Question 1

Which two conditions must be met for a firewall to successfully forward traffic to a syslog server? (Choose two)

Accepted Answer

A, B

Explanation: :

Question 2

Which of the following must be enabled to use Threat Prevention features such as Anti-Virus and Anti-Spyware on a firewall?

Accepted Answer

A

Explanation: :

Question 3

DRAG DROP Identity the Stakeholder with their Role when planning a Firewall Panorama, and Cortex XDR Deployment https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/PALO_ALTO_NETWORKS_PCNSC/page_3_img_1.jpg

Accepted Answer

Explanation: Security Engineer - Determines the security, logging, reporting requirements and manages the policy. System Administrator - Manages the software distribution method for the Cortex XDR Client. Security Operations Analyst - Manages the alerts and responds to threats identified on the network or endpoints. Network Engineer - Manages the routing, switching, and general device interconnectivity. When planning a deployment involving Firewall, Panorama, and Cortex XDR, each stakeholder plays a specific role: Security Engineer - This role involves defining and managing security policies, logging configurations, and reporting requirements to ensure compliance and optimal security posture. They are responsible for the overall security configuration and implementation. Reference: Palo Alto Networks Security Policy Documentation. System Administrator - They are responsible for the deployment and maintenance of software, including the Cortex XDR client. This includes distributing the software across the organization and ensuring it is up to date. Reference: Palo Alto Networks Cortex XDR Agent Administrator's Guide Documentation. Security Operations Analyst - Their primary responsibility is to monitor and analyze security events, manage alerts, and respond to threats. They play a critical role in incident detection and response. Reference: Palo Alto Networks Security Operations Documentation. Network Engineer - They ensure the network infrastructure is properly configured for routing, switching, and general device interconnectivity. This ensures that all components, including firewalls and endpoint security solutions, can communicate effectively. Reference: Palo Alto Networks Networking Documentation.

Question 4

An administrator needs to create a new Antivirus Profile to address a virus that is spreading
internally over SMB.
To create a secure posture the administrator should choose which set of actions for the SMB decoder
in an Antivirus Profile?

Accepted Answer

B

Explanation: To create a secure Antivirus Profile to address a virus spreading internally over SMB, the administrator should choose the following set of actions for the SMB decoder: B . Action - Reset-Both; Wildfire Action - Reset-Both Choosing "Reset-Both" for both the Antivirus Action and the Wildfire Action ensures that the connection is terminated on both the client and server sides whenever a virus is detected. This action helps prevent the spread of the virus by cutting off the infected connection immediately. Reference: Palo Alto Networks - Antivirus Profile Best Practices: https://docs.paloaltonetworks.com/bestpractices Palo Alto Networks - Creating and Configuring Antivirus Profiles: https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/threat-prevention/antivirus-profiles

Question 5

Which GlobalProtect feature ensures that only trusted endpoints can connect to the network?

Accepted Answer

A

Explanation: :

Question 6

DRAG DROP Match the App-ID adoption task with its order in the process. https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/PALO_ALTO_NETWORKS_PCNSC/page_11_img_1.jpg

Accepted Answer

Explanation: To match the App-ID adoption task with its order in the process, follow these steps: Perform a like-for-like (Layer 3/4) migration from the legacy firewall to the Palo Alto Networks NGFW. This is the initial step to ensure that the Palo Alto Networks NGFW is in place and functioning with the existing security policies. Capture, retain, and verify that all traffic has been logged for a period of time. This step involves enabling logging and monitoring traffic to understand the application usage and to ensure that all traffic is being logged. Clone the legacy rules and add application information to the intended application-based rules. This step involves creating copies of the existing rules and enhancing them with application-specific information using App-ID. Verify that no traffic is hitting the legacy rules. After creating application-based rules, ensure that traffic is now hitting these new rules instead of the legacy rules. This indicates that the transition to App-ID based policies is successful. Remove the legacy rules. Once it is confirmed that no traffic is hitting the legacy rules and the new App-ID based rules are effectively managing the traffic, the legacy rules can be safely removed. Order in Process: Perform a like-for-like (Layer 3/4) migration from the legacy firewall to the Palo Alto Networks NGFW. Capture, retain, and verify that all traffic has been logged for a period of time. Clone the legacy rules and add application information to the intended application-based rules. Verify that no traffic is hitting the legacy rules. Remove the legacy rules. Reference: Palo Alto Networks - App-ID Best Practices: https://docs.paloaltonetworks.com/best-practices Palo Alto Networks - Migration from Legacy Firewalls: https://docs.paloaltonetworks.com/migration

Question 7

How can you ensure that a Palo Alto Networks firewall does not block traffic during a software update?

