paloaltonetworks.pcnse.v2019-06-01 - freecram.com · 1/6/2019 ·...

PaloAltoNetworks.PCNSE.v2019-06-01.q64

Exam Code: PCNSEExam Name: Palo Alto Networks Certified Network Security EngineerCertification Provider: Palo Alto NetworksFree Question Number: 64Version: v2019-06-01# of views: 849# of Questions views: 18575https://www.freecram.com/torrent/PaloAltoNetworks.PCNSE.v2019-06-01.q64.html

NEW QUESTION: 1A Palo Alto Networks NGFW just submitted a file to WildFire for analysis. Assume a 5-minutewindow for analysis. The firewall is configured to check for verdicts every 5 minutes.How quickly will the firewall receive back a verdict?A. 10 to 15 minutesB. 5 minutesC. 5 to 10 minutesD. More than 15 minutesAnswer: C

NEW QUESTION: 2An administrator needs to optimize traffic to prefer business-critical applications over non-criticalapplications.QoS natively integrates with which feature to provide service quality?A. Port InspectionB. Certificate revocationC. Content-IDD. App-IDAnswer: DExplanation/Reference:Reference: https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/quality-of-service/qos- concepts/qos-for-applications-and-users#idaed4e749-80b4-4641-a37c-c741aba562e9

NEW QUESTION: 3An administrator creates a custom application containing Layer 7 signatures. The latestapplication and threat dynamic update is downloaded to the same NGFW. The update containsan application that matches the same traffic signatures as the custom application.Which application should be used to identify traffic traversing the NGFW?A. System logs show an application error and neither signature is used.

https://www.freecram.com/torrent/PaloAltoNetworks.PCNSE.v2019-06-01.q64.html

B. Custom and downloaded application signature files are merged and both are usedC. Custom applicationD. Downloaded applicationAnswer: C

NEW QUESTION: 4An administrator has a requirement to export decrypted traffic from the Palo Alto Networks NGFWto a third-party, deep-level packet inspection appliance.Which interface type and license feature are necessary to meet the requirement?A. Decryption Mirror interface with the Threat Analysis licenseB. Virtual Wire interface with the Decryption Port Export licenseC. Tap interface with the Decryption Port Mirror licenseD. Decryption Mirror interface with the associated Decryption Port Mirror licenseAnswer: DExplanation/Reference:Reference: https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/decryption/decryption- concepts/decryption-mirroring

NEW QUESTION: 5How can a candidate or running configuration be copied to a host external from Panorama?A. Commit a running configuration.B. Save a configuration snapshot.C. Save a candidate configuration.D. Export a named configuration snapshot.Answer: DExplanation/Reference:Reference:https://www.paloaltonetworks.com/documentation/71/panorama/panorama_adminguide/administer-panorama/back-up-panorama-and-firewall-configurations

NEW QUESTION: 6An administrator has created an SSL Decryption policy rule that decrypts SSL sessions on anyport.Which log entry can the administrator use to verify that sessions are being decrypted?A. In the details of the Traffic log entriesB. Decryption logC. Data Filtering logD. In the details of the Threat log entriesAnswer: AExplanation/Reference:

Reference: https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Implement-and-Test-SSL- Decryption/ta-p/59719

NEW QUESTION: 7An administrator using an enterprise PKI needs to establish a unique chain of trust to ensuremutual authentication between Panorama and the managed firewalls and Log Collectors.How would the administrator establish the chain of trust?A. Use custom certificatesB. Enable LDAP or RADIUS integrationC. Set up multi-factor authenticationD. Configure strong password authenticationAnswer: AExplanation/Reference:Reference:https://www.paloaltonetworks.com/documentation/80/panorama/panorama_adminguide/panorama-overview/plan-your-panorama-deployment

NEW QUESTION: 8Refer to the exhibit. A web server in the DMZ is being mapped to a public address through DNAT.

