Free Palo Alto Networks PCNSE Exam Dumps and PCNSE Exam Questions

Question No: 1

MultipleChoice

Based on the screenshots above, and with no configuration inside the Template Stack itself, what access will the device permit on its Management port?

Options

AThe firewall will allow HTTP Telnet, HTTPS, SSH, and Ping from IP addresses defined as $permitted-subnet-1.

BThe firewall will allow HTTP Telnet, HTTPS, SSH, and Ping from IP addresses defined as $permitted-subnet-2.

CThe firewall will allow HTTP, Telnet, SNMP, HTTPS, SSH and Ping from IP addresses defined as $permitted-subnet-1 and $permitted-subnet-2.

DThe firewall will allow HTTP, Telnet, HTTPS, SSH, and Ping from IP addresses defined as $permitted-subnet-1 and $permitted-subnet-2.

Question No: 2

MultipleChoice

Refer to the exhibit.

Based on the screenshots above what is the correct order in which the various rules are deployed to firewalls inside the DATACENTER_DG device group?

Options

Ashared pre-rules
DATACENTER DG pre rules
rules configured locally on the firewall
shared post-rules
DATACENTER_DG post-rules
DATACENTER.DG default rules

Bshared pre-rules
DATACENTER_DG pre-rules
rules configured locally on the firewall
shared post-rules
DATACENTER.DG post-rules
shared default rules

Cshared pre-rules
DATACENTER_DG pre-rules
rules configured locally on the firewall
DATACENTER_DG post-rules
shared post-rules
shared default rules

Dshared pre-rules
DATACENTER_DG pre-rules
rules configured locally on the firewall
DATACENTER_DG post-rules
shared post-rules
DATACENTER_DG default rules

Question No: 3

MultipleChoice

When you navigate to Network: > GlobalProtect > Portals > Method section, which three options are available? (Choose three )

Options

Auser-logon (always on)

Bpre-logon then on-demand

Con-demand (manual user initiated connection)

Dpost-logon (always on)

Ecertificate-logon

Question No: 4

MultipleChoice

A network security engineer is attempting to peer a virtual router on a PAN-OS firewall with an external router using the BGP protocol. The peer relationship is not establishing.

What command could the engineer run to see the current state of the BGP state between the two devices?

Options

Ashow routing protocol bgp state

Bshow routing protocol bgp peer

Cshow routing protocol bgp summary

Dshow routing protocol bgp rib-out

Question No: 5

MultipleChoice

A network security engineer must implement Quality of Service policies to ensure specific levels of delivery guarantees for various applications in the environment They want to ensure that they know as much as they can about QoS before deploying.

Which statement about the QoS feature is correct?

Options

AQoS is only supported on firewalls that have a single virtual system configured

BQoS can be used in conjunction with SSL decryption

CQoS is only supported on hardware firewalls

DQoS can be used on firewalls with multiple virtual systems configured

Question No: 6

MultipleChoice

Refer to the exhibit.

Review the images. A firewall policy that permits web traffic includes the global-logs policy is depicted

What is the result of traffic that matches the 'Alert - Threats' Profile Match List?

Options

AThe source address of SMTP traffic that matches a threat is automatically blocked as BadGuys for 180 minutes.

BThe source address of traffic that matches a threat is automatically blocked as BadGuys for 180 minutes.

CThe source address of traffic that matches a threat is automatically tagged as BadGuys for 180 minutes.

DThe source address of SMTP traffic that matches a threat is automatically tagged as BadGuys for 180 minutes.

Question No: 7

DragDrop

Match the terms to their corresponding definitions

https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/datasheets/education/pcnse-study-guide.pdf page 83

Question No: 8

MultipleChoice

Review the images. A firewall policy that permits web traffic includes the global-logs policy is depicted

What is the result of traffic that matches the 'Alert - Threats' Profile Match List?

Options

AThe source address of SMTP traffic that matches a threat is automatically blocked as BadGuys for 180 minutes.

BThe source address of traffic that matches a threat is automatically blocked as BadGuys for 180 minutes.

CThe source address of traffic that matches a threat is automatically tagged as BadGuys for 180 minutes.

DThe source address of SMTP traffic that matches a threat is automatically tagged as BadGuys for 180 minutes.

Question No: 9

DragDrop

Match the terms to their corresponding definitions

Question No: 10

MultipleChoice

Refer to the diagram. Users at an internal system want to ssh to the SSH server The server is configured to respond only to the ssh requests coming from IP 172.16.16.1.

In order to reach the SSH server only from the Trust zone, which Security rule and NAT rule must be configured on the firewall?

Options

ANAT Rule:
Source Zone: Trust -
Source IP: Any -
Destination Zone: Server -
Destination IP: 172.16.15.10 -
Source Translation: Static IP / 172.16.15.1
Security Rule:
Source Zone: Trust -
Source IP: Any -
Destination Zone: Trust -
Destination IP: 172.16.15.10 -
Application: ssh

BNAT Rule:
Source Zone: Trust -
Source IP: 192.168.15.0/24 -
Destination Zone: Trust -
Destination IP: 192.168.15.1 -
Destination Translation: Static IP / 172.16.15.10
Security Rule:
Source Zone: Trust -
Source IP: 192.168.15.0/24 -
Destination Zone: Server -
Destination IP: 172.16.15.10 -
Application: ssh

CNAT Rule:
Source Zone: Trust -
Source IP: Any -
Destination Zone: Trust -
Destination IP: 192.168.15.1 -
Destination Translation: Static IP /172.16.15.10
Security Rule:
Source Zone: Trust -
Source IP: Any -
Destination Zone: Server -
Destination IP: 172.16.15.10 -
Application: ssh

DNAT Rule:
Source Zone: Trust -
Source IP: Any -
Destination Zone: Server -
Destination IP: 172.16.15.10 -
Source Translation: dynamic-ip-and-port / ethernet1/4
Security Rule:
Source Zone: Trust -
Source IP: Any -
Destination Zone: Server -
Destination IP: 172.16.15.10 -
Application: ssh