PCNSE Paloalto-Networks Exam Questions and Free Practice Test

Question 25

- (Exam Topic 1)
Which CLI command displays the physical media that are connected to ethernetl/8?

A. > show system state filter-pretty sys.si.p8.stats

B. > show interface ethernetl/8

C. > show system state filter-pretty sys.sl.p8.phy

D. > show system state filter-pretty sys.si.p8.med

Correct Answer:D

Question 26

- (Exam Topic 3)
Which Security Policy Rule configuration option disables antivirus and anti-spyware scanning of server-to-client flows only?

A. Disable Server Response Inspection

B. Apply an Application Override

C. Disable HIP Profile

D. Add server IP Security Policy exception

Correct Answer:A

Question 27

- (Exam Topic 2)
In High Availability, which information is transferred via the HA data link?

A. session information

B. heartbeats

C. HA state information

D. User-ID information

Correct Answer:A
Reference:
https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/high-availability/ha-links-and-backup-links

Question 28

- (Exam Topic 2)
Which two benefits come from assigning a Decryption Profile to a Decryption policy rule with a “No Decrypt” action? (Choose two.)

A. Block sessions with expired certificates

B. Block sessions with client authentication

C. Block sessions with unsupported cipher suites

D. Block sessions with untrusted issuers

E. Block credential phishing

Correct Answer:AD
https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/decryption/configure-decryption-exception

Question 29

- (Exam Topic 3)
A company is upgrading its existing Palo Alto Networks firewall from version 7.0.1 to 7.0.4.
Which three methods can the firewall administrator use to install PAN-OS 8.0.4 across the enterprise?( Choose three)

A. Download PAN-OS 8.0.4 files from the support site and install them on each firewall after manually uploading.

B. Download PAN-OS 8.0.4 to a USB drive and the firewall will automatically update after the USB drive is inserted in the firewall.

C. Push the PAN-OS 8.0.4 updates from the support site to install on each firewall.

D. Push the PAN-OS 8.0.4 update from one firewall to all of the other remaining after updating one firewall.

E. Download and install PAN-OS 8.0.4 directly on each firewall.

F. Download and push PAN-OS 8.0.4 from Panorama to each firewall.

Correct Answer:ACF

Question 30

- (Exam Topic 2)
A web server is hosted in the DMZ, and the server is configured to listen for incoming connections only on TCP port 8080. A Security policy rule allowing access from the Trust zone to the DMZ zone need to be configured to enable we browsing access to the server.
Which application and service need to be configured to allow only cleartext web-browsing traffic to thins server on tcp/8080.

A. application: web-browsing; service: application-default

B. application: web-browsing; service: service-https

C. application: ssl; service: any

D. application: web-browsing; service: (custom with destination TCP port 8080)

Correct Answer:D
If you check in the FW the default port for web-browsing is TCP 80, so you will need a custom app. admin@PA-LAB-01# show predefined application web-browsing web-browsing { category general-internet; subcategory internet-utility; technology browser-based; analysis 'Web browsing continues to evolve. Initially used to simply view HTML formatted information, web browsers have become the client, through which, users can access new applications that provide functionality far beyond simple information browsing. These applications include web mail, instant messaging, streaming media, web conferencing, blogs, file sharing and other social networkingapplications. Much of the plain web-browsing activities has effectively been overshadowed by all the other applications. } default { port tcp/80; } tunnel-applications http-proxy; risk 4; } [edit]

START PCNSE EXAM