PCNSE Paloalto-Networks Exam Questions and Free Practice Test

Question 55

- (Exam Topic 3)
Which two actions are required to make Microsoft Active Directory users appear in a firewall traffic log? (Choose two.)

A. Run the User-ID Agent using an Active Directory account that has "event log viewer" permissions

B. Enable User-ID on the zone object for the destination zone

C. Run the User-ID Agent using an Active Directory account that has "domain administrator" permissions

D. Enable User-ID on the zone object for the source zone

E. Configure a RADIUS server profile to point to a domain controller

Correct Answer:AD

Question 56

- (Exam Topic 2)
The administrator has enabled BGP on a virtual router on the Palo Alto Networks NGFW, but new routes do not seem to be populating the virtual router.
Which two options would help the administrator troubleshoot this issue? (Choose two.)

A. View the System logs and look for the error messages about BGP.

B. Perform a traffic pcap on the NGFW to see any BGP problems.

C. View the Runtime Stats and look for problems with BGP configuration.

D. View the ACC tab to isolate routing issues.

Correct Answer:BC
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClEWCA0

Question 57

- (Exam Topic 2)
Which method will dynamically register tags on the Palo Alto Networks NGFW?

A. Restful API or the VMWare API on the firewall or on the User-ID agent or the read-only domain controller (RODC)

B. Restful API or the VMware API on the firewall or on the User-ID agent

C. XML-API or the VMware API on the firewall or on the User-ID agent or the CLI

D. XML API or the VM Monitoring agent on the NGFW or on the User-ID agent

Correct Answer:D
Reference:
https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/policy/monitor-changes-in-the-virtual-environmen

Question 58

- (Exam Topic 1)
When you import the configuration of an HA pair into Panorama, how do you prevent the import from affecting ongoing traffic?

A. Disable HA

B. Disable the HA2 link

C. Disable config sync

D. Set the passive link state to 'shutdown.

Correct Answer:C

Question 59

- (Exam Topic 2)
Refer to the exhibit.
PCNSE dumps exhibit
Which will be the egress interface if the traffic’s ingress interface is ethernet 1/7 sourcing from 192.168.111.3 and to the destination 10.46.41.113?

A. ethernet1/6

B. ethernet1/3

C. ethernet1/7

D. ethernet1/5

Correct Answer:D

Question 60

- (Exam Topic 3)
An administrator is configuring an IPSec VPN to a Cisco ASA at the administrator's home and experiencing issues completing the connection. the following is the output from the command:
PCNSE dumps exhibit
What could be the cause of this problem?

A. The dead peer detection settings do not match between the Palo Alto Networks Firewall and the ASA.

B. The Proxy IDs on the Palo Alto Networks Firewall do not match the setting on the ASA.

C. The public IP addresses do not match for both the Palo Alto Networks Firewall and the ASA.

D. The shared secrets do not match between the Palo Alto Networks Firewall and the ASA.

Correct Answer:C

START PCNSE EXAM