DUMPS BASE EXAM DUMPS PALO ALTO NETWORKS PCNSE 28% OFF Automatically For You Paloalto Networks Palo Alto Networks Certified Network Security Engineer Exam Clear PCNSE Exam With Great PCNSE Dumps Questions V16.02 [2022] 1.An administrator wants to enable WildFire inline machine learning. Which three file types does WildFire inline ML analyze? (Choose three.) A. APK B. VBscripts C. MS Office D. ELF E. Powershell scripts Answer: CDE 2.A firewall has been assigned to a new template stack that contains both "Global" and "Local" templates in Panorama, and a successful commit and push has been performed. While validating the configuration on the local firewall, the engineer discovers that some settings are not being applied as intended. The setting values from the "Global" template are applied to the firewall instead of the "Local" template that has different values for the same settings. What should be done to ensure that the settings in the "Local" template are applied while maintaining settings from both templates? A. Move the "Global" template above the "Local” template in the template stack. B. Move the "Local" template above the "Global" template in the template stack. C. Perform a commit and push with the "Force Template Values" option selected. D. Override the values on the local firewall and apply the correct settings for each value. Answer: B 3.A firewall is configured with SSL Forward Proxy decryption and has the following four enterprise certificate authorities (CAs): i. Enterprise-Trusted-CA, which is verified as Forward Trust Certificate (The CA is also installed in the trusted store of the end-user browser and system.) ii. Enterprise-Untrusted-CA, which is verified as Forward Untrust Certificate iii. Enterprise-Intermediate-CA iv. Enterprise-Root-CA, which is verified only as Trusted Root CA An end-user visits https://www.example-website.com/ with a server certificate Common Name (CN): www.example-website.com.The firewall does the SSL Forward Proxy decryption for the website and the server certificate is not trusted by the firewall. The end-user's browser will show that the certificate for www.example- website.comwas issued by which of the following? A. Enterprise-Root-CA which is a self-signed CA B. Enterprise-Intermediate-CA which was, in turn, issued by Enterprise-Root-CA C. Enterprise-Untrusted-CA which is a self-signed CA D. Enterprise-Trusted-CA which is a self-signed CA Clear PCNSE Exam With Great PCNSE Dumps Questions V16.02 [2022] Answer: C 4.When you navigate to Network>Global Protect>Portals>Agent>(config)>App and look in the Connect Method section, which three options are available? (Choose three.) A. pre-logon the non-demand B. certificate-logon C. on-demand (manual user-initiated connection) D. post-logon (always on) E. user-logon (always on) Answer: ACE 5.An existing NGFW customer requires direct internet access offload locally at each site, and IPSec connectivity to all branches over public internet. One requirement is that no new SD-WAN hardware be introduced to the environment. What is the best solution for the customer? A. Upgrade to a PAN-OS SD-WAN subscription B. Configure policy-based forwarding C. Deploy Prisma SD-WAN with Prisma Access D. Configure a remote network on PAN-OS Answer: A 6.A user at an external system with the IP address 65. 124.57.5 queries the DNS server at 4.2.2.2 for the IP address of the web server, www.xyz.com. The DNS server returns an address of 172.16.15.1 In order to reach the web server, which Security rule and NAT rule must be configured on the firewall? A. NAT Rule: Untrust-L3 (any) - Trust-L3 (172.16.15.1) Destination Translation: 192.168.15.47 Security Rule: Clear PCNSE Exam With Great PCNSE Dumps Questions V16.02 [2022] Untrust-L3 (any) - Trust-L3 (192.168. 15.47) - Application: Web-browsing B. NAT Rule: Untrust-L3 (any) - Untrust-L3 (172.16. 15.1) Destination Translation: 192.168.15.47 Security Rule: Untrust-L3 (any) - Trust-L3 (172.16.15.1) - Application: Web-browsing C. NAT Rule: Untrust-L3 (any) - Trust-L3 (172.16.15.1) Destination Translation: 192.168.15.47 Security Rule: Untrust-L3 (any) - Trust-L3 (172.16.15.1) - Application: Web-browsing D. NAT Rule: Untrust-L3 (any) - Untrust-L3 (any) Destination Translation: 192.168.15.1 Security Rule: Untrust-L3 (any) - Trust-L3 (172.16.15.1) - Application: Web-browsing Answer: B 7.Given the following snippet of a WildFire submission log, did the end-user get access to the requested information and why or why not? A. Yes. because the action is set to "allow '' B. No because WildFire classified the seventy as "high." C. Yes because the action is set to "alert" D. No because WildFire categorized a file with the verdict "malicious" Answer: D 8.A remote administrator needs firewall access on an untrusted interface. Which two components are required on the firewall to configure certificate-based Clear PCNSE Exam With Great PCNSE Dumps Questions V16.02 [2022] administrator authentication to the web Ul? (Choose two) A. certificate profile B. server certificate C. client certificate D. certificate authority (CA) certificate Answer: AD 9.A bootstrap USB flash drive has been prepared using a Windows workstation to load the initial configuration of a Palo Alto Networks firewall that was previously being used in a lab. The USB flash drive was formatted using file system FAT32 and the initial configuration is stored in a file named init-cfg txt. The firewall is currently running PAN-OS 10.0 and using a lab config. The contents of init-cfg.txi in the USB flash drive are as follows: Clear PCNSE Exam With Great PCNSE Dumps Questions V16.02 [2022] The USB flash drive has been inserted in the firewalls' USB port, and the firewall has been restarted using command:> request resort system Upon restart, the firewall fails to begin the bootstrapping process. The failure is caused because: A. Firewall must be in factory default state or have all private data deleted for bootstrapping B. The USB must be formatted using the ext3 file system, FAT32 is not supported C. The hostname is a required parameter, but it is missing in init-cfg txt D. The bootstrap.xml file is a required file but it is missing Answer: A 10.When an in-band data port is set up to provide access to required services, what is required for an interface that is assigned to service routes? A. You must set the interface to Layer 2, Layer 3, or virtual wire. B. You must enable DoS and zone protection. C. The interface must be used for traffic to the required services. D. You must use a static IP address. Answer: D 11.An administrator cannot see any Traffic logs from the Palo Alto Networks NGFW in Panorama reports. The configuration problem seems to be on the firewall. Which settings, if configured incorrectly, most likely would stop only Traffic logs from being sent from the NGFW to Panorama? A) Clear PCNSE Exam With Great PCNSE Dumps Questions V16.02 [2022] B) C) D) Clear PCNSE Exam With Great PCNSE Dumps Questions V16.02 [2022] A. Option A B. Option B C. Option C D. Option D Answer: C 12.Your company has 10 Active Directory domain controllers spread across multiple WAN links. All users authenticate to Active Directory. Each link has substantial network bandwidth to support all mission-critical applications. The firewall's management plane is highly utilized. Given this scenario, which type of User-ID agent is considered a best practice by Palo Alto Networks? A. PAN-OS integrated agent B. Citrix terminal server agent with adequate data-plane resources C. Captive Portal D. Windows- based User-ID agent on a standalone server Answer: C 13.Refer to the image. Clear PCNSE Exam With Great PCNSE Dumps Questions V16.02 [2022] An administrator is tasked with correcting an NTP service configuration for firewalls that cannot use the Global template NTP servers. The administrator needs to change the IP address to a preferable server for this template stack but cannot impact other template stacks. How can the issue be corrected? A. Override the value on the NYCFW template. B. Enable "objects defined in ancestors will take higher precedence" under Panorama settings. C. Override the value on the Global template. D. Override a template value using a template stack variable. Answer: AD 14.A Panorama administrator configures a new zone and uses the zone in a new Security policy. After the administrator commits the configuration to Panorama, which device-group commit push operation should the administrator use to ensure that the push is successful? A. merge with candidate config B. force template values C. specify the template as a reference template D. include device and network templates Answer: C 15.Which component enables you to configure firewall resource protection settings? A. Zone Protection Profile B. DoS Protection Profile C. DoS Protection policy Clear PCNSE Exam With Great PCNSE Dumps Questions V16.02 [2022] D. QoS Profile Answer: B 16.Which statement is true regarding a Best Practice Assessment? A. It runs only on firewalls. B. It provides a set of questionnaires that help uncover security risk prevention gaps across all areas of network and security architecture. C. When guided by an authorized sales engineer, it helps determine the areas of greatest risk where you should focus prevention activities. D. It shows how your current configuration compares to Palo Alto Networks recommendations. Answer: D 17.What would allow a network security administrator to authenticate and identify a user with a new BYOD-type device that is not joined to the corporate domain? A. a Security policy with "known-user” selected in the Source User field B. an Authentication policy with "known-user” selected in the Source User field C. an Authentication policy with 'unknown' selected in the Source User field D. a Security policy with “unknown” selected in the Source User field Answer: C 18.Which configuration task is best for reducing load on the management plane? A. Set the URL filtering action to send alerts. B. Enable session logging at start. C. Disable pre-defined reports. D. Disable logging on the default deny rule. Answer: C 19.SAML SLO is supported for which two firewall features? (Choose two.) A. WebUI B. CLI C. GlobalProtectPortal D. CaptivePortal Answer: AC 20.You need to allow users to access the office-suite applications of their choice. How should you configure the firewall to allow access to any office-suite application? A. Create an Application Filter and name it Office Programs, then filter it on the Clear PCNSE Exam With Great PCNSE Dumps Questions V16.02 [2022] business-systems category. B. Create an Application Group and add business-systems to it. C. Create an Application Filter and name it Office Programs, then filter it on the office- programs subcategory. D. Create an Application Group and add Office 365, Evernote, Google Docs, and Libre Office. Answer: B 21.Which statement is correct given the following message from the PanGPA.log on the GlobalProtect app? Failed to connect to server at port: 4767 A. The GlobalProtect app failed to connect to the GlobalProtect Portal on port 4767. B. The PanGPS process failed to connect to the PanGPA process on port 4767. C. The GlobalProtect app failed to connect to the GlobalProtect Gateway on port 4767. D. The PanGPA process failed to connect to the PanGPS process on port 4767. Answer: D 22.A network administrator plans a Prisma Access deployment with three service connections, each with a BGP peering to a CPE. The administrator needs to minimize the BGP configuration and management overhead on on-prem network devices. What should the administrator implement? A. hot potato routing B. summarized BGP routes before advertising C. target service connection for traffic steering D. default routing Answer: D 23.A firewall administrator is trying to identify active routes learned via BGP in the virtual router runtime stats within the GUI. Where can they find this information? A. under the BGP Summary tab B. routes listed in the routing table with flags A?B C. routes listed in the forwarding table with BGP in the Protocol column D. routes listed in the routing table with flags Oi Answer: B 24. In the screenshot above, which two pieces of information can be determined from the ACC configuration shown? (Choose two.) Clear PCNSE Exam With Great PCNSE Dumps Questions V16.02 [2022] A. Threats with a severity of "high" are always listed at the top of the Threat Name list. B. The ACC has been filtered to only show the FTP application. C. The Network Activity tab will display all applications, including FTP. D. Insecure-credentials, brute-force, and protocol-anomaly are all a part of the vulnerability Threat Type. Answer: AD 25.What type of address object would be useful for internal devices where the addressing structure assigns meaning to certain bits in the address, as illustrated in the diagram? A. IP Netmask B. IP Address C. IP Wildcard Mask D. IP Range Answer: C 26.An engineer is troubleshooting traffic routing through the virtual router. The firewall uses multiple routing protocols, and the engineer is trying to determine routing priority. Clear PCNSE Exam With Great PCNSE Dumps Questions V16.02 [2022] Match the default Administrative Distances for each routing protocol. Answer: GET FULL VERSION OF PCNSE DUMPS