http://https://www.examslabs.com/Palo-Alto-Networks/PCNSE/best-PCNSE-exam-dumps.html(240 Q&As Dumps, 30%OFF Special Discount: bmzblwH7 )

NEW QUESTION NO: 8
The firewall identifies a popular application as an unknown-tcp.
Which two options are available to identify the application? (Choose two.)
A. Create a custom application.
B. Create a custom object for the custom application server to identify the custom application.
C. Submit an Apple-ID request to Palo Alto Networks.
D. Create a Security policy to identify the custom application.
Answer: A
Explanation/Reference:
Reference: https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/app-id/use-application- objects-in-policy/create-a-custom-application

NEW QUESTION NO: 9
What will be the egress interface if the traffic's ingress interface is ethernet1/6 sourcing from 192.168.111.3 and to the destination 10.46.41.113 during the time shown in the image?

A. ethernet1/3
B. ethernet1/6
C. ethernet1/7
D. ethernet1/5
Answer: A

NEW QUESTION NO: 10
A global corporate office has a large-scale network with only one User-ID agent, which creates a bottleneck near the User-ID agent server.
Which solution in PAN-OS® software would help in this case?
A. application override
B. Virtual Wire mode
C. content inspection
D. redistribution of user mappings
Answer: D
Explanation/Reference:
Reference: https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/user-id/deploy-user-id-in- a-large-scale-network

NEW QUESTION NO: 11
Which two subscriptions are available when configuring panorama to push dynamic updates to connected devices? (Choose two.)
A. Content-ID
B. User-ID
C. Applications and Threats
D. Antivirus
Answer: C,D
Explanation/Reference:
Reference: https://www.paloaltonetworks.com/documentation/71/pan-os/web-interface-help/device/device- dynamic-updates

NEW QUESTION NO: 12
Which method does an administrator use to integrate all non-native MFA platforms in PAN-OS® software?
A. Okta
B. PingID
C. RADIUS
D. DUO
Answer: C

NEW QUESTION NO: 13
Which Palo Alto Networks VM-Series firewall is valid?
A. VM-25
B. VM-800
C. VM-50
D. VM-400
Answer: C
Explanation/Reference:
Reference: https://www.paloaltonetworks.com/products/secure-the-network/virtualized-next-generation- firewall/vm-series

NEW QUESTION NO: 14
A web server is hosted in the DMZ and the server is configured to listen for incoming connections on TCP port 443. A Security policies rules allowing access from the Trust zone to the DMZ zone needs to be configured to allow web-browsing access. The web server hosts its contents over HTTP(S). Traffic from Trust to DMZ is being decrypted with a Forward Proxy rule.
Which combination of service and application, and order of Security policy rules, needs to be configured to allow cleartext web-browsing traffic to this server on tcp/443.
A. Rule #1: application: web-browsing; service: service-http; action: allow Rule #2: application: ssl; service: application-default; action: allow
B. Rule # 1: application: ssl; service: application-default; action: allow Rule #2: application: web-browsing; service: application-default; action: allow
C. Rule #1: application: web-browsing; service: service-https; action: allow Rule #2: application: ssl; service: application-default; action: allow
D. Rule #1: application: web-browsing; service: application-default; action: allow Rule #2: application: ssl; service: application-default; action: allow
Answer: D

NEW QUESTION NO: 15
Which option would an administrator choose to define the certificate and protocol that Panorama and its managed devices use for SSL/TLS services?
A. Configure a Decryption Profile and select SSL/TLS services.
B. Set up SSL/TLS under Polices > Service/URL Category>Service.
C. Set up Security policy rule to allow SSL communication.
D. Configure an SSL/TLS Profile.
Answer: D
Explanation/Reference:
Reference: https://www.paloaltonetworks.com/documentation/80/pan-os/web-interface-help/device/device- certificate-management-ssltls-service-profile

NEW QUESTION NO: 16
A session in the Traffic log is reporting the application as "incomplete." What does "incomplete" mean?
A. Data was received but was instantly discarded because of a Deny policy was applied before App-ID could be applied.
B. The three-way TCP handshake was observed, but the application could not be identified.
C. The three-way TCP handshake did not complete.
D. The traffic is coming across UDP, and the application could not be identified.
Answer: D

NEW QUESTION NO: 17
When is the content inspection performed in the packet flow process?
A. after the application has been identified
B. before session lookup
C. before the packet forwarding process
D. after the SSL Proxy re-encrypts the packet
Answer: A
Explanation/Reference:
Reference:
https://live.paloaltonetworks.com/t5/Learning-Articles/Packet-Flow-Sequence-in-PAN-OS/ta-p/56081

NEW QUESTION NO: 18
If the firewall is configured for credential phishing prevention using the "Domain Credential Filter" method, which login will be detected as credential theft?
A. Mapping to the IP address of the logged-in user.
B. First four letters of the username matching any valid corporate username.
C. Using the same user's corporate username and password.
D. Marching any valid corporate username.
Answer: A
Explanation/Reference:
Reference: https://www.paloaltonetworks.com/documentation/80/pan-os/newfeaturesguide/content- inspection-features/credential-phishing-prevention