Free 2021 PCNSE PCNSE dumps are available on Google Drive shared by Actual4test
Welcome to download the newest Actual4test PCNSE PDF dumps: https://www.actual4test.com/PCNSE_examcollection.html ( 337 Q&As)
NEW QUESTION 88
The firewall determines if a packet is the first packet of a new session or if a packet is part of an existing session using which kind of match?
- A. 9-tuple match:
Source IP Address, Destination IP Address, Source port, Destination Port, Source User, Source Security Zone, Destination Security Zone, Application, and URL Category - B. 7-tuple match:
Source IP Address, Destination IP Address, Source port, Destination Port, Source User, URL Category, and Source Security Zone - C. 5-tuple match:
Source IP Address, Destination IP Address, Source port, Destination Port, Protocol - D. 6-tuple match:
Source IP Address, Destination IP Address, Source port, Destination Port, Protocol, and Source Security Zone
Answer: D
Explanation:
Explanation
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVECA0
NEW QUESTION 89
Refer to exhibit.
An organization has Palo Alto Networks NGFWs that send logs to remote monitoring and security management platforms. The network team has reported excessive traffic on the corporate WAN.
How could the Palo Alto Networks NGFW administrator reduce WAN traffic while maintaining support for all existing monitoring/ security platforms?
- A. Any configuration on an M-500 would address the insufficient bandwidth concerns.
- B. Configure log compression and optimization features on all remote firewalls.
- C. Forward logs from external sources to Panorama for correlation, and from Panorama send them to the NGFW.
- D. Forward logs from firewalls only to Panorama and have Panorama forward logs to other external services.
Answer: D
NEW QUESTION 90
Refer to the exhibit.
An administrator is using DNAT to map two servers to a single public IP address. Traffic will be steered to
the specific server based on the application, where Host A (10.1.1.100) receives HTTP traffic and HOST B
(10.1.1.101) receives SSH traffic.
Which two security policy rules will accomplish this configuration? (Choose two.)
- A. Untrust (Any) to Untrust (10.1.1.100), web-browsing -Allow
- B. Untrust (Any) to Untrust (10.1.1.101), ssh -Allow
- C. Untrust (Any) to DMZ (10.1.1.100), web-browsing -Allow
- D. Untrust (Any) to DMZ (10.1.1.100.10.1.1.101), ssh, web-browsing -Allow
- E. Untrust (Any) to DMZ (10.1.1.100), ssh -Allow
Answer: C,E
NEW QUESTION 91
A customer wants to combine multiple Ethernet interfaces into a single virtual interface using link aggregation. Which two formats are correct for naming aggregate interfaces? (Choose two.)
- A. ae.1
- B. aggregate.8
- C. aggregate.1
- D. ae.8
Answer: A,D
NEW QUESTION 92
Which three fields can be included in a pcap filter? (Choose three)
- A. Source IP
- B. Ingress interface
- C. Egress interface
- D. Rule number
- E. Destination IP
Answer: A,D,E
Explanation:
Explanation
(https://live.paloaltonetworks.com/t5/Featured-Articles/Getting-Started-Packet-Capture/ta-p/72069)
NEW QUESTION 93
What are two common reasons to use a "No Decrypt" action to exclude traffic from SSL decryption? (Choose two.)
- A. the website matches a sensitive category
- B. the website matches a high-risk category
- C. the website matches a category that is not allowed for most users
- D. the web server requires mutual authentication
Answer: A,C
NEW QUESTION 94
Which log file can be used to identify SSL decryption failures?
- A. Traffic
- B. ACC
- C. Configuration
- D. Threats
Answer: A
Explanation:
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClboCAC
NEW QUESTION 95
What are two benefits of nested device groups in Panorama? (Choose two.)
- A. All device groups inherit settings form the Shared group
- B. Reuse of the existing Security policy rules and objects
- C. Requires configuring both function and location for every device
- D. Overwrites local firewall configuration
Answer: A,B
Explanation:
Creation of a device group hierarchy enables you to organize firewalls based on common policy requirements without redundant configuration. When you create objects for use in shared or device group policy once and use them many times, you reduce administrative overhead and ensure consistency across firewall policies.
NEW QUESTION 96
During the packet flow process, which two processes are performed in application identification?
(Choose two.)
- A. Application override policy match
- B. Pattern based application identification
- C. Session application identified.
- D. Application changed from content inspection
Answer: A,B
Explanation:
http://live.paloaltonetworks.com//t5/image/serverpage/image-id/12862i950F549C7D4E6309
NEW QUESTION 97
Which Zone Pair and Rule Type will allow a successful connection for a user on the Internet zone to a web server hosted on the DMZ zone? The web server is reachable using a Destination NAT policy in the Palo Alto Networks firewall.
- A.
- B.
- C.
- D.
Answer: C
NEW QUESTION 98
Which User-ID method maps IP addresses to usernames for users connecting through a web proxy that has already authenticated the user?
- A. client probing
- B. server monitoring
- C. syslog listening
- D. port mapping
Answer: C
NEW QUESTION 99
Which three options are supported in HA Lite? (Choose three.)
- A. Configuration synchronization
- B. Active/passive deployment
- C. Session synchronization
- D. Synchronization of IPsec security associations
- E. Virtual link
Answer: A,B,D
NEW QUESTION 100
A global corporate office has a large-scale network with only one User-ID agent, which creates a bottleneck near the User-ID agent server.
Which solution in PAN-OS® software would help in this case?
- A. Virtual Wire mode
- B. application override
- C. content inspection
- D. redistribution of user mappings
Answer: D
Explanation:
Explanation/Reference:
Reference: https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/user-id/deploy-user-id-in- a-large-scale-network
NEW QUESTION 101
Which method does an administrator use to integrate all non-native MFA platforms in PAN-OS® software?
- A. Okta
- B. PingID
- C. RADIUS
- D. DUO
Answer: C
Explanation:
https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/authentication/authentication-types/multi-factor-authentication
NEW QUESTION 102
Click the Exhibit button below,
A firewall has three PBF rules and a default route with a next hop of 172.20.10.1 that is configured in the default VR. A user named Will has a PC with a 192.168.10.10 IP address. He makes an HTTPS connection to
172.16.10.20.
Which is the next hop IP address for the HTTPS traffic from Will's PC?
- A. 172.20.10.1
- B. 172.20.30.1
- C. 172.20.40.1
- D. 172.20.20.1
Answer: D
NEW QUESTION 103
Refer to the exhibit.
Which certificates can be used as a Forwarded Trust certificate?
- A. Domain Sub-CA
- B. Certificate from Default Trust Certificate Authorities
- C. Forward_Trust
- D. Domain-Root-Cert
Answer: B
NEW QUESTION 104
Which CLI command displays the current management plane memory utilization?
- A. > show running resource-monitor
- B. > show system resources
- C. > show system info
- D. > debug management-server show
Answer: B
Explanation:
https://live.paloaltonetworks.com/t5/Learning-Articles/How-to-Interpret-show-system-resources/ta-p/59364
"The command show system resources gives a snapshot of Management Plane (MP) resource utilization including memory and CPU. This is similar to the 'top' command in Linux." https://live.paloaltonetworks.com/t5/Learning-Articles/How-to-Interpret-show-system-resources/ta-p/59364
NEW QUESTION 105
......
Tested Material Used To PCNSE: https://www.actual4test.com/PCNSE_examcollection.html
Following are some new PCNSE Real Exam Questions!: https://drive.google.com/open?id=1ND86MP0jCyr1muyr5mXe7b08nfl2grWH