Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

PCNSE_10 > Study Guide PDF Q-Answers > Flashcards

Study Guide PDF Q-Answers Flashcards

1
Q 
1. What is the last step of packet processing in the firewall?
A. check allowed ports
B. check Security Profiles
C. check Security policy
D. forwarding lookup
A

B. check Security Profiles

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q 
2. Which interface type requires you to configure where the next hop is for various addresses?
A. tap
B. virtual wire
C. Layer 2
D. Layer 3
A

D. Layer 3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q
  1. How do you enable the firewall to be managed through a data-plane interface?
    A. You specify Web UI in the interface properties.
    B. You specify Management in the interface properties.
    C. You specify HTTPS in the Interface Management Profile, and then specify in the interface properties to use that profile.
    D. You specify Management in the Interface Management Profile, and then specify in the interface properties to use that profile.
A

C. You specify HTTPS in the Interface Management Profile, and then specify in the interface properties to use that profile.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q
  1. Some devices managed by Panorama have their external interface on ethernet1/1, some on ethernet1/2. However, the zone definitions for the external zone are identical. What is the recommended solution in this case?
    A. Create two templates: one for the ethernet1/1 devices, one for the ethernet1/2 devices. Use the same external zone definitions in both. Apply those two templates to the appropriate devices.
    B. Create three templates: one for the ethernet1/1 devices, one for the ethernet1/2 devices, and one with the external zone definitions. Use those templates to create two template stacks, one with the ethernet1/1 and external zone, another with the ethernet1/2 and external zone. Apply those two template stacks to the appropriate devices.
    C. Create three templates: one for the ethernet1/1 devices, one for the ethernet1/2 devices, and one with the external zone definitions. Apply the external zone template to all devices, and the ethernet1/1 and ethernet1/2 as appropriate (you can apply up to five templates per device).
    D. Create three template stacks: one for the ethernet1/1 devices, one for the ethernet1/2 devices, and one with the external zone definitions. Apply the external zone template to all devices, and the ethernet1/1 and ethernet1/2 as appropriate (you can apply up to five templates per device).
A

A. Create two templates: one for the ethernet1/1 devices, one for the ethernet1/2 devices. Use the same external zone definitions in both. Apply those two templates to the appropriate devices.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q
  1. In a Panorama managed environment, which two options show the correct order of policy evaluation? (Choose two.)
    A. device group pre-rules, shared pre-rules, local firewall rules, intrazone-default, interzone-default
    B. device group pre-rules, local firewall rules, shared post-rules, device group post-rules, intrazone-default, interzone-default
    C. device group pre-rules, local firewall rules, device group post-rules, shared post-rules, intrazone-default, interzone-default
    D. device group pre-rules, local firewall rules, intrazone-default, interzone-default, device group post-rules, shared post-rules
    E. shared pre-rules, device group pre-rules, local firewall rules, intrazone-default, interzone-default
A

C. device group pre-rules, local firewall rules, device group post-rules, shared post-rules, intrazone-default, interzone-default

E. shared pre-rules, device group pre-rules, local firewall rules, intrazone-default, interzone-default

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q
  1. When you deploy the Palo Alto Networks NGFW on NSX, how many virtual network interfaces does a VM-Series firewall need?
    A. two, one for traffic input and output and one for management traffic
    B. four, two for traffic input and output and two for management traffic (for High Availability)
    C. three, one for traffic input, one for traffic output, and one for management traffic
    D. six, two for traffic input, two for traffic output, and two for management traffic (for High Availability)
A

C. three, one for traffic input, one for traffic output, and one for management traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q 
7. Which source of user information is not supported by the NGFW?
A. RACF
B. LDAP
C. Active Directory
D. SAML
A

A. RACF

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q
  1. What is the main mechanism of packet-based vulnerability attacks?
    A. malformed packets that trigger software bugs when they are received
    B. excess packets that fill up buffers, thus preventing legitimate traffic from being processed
    C. packets that get responses that leak information about the system
    D. packets that either fill up buffers or get responses that leak information
A

