PCNSE Exam Dumps - Palo Alto Networks Certified Security Engineer (PCNSE) PAN-OS 11.0

Go to page:

<< First
Prev
1
2
3
4
5
6
7
8
9
10
Next
Last >>

Question # 41

Exhibit.

An organization has Palo Alto Networks NGFWs that send logs to remote monitoring and security management platforms The network team has reported excessive traffic on the corporate WAN How could the Palo Alto Networks NGFW administrator reduce WAN traffic while maintaining support for all the existing monitoring/security platforms?

Any configuration on an M-500 would address the insufficient bandwidth concerns

Forward logs from external sources to Panorama for correlation, and from Panorama send them to the NGFW

Configure log compression and optimization features on all remote firewalls

Forward logs from firewalls only to Panorama and have Panorama forward logs to other external services.

Full Access

Question # 42

An engineer configures SSL decryption in order to have more visibility to the internal users' traffic when it is regressing the firewall.

Which three types of interfaces support SSL Forward Proxy? (Choose three.)

High availability (HA)

Layer 3

Layer 2

Tap

Virtual Wire

Full Access

Question # 43

An administrator notices that an interface configuration has been overridden locally on a firewall. They require all configuration to be managed from Panorama and overrides are not allowed.

What is one way the administrator can meet this requirement?

Perform a commit force from the CLI of the firewall.

Perform a template commit push from Panorama using the "Force Template Values" option.

Perform a device-group commit push from Panorama using the "Include Device and Network Templates" option.

Reload the running configuration and perform a Firewall local commit.

Full Access

Question # 44

A firewall administrator is configuring an IPSec tunnel between a company's HQ and a remote location. On the HQ firewall, the interface used to terminate the IPSec tunnel has a static IP. At the remote location, the interface used to terminate the IPSec tunnel has a DHCP assigned IP address.

Which two actions are required for this scenario to work? (Choose two.)

On the HQ firewall select peer IP address type FQDN

On the remote location firewall select peer IP address type Dynamic

On the HQ firewall enable DDNS under the interface used for the IPSec tunnel

On the remote location firewall enable DONS under the interface used for the IPSec tunnel

Full Access

Question # 45

Which Panorama mode should be used so that all logs are sent to. and only stored in. Cortex Data Lake?

Log Collector

Panorama

Legacy

Management Only

Full Access

Question # 46

A company uses GlobalProtect for its VPN and wants to allow access to users who have only an endpoint solution installed. Which sequence of configuration steps will allow access only for hosts that have antivirus or anti-spyware enabled?

Create a HIP object with Anti-Malware enabled and Real Time Protection set to yes. * Create a HIP Profile that matches the HIP object criteria. Enable GlobalProtect Portal Agent to collect HIP Data Collection. Create a Security policy that matches source HIP profile. Enable GlobalProtect Gateway Agent for HIP Notification.

Create Security Profiles for Antivirus and Anti-Spyware.

Create Security Profile Group that includes the Antivirus and Anti-Spyware profiles. Enable GlobalProtect Portal Agent to collect HIP Data Collection. Create a Security policy that matches source device object. Enable GlobalProtect Gateway Agent for HIP Notification.

Create a HIP object with Anti-Malware enabled and Real Time Protection set to yes. Create a HIP Profile that matches the HIP object criteria. Enable GlobalProtect Gateway Agent to collect HIP Data Collection. Create a Security policy that matches source device object. Enable GlobalProtect Portal Agent for HIP Notification.

Create Security Profiles for Antivirus and Anti-Spyware.

Create Security Profile Group that includes the Antivirus and Anti-Spyware profile. Enable GlobalProtect Gateway Agent to collect HIP Data Collection. Create a Security policy that has the Profile Setting. Profile Type selected to Group. Enable GlobalProtect Portal Agent for HIP Notification.

Full Access

Question # 47

Refer to the exhibit.

Using the above screenshot of the ACC, what is the best method to set a global filter, narrow down Blocked User Activity, and locate the user(s) that could be compromised by a botnet?

Click the hyperlink for the Zero Access.Gen threat.

Click the left arrow beside the Zero Access.Gen threat.

Click the source user with the highest threat count.

Click the hyperlink for the hotport threat Category.

Full Access

Question # 48

A network security administrator wants to begin inspecting bulk user HTTPS traffic flows egressing out of the internet edge firewall. Which certificate is the best choice to configure as an SSL Forward Trust certificate?

A self-signed Certificate Authority certificate generated by the firewall

A Machine Certificate for the firewall signed by the organization's PKI

A web server certificate signed by the organization's PKI

A subordinate Certificate Authority certificate signed by the organization's PKI

Full Access