Rebirth PCNSE Questions Pool 2021

NEW QUESTION 1
What is exchanged through the HA2 link?

• A. hello heartbeats
• B. User-ID information
• C. session synchronization
• D. HA state information

Answer: C

Explanation:
Reference: https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/high-availability/ha-links-and-backup-links

NEW QUESTION 2
Based on the image, what caused the commit warning?

• A. The CA certificate for FWDtrust has not been imported into the firewall.
• B. The FWDtrust certificate has not been flagged as Trusted Root CA.
• C. SSL Forward Proxy requires a public certificate to be imported into the firewall.
• D. The FWDtrust certificate does not have a certificate chain.

Answer: D

NEW QUESTION 3
Which two statements are correct for the out-of-box configuration for Palo Alto Networks NGFWs? (Choose two)

• A. The devices are pre-configured with a virtual wire pair out the first two interfaces.
• B. The devices are licensed and ready for deployment.
• C. The management interface has an IP address of 192.168.1.1 and allows SSH and HTTPS connections.
• D. A default bidirectional rule is configured that allows Untrust zone traffic to go to the Trust zone.
• E. The interface are pingable.

Answer: BC

NEW QUESTION 4
Which DoS protection mechanism detects and prevents session exhaustion attacks?

• A. Packet Based Attack Protection
• B. Flood Protection
• C. Resource Protection
• D. TCP Port Scan Protection

Answer: C

Explanation:
Reference: https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/policy/dos-protection-profiles

NEW QUESTION 5
Which Panorama feature allows for logs generated by Panorama to be forwarded to an external Security Information and Event Management(SIEM) system?

• A. Panorama Log Settings
• B. Panorama Log Templates
• C. Panorama Device Group Log Forwarding
• D. Collector Log Forwarding for Collector Groups

Answer: A

Explanation:
https://www.paloaltonetworks.com/documentation/61/panorama/panorama_admiHYPERLINK "https://www.paloaltonetworks.com/documentation/61/panorama/panorama_adminguide/manag e-log-collection/enable-log-forwarding-from-panorama-to-external-destinations"nguidHYPERLINK "https://www.paloaltonetworks.com/documentation/61/panorama/panorama_adminguide/manag e-log-collection/enable-log-forwarding-from-panorama-to-external-destinations"e/manage-log- collection/enable-log-forwarding-from-panorama-to-external-destinaHYPERLINK "https://www.paloaltonetworks.com/documentation/61/panorama/panorama_adminguide/manag e-log-collection/enable-log-forwarding-from-panorama-to-external-destinations"tions

NEW QUESTION 6
Which administrative authentication method supports authorization by an external service?

• A. Certificates
• B. LDAP
• C. RADIUS
• D. SSH keys

Answer: C

NEW QUESTION 7
To connect the Palo Alto Networks firewall to AutoFocus, which setting must be enabled?

• A. Device>Setup>Services>AutoFocus
• B. Device> Setup>Management >AutoFocus
• C. AutoFocus is enabled by default on the Palo Alto Networks NGFW
• D. Device>Setup>WildFire>AutoFocus
• E. Device>Setup> Management> Logging and Reporting Settings

Answer: B

Explanation:
Reference: https://www.paloaHYPERLINK
"https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/getting-started/enable-autofocus-threat-intelligence"ltonetworks.com/documentation/71/pan-os/pan-os/getting-started/enable-autofocus-threat-intelligence

NEW QUESTION 8
A network engineer has revived a report of problems reaching 98.139.183.24 through vr1 on the firewall. The routing table on this firewall is extensive and complex.
Which CLI command will help identify the issue?

• A. test routing fib virtual-router vr1
• B. show routing route type static destination 98.139.183.24
• C. test routing fib-lookup ip 98.139.183.24 virtual-router vr1
• D. show routing interface

Answer: C

NEW QUESTION 9
Refer to the exhibit.

An administrator cannot see any of the Traffic logs from the Palo Alto Networks NGFW on Panorama. The configuration problem seems to be on the firewall side. Where is the best place on the Palo Alto Networks NGFW to check whether the configuration is correct?
A)

B)

C)

D)

• A. Option A
• B. Option B
• C. Option C
• D. Option D

Answer: D

NEW QUESTION 10
Which Public Key infrastructure component is used to authenticate users for GlobalProtect when the Connect Method is set to pre-logon?

• A. Certificate revocation list
• B. Trusted root certificate
• C. Machine certificate
• D. Online Certificate Status Protocol

Answer: C

NEW QUESTION 11
What are three valid method of user mapping? (Choose three)

• A. Syslog
• B. XML API
• C. 802.1X
• D. WildFire
• E. Server Monitoring

Answer: ABE

NEW QUESTION 12
The certificate information displayed in the following image is for which type of certificate? Exhibit:

• A. Forward Trust certificate
• B. Self-Signed Root CA certificate
• C. Web Server certificate
• D. Public CA signed certificate

Answer: D

NEW QUESTION 13
Which three firewall states are valid? (Choose three.)