A. malformed packets that trigger software bugs when they are received

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q 
9. Which method is not a PAN-OS software decryption method?
A. SSH Proxy
B. SSL Proxy
C. SSL Forward Proxy
D. SSL Inbound Inspection
A

B. SSL Proxy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q 
10. What type of identification does an Application Override policy override?
A. App-ID
B. User-ID
C. Content-ID
D. Service
A

A. App-ID

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q 
11. Which two types of protocols can cause an insufficient data value in the Application field in the Traffic log? (Choose two.)
A. UDP
B. TCP
C. ICMP
D. GRE
E. IGP
A

A. UDP

B. TCP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q 
12. Which three profile types are used to prevent malware executables from entering the network? (Choose three.)
A. Antivirus
B. Anti-Spyware
C. WildFire Analysis
D. File Blocking
E. Vulnerability Protection
F. Zone Protection
A

A. Antivirus

C. WildFire Analysis
D. File Blocking

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q 
13. Which user credential detection method does not require access to an external directory?
A. group mapping
B. domain credential filter
C. LDAP
D. Certificate
A

D. Certificate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q 
14. Which object type has a property to specify whether it can transfer files?
A. Application
B. Service
C. User
D. User group
A

A. Application

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q
  1. When destination NAT rules are configured, the associated security rule is matched using which parameters?
    A. pre-NAT source zone and post-NAT destination zone
    B. post-NAT source zone and pre-NAT destination zone
    C. pre-NAT source zone and post-NAT destination IP address
    E. post-NAT source zone and post-NAT destination zone
A

A. pre-NAT source zone and post-NAT destination zone

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q 
16. What is the initial IP address for the management interface?
A. 10.0.0.1
B. 172.16.0.1
C. 192.168.1.1
D. 192.168.255.254
A

C. 192.168.1.1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q 
17. In a new firewall, which port provides web interface access by default?
A. data port #1
B. any data port
C. management port
D. console port
A

C. management port

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q 
18. Which application requires you to import private keys? 
A. Captive Portal 
B. Forward Trust 
C. SSL Inbound Inspection 
D. SSL Exclude Certificate
A

C. SSL Inbound Inspection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q
  1. Under which conditions can two Layer 3 interfaces have the same IP address?
    A. They must be connected to a common VLAN object interface.
    B. They must be connected to the same Ethernet network through a switch. This configuration can be used only for High Availability.
    C. They must be connected to different virtual routers.
    D. They must be subinterfaces of the same physical interface.
    E. This feature is not supported.
A

E. This feature is not supported.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q 
20. Which two protocols are supported for site-to-site VPNs? (Choose two.) 
A. Authentication Header (AH) 
B. Secure Socket Layer (SSL) 
C. Encapsulating Security Payload (ESP) 
D. Transport Layer Security (TLS) 
E. Secure Shell (SSH)
A

A. Authentication Header (AH)

C. Encapsulating Security Payload (ESP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q
  1. GlobalProtect Portal is responsible for which two functions? (Choose two.)
    A. terminating SSL tunnels
    B. authenticating GlobalProtect users
    C. creating on-demand certificates to encrypt SSL
    D. managing and updating GlobalProtect client configurations
    E. managing GlobalProtect Gateway configurations
A

B. authenticating GlobalProtect users

D. managing and updating GlobalProtect client configurations

22
Q 
22. What is the preferred SYN flood defense action type? 
A. Random Drop 
B. Random Early Drop 
C. SYN Proxy 
D. SYN Cookies
A

D. SYN Cookies

23
Q
  1. What would be a valid reason to allow non-SYN TCP packets at the start of a connection?
    A. Such packets could happen legitimately in the case of asymmetric routing.
    B. Such packets could happen legitimately if there is load balancing across firewalls.
    C. Such packets could happen legitimately because of either asymmetric routing or load balancing across firewalls.
    D. Such packets could happen because of router bugs.
A

B. Such packets could happen legitimately if there is load balancing across firewalls.

24
Q 
24. Where do you configure protection from malformed IP and TCP headers? 
A. DoS Profile 
B. QoS Profile 
C. Zone Protection Profile 
D. Application Profile
A

C. Zone Protection Profile

25
Q 
25. Which parameter is "not" a valid criterion for the original packet in address translation? 
A. source zone 
B. application 
C. service 
D. destination address
A

B. application

26
Q 
26. Which parameter in a Security policy rule do you use to apply a rule to traffic coming in from a specific interface? 
A. source zone 
B. source address 
C. user 
D. source interface
A

A. source zone

27
Q 
27. Where do you specify that certain URL categories are not to be decrypted? 
A. certificate properties 
B. Decryption Profile 
C. Decryption policy 
D. Security policy
A

C. Decryption policy

28
Q 
28. Where do you specify how the firewall should treat invalid certificates? 
A. certificate properties 
B. Decryption Profile 
C. Decryption policy 
D. Security policy
A

B. Decryption Profile

29
Q 
29. Which two public cloud environments support pay-as-you-go (PAYG) firewall licensing? (Choose two.) 
A. Microsoft Azure 
B. Microsoft Hyper-V 
C. Amazon AWS 
D. VMware NSX 
E. VMware ESXi
A

A. Microsoft Azure

C. Amazon AWS

“a” holes charge

30
Q 
30. Which log type gets redirected in Device > Log Settings? 
A. Config 
B. Traffic 
C. Threat 
D. WildFire Submission
A

A. Config

31
Q 
31. Which tab of the firewall web interface gives you a consolidated picture of the security situation and the top-level threats? 
A. Dashboard 
B. ACC 
C. Monitor 
D. Devices
A

B. ACC

32
Q
  1. A customer’s custom application uses SMTP (email) to transfer directory information, which needs to be filtered in a different manner from normal SMTP. How do you configure this filtering?
    A. You cannot do it with the NGFW. You need to manually configure a proxy.
    B. Create specific rules for the sources and destinations that run this application.
    C. Create a custom signature and specify the SMTP fields that are different from normal SMTP use and patterns to identify when it is the custom application.
    D. Create an Application Override policy and specify the sources and destinations that run this application.
A

C. Create a custom signature and specify the SMTP fields that are different from normal SMTP use and patterns to identify when it is the custom application.

33
Q
  1. Which kind of update requires a disruption in connectivity?
    A. downloading the PAN-DB seed file
    B. dynamic content
    C. PAN-OS software
    D. WildFire subscription antivirus signatures
A

C. PAN-OS software

34
Q
  1. Which dedicated High Availability port is used for which plane?
    A. HA1 for the data plane, HA2 for the management plane
    B. HA1 for the management plane, HA2 for the data plane
    C. MGT for the management plane; HA2 as a backup
    D. HA1 for the management plane, HA2 for the data plane in the 7000 Series
A

B. HA1 for the management plane, HA2 for the data plane

35
Q
  1. Which two protocols can AutoFocus use to retrieve log information from an NGFW? (Choose two.)
    A. syslog
    B. Log transfer protocol, a Palo Alto Networks proprietary protocol
    C. HTTP
    D. HTTPS
    E. SNMP
A

C. HTTP

D. HTTPS

36
Q 
36. Palo Alto Networks publishes new applications at which approximate interval? 
A. every 30 minutes 
B. hourly 
C. daily 
D. weekly
A

D. weekly

37
Q 
37. Which type of device can receive the GlobalProtect data files content update? 
A. Log Collector 
B. firewall 
C. WildFire 
D. Antivirus
A

B. firewall

38
Q 
38. In which log will you see evidence that an administrator cannot log in to the firewall? 
A. Traffic 
B. System 
C. Configuration 
D. Authentication
A

B. System

39
Q 
39. How do you reboot the firewall from the command line? 
A. restart system 
B. reboot 
C. request restart system 
D. request reboot
A

C. request restart system

40
Q
  1. Where in the user interface do you configure how many packets to capture when the extended-capture option is selected in an Anti-Spyware Profile or Vulnerability Profile?
    A. Device tab, as part of the Setup node
    B. Security Profiles, because the desired number of captured packets can vary between profiles
    C. as a default in the Device tab, as part of the Capture node. Then, exceptions can be configured in the Security Profiles
    D. Configure Capturing options for each defined capture file
A

D. Configure Capturing options for each defined capture file

!!!! located in device/setup Content-ID

41
Q
  1. You are preparing a bootstrap template for use with a VM-Series firewall hosted in a public cloud. You don’t need to include the Content-ID files because the firewall will download the latest version when it is booted anyway. How do you configure the bootstrap’s content directory?
    A. leave it empty
    B. delete it
    C. rename it to content-null
    D. add an empty file to it named no-download
A

A. leave it empty

42
Q 
42. Which format do you use for an AWS CloudFormation Template? 
A. XML 
B. CSV 
C. JSON 
D. JSON or XML
A

C. JSON

43
Q
  1. In which order are Security policy rules from Panorama processed relative to local firewall policy rules?
    A. Local firewall policy rules are processed only during loss of Panorama connectivity.
    B. All Panorama rules are processed first.
    C. All local firewall policy rules are processed first.
    D. Some Panorama rules are processed before the firewall’s local rules, and some are processed after the local rules.
A

D. Some Panorama rules are processed before the firewall’s local rules, and some are processed after the local rules.

44
Q
  1. Which statement is true about Security Profiles?
    A. They are evaluated from top down, with the first match processing the traffic.
    B. They are applied to all inbound traffic when they are enabled.
    C. They enable a specific type of threat scanning (e.g., Virus, Spyware).
    D. They can specify actions based on the username.
A

C. They enable a specific type of threat scanning (e.g., Virus, Spyware).

45
Q 
45. Which Captive Portal authentication method can be handled by the browser without affecting the user experience? 
A. web-challenge 
B. browser-challenge 
C. web-form 
D. browser-form
A

B. browser-challenge

46
Q
  1. The firewall of a defense contractor is not connected to the internet. However, it is connected to the classified SIPRNet. The contractor is concerned about getting malware files through that network. Can this defense contractor use the WildFire service for protection?
    A. No, because there is no network path to the WildFire cloud.
    B. No, because all SIPRNet files are encrypted.
    C. Yes, but only for PE-type file analysis.
    D. Yes, it can use a WF-500 appliance.
A

D. Yes, it can use a WF-500 appliance.

47
Q
  1. How does the NGFW handle excess packets when there are QoS constraints?
    A. It buffers them until there is bandwidth to send them.
    B. It drops a percentage of them randomly.
    C. It replaces them with packets that tell the computer on the other side to slow down.
    D. It sends a portion instead of the whole packet.
A

B. It drops a percentage of them randomly.

48
Q 
48. Which function is performed by the management plane? 
A. signature matching 
B. VPN encryption 
C. policy matching 
D. User-ID group lookups
A

D. User-ID group lookups

49
Q
  1. Which User-ID IP address-to-username mapping method can be visible to users?
    A. Captive Portal
    B. monitoring Active Directory event logs
    C. monitoring print server event logs
    D. monitoring a Cisco WLAN controller
A

A. Captive Portal

50
Q 
50. Which feature of the NGFW enables you to identify attempts to tunnel SSH over other ports? 
A. App-ID  	 
B. Content-ID 
C. User-ID 
D. SSH Forward Proxy
A

A. App-ID

db note- set service to “any”

51
Q
  1. What is the correct order of operations?
    A. check allowed ports, decrypt (if traffic is encrypted and the policy specifies to decrypt it), check Security policy, check Security Profiles, re-encrypt traffic
    B. check allowed ports, decrypt (if traffic is encrypted and the policy specifies to decrypt it), check Security Profiles, check Security policy, re-encrypt traffic
    C. decrypt (if traffic is encrypted and the policy specifies to decrypt it), check allowed ports, check Security policy, re-encrypt traffic
    D. decrypt (if traffic is encrypted and the policy specifies to decrypt it), check allowed ports, check Security Profiles, check Security policy, re-encrypt traffic
A

A. check allowed ports, decrypt (if traffic is encrypted and the policy specifies to decrypt it), check Security policy, check Security Profiles, re-encrypt traffic

PCNSE_10 (6 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions