PCNSC question 21 to 40

​ ​ ​

​ ​ ​ Match the command with the appropriate scenario for its use

Groups:

(a) Management plane resource

,

(b) Data plane resources

,

(c) State of various processes

,

(d) Authentication log

• show running resource-monitor

• show system resources

• tail follow yes dp.log authd.log

• debug dataplane packet-diag

• tail follow yes mp.log authd.log

Your customer is setting up an IPsec VPN tunnel with a third party. The third-party device only supports policy-based IPsec VPN tunnels.
What must be set up on the IPsec tunnel on the Palo Alto Networks Next-Generation Firewall to support policy-based tunnels?

• policy-based forwarding

• static route

• Proxy-ID

• DNS proxy

Which category of Vulnerability Signatures is most likely to trigger false positive alerts?

• info-leak

• code-execution

• phishing

• brute-force

What information is required in order to plan the deployment of a perimeter firewall?

• the management IP of the DSL device provided by the ISP

• The operating system and browser version of the management client

• the link type and speed of the surrounding devices

• the name of the Internet provider and the cost of the link

A customer uses an application on the network that shows unknown-tcp application in the traffic logs.
Which two actions can the administrator take to make the application display this information? (Choose two.)

• Create a custom application by using fingerprinting applications

• Submit a request for a new App-ID on the Application & Threat Research Center

• Create a customer application by using signatures

• Submit a request for new App-ID with Unit-42

What happens when a packet from an existing session is received by a firewall that is not the owner in an HA active/active configuration?

• The firewall requests the sender to resend the packet

• The firewall forwards the packet to the peer firewall over the HA3 link.

• The firewall takes ownership of the session from the peer firewall

• The firewall drops the packet to prevent any L3 loops.

You have just completed a firewall migration project in Expedition. Expedition is not directly connected to a firewall. You decide to export the configuration.
What two file types will be available to you in the download options? (Choose two.)

• a tech support file for the target firewall

• the README file describing how to use the XML file

• a TXT file with SET commands

• an XML file to upload to the Palo Alto Networks device

Which three steps must an administrator perform to load only address objects from a PAN-OS saved configuration file into a VM-300 firewall that is in production? (Choose three.)

• import named configuration snapshot through the web interface

• use load config partial command

• use the device configuration import in Panorama

• load the config in the web interface and commit

• enter the configuration mode from the CLI

DRAG DROP -
Match the task for server settings in group mapping with its order in the process

• Navigate to Device > User Identification > Group Mapping

• Enter a unique name to identify the group mapping configuration

• Create an Ldap Server Profile

• Select the LDAP Server Profile

• Add a new group mapping

DRAG DROP -
Match the App-ID adoption task with its order in the process

• Verify thet no traffic is hitting the legacy rules.

• Clone the legacy rules and add aplication information to the intended application-based rules

• Remove the legacy rules

• Capture, retain, and verify that all trafic has been logged for a period of time.

• Perform a like-for-like (layer 3/4) migration from the legacy firewall to the Palo Alto Networks NGFW