• A. Active
• B. Functional
• C. Pending
• D. Passive
• E. Suspended

Answer: ADE

Explanation:
Reference: https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/high-availability/ha-firewall-states

NEW QUESTION 14
Which three options are available when creating a security profile? (Choose three)

• A. Anti-Malware
• B. File Blocking
• C. Url Filtering
• D. IDS/ISP
• E. Threat Prevention
• F. Antivirus

Answer: ABF

NEW QUESTION 15
Which is the maximum number of samples that can be submitted to WildFire per day, based on wildfire subscription?

• A. 15,000
• B. 10,000
• C. 75,00
• D. 5,000

Answer: B

NEW QUESTION 16
In which two types of deployment is active/active HA configuration supported? (Choose two.)

• A. TAP mode
• B. Layer 2 mode
• C. Virtual Wire mode
• D. Layer 3 mode

Answer: CD

NEW QUESTION 17
Where can an administrator see both the management plane and data plane CPU utilization in the WebUI?

• A. System log
• B. CPU Utilization widget
• C. Resources widget
• D. System Utilization log

Answer: C

NEW QUESTION 18
The firewall is not downloading IP addresses from MineMeld. Based, on the image, what most likely is wrong?

• A. A Certificate Profile that contains the client certificate needs to be selected.
• B. The source address supports only files hosted with an ftp://<address/file>.
• C. External Dynamic Lists do not support SSL connections.
• D. A Certificate Profile that contains the CA certificate needs to be selected.

Answer: D

NEW QUESTION 19
Site-A and Site-B have a site-to-site VPN set up between them. OSPF is configured to dynamically create the routes between the sites. The OSPF configuration in Site-A is configured properly, but the route for the tunner is not being established. The Site-B interfaces in the graphic are using a broadcast Link Type. The administrator has determined that the OSPF configuration in Site-B is using the wrong Link Type for one of its interfaces.

Which Link Type setting will correct the error?

• A. Set tunne
• B. 1 to p2p
• C. Set tunne
• D. 1 to p2mp
• E. Set Ethernet 1/1 to p2mp
• F. Set Ethernet 1/1 to p2p

Answer: A

NEW QUESTION 20
A network Administrator needs to view the default action for a specific spyware signature. The administrator follows the tabs and menus through Objects> Security Profiles> Anti-Spyware and select default profile.
What should be done next?

• A. Click the simple-critical rule and then click the Action drop-down list.
• B. Click the Exceptions tab and then click show all signatures.
• C. View the default actions displayed in the Action column.
• D. Click the Rules tab and then look for rules with "default" in the Action column.

Answer: B

NEW QUESTION 21
VPN traffic intended for an administrator’s Palo Alto Networks NGFW is being maliciously intercepted and retransmitted by the interceptor. When creating a VPN tunnel, which protection profile can be enabled to prevent this malicious behavior?

• A. Zone Protection
• B. DoS Protection
• C. Web Application
• D. Replay

Answer: A

NEW QUESTION 22
Which Zone Pair and Rule Type will allow a successful connection for a user on the internet zone to a web server hosted in the DMZ zone? The web server is reachable using a destination Nat policy in the Palo Alto Networks firewall.

• A. Zone Pair:Source Zone: Internet Destination Zone: DMZ Rule Type:“intrazone”
• B. Zone Pair:Source Zone: Internet Destination Zone: DMZ Rule Type:“intrazone” or “universal”
• C. Zone Pair:Source Zone: Internet Destination Zone: Internet Rule Type:“intrazone” or “universal”
• D. Zone Pair:Source Zone: Internet Destination Zone: Internet Rule Type:“intrazone”

Answer: B

NEW QUESTION 23
Which User-ID method should be configured to map IP addresses to usernames for users connected through a terminal server?

• A. port mapping
• B. server monitoring
• C. client probing
• D. XFF headers

Answer: A

Explanation:
Reference: https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/user-id/configure-user-mapping-for-terminal-server-users

NEW QUESTION 24
In the following image from Panorama, why are some values shown in red?

• A. sg2 session count is the lowest compared to the other managed devices.
• B. us3 has a logging rate that deviates from the administrator-configured thresholds.
• C. uk3 has a logging rate that deviates from the seven-day calculated baseline.
• D. sg2 has misconfigured session thresholds.

Answer: C

NEW QUESTION 25
A file sharing application is being permitted and no one knows what this application is used for. How should this application be blocked?

• A. Block all unauthorized applications using a security policy
• B. Block all known internal custom applications
• C. Create a WildFire Analysis Profile that blocks Layer 4 and Layer 7 attacks
• D. Create a File blocking profile that blocks Layer 4 and Layer 7 attacks

Answer: D

NEW QUESTION 26
......