[2021] PCNSE Actual Exam Dumps, PCNSE Practice Test
VerifiedDumps PCNSE dumps & PCNSE sure practice dumps
NEW QUESTION 56
What are two benefits of nested device groups in Panorama? (Choose two.)
- A. Reuse of the existing Security policy rules and objects
- B. Overwrites local firewall configuration
- C. Requires configuring both function and location for every device
- D. All device groups inherit settings form the Shared group
Answer: A,D
Explanation:
Explanation
https://docs.paloaltonetworks.com/panorama/8-0/panorama-admin/panorama-overview/centralized-firewall-conf
NEW QUESTION 57
An engineer must configure the Decryption Broker feature
Which Decryption Broker security chain supports bi-directional traffic flow?
- A. Transparent Proxy security chain
- B. Layer 2 security chain
- C. Transparent Bridge security chain
- D. Layer 3 security chain
Answer: D
Explanation:
Explanation
Together, the primary and secondary interfaces form a pair of decryption forwarding interfaces. Only interfaces that you have enabled to be Decrypt Forward interfaces are displayed here. Your security chain type (Layer 3 or Transparent Bridge) and the traffic flow direction (unidirectional or bidirectional) determine which of the two interfaces forwards allowed, clear text traffic to the security chain, and which interface receives the traffic back from the security chain after it has undergone additional enforcement.
NEW QUESTION 58
A session in the Traffic log is reporting the application as "incomplete." What does "incomplete" mean?
- A. The three-way TCP handshake was observed, but the application could not be identified.
- B. The three-way TCP handshake did not complete.
- C. Data was received but was instantly discarded because of a Deny policy was applied before App-ID could be applied.
- D. The traffic is coming across UDP, and the application could not be identified.
Answer: D
NEW QUESTION 59
Site-A and Site-B have a site-to-site VPN set up between them. OSPF is configured to dynamically create the routes between the sites. The OSPF configuration in Site-A is configured properly, but the route for the tunner is not being established. The Site-B interfaces in the graphic are using a broadcast Link Type. The administrator has determined that the OSPF configuration in Site-B is using the wrong Link Type for one of its interfaces.
Which Link Type setting will correct the error?
- A. Set tunnel. 1 to p2mp
- B. Set tunnel. 1 to p2p
- C. Set Ethernet 1/1 to p2mp
- D. Set Ethernet 1/1 to p2p
Answer: B
NEW QUESTION 60
Which three file types can be forwarded to WildFire for analysis as a part of the basic WildFire service? (Choose three.)
- A. .jar
- B. .exe
- C. .apk
- D. .pdf
- E. .dll
- F. .src
Answer: A,C,D
NEW QUESTION 61
Refer to the exhibit.
An administrator cannot see any of the Traffic logs from the Palo Alto Networks NGFW on Panorama. The configuration problem seems to be on the firewall side. Where is the best place on the Palo Alto Networks NGFW to check whether the configuration is correct?
A)
B)
C)
D)
- A. Option D
- B. Option B
- C. Option A
- D. Option C
Answer: A
Explanation:
Explanation
https://docs.paloaltonetworks.com/panorama/8-1/panorama-admin/manage-log-collection/configure-log-forward
NEW QUESTION 62
If an administrator does not possess a website's certificate, which SSL decryption mode will allow the Palo
Alto networks NGFW to inspect traffic when users browse to HTTP(S) websites?
- A. SSL Forward Proxy
- B. SSL Inbound Inspection
- C. TLS Bidirectional proxy
- D. SSL Outbound Inspection
Answer: B
NEW QUESTION 63
Which three firewall states are valid? (Choose three.)
- A. Suspended
- B. Active
- C. Functional
- D. Passive
- E. Pending
Answer: A,B,D
Explanation:
Reference:
https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/high-availability/ha-firewall-states
NEW QUESTION 64
A global corporate office has a large-scale network with only one User-ID agent, which creates a bottleneck near the User-ID agent server.
Which solution in PAN-OS software would help in this case?
- A. content inspection
- B. application override
- C. redistribution of user mappings
- D. Virtual Wire mode
Answer: C
Explanation:
Reference: https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/user-id/deploy- user-id-in-a-large-scale-network
NEW QUESTION 65
DRAG DROP
When using the predefined default profile, the policy will inspect for viruses on the decoders. Match each decoder with its default action.
Answer options may be used more than once or not at all.
Answer:
Explanation:
NEW QUESTION 66
A company hosts a publically accessible web server behind a Palo Alto Networks next generation firewall with the following configuration information.
* Users outside the company are in the "Untrust-L3" zone
* The web server physically resides in the "Trust-L3" zone.
* Web server public IP address: 23.54.6.10
* Web server private IP address: 192.168.1.10
Which two items must be NAT policy contain to allow users in the untrust-L3 zone to access the web server?
(Choose two)
- A. Untrust-L3 for Source Zone and Trust-L3 for Destination Zone
- B. Destination IP of 192.168.1.10
- C. Untrust-L3 for both Source and Destination zone
- D. Destination IP of 23.54.6.10
Answer: A,D
NEW QUESTION 67
A web server is hosted in the DMZ and the server is configured to listen for incoming connections on TCP port 443. A Security policies rules allowing access from the Trust zone to the DMZ zone needs to be configured to allow web-browsing access. The web server hosts its contents over HTTP(S). Traffic from Trust to DMZ is being decrypted with a Forward Proxy rule.
Which combination of service and application, and order of Security policy rules, needs to be configured to allow cleartext web- browsing traffic to this server on tcp/443.
- A. Rule #1: application: web-browsing; service: application-default; action: allow Rule #2: application: ssl; service: application-default; action: allow
- B. Rule # 1: application: ssl; service: application-default; action: allow Rule #2: application: web-browsing; service: application-default; action: allow
- C. Rule #1: application: web-browsing; service: service-https; action: allow Rule #2: application: ssl; service: application-default; action: allow
- D. Rule #1: application: web-browsing; service: service-http; action: allow Rule #2: application: ssl; service: application-default; action: allow
Answer: C
Explanation:
Explanation
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClEyCAK
NEW QUESTION 68
Which item enables a firewall administrator to see details about traffic that is currently active through the NGFW?
- A. App Scope
- B. Session Browser
- C. System Logs
- D. ACC
Answer: B
NEW QUESTION 69
Which CLI command enables an administrator to view details about the firewall including uptime, PAN-OS version, and serial number?
- A. show system details
- B. debug system details
- C. show system info
- D. show session info
Answer: C
Explanation:
Explanation/Reference: https://live.paloaltonetworks.com/t5/Learning-Articles/Quick-Reference-Guide-Helpful-Commands/ ta-p/56511
NEW QUESTION 70
Refer to the exhibit.
An administrator is using DNAT to map two servers to a single public IP address. Traffic will be steered to the specific server based on the application, where Host A (10.1.1.100) receives HTTP traffic and HOST B (10.1.1.101) receives SSH traffic.) Which two security policy rules will accomplish this configuration? (Choose two.)
- A. Untrust (Any) to Untrust (10.1.1.1), ssh -Allow
- B. Untrust (Any) to DMZ (10.1.1.1), web-browsing -Allow
- C. Untrust (Any) to DMZ (10.1.1.100.10.1.1.101), ssh, web-browsing -Allow
- D. Untrust (Any) to DMZ (10.1.1.1), ssh -Allow
- E. Untrust (Any) to Untrust (10.1.1.1), web-browsing -Allow
Answer: B,D
Explanation:
Explanation
https://docs.paloaltonetworks.com/pan-os/8-0/pan-os-admin/networking/nat/nat-configuration-examples/destinat
NEW QUESTION 71
View the GlobalProtect configuration screen capture.
What is the purpose of this configuration?
- A. It forces an internal client to connect to an internal gateway at IP address 192.168.10.1.
- B. It enables a client to perform a reverse DNS lookup on 192.168.10.1 to detect that it is an internal client.
- C. It configures the tunnel address of all internal clients to an IP address range starting at 192.168.10.1.
- D. It forces the firewall to perform a dynamic DNS update, which adds the internal gateway's hostname and IP address to the DNS server.
Answer: B
Explanation:
Reference:
https://www.paloaltonetworks.com/documentation/80/globalprotect/globalprotect-admin-guide/globalprotect-portals/define- the-globalprotect-client-authentication-configurations/define-the-globalprotect-agent-configurations
"Select this option to allow the GlobalProtect agent to determine if it is inside the enterprise network. This option applies only to endpoints that are configured to communicate with internal gateways. When the user attempts to log in, the agent does a reverse DNS lookup of an internal host using the specified Hostname to the specified IP Address. The host serves as a reference point that is reachable if the endpoint is inside the enterprise network. If the agent finds the host, the endpoint is inside the network and the agent connects to an internal gateway; if the agent fails to find the internal host, the endpoint is outside the network and the agent establishes a tunnel to one of the external gateways"
NEW QUESTION 72
Refer to the exhibit.
Which will be the egress interface if the traffic's ingress interface is ethernet 1/7 sourcing from
192.168.111.3 and to the destination 10.46.41.113?
- A. ethernet1/3
- B. ethernet1/7
- C. ethernet1/5
- D. ethernet1/6
Answer: C
NEW QUESTION 73
......
Difficulty in writing PCNSE Exam
Mostly job holder candidates give a short time to their study and want to pass the exam with good marks. Thereby we have many ways to prepare and practice for exams in a very short time that help the candidates to ready for exams in a very short time without any tension. Candidates can easily prepare Palo Alto Networks PCNSE exams from VerifiedDumps because we are providing the best PCNSE dumps which are verified by our experts. VerifiedDumps has always verified and updated PCNSE dumps that helps the candidate to prepare his exam with little effort in a very short time. We also provide latest and relevant study guide material which is very useful for a candidate to prepare easily for PCNSE exam dumps. Candidate can download and read the latest dumps in PDF and VCE format. VerifiedDumps is providing real questions of PCNSE practice test. We are very fully aware of the importance of student time and money that’s why VerifiedDumps give the candidate the most astounding brain dumps having all the inquiries answer outlined and verified by our experts.
PCNSE Actual Questions and Braindumps: https://www.verifieddumps.com/PCNSE-valid-exam-braindumps.html
Pass PCNSE Exam with Updated PCNSE Exam Dumps PDF 2021: https://drive.google.com/open?id=1UTXCmhmclJqmosywVfFbQ2w8uxAhxAsD
