Palo Alto Networks PCNSE Exam Questions Instant Access

Question 1

Which statement accurately describes how web proxy is run on a firewall with multiple virtual systems?

AIt can run on a single virtual system and multiple virtual systems.

BIt can run on multiple virtual systems without issue.

CIt can run only on a single virtual system.

DIt can run only on a virtual system with an alias named 'web proxy.

Answer : A

Question 2

An engineer is bootstrapping a VM-Series Firewall Other than the /config folder, which three directories are mandatory as part of the bootstrap package directory structure? (Choose three.)

A/content

B/software

C/piugins

D/license

E/opt

Answer : A, B, D

Question 3

Which three methods are supported for split tunneling in the GlobalProtect Gateway? (Choose three.)

ADestination user/group

BURL Category

CDestination Domain

Dvideo streaming application

ESource Domain

FClient Application Process

Answer : C, D, E

Question 4

An engineer needs to configure a standardized template for all Panorama-managed firewalls. These settings will be configured on a template named "Global" and will be included in all template stacks.

Which three settings can be configured in this template? (Choose three.)

ALog Forwarding profile

BSSL decryption exclusion

CEmail scheduler

DLogin banner

EDynamic updates

Answer : B, D, E

A template is a set of configuration options that can be applied to one or more firewalls or virtual systems managed by Panorama.A template can include settings from the Device and Network tabs on the firewall web interface, such as login banner, SSL decryption exclusion, and dynamic updates4. These settings can be configured in a template named ''Global'' and included in all template stacks.A template stack is a group of templates that Panorama pushes to managed firewalls in an ordered hierarchy4.Reference:Manage Templates and Template Stacks, PCNSE Study Guide (page 50)

Question 5

In which two scenarios would it be necessary to use Proxy IDs when configuring site-to-site VPN Tunnels? (Choose two.)

AFirewalls which support policy-based VPNs.

BThe remote device is a non-Palo Alto Networks firewall.

CFirewalls which support route-based VPNs.

DThe remote device is a Palo Alto Networks firewall.

Answer : A, B

Question 6

Review the information below. A firewall engineer creates a U-NAT rule to allow users in the trust zone access to a server in the same zone by using an external,

public NAT IP for that server.

Given the rule below, what change should be made to make sure the NAT works as expected?

AChange destination NAT zone to Trust_L3.

BChange destination translation to Dynamic IP (with session distribution) using firewall ethI/2 address.

CChange Source NAT zone to Untrust_L3.

DAdd source Translation to translate original source IP to the firewall eth1/2 interface translation.

Answer : D

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClEiCAK

Question 7

Which rule type controls end user SSL traffic to external websites?

ASSL Outbound Proxyless Inspection

BSSL Forward Proxy

CSSH Proxy

DSSL Inbound Inspection

Answer : B

The SSL Forward Proxy rule type is designed to control and inspect SSL traffic from internal users to external websites. When an internal user attempts to access an HTTPS site, the Palo Alto Networks firewall, acting as an SSL Forward Proxy, intercepts the SSL request. It then establishes an SSL connection with the requested website on behalf of the user. Simultaneously, the firewall establishes a separate SSL connection with the user. This setup allows the firewall to decrypt and inspect the traffic for threats and compliance with security policies before re-encrypting and forwarding the traffic to its destination.

This process is transparent to the end user and ensures that potentially harmful content delivered over encrypted SSL connections can be identified and blocked. SSL Forward Proxy is a critical component of a comprehensive security strategy, allowing organizations to enforce security policies and protect against threats in encrypted traffic.

Palo Alto Networks Certified Security Engineer PAN-OS 11.0 PCNSE Exam Questions