[May-2025] Free PCNSC Exam Questions PCNSC Actual Free Exam Questions
Verified PCNSC dumps and 62 unique questions
NEW QUESTION # 37
Which method will dynamically register tags on the Palo Alto Networks NGFW?
- A. Restful API or the VMware API on the firewall or on the User.-D agent or the ready -only domain controller
- B. XML- API or lite VM Monitoring agent on the NGFW or on the User- ID agent
- C. Restful API or the VMware API on the firewall or on the User-ID Agent
- D. XML API or the VMware API on the firewall on the User-ID agent or the CLI
Answer: B
NEW QUESTION # 38
Which of the following is a primary use case for the Decryption Broker feature?
- A. Aggregating traffic logs from different sources
- B. Sharing decrypted traffic with multiple security appliances
- C. Decrypting outbound SSL traffic
- D. Managing multiple decryption rules
Answer: B
NEW QUESTION # 39
Which DoS protection mechanism detects and prevents session exhaustion attacks?
- A. Flood Protection
- B. Pocket Based Attack Protection
- C. Resource Protection
- D. TCP Port Scan Protection
Answer: C
NEW QUESTION # 40
Winch three steps will reduce the CPU utilization on the management plane? (Choose three. ) Disable logging at session start in Security policies.
- A. Application override of SSL application.
- B. Disable SNMP on the management interface.
- C. Reduce the traffic being decrypted by the firewall.
- D. Disable predefined reports.
Answer: B,C,D
NEW QUESTION # 41
In Panorama the web interface displays the security rules in evaluation order Organize the security rules m the order in which they will be evaluated?
Answer:
Explanation:
Explanation:
In Panorama, security rules are evaluated in a specific order to determine which rule applies to the traffic. The correct evaluation order is as follows:
* Shared pre-rules(evaluated first)
* Device group pre-rules(evaluated second)
* Local firewall rules(evaluated third)
* Device group post-rules(evaluated fourth)
* Shared post-rules(evaluated fifth)
This order ensures that the most generic rules (shared across all devices) are evaluated first, followed by more specific rules at the device group and local firewall levels, and then the post-rules.
References:
* Palo Alto Networks - Panorama Admin Guide:
https://docs.paloaltonetworks.com/panorama/10-0/panorama-admin/policy/policy-precedence-and-evaluati
* Palo Alto Networks - Security Policy Evaluation: https://knowledgebase.paloaltonetworks.com
NEW QUESTION # 42
An administrator pushes a new configuration from panorama to a pair of firewalls that are configured as active/passive HA pair.
Which NGFW receives the configuration from panorama?
- A. both the active and passive firewalls, which then synchronizes with each other
- B. the active firewall, which then synchronizes to the passive firewall
- C. the passive firewall, which then synchronizes to the active firewall
- D. both the active and passive firewalls independently, with no synchronization afterward
Answer: A
NEW QUESTION # 43
A speed/duplex negotiation mismatch is between the Palo Alto Networks management port and the switch it connect.
How would an administrator configure the interface to IGbps?
- A. set deviceconfig interface speed-duplex 1Gbs--full-duplex
- B. set deviceconfig system speed-duplex 1Gbs--half-duplex.
- C. set deviceconfig system speed-duplex 10Gbps-full-duplex
- D. set deviceconfig interface speed-duplex 1Gbs--half-duplex
Answer: B
NEW QUESTION # 44
Which three options are supposed in HA Lite? (Choose three.)
- A. active/passive deployment
- B. Configuration synchronization
- C. synchronization of IPsec security associations
- D. Virtual link
- E. session synchronization
Answer: A,B,C
NEW QUESTION # 45
An administrator needs to optimize traffic to prefer business-critical applications over non-critical applications.
QoS natively integrates with which feature to provide service quality?
- A. Content-ID
- B. port inspection
- C. certification revocation
- D. App-ID
Answer: D
NEW QUESTION # 46
What is exchanged through the HA2 link?
- A. hello heartbeats
- B. User-ID in information
- C. session synchronization
- D. HA state information
Answer: C
NEW QUESTION # 47
Your customer believes that the Panorama appliance is being overwhelmed by the logs from deployed Palo Alto Networks Next-Generation Firewalls.What CLl command can you run to determine the number oflogs per second sent by each firewall?
- A. debug log-sender statistics
- B. logging status
- C. show log traffic
- D. debug log-receiver statistics
Answer: D
Explanation:
To determine the number of logs per second sent by each firewall to a Panorama appliance, the appropriate CLI command to use is:
D:debug log-receiver statistics
This command provides detailed statistics about the logs being received by the Panorama, including the rate at which logs are being sent by each connected firewall. This information can help identify whether the Panorama is being overwhelmed by the volume of logs and which firewalls are contributing the most to the log traffic.
References:
* Palo Alto Networks - CLI Commands for Troubleshooting Panorama: https://docs.paloaltonetworks.com
* Palo Alto Networks - Managing Logs and Log Forwarding:
https://knowledgebase.paloaltonetworks.com
NEW QUESTION # 48
When is the content inspection performed in the packet flow process?
- A. before the packet forwarding process
- B. after the application has been identified
- C. after the SSL Proxy re-encrypts the packet
- D. before session lookup
Answer: B
NEW QUESTION # 49
Which of the following must be enabled to use Threat Prevention features such as Anti-Virus and Anti-Spyware on a firewall?
- A. GlobalProtect Subscription
- B. URL Filtering
- C. WildFire Subscription
- D. Security Profiles
Answer: D
NEW QUESTION # 50
Which two types of security profiles are recommended to protect against known and unknown threats?
(Choose two)
- A. Antivirus
- B. File Blocking
- C. URL Filtering
- D. Anti-Spyware
Answer: A,D
NEW QUESTION # 51
Which two options prevents the firewall from capturing traffic passing through it? (Choose two.)
- A. The firewall is in milti-vsys mode.
- B. The firewall's DP CPU is higher than 50%
- C. The traffic does not match the packet capture filter
- D. The traffic is offloaded.
Answer: C,D
NEW QUESTION # 52
How can you ensure that a Palo Alto Networks firewall does not block traffic during a software update?
- A. Enable the Suspend Traffic During Upgrade option
- B. Schedule the upgrade during a maintenance window
- C. Use the High Availability feature
- D. Configure session synchronization
Answer: B
NEW QUESTION # 53
The administrator has enabled BGP on a virtual router on the Palo Alto Networks NGFW, but new routes do not seem to be populating the virtual router.
Which two options would help the administrator Troubleshoot this issue? (Choose two.)
- A. View the System logs and look for error messages about BGP
- B. View the Runtime Stats and look for problems with BGP configuration
- C. View the ACC lab to isolate routing issues.
- D. Perform a traffic pcap on the NGFW lo see any BGP problems
Answer: B,C
NEW QUESTION # 54
Which of the following WildFire action settings will ensure that a malicious file is quarantined and prevented from spreading?
- A. Allow
- B. Block
- C. Alert
- D. Reset-Both
Answer: B
NEW QUESTION # 55
A client has a sensitive application server in their data center and is particularly concerned about resource exhaustion because of distributed denial-of-service attacks.
How can the Palo Alto Networks NGFW be configured to specifically protect tins server against resource exhaustion originating from multