Palo Alto Networks (PCNSE) Certification Study Questions

Text Material Preview

https://www.certspots.com/exam/pcnse/
PCNSE Certification
Dumps
PCNSE Certification Dumps
1. A network engineer is troubleshooting a VPN and wants to verify whether the 
decapsulation/encapsulation counters are increasing.
Which CLI command should the engineer run?
A. Show vpn tunnel name | match encap
B. Show vpn flow name <tunnel name>
C. Show running tunnel flow lookup
D. Show vpn ipsec-sa tunnel <tunnel name>
Answer: B
PCNSE Certification Dumps
2. A network engineer troubleshoots a VPN Phase 2 mismatch and decides that PFS 
(Perfect Forward Secrecy) needs to be enabled.
What action should the engineer take?
A. Add an authentication algorithm in the IPSec Crypto profile.
B. Enable PFS under the IPSec Tunnel advanced options.
C. Select the appropriate DH Group under the IPSec Crypto profile.
D. Enable PFS under the IKE gateway advanced options
Answer: D
PCNSE Certification Dumps
3. A customer wants to set up a VLAN interface for a Layer 2 Ethernet port.
Which two mandatory options are used to configure a VLAN interface? (Choose two.)
A. Virtual router
B. Security zone
C. ARP entries
D. Netflow Profile
Answer: A,B
PCNSE Certification Dumps
4. What are three reasons for excluding a site from SSL decryption? (Choose three.)
A. the website is not present in English
B. unsupported ciphers
C. certificate pinning
D. unsupported browser version
E. mutual authentication
Answer: B,C,E
PCNSE Certification Dumps
5. A security engineer received multiple reports of an IPSec VPN tunnel going down 
the night before. The engineer couldn't find any events related to VPN under system 
togs.
What is the likely cause?
A. Dead Peer Detection is not enabled.
B. Tunnel Inspection settings are misconfigured.
C. The Tunnel Monitor is not configured.
D. The log quota for GTP and Tunnel needs to be adjusted
Answer: C
PCNSE Certification Dumps
6. When an in-band data port is set up to provide access to required services, what is 
required for an interface that is assigned to service routes?
A. The interface must be used for traffic to the required services
B. You must enable DoS and zone protection
C. You must set the interface to Layer 2 Layer 3. or virtual wire
D. You must use a static IP address
Answer: D
PCNSE Certification Dumps
7. Which two actions would be part of an automatic solution that would block sites 
with untrusted certificates without enabling SSL Forward Proxy? (Choose two.)
A. Create a no-decrypt Decryption Policy rule.
B. Configure an EDL to pull IP addresses of known sites resolved from a CRL.
C. Create a Dynamic Address Group for untrusted sites
D. Create a Security Policy rule with vulnerability Security Profile attached.
E. Enable the “Block sessions with untrusted issuers” setting.
Answer: A,D
PCNSE Certification Dumps
8. Before you upgrade a Palo Alto Networks NGFW, what must you do?
A. Make sure that the PAN-OS support contract is valid for at least another year
B. Export a device state of the firewall
C. Make sure that the firewall is running a version of antivirus software and a version 
of WildFire that support the licensed subscriptions.
D. Make sure that the firewall is running a supported version of the app + threat 
update
Answer: D
PCNSE Certification Dumps
9. An engineer is planning an SSL decryption implementation
Which of the following statements is a best practice for SSL decryption?
A. Use the same Forward Trust certificate on all firewalls in the network.
B. Obtain a certificate from a publicly trusted root CA for the Forward Trust 
certificate.
C. Obtain an enterprise CA-signed certificate for the Forward Trust certificate.
D. Use an enterprise CA-signed certificate for the Forward Untrust certificate.
Answer: C
PCNSE Certification Dumps
10. An engineer discovers the management interface is not routable to the User-ID 
agent
What configuration is needed to allow the firewall to communicate to the User-ID 
agent?
A. Create a NAT policy for the User-ID agent server
B. Add a Policy Based Forwarding (PBF) policy to the User-ID agent IP
C. Create a custom service route for the UID Agent
D. Add a static route to the virtual router
Answer: C