Which Security policy rule will allow traffic to flow to the web server?A. Untrust (any) to Untrust (1. 1. 1. 100), web browsing - AllowB. Untrust (any) to DMZ (10. 1. 1. 100), web browsing - AllowC. Untrust (any) to Untrust (10. 1.1. 100), web browsing - AllowD. Untrust (any) to DMZ (1. 1. 1. 100), web browsing - AllowAnswer: A

NEW QUESTION: 9

Which tool provides an administrator the ability to see trends in traffic over periods of time, suchas threats detected in the last 30 days?A. Session BrowserB. Application Command CenterC. TCP DumpD. Packet CaptureAnswer: BExplanation/Reference:Reference: https://live.paloaltonetworks.com/t5/Management-Articles/Tips-amp-Tricks-How-to-Use-the- Application-Command-Center-ACC/ta-p/67342

NEW QUESTION: 10Which virtual router feature determines if a specific destination IP address is reachable?A. Heartbeat MonitoringB. FailoverC. Path MonitoringD. Ping-PathAnswer: CExplanation/Reference:Reference: https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/policy/policy-based- forwarding/pbf/path-monitoring-for-pbf

NEW QUESTION: 11Which User-ID method should be configured to map IP addresses to usernames for usersconnected through a terminal server?A. port mappingB. server monitoringC. client probingD. XFF headersAnswer: AExplanation/Reference:Reference: https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/user-id/configure-user- mapping-for-terminal-server-users

NEW QUESTION: 12An administrator has been asked to create 100 virtual firewalls in a local, on-premise labenvironment (not in "the cloud"). Bootstrapping is the most expedient way to perform this task.Which option describes deployment of a bootstrap package in an on-premise virtual environment?A. Use config-drive on a USB stick.B. Use an S3 bucket with an ISO.C. Create and attach a virtual hard disk (VHD).

D. Use a virtual CD-ROM with an ISO.Answer: DExplanation/Reference:Reference: https://www.paloaltonetworks.com/documentation/80/virtualization/virtualization/set-up-the-vm- series-firewall-on-kvm/install-the-vm-series-firewall-on-kvm/use-an-iso-file-to-deploy-the-vm-series-firewall

NEW QUESTION: 13Which three file types can be forwarded to WildFire for analysis as a part of the basic WildFireservice?(Choose three.)A. .dllB. .exeC. .srcD. .apkE. .pdfF. .jarAnswer: D,E,FExplanation/Reference:Reference: https://www.paloaltonetworks.com/documentation/80/wildfire/wf_admin/wildfire-overview/ wildfire-file-type-support

NEW QUESTION: 14Which method does an administrator use to integrate all non-native MFA platforms in PAN-OS®software?A. OktaB. DUOC. RADIUSD. PingIDAnswer: C

NEW QUESTION: 15If the firewall is configured for credential phishing prevention using the "Domain Credential Filter"method, which login will be detected as credential theft?A. Mapping to the IP address of the logged-in user.B. First four letters of the username matching any valid corporate username.C. Using the same user's corporate username and password.D. Marching any valid corporate username.Answer: AExplanation/Reference:

Reference: https://www.paloaltonetworks.com/documentation/80/pan-os/newfeaturesguide/content- inspection-features/credential-phishing-prevention

NEW QUESTION: 16An administrator has been asked to configure a Palo Alto Networks NGFW to provide protectionagainst external hosts attempting to exploit a flaw in an operating system on an internal system.Which Security Profile type will prevent this attack?A. Vulnerability ProtectionB. Anti-SpywareC. URL FilteringD. AntivirusAnswer: AExplanation/Reference:Reference: https://www.paloaltonetworks.com/documentation/80/pan-os/web-interface-help/objects/ objects-security-profiles-vulnerability-protection

Valid PCNSE Dumps shared by PrepAwayExam.com for Helping Passing PCNSE Exam!PrepAwayExam.com now offer the newest PCNSE exam dumps, the PrepAwayExam.comPCNSE exam questions have been updated and answers have been corrected get thenewest PrepAwayExam.com PCNSE dumps with Test Engine here:https://www.prepawayexam.com/Palo-Alto-Networks/braindumps.PCNSE.ete.file.html (258

Q&As Dumps, 40%OFF Special Discount: freecram)

NEW QUESTION: 17If the firewall has the link monitoring configuration, what will cause a failover?

