Free Palo Alto Networks PCNSE Exam Dumps and PCNSE Exam Questions

Question No: 11

MultipleChoice

Refer to the diagram. Users at an internal system want to ssh to the SSH server The server is configured to respond only to the ssh requests coming from IP 172.16.16.1.

In order to reach the SSH server only from the Trust zone, which Security rule and NAT rule must be configured on the firewall?

Options

ANAT Rule:
Source Zone: Trust -
Source IP: Any -
Destination Zone: Server -
Destination IP: 172.16.15.10 -
Source Translation: Static IP / 172.16.15.1
Security Rule:
Source Zone: Trust -
Source IP: Any -
Destination Zone: Trust -
Destination IP: 172.16.15.10 -
Application: ssh

BNAT Rule:
Source Zone: Trust -
Source IP: 192.168.15.0/24 -
Destination Zone: Trust -
Destination IP: 192.168.15.1 -
Destination Translation: Static IP / 172.16.15.10
Security Rule:
Source Zone: Trust -
Source IP: 192.168.15.0/24 -
Destination Zone: Server -
Destination IP: 172.16.15.10 -
Application: ssh

CNAT Rule:
Source Zone: Trust -
Source IP: Any -
Destination Zone: Trust -
Destination IP: 192.168.15.1 -
Destination Translation: Static IP /172.16.15.10
Security Rule:
Source Zone: Trust -
Source IP: Any -
Destination Zone: Server -
Destination IP: 172.16.15.10 -
Application: ssh

DNAT Rule:
Source Zone: Trust -
Source IP: Any -
Destination Zone: Server -
Destination IP: 172.16.15.10 -
Source Translation: dynamic-ip-and-port / ethernet1/4
Security Rule:
Source Zone: Trust -
Source IP: Any -
Destination Zone: Server -
Destination IP: 172.16.15.10 -
Application: ssh

Question No: 12

MultipleChoice

An organization conducts research on the benefits of leveraging the Web Proxy feature of PAN-OS 11.0.

What are two benefits of using an explicit proxy method versus a transparent proxy method? (Choose two.)

. No client configuration is required for explicit proxy, which simplifies the deployment complexity.

Options

BExplicit proxy supports interception of traffic using non-standard HTTPS ports.

CIt supports the X-Authenticated-User (XAU) header, which contains the authenticated username in the outgoing request.

DExplicit proxy allows for easier troubleshooting, since the client browser is aware of the existence of the proxy.

Question No: 13

DragDrop

Match the terms to their corresponding definitions

https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/datasheets/education/pcnse-study-guide.pdf page 83

Question No: 14

MultipleChoice

A network administrator wants to use a certificate for the SSL/TLS Service Profile.

Which type of certificate should the administrator use?

Options

Acertificate authority (CA) certificate

Bclient certificate

Cmachine certificate

Dserver certificate

Question No: 15

MultipleChoice

Using multiple templates in a stack to manage many firewalls provides which two advantages? (Choose two.)

Options

Ainherit address-objects from templates

Bdefine a common standard template configuration for firewalls

Cstandardize server profiles and authentication configuration across all stacks

Dstandardize log-forwarding profiles for security polices across all stacks

Question No: 16

MultipleChoice

An administrator wants to enable WildFire inline machine learning. Which three file types does WildFire inline ML analyze? (Choose three.)

Options

AMS Office

BELF

CAPK

DVBscripts

EPowershell scripts

Question No: 17

MultipleChoice

What are three types of Decryption Policy rules? (Choose three.)

Options

ASSL Inbound Inspection

BSSH Proxy

CSSL Forward Proxy

DDecryption Broker

EDecryption Mirror

Question No: 18

DragDrop

Place the steps in the WildFire process workflow in their correct order.

Question No: 19

MultipleChoice

Review the images. A firewall policy that permits web traffic includes the

What is the result of traffic that matches the 'Alert - Threats' Profile Match List?

Options

AThe source address of SMTP traffic that matches a threat is automatically blocked as BadGuys for 180 minutes.

BThe source address of traffic that matches a threat is automatically blocked as BadGuys for 180 minutes.

CThe source address of traffic that matches a threat is automatically tagged as BadGuys for 180 minutes.

DThe source address of SMTP traffic that matches a threat is automatically tagged as BadGuys for 180 minutes.

Question No: 20

MultipleChoice

The NAT rule destination zone should be set to Outside because that is the zone where the post-NAT IP address of the server (192.168.10.10) belongs. The destination zone of a NAT rule is the zone where the translated IP address resides. Option A is incorrect because None is not a valid zone for a NAT rule. Option C is incorrect because DMZ is the zone where the pre-NAT IP address of the server (153.6 12.10) belongs, not the post-NAT IP address. Option D is incorrect because Inside is not a zone that is configured on the firewall.

An administrator is troubleshooting why video traffic is not being properly classified.

If this traffic does not match any QoS classes, what default class is assigned?

Options

A1

B2

C3

D4