Free Palo Alto Networks PCNSE Exam Dumps and PCNSE Exam Questions

Question No: 1

MultipleChoice

When you navigate to Network: > GlobalProtect > Portals > Method section, which three options are available? (Choose three )

Options

Auser-logon (always on)

Bpre-logon then on-demand

Con-demand (manual user initiated connection)

Dpost-logon (always on)

Ecertificate-logon

Question No: 2

MultipleChoice

A network security engineer is attempting to peer a virtual router on a PAN-OS firewall with an external router using the BGP protocol. The peer relationship is not establishing.

What command could the engineer run to see the current state of the BGP state between the two devices?

Options

Ashow routing protocol bgp state

Bshow routing protocol bgp peer

Cshow routing protocol bgp summary

Dshow routing protocol bgp rib-out

Question No: 3

MultipleChoice

A network security engineer must implement Quality of Service policies to ensure specific levels of delivery guarantees for various applications in the environment They want to ensure that they know as much as they can about QoS before deploying.

Which statement about the QoS feature is correct?

Options

AQoS is only supported on firewalls that have a single virtual system configured

BQoS can be used in conjunction with SSL decryption

CQoS is only supported on hardware firewalls

DQoS can be used on firewalls with multiple virtual systems configured

Question No: 4

MultipleChoice

Refer to the exhibit.

Review the images. A firewall policy that permits web traffic includes the global-logs policy is depicted

What is the result of traffic that matches the 'Alert - Threats' Profile Match List?

Options

AThe source address of SMTP traffic that matches a threat is automatically blocked as BadGuys for 180 minutes.

BThe source address of traffic that matches a threat is automatically blocked as BadGuys for 180 minutes.

CThe source address of traffic that matches a threat is automatically tagged as BadGuys for 180 minutes.

DThe source address of SMTP traffic that matches a threat is automatically tagged as BadGuys for 180 minutes.

Question No: 5

DragDrop

Match the terms to their corresponding definitions

https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/datasheets/education/pcnse-study-guide.pdf page 83

Question No: 6

MultipleChoice

Review the images. A firewall policy that permits web traffic includes the global-logs policy is depicted

What is the result of traffic that matches the 'Alert - Threats' Profile Match List?

Options

AThe source address of SMTP traffic that matches a threat is automatically blocked as BadGuys for 180 minutes.

BThe source address of traffic that matches a threat is automatically blocked as BadGuys for 180 minutes.

CThe source address of traffic that matches a threat is automatically tagged as BadGuys for 180 minutes.

DThe source address of SMTP traffic that matches a threat is automatically tagged as BadGuys for 180 minutes.

Question No: 7

DragDrop

Match the terms to their corresponding definitions

Question No: 8

MultipleChoice

Refer to the diagram. Users at an internal system want to ssh to the SSH server The server is configured to respond only to the ssh requests coming from IP 172.16.16.1.

In order to reach the SSH server only from the Trust zone, which Security rule and NAT rule must be configured on the firewall?

Options

ANAT Rule:
Source Zone: Trust -
Source IP: Any -
Destination Zone: Server -
Destination IP: 172.16.15.10 -
Source Translation: Static IP / 172.16.15.1
Security Rule:
Source Zone: Trust -
Source IP: Any -
Destination Zone: Trust -
Destination IP: 172.16.15.10 -
Application: ssh

BNAT Rule:
Source Zone: Trust -
Source IP: 192.168.15.0/24 -
Destination Zone: Trust -
Destination IP: 192.168.15.1 -
Destination Translation: Static IP / 172.16.15.10
Security Rule:
Source Zone: Trust -
Source IP: 192.168.15.0/24 -
Destination Zone: Server -
Destination IP: 172.16.15.10 -
Application: ssh

CNAT Rule:
Source Zone: Trust -
Source IP: Any -
Destination Zone: Trust -
Destination IP: 192.168.15.1 -
Destination Translation: Static IP /172.16.15.10
Security Rule:
Source Zone: Trust -
Source IP: Any -
Destination Zone: Server -
Destination IP: 172.16.15.10 -
Application: ssh

DNAT Rule:
Source Zone: Trust -
Source IP: Any -
Destination Zone: Server -
Destination IP: 172.16.15.10 -
Source Translation: dynamic-ip-and-port / ethernet1/4
Security Rule:
Source Zone: Trust -
Source IP: Any -
Destination Zone: Server -
Destination IP: 172.16.15.10 -
Application: ssh

Question No: 9

MultipleChoice

An organization conducts research on the benefits of leveraging the Web Proxy feature of PAN-OS 11.0.

What are two benefits of using an explicit proxy method versus a transparent proxy method? (Choose two.)

. No client configuration is required for explicit proxy, which simplifies the deployment complexity.

Options

BExplicit proxy supports interception of traffic using non-standard HTTPS ports.

CIt supports the X-Authenticated-User (XAU) header, which contains the authenticated username in the outgoing request.

DExplicit proxy allows for easier troubleshooting, since the client browser is aware of the existence of the proxy.

Question No: 10

DragDrop

Match the terms to their corresponding definitions

https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/datasheets/education/pcnse-study-guide.pdf page 83

Free Palo Alto Networks Certified Security Engineer PAN-OS 11.0 Exam Dumps