A. ethernet1/3 going down

https://www.prepawayexam.com/Palo-Alto-Networks/braindumps.PCNSE.ete.file.html

B. ethernet1/6 going downC. ethernet1/3 or Ethernet1/6 going downD. ethernet1/3 and ethernet1/6 going downAnswer: D

NEW QUESTION: 18Which three authentication services can administrator use to authenticate admins into the PaloAlto Networks NGFW without defining a corresponding admin account on the local firewall?(Choose three.)A. KerberosB. SAMLC. RADIUSD. PAPE. LDAPF. TACACS+Answer: A,B,E

NEW QUESTION: 19Which processing order will be enabled when a Panorama administrator selects the setting"Objects defined in ancestors will take higher precedence?"A. Descendant objects will take precedence over other descendant objects.B. Descendant objects will take precedence over ancestor objects.C. Ancestor objects will have precedence over descendant objects.D. Ancestor objects will have precedence over other ancestor objects.Answer: CExplanation/Reference:Reference: https://www.paloaltonetworks.com/documentation/80/pan-os/web-interface-help/device/device- setup-management

NEW QUESTION: 20An administrator logs in to the Palo Alto Networks NGFW and reports that the WebUI is missingthe Policies tab. Which profile is the cause of the missing Policies tab?A. Admin RoleB.WebUIC. AuthorizationD. AuthenticationAnswer: A

NEW QUESTION: 21In High Availability, which information is transferred via the HA data link?A. session information

B. heartbeatsC. HA state informationD. User-ID informationAnswer: AExplanation/Reference:Reference: https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/high-availability/ha- concepts/ha-links-and-backup-links

NEW QUESTION: 22When is the content inspection performed in the packet flow process?A. after the application has been identifiedB. before session lookupC. before the packet forwarding processD. after the SSL Proxy re-encrypts the packetAnswer: AExplanation/Reference:Reference:https://live.paloaltonetworks.com/t5/Learning-Articles/Packet-Flow-Sequence-in-PAN-OS/ta-p/56081

NEW QUESTION: 23An administrator needs to implement an NGFW between their DMZ and Core network. EIGRPRouting between the two environments is required. Which interface type would support thisbusiness requirement?A. Tunnel interfaces to terminate EIGRP routing on an IPsec tunnel (with the GlobalProtectLicense to support LSVPN and EIGRP protocols)B. Virtual Wire interfaces to permit EIGRP routing to remain between the Core and DMZC. Layer 3 interfaces, but configuring EIGRP on the attached virtual routerD. Layer 3 or Aggregate Ethernet interfaces, but configuring EIGRP on subinterfaces onlyAnswer: D

NEW QUESTION: 24A speed/duplex negotiation mismatch is between the Palo Alto Networks management port andthe switch port which it connects.How would an administrator configure the interface to 1Gbps?A. set deviceconfig interface speed-duplex 1Gbps-full-duplexB. set deviceconfig system speed-duplex 1Gbps-duplexC. set deviceconfig system speed-duplex 1Gbps-full-duplexD. set deviceconfig Interface speed-duplex 1Gbps-half-duplexAnswer: BExplanation/Reference:

Reference: https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Change-the-Speed-and- Duplex-of-the-Management-Port/ta-p/59034

NEW QUESTION: 25Refer to the exhibit.

An administrator is using DNAT to map two servers to a single public IP address. Traffic will besteered to the specific server based on the application, where Host A (10.1.1.100) receives HTTPtraffic and HOST B (10.1.1.101) receives SSH traffic.) Which two security policy rules willaccomplish this configuration? (Choose two.)A. Untrust (Any) to Untrust (10.1.1.1), ssh -AllowB. Untrust (Any) to DMZ (10.1.1.1), web-browsing -AllowC. Untrust (Any) to DMZ (10.1.1.1), ssh -AllowD. Untrust (Any) to DMZ (10.1.1.100.10.1.1.101), ssh, web-browsing -AllowE. Untrust (Any) to Untrust (10.1.1.1), web-browsing -AllowAnswer: B,C

