Palo Alto Networks PCNSE Exam Questions Instant Access

Question 1

A company has deployed policies based on AD groups to restrict user access to critical infrastructure systems. However, a phishing campaign against the organization prompts a search for more controls to secure access to critical assets. For users who need to access these systems, the company decides to use PAN-OS multi-factor authentication (MFA) integration to enforce MFA.

What must the company do in order to use PAN-OS MFA?

AConfigure a Captive Portal authentication policy that uses an authentication profile that references a RADIUS profile.

BUse a Credential Phishing agent to detect, prevent, and mitigate credential phishing campaigns.

CConfigure a Captive Portal authentication policy that uses an authentication sequence.

DCreate an authentication profile and assign another authentication factor to be used by a Captive Portal authentication policy.

Answer : D

Question 2

A network administrator is troubleshooting an issue with Phase 2 of an IPSec VPN tunnel The administrator determines that the lifetime needs to be changed to match the peer. Where should this change be made?

AIPSec Tunnel settings

BIKE Crypto profile

CIPSec Crypto profile

DIKE Gateway profile

Answer : C

Question 3

Which active-passive HA firewall state describes the firewall that is currently processing traffic?

AActive-secondary

BActive

CActive-primary

DInitial

Answer : C

Question 4

During a routine security audit, the risk and compliance team notices a series of WildFire logs that contain a "malicious" verdict and the action "allow." Upon further inspection, the team confirms that these same threats are automatically blocked by the firewalls the following day. How can the existing configuration be adjusted to ensure that new threats are blocked within minutes instead of having to wait until the following day?

AConfirm the file types and direction are configured correctly in the WildFire analysis profile

BConfigure the appropriate actions in the Antivirus security profile

CConfigure the appropriate actions in the File Blocking profile

DConfirm the file size limits are configured correctly in the WildFire general settings

Answer : B

WildFire logs showing a 'malicious' verdict with an 'allow' action indicate that the initial traffic wasn't blocked in real-time, likely because the Antivirus profile isn't configured to act immediately on WildFire verdicts. By default, WildFire submits files for analysis, and signatures may take up to 24 hours to propagate globally unless real-time blocking is enabled. Configuring the Antivirus security profile (Option B) to 'block' on malicious WildFire verdicts ensures that threats are blocked within minutes once the verdict is returned (typically 5-15 minutes), leveraging WildFire's real-time signature updates.

Option A (WildFire analysis profile) defines what files are sent to WildFire but doesn't control blocking actions. Option C (File Blocking profile) manages file type blocking, not threat verdicts. Option D (file size limits) affects submission eligibility, not blocking behavior. The Antivirus profile is the key to real-time WildFire enforcement, as per Palo Alto Networks documentation.

Question 5

An engineer creates a set of rules in a Device Group (Panorama) to permit traffic to various services for a specific LDAP user group.

What needs to be configured to ensure Panorama can retrieve user and group information for use in these rules?

AA service route to the LDAP server

BA Master Device

CAuthentication Portal

DA User-ID agent on the LDAP server

Answer : B

https://live.paloaltonetworks.com/t5/general-topics/what-is-a-master-device-in-device-groups/td-p/15032

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PMtpCAG

Question 6

For company compliance purposes, three new contractors will be working with different device groups in their hierarchy to deploy policies and objects. Which type of role-based access is most appropriate for this project?

ACreate a Device Group and Template Admin

BCreate a Dynamic Admin with the Panorama Administrator role

CCreate a Dynamic Read-only Superuser

DCreate a Custom Panorama Admin

Answer : A

The Device Group and Template Admin role is tailored for managing specific device groups and templates in Panorama, allowing contractors to deploy policies and objects within their assigned scope without broader administrative access. This aligns with compliance by restricting privileges.

Option B (Dynamic Admin) is undefined in PAN-OS; Panorama Admin is too broad. Option C (Read-only Superuser) prevents configuration changes. Option D (Custom Panorama Admin) could work but requires more setup than the predefined role. Documentation recommends this role for such scenarios.

Question 7

After importing a pre-configured firewall configuration to Panorama, what step is required to ensure a commit/push is successful without duplicating local configurations?

AEnsure Force Template Values is checked when pushing configuration.

BPush the Template first, then push Device Group to the newly managed firewall.

CPerform the Export or push Device Config Bundle to the newly managed firewall.

DPush the Device Group first, then push Template to the newly managed firewall

Answer : C

https://docs.paloaltonetworks.com/panorama/11-0/panorama-admin/manage-firewalls/transition-a-firewall-to-panorama-management/migrate-a-firewall-to-panorama-management Push the configuration bundle from Panorama to the newly added firewall to remove all policy rules and objects from its local configuration. This step is necessary to prevent duplicate rule or object names, which would cause commit errors when you push the device group configuration from Panorama to the firewall in the next step.

Palo Alto Networks Certified Security Engineer PAN-OS 11.0 PCNSE Exam Questions