Accepted Answer

B

Explanation: :

Question 8

TAC has requested a PCAP on your Panorama lo see why the DNS app is having intermittent issues resolving FODN What is the appropriate CLI command1*

Accepted Answer

B

Explanation: To capture a PCAP on your Panorama to troubleshoot DNS resolution issues, the appropriate CLI command is: B . tcpdump snaplen 0 filter "port 53" This command captures packets with no size limit (snaplen 0) and filters the traffic for port 53, which is used by DNS. This is the most straightforward and comprehensive way to capture all DNS traffic for analysis. Reference: Palo Alto Networks - Using tcpdump on PAN-OS: https://knowledgebase.paloaltonetworks.com Palo Alto Networks - Troubleshooting Network Connectivity Issues: https://docs.paloaltonetworks.com

Question 9

Which log type would you consult to diagnose why a specific URL is being blocked?

Accepted Answer

B

Explanation: :

Question 10

Which license is required to use the Cortex XDR Managed Threat Hunting service?

Accepted Answer

C

Explanation: :

Question 11

What happens when a packet from an existing session is received by a firewall that

Accepted Answer

D

Explanation: When a packet from an existing session is received by a firewall that is part of an HA (High Availability) pair: D . The firewall takes ownership of the session from the peer firewall In a high-availability configuration, if a firewall in an HA pair receives a packet for an existing session that it is not currently handling, it will take ownership of that session from the peer firewall. This ensures seamless continuity of the session and maintains the stateful nature of the firewall's session handling. Reference: Palo Alto Networks - High Availability Concepts: https://docs.paloaltonetworks.com/pan-os/100/pan-os-admin/high-availability/ha-concepts

Question 12

What is the default port used by the Terminal Services agent to communicate with a firewall?

Accepted Answer

A

Explanation: The default port used by the Terminal Services agent to communicate with a Palo Alto Networks firewall is 5007. The Terminal Services agent (TS agent) integrates with Microsoft Terminal Services to associate user information with sessions, enabling User-ID to accurately map user identities to security policies. Reference: Palo Alto Networks Terminal Services Agent Documentation.

Question 13

Which command would you use to view the current sessions on a Palo Alto firewall?

Accepted Answer

B

Explanation: :

Question 14

A customer has deployed a GlobalProtect portal and gateway as its remote-access VPN solution for
its fleet of Windows 10 laptops
The customer wants to use Host information Profile (HIP) data collected at the GlobalProtect gateway
throughout its enterprise as an additional means of policy enforcement
What additional licensing must the customer purchase?

Accepted Answer

B

Explanation: To utilize Host Information Profile (HIP) data collected at the GlobalProtect gateway for policy enforcement throughout the enterprise, the customer needs to purchase a GlobalProtect license for each firewall that will use HIP data to enforce policy. The GlobalProtect license enables the firewall to collect and use HIP data to create policies based on the security posture of the endpoints. Reference: Palo Alto Networks - GlobalProtect Licensing: https://docs.paloaltonetworks.com/globalprotect/100/globalprotect-admin/globalprotect-licenses

Question 15

A customer has a five-year-old firewall in production in the time since the firewall was installed, the
IT team deleted unused security policies on a regular basis but they did not remove the address
objects and groups that were part of these security policies.
What is the best way to delete all of the unused address objects on the firewall?

Accepted Answer

B

Explanation: To delete all of the unused address objects on the firewall, the best method is: B . Using CLI execute request configuration address-objects remove-unused-objects This CLI command is designed to identify and remove all unused address objects in the firewall's configuration. It is the most efficient and accurate method for cleaning up unused objects without manually checking each one. Reference: Palo Alto Networks - PAN-OS CLI Quick Start: https://docs.paloaltonetworks.com/pan-os/10-0/panos-cli-quick-start Palo Alto Networks - Removing Unused Address Objects: https://knowledgebase.paloaltonetworks.com

Free PALO ALTO NETWORKS PCNSC Actual Exam Questions