PCNSE Free Practice Test

After importing a pre-configured firewall configuration to Panorama, what step is required to ensure a commit/push is successful without duplicating local configurations?

1. A. Ensure Force Template Values is checked when pushing configuration.
2. B. Push the Template first, then push Device Group to the newly managed firewal.
3. C. Perform the Export or push Device Config Bundle to the newly managed firewall.
4. D. Push the Device Group first, then push Template to the newly managed firewall

Correct Answer: C
When importing a pre-configured firewall configuration to Panorama, you need to perform the following steps 12:
Add the serial number of the firewall under Panorama > Managed Devices
In Panorama, import the firewall’s configuration bundle under Panorama > Setup > Operations > Import device configuration to Panorama
Commit the changes you made to Panorama
Perform an Export or push Device Config Bundle operation under Panorama > Setup > Operations
The Export or push Device Config Bundle operation allows you to push a complete configuration bundle from Panorama to a managed firewall without duplicating local configurations3. This operation ensures that any local settings on the firewall are preserved and merged with the settings from Panorama.

Which statement is true regarding a Best Practice Assessment?

1. A. It shows how your current configuration compares to Palo Alto Networks recommendations
2. B. It runs only on firewalls
3. C. When guided by an authorized sales engineer, it helps determine the areas of greatest risk where you should focus prevention activities.
4. D. It provides a set of questionnaires that help uncover security risk prevention gaps across all areas of network and security architecture

Correct Answer: A

What are three valid qualifiers for a Decryption Policy Rule match? (Choose three.)

1. A. Destination Zone
2. B. App-ID
3. C. Custom URL Category
4. D. User-ID
5. E. Source Interface

Correct Answer: ACD

During a laptop-replacement project, remote users must be able to establish a GlobalProtect VPN connection to the corporate network before logging in to their new Windows 10 endpoints.
The new laptops have the 5.2.10 GlobalProtect Agent installed, so the administrator chooses to use the Connect Before Logon feature to solve this issue.
What must be configured to enable the Connect Before Logon feature?

1. A. The GlobalProtect Portal Agent App Settings Connect Method to Pre-logon then On-demand.
2. B. Registry keys on the Windows system.
3. C. X-Auth Support in the GlobalProtect Gateway Tunnel Settings.
4. D. The Certificate profile in the GlobalProtect Portal Authentication Settings.

Correct Answer: D

A firewall administrator notices that many Host Sweep scan attacks are being allowed through the firewall sourced from the outside zone. What should the firewall administrator do to mitigate this type of attack?

1. A. Create a DOS Protection profile with SYN Flood protection enabled and apply it to all rules allowing traffic from the outside zone
2. B. Enable packet buffer protection in the outside zone.
3. C. Create a Security rule to deny all ICMP traffic from the outside zone.
4. D. Create a Zone Protection profile, enable reconnaissance protection, set action to Block, and apply it to the outside zone.

Correct Answer: D