NEW QUESTION: 26Which two options prevent the firewall from capturing traffic passing through it? (Choose two.)A. The firewall is in multi-vsys mode.B. The traffic is offloaded.C. The traffic does not match the packet capture filter.D. The firewall's DP CPU is higher than 50%.Answer: B,CExplanation/Reference:Reference: https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/monitoring/take-packet- captures/disable-hardware-offload

NEW QUESTION: 27

Which three steps will reduce the CPU utilization on the management plane? (Choose three.)A. Reduce the traffic being decrypted by the firewall.B. Application override of SSL application.C. Disable SNMP on the management interface.D. Disable predefined reports.E. Disable logging at session start in Security policies.Answer: A,D,E

NEW QUESTION: 28What will be the egress interface if the traffic's ingress interface is ethernet1/6 sourcing from192.168.111.3 and to the destination 10.46.41.113 during the time shown in the image?

A. ethernet1/7B. ethernet1/6

C. ethernet1/5D. ethernet1/3Answer: D

NEW QUESTION: 29Which three firewall states are valid? (Choose three.)A. ActiveB. FunctionalC. PendingD. PassiveE. SuspendedAnswer: A,D,EExplanation/Reference:Reference: https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/high-availability/ha- firewall-states

NEW QUESTION: 30A Security policy rule is configured with a Vulnerability Protection Profile and an action of 'Deny".Which action will this cause configuration on the matched traffic?A. The configuration is invalid. It will cause the firewall to skip this Security policy rule. A warningwill be displayed during a commit.B. The configuration is invalid. The Profile Settings section will be grayed out when the Action isset to"Deny".C. The configuration will allow the matched session unless a vulnerability signature is detected.The"Deny" action will supersede the per-severity defined actions defined in the associatedVulnerability Protection Profile.D. The configuration is valid. It will cause the firewall to deny the matched sessions. Anyconfigured Security Profiles have no effect if the Security policy rule action is set to "Deny."Answer: C

NEW QUESTION: 31An administrator needs to determine why users on the trust zone cannot reach certain websites.The only information available is shown on the following image. Which configuration changeshould the administrator make?A:

C:

D:

E:

A. Option DB. Option BC. Option AD. Option EE. Option CAnswer: B

Valid PCNSE Dumps shared by PrepAwayExam.com for Helping Passing PCNSE Exam!PrepAwayExam.com now offer the newest PCNSE exam dumps, the PrepAwayExam.comPCNSE exam questions have been updated and answers have been corrected get thenewest PrepAwayExam.com PCNSE dumps with Test Engine here:

https://www.prepawayexam.com/Palo-Alto-Networks/braindumps.PCNSE.ete.file.html (258


NEW QUESTION: 32An administrator has users accessing network resources through Citrix XenApp 7 x. Which User-ID mapping solution will map multiple users who are using Citrix to connect to the network andaccess resources?A. Terminal Services agentB. Client ProbingC. GlobalProtectD. Syslog MonitoringAnswer: C

NEW QUESTION: 33Which feature can be configured on VM-Series firewalls?A. aggregate interfacesB. GlobalProtectC. machine learningD. multiple virtual systemsAnswer: B

NEW QUESTION: 34A global corporate office has a large-scale network with only one User-ID agent, which creates abottleneck near the User-ID agent server. Which solution in PAN-OS® software would help in thiscase?A. Content inspectionB. Virtual Wire modeC. Application overrideD. Redistribution of user mappingsAnswer: D

NEW QUESTION: 35The firewall identifies a popular application as an unknown-tcp.Which two options are available to identify the application? (Choose two.)A. Create a custom application.B. Create a custom object for the custom application server to identify the custom application.C. Submit an Apple-ID request to Palo Alto Networks.D. Create a Security policy to identify the custom application.Answer: AExplanation/Reference:


Reference: https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/app-id/use-application- objects-in-policy/create-a-custom-application

