management profile with HTTP and HTTPS enabled.

CA Certificate profile with a trusted root CA.

DAn Authentication profile with the allow list of users.

Answer : A

Question 4

An enterprise network security team is deploying VM-Series firewalls in a multi-cloud environment. Some firewalls are deployed in VMware NSX-V, while others are in AWS, and all are centrally managed using Panorama with the appropriate plugins installed. The team wants to streamline policy management by organizing the firewalls into device groups in which the AWS-based firewalls act as a parent device group, while the NSX-V firewalls are configured as a child device group to inherit Security policies. However, after configuring the device group hierarchy and attempting to push configurations, the team receives errors, and policy inheritance is not functioning as expected. What is the most likely cause of this issue?

APanorama must use the same plugin version numbers for both AWS and NSX-V environments before device group inheritance can function properly

BPanorama requires the objects to be overridden in the child device group before firewalls in different hypervisors can inherit Security policies

CPanorama by default does not allow different hypervisors in parent/child device groups, but this can be overridden with the command 'set device-group allow-multi-hypervisor enable'

DPanorama does not support policy inheritance across device groups containing firewalls deployed in different hypervisors when using multiple plugins

Answer : D

Panorama's device group hierarchy supports policy inheritance, but it does not support inheritance across groups with firewalls on different hypervisors (e.g., AWS and NSX-V) when managed by multiple plugins (Option D). AWS and NSX-V firewalls use distinct plugins (e.g., AWS Plugin, NSX Plugin), and Panorama restricts cross-hypervisor inheritance due to differing configurations and contexts, causing errors when pushing policies.

Option A (plugin versions) is unrelated to inheritance. Option B (object overrides) isn't a requirement for this issue. Option C (command) is fictional. Documentation confirms this limitation.

Question 5

An engineer troubleshooting a VPN issue needs to manually initiate a VPN tunnel from the CLI Which CLI command can the engineer use?

Atest vpn ike-sa

Btest vpn gateway

Ctest vpn flow

Dtest vpn tunnel

Answer : A

Question 6

An administrator is building Security rules within a device group to block traffic to and from malicious locations.

How should those rules be configured to ensure that they are evaluated with a high priority?

ACreate the appropriate rules with a Block action and apply them at the top ol the Security Pre-Rules.

BCreate the appropriate rules with a Block action and apply them at the top of the Security Post-Rules.

CCreate the appropriate rules with a Block action and apply them at the top of the local firewall Security rules.

DCreate the appropriate rules with a Block action and apply them at the top of the Default Rules.

Answer : A

In Palo Alto Networks firewalls, the order of rule evaluation is critical for traffic enforcement. To ensure high priority evaluation, rules should be configured at the top of the rulebase so they are matched before others. The Security Pre-Rules are designed for shared policies across multiple device groups in Panorama, and by placing the block action rules at the top of the Pre-Rules, it guarantees that these rules are evaluated first, before any device-specific or post-rules.

For verification, please refer to the Palo Alto Networks 'PAN-OS Administrator's Guide' or the official configuration documentation for Panorama and device group rules.

Question 7

What does SSL decryption require to establish a firewall as a trusted third party and to establish trust between a client and server to secure an SSL/TLS connection'?

Acertificates

Bprofiles

Clink state

Dstateful firewall connection

Answer : A

Palo Alto Networks Certified Security Engineer PAN-OS 11.0 PCNSE Exam Questions