http://https://www.examslabs.com/Palo-Alto-Networks/PCNSE/best-PCNSE-exam-dumps.html (240 Q&As Dumps, 30%OFF Special Discount: bmzblwH7 )

NEW QUESTION NO: 7
If an administrator does not possess a website's certificate, which SSL decryption mode will allow the Palo Alto networks NGFW to inspect when users browse to HTTP(S) websites?
A. SSL Inbound Inspection
B. SSL Forward Proxy
C. SSL Outbound Inspection
D. TLS Bidirectional proxy
Answer: A

NEW QUESTION NO: 8
An administrator encountered problems with inbound decryption. Which option should the administrator investigate as part of triage?
A. Security policy rule allowing SSL to the target server
B. Firewall connectivity to a CRL
C. Root certificate imported into the firewall with "Trust" enabled
D. Importation of a certificate from an HSM
Answer: A
Explanation/Reference:
Reference: https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/decryption/configure-ssl- inbound-inspection

NEW QUESTION NO: 9
Which CLI command enables an administrator to view details about the firewall including uptime, PAN- OS® version, and serial number?
A. debug system details
B. show session info
C. show system info
D. show system details
Answer: C
Explanation/Reference:
Reference: https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/technical- documentation/pan-os-60/PAN-OS-6.0-CLI-ref.pdf

NEW QUESTION NO: 10
Which protection feature is available only in a Zone Protection Profile?
A. Port Scan Protection
B. ICMP Flood Protection
C. SYN Flood Protection using SYN Flood Cookies
D. UDP Flood Protections
Answer: C

NEW QUESTION NO: 11
How does an administrator schedule an Applications and Threats dynamic update while delaying installation of the update for a certain amount of time?
A. Automatically "download and install" but with the "disable new applications" option used.
B. Automatically "download only" and then install Applications and Threats later, after the administrator approves the update.
C. Configure the option for "Threshold".
D. Disable automatic updates during weekdays.
Answer: B

NEW QUESTION NO: 12
Which event will happen if an administrator uses an Application Override Policy?
A. Threat-ID processing time is decreased.
B. The Palo Alto Networks NGFW stops App-ID processing at Layer 4.
C. The application name assigned to the traffic by the security rule is written to the Traffic log.
D. App-ID processing time is increased.
Answer: B
Explanation/Reference:
Reference: https://live.paloaltonetworks.com/t5/Learning-Articles/Tips-amp-Tricks-How-to-Create-an- Application-Override/ta-p/65513

NEW QUESTION NO: 13
A speed/duplex negotiation mismatch is between the Palo Alto Networks management port and the switch port which it connects.
How would an administrator configure the interface to 1Gbps?
A. set deviceconfig interface speed-duplex 1Gbps-full-duplex
B. set deviceconfig system speed-duplex 1Gbps-duplex
C. set deviceconfig system speed-duplex 1Gbps-full-duplex
D. set deviceconfig Interface speed-duplex 1Gbps-half-duplex
Answer: B
Explanation/Reference:
Reference: https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Change-the-Speed-and- Duplex-of-the-Management-Port/ta-p/59034

NEW QUESTION NO: 14
An administrator needs to implement an NGFW between their DMZ and Core network. EIGRP Routing between the two environments is required. Which interface type would support this business requirement?
A. Layer 3 interfaces, but configuring EIGRP on the attached virtual router
B. Tunnel interfaces to terminate EIGRP routing on an IPsec tunnel (with the GlobalProtect License to support LSVPN and EIGRP protocols)
C. Layer 3 or Aggregate Ethernet interfaces, but configuring EIGRP on subinterfaces only
D. Virtual Wire interfaces to permit EIGRP routing to remain between the Core and DMZ
Answer: C

NEW QUESTION NO: 15
Which Security policy rule will allow an admin to block facebook chat but allow Facebook in general?
A. Deny application facebook-chat before allowing application facebook
B. Deny application facebook on top
C. Allow application facebook on top
D. Allow application facebook before denying application facebook-chat
Answer: A
Explanation/Reference:
Reference: https://live.paloaltonetworks.com/t5/Configuration-Articles/Failed-to-Block-Facebook-Chat- Consistently/ta-p/115673

NEW QUESTION NO: 16
A session in the Traffic log is reporting the application as "incomplete." What does "incomplete" mean?
A. Data was received but was instantly discarded because of a Deny policy was applied before App-ID could be applied.
B. The three-way TCP handshake was observed, but the application could not be identified.
C. The three-way TCP handshake did not complete.
D. The traffic is coming across UDP, and the application could not be identified.
Answer: D

NEW QUESTION NO: 17
Which PAN-OS® policy must you configure to force a user to provide additional credentials before he is allowed to access an internal application that contains highly-sensitive business data?
A. Authentication policy
B. Application Override policy
C. Security policy
D. Decryption policy
Answer: A