NEW QUESTION: 36A session in the Traffic log is reporting the application as "incomplete." What does "incomplete"mean?A. The three-way TCP handshake did not complete.B. The three-way TCP handshake was observed, but the application could not be identified.C. The traffic is coming across UDP, and the application could not be identified.D. Data was received but was instantly discarded because of a Deny policy was applied beforeApp-ID could be applied.Answer: B

NEW QUESTION: 37A web server is hosted in the DMZ, and the server is configured to listen for incoming connectionsonly on TCP port 8080. A Security policy rule allowing access from the Trust zone to the DMZzone need to be configured to enable we browsing access to the server.Which application and service need to be configured to allow only cleartext web-browsing trafficto thins server on tcp/8080.A. application: ssl; service: anyB. application: web-browsing; service: application-defaultC. application: web-browsing; service: service-httpsD. application: web-browsing; service: (custom with destination TCP port 8080)Answer: B

NEW QUESTION: 38Which two benefits come from assigning a Decryption Profile to a Decryption policy rule with a"No Decrypt" action? (Choose two.)A. Block sessions with expired certificatesB. Block sessions with client authenticationC. Block sessions with unsupported cipher suitesD. Block sessions with untrusted issuersE. Block credential phishingAnswer: A,B,CExplanation/Reference:Reference: https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/decryption/define-traffic- to-decrypt/create-a-decryption-profile

NEW QUESTION: 39A global corporate office has a large-scale network with only one User-ID agent, which creates abottleneck near the User-ID agent server.

Which solution in PAN-OS® software would help in this case?A. application overrideB. Virtual Wire modeC. content inspectionD. redistribution of user mappingsAnswer: DExplanation/Reference:Reference: https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/user-id/deploy-user-id-in- a-large-scale-network

NEW QUESTION: 40Which Security policy rule will allow an admin to block facebook chat but allow Facebook ingeneral?A. Deny application facebook-chat before allowing application facebookB. Deny application facebook on topC. Allow application facebook on topD. Allow application facebook before denying application facebook-chatAnswer: AExplanation/Reference:Reference: https://live.paloaltonetworks.com/t5/Configuration-Articles/Failed-to-Block-Facebook-Chat- Consistently/ta-p/115673

NEW QUESTION: 41An administrator has enabled OSPF on a virtual router on the NGFW. OSPF is not adding newroutes to the virtual router.Which two options enable the administrator to troubleshoot this issue? (Choose two.)A. View Runtime Stats in the virtual router.B. Perform a traffic pcap at the routing stage.C. Add a redistribution profile to forward as BGP updates.D. View System logs.Answer: A,C

NEW QUESTION: 42An administrator is using Panorama and multiple Palo Alto Networks NGFWs. After upgrading alldevices to the latest PAN-OS® software, the administrator enables log forwarding from thefirewalls to Panorama.Pre-existing logs from the firewalls are not appearing in Panorama.Which action would enable the firewalls to send their pre-existing logs to Panorama?A. The log database will need to exported form the firewalls and manually imported intoPanorama.B. Use the import option to pull logs into Panorama.

C. Use the ACC to consolidate pre-existing logs.D. A CLI command will forward the pre-existing logs to Panorama.Answer: D

NEW QUESTION: 43An administrator needs to upgrade a Palo Alto Networks NGFW to the most current version ofPAN-OS® software. The firewall has internet connectivity through an Ethernet interface, but nointernet connectivity from the management interface. The Security policy has the default securityrules and a rule that allows all web-browsing traffic from any to any zone.What must the administrator configure so that the PAN-OS® software can be upgraded?A. Security policy ruleB. SchedulerC. CRLD. Service routeAnswer: A

NEW QUESTION: 44What are two benefits of nested device groups in Panorama? (Choose two.)A. All device groups inherit settings form the Shared groupB. Requires configuring both function and location for every deviceC. Overwrites local firewall configurationD. Reuse of the existing Security policy rules and objectsAnswer: A,B

NEW QUESTION: 45The administrator has enabled BGP on a virtual router on the Palo Alto Networks NGFW, but newroutes do not seem to be populating the virtual router.Which two options would help the administrator troubleshoot this issue? (Choose two.)A. View the ACC tab to isolate routing issues.B. View the System logs and look for the error messages about BGP.C. Perform a traffic pcap on the NGFW to see any BGP problems.D. View the Runtime Stats and look for problems with BGP configuration.Answer: A,D

NEW QUESTION: 46An administrator sees several inbound sessions identified as unknown-tcp in the Traffic logs. Theadministrator determines that these sessions are form external users accessing the company'sproprietary accounting application. The administrator wants to reliably identify this traffic as theiraccounting application and to scan this traffic for threats.Which option would achieve this result?A. Create an Application Override policy.

