PCNSE Exam Questions

In a security-first network what is the recommended threshold value for content updates to be dynamically updated?

A firewall is configured with SSL Forward Proxy decryption and has the following four enterprise certificate authorities (Cas):

An administrator plans to deploy 15 firewalls to act as GlobalProtect gateways around the world Panorama will manage the firewalls. The firewalls will provide access to mobile user...

A traffic log might list an application as "not-applicable" for which two reasons? (Choose two )

An administrator is considering upgrading the Palo Alto Networks NGFW and central management Panorama version. What is considered best practice for this scenario?

When you configure a Layer 3 interface what is one mandatory step?

An administrator has a PA-820 firewall with an active Threat Prevention subscription. The administrator is considering adding a WildFire subscription. How does adding the WildFire...

Which three statements accurately describe Decryption Mirror? (Choose three.)

As a best practice, which URL category should you target first for SSL decryption?

An administrator wants to enable zone protection. Before doing so, what must the administrator consider?

What are two characteristic types that can be defined for a variable? (Choose two)

What are three valid qualifiers for a Decryption Policy Rule match? (Choose three )

Given the following configuration, which route is used for destination 10.10.0.4?

When an in-band data port is set up to provide access to required services, what is required for an interface that is assigned to service routes?

What does SSL decryption require to establish a firewall as a trusted third party and to establish trust between a client and server to secure an SSL/TLS connection?

When setting up a security profile which three items can you use? (Choose three )

A variable name must start with which symbol?

An administrator needs to troubleshoot a User-ID deployment. The administrator believes that there is an issue related to LDAP authentication. The administrator wants to create a p...

What are two common reasons to use a "No Decrypt" action to exclude traffic from SSL decryption? (Choose two.)

During SSL decryption which three factors affect resource consumption1? (Choose three )

An internal system is not functioning. The firewall administrator has determined that the incorrect egress interface is being used. After looking at the configuration, the administ...

Before you upgrade a Palo Alto Networks NGFW what must you do?

Which User-ID mapping method should be used in a high-security environment where all IP address-to-user mappings should always be explicitly known?

Given the following snippet of a WildFire submission log, did the end-user get access to the requested information and why or why not?

An administrator needs to gather information about the CPU utilization on both the management plane and the data plane. Where does the administrator view the desired data?

An administrator is required to create an application-based Security policy rule to allow Evernote. The Evernote application implicitly uses SSL and web browsing. What is the minim...

Your company occupies one floor in a single building. You have two Active Directory domain controllers on a single network. The firewall's management-plane resources are lightly ut...

Before an administrator of a VM-500 can enable DoS and zone protection, what actions need to be taken?

An administrator receives the following error message: "IKE phase-2 negotiation failed when processing Proxy ID. Received local id 192. 168.33.33/24 type IPv4 address protocol 0 po...

The following objects and policies are defined in a device group hierarchy. Dallas-Branch has Dallas-FW as a member of the Dallas-Branch device-group NYC-DC has NYC-FW as a member...

An administrator has purchased WildFire subscriptions for 90 firewalls globally. What should the administrator consider with regards to the WildFire infrastructure?

What are three reasons for excluding a site from SSL decryption? (Choose three.)

When setting up a security profile, which three items can you use? (Choose three.)

What are three types of Decryption Policy rules? (Choose three.)

Which two features require another license on the NGFW? (Choose two.)

A remote administrator needs access to the firewall on an untrust interface. Which three options would you configure on an Interface Management profile to secure management access?...

A customer is replacing its legacy remote-access VPN solution. Prisma Access has been selected as the replacement. During onboarding, the following options and licenses were select...

A network security engineer has applied a File Blocking profile to a rule with the action of Block. The user of a Linux CLI operating system has opened a ticket. The ticket states...

In a device group, which two configuration objects are defined? (Choose two )

An enterprise Information Security team has deployed policies based on AD groups to restrict user access to critical infrastructure systems. However, a recent phishing campaign aga...

An enterprise has a large Palo Alto Networks footprint that includes onsite firewalls and Prisma Access for mobile users, which is managed by Panorama. The enterprise already uses...

What happens to traffic traversing SD-WAN fabric that doesn't match any SD-WAN policies?

A remote administrator needs firewall access on an untrusted interface. Which two components are required on the firewall to configure certificate-based administrator authenticatio...

An engineer configures a specific service route in an environment with multiple virtual systems instead of using the inherited global service route configuration. What type of serv...

A company wants to use their Active Directory groups to simplify their Security policy creation from Panorama. Which configuration is necessary to retrieve groups from Panorama?

How can packet buffer protection be configured?

An existing NGFW customer requires direct internet access offload locally at each site, and IPSec connectivity to all branches over public internet. One requirement is that no new...

A firewall administrator requires an A/P HA pair to fail over more quickly due to critical business application uptime requirements. What is the correct setting?

What is the function of a service route?

Which of the following commands would you use to check the total number of the sessions that are currently going through SSL Decryption processing?