B. Create a custom App-ID and use the "ordered conditions" check box.C. Create an Application Override policy and custom threat signature for the application.D. Create a custom App-ID and enable scanning on the advanced tab.Answer: D

Valid PCNSE Dumps shared by PrepAwayExam.com for Helping Passing PCNSE Exam!PrepAwayExam.com now offer the newest PCNSE exam dumps, the PrepAwayExam.comPCNSE exam questions have been updated and answers have been corrected get thenewest PrepAwayExam.com PCNSE dumps with Test Engine here:https://www.prepawayexam.com/Palo-Alto-Networks/braindumps.PCNSE.ete.file.html (258


NEW QUESTION: 47How would an administrator monitor/capture traffic on the management interface of the Palo AltoNetworks NGFW?A. Use the debug dataplane packet-diag set capture stage firewall file command.B. Enable all four stages of traffic capture (TX, RX, DROP, Firewall).C. Use the debug dataplane packet-diag set capture stage management file command.D. Use the tcpdump command.Answer: AExplanation/Reference:Reference: https://live.paloaltonetworks.com/t5/Learning-Articles/How-to-Run-a-Packet-Capture/ta- p/62390

NEW QUESTION: 48Which Palo Alto Networks VM-Series firewall is valid?A. VM-25B. VM-800C. VM-50D. VM-400Answer: CExplanation/Reference:Reference: https://www.paloaltonetworks.com/products/secure-the-network/virtualized-next-generation- firewall/vm-series

NEW QUESTION: 49If an administrator does not possess a website's certificate, which SSL decryption mode will allowthe Palo Alto networks NGFW to inspect when users browse to HTTP(S) websites?A. SSL Outbound Inspection


B. TLS Bidirectional proxyC. SSL Inbound InspectionD. SSL Forward ProxyAnswer: C

NEW QUESTION: 50A customer has an application that is being identified as unknown-top for one of their customPostgreSQL database connections. Which two configuration options can be used to correctlycategorize their custom database application? (Choose two.)A. Custom application.B. Security policy to identify the custom application.C. Custom Service object.D. Application Override policy.Answer: A,B

NEW QUESTION: 51A web server is hosted in the DMZ and the server is configured to listen for incoming connectionson TCP port 443. A Security policies rules allowing access from the Trust zone to the DMZ zoneneeds to be configured to allow web-browsing access. The web server hosts its contents overHTTP(S). Traffic from Trust to DMZ is being decrypted with a Forward Proxy rule.Which combination of service and application, and order of Security policy rules, needs to beconfigured to allow cleartext web-browsing traffic to this server on tcp/443.A. Rule #1: application: web-browsing; service: service-https; action: allow Rule #2: application:ssl; service: application-default; action: allowB. Rule # 1: application: ssl; service: application-default; action: allow Rule #2: application: web-browsing; service: application-default; action: allowC. Rule #1: application: web-browsing; service: application-default; action: allow Rule #2:application: ssl; service: application-default; action: allowD. Rule #1: application: web-browsing; service: service-http; action: allow Rule #2: application:ssl; service: application-default; action: allowAnswer: C

NEW QUESTION: 52Which event will happen if an administrator uses an Application Override Policy?A. Threat-ID processing time is decreased.B. The Palo Alto Networks NGFW stops App-ID processing at Layer 4.C. The application name assigned to the traffic by the security rule is written to the Traffic log.D. App-ID processing time is increased.Answer: BExplanation/Reference:

Reference: https://live.paloaltonetworks.com/t5/Learning-Articles/Tips-amp-Tricks-How-to-Create-an- Application-Override/ta-p/65513

NEW QUESTION: 53During the packet flow process, which two processes are performed in application identification?(Choose two.)A. Session application identified.B. Application changed from content inspectionC. Application override policy matchD. Pattern based application identificationAnswer: A,C

NEW QUESTION: 54Which Captive Portal mode must be configured to support MFA authentication?A. NTLMB. RedirectC. Single Sign-OnD. TransparentAnswer: BExplanation/Reference:Reference: https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/authentication/configure- multi-factor-authentication

NEW QUESTION: 55Refer to the exhibit.

Which will be the egress interface if the traffic's ingress interface is ethernet 1/7 sourcing from192.168.111.3 and to the destination 10.46.41.113?A. ethernet1/3B. ethernet1/6C. ethernet1/7D. ethernet1/5Answer: D

NEW QUESTION: 56An administrator wants multiple web servers in the DMZ to receive connections initiated from theinternet.Traffic destined for 206.15.22.9 port 80/TCP needs to be forwarded to the server at 10.1.1.22Based on the information shown in the image, which NAT rule will forward web-browsing trafficcorrectly?

A:

B:

C:

D:

A. Option BB. Option CC. Option AD. Option DAnswer: B

NEW QUESTION: 57An administrator has left a firewall to use the default port for all management services. Whichthree functions are performed by the dataplane? (Choose three.)

A. File blockingB. NTPC.WildFire updatesD. antivirusE. NATAnswer: B,C,E

NEW QUESTION: 58A user's traffic traversing a Palo Alto Networks NGFW sometimes can reachhttp://www.company.com. At other times the session times out. The NGFW has been configuredwith a PBF rule that the user's traffic matches when it goes to http://www.company.com.How can the firewall be configured automatically disable the PBF rule if the next hop goes down?A. Create and add a Monitor Profile with an action of Fail Over in the PBF rule in question.B. Configure path monitoring for the next hop gateway on the default route in the virtual router.C. Enable and configure a Link Monitoring Profile for the external interface of the firewall.D. Create and add a Monitor Profile with an action of Wait Recover in the PBF rule in question.Answer: B

NEW QUESTION: 59Which three settings are defined within the Templates object of Panorama? (Choose three.)A. SetupB. Virtual RoutersC. Application OverrideD. InterfacesE. SecurityAnswer: A,C,E

NEW QUESTION: 60The certificate information displayed in the following image is for which type of certificate?

A. Public CA signed certificateB. Self-Signed Root CA certificateC.Web Server certificateD. Forward Trust certificateAnswer: A

NEW QUESTION: 61Which CLI command enables an administrator to view details about the firewall including uptime,PAN- OS® version, and serial number?A. debug system detailsB. show session infoC. show system infoD. show system detailsAnswer: CExplanation/Reference:Reference: https://live.paloaltonetworks.com/t5/Learning-Articles/Quick-Reference-Guide-Helpful-Commands/ta-p/56511




NEW QUESTION: 62Which feature must you configure to prevent users form accidentally submitting their corporatecredentials to a phishing website?A. URL Filtering profileB. Zone Protection profileC. Anti-Spyware profileD. Vulnerability Protection profileAnswer: AExplanation/Reference:Reference: https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/threat-prevention/prevent- credential-phishing

NEW QUESTION: 63VPN traffic intended for an administrator's Palo Alto Networks NGFW is being maliciouslyintercepted and retransmitted by the interceptor. When creating a VPN tunnel, which protectionprofile can be enabled to prevent this malicious behavior?A. DoS ProtectionB. Zone ProtectionC. ReplayD.Web ApplicationAnswer: B

NEW QUESTION: 64A client is concerned about resource exhaustion because of denial-of-service attacks against theirDNS servers.Which option will protect the individual servers?A. Apply an Anti-Spyware Profile with DNS sinkholing.B. Enable packet buffer protection on the Zone Protection Profile.C. Apply a classified DoS Protection Profile.D. Use the DNS App-ID with application-default.Answer: B



paloaltonetworks.pcnse.v2019-06-01 - freecram.com · 1/6/2019 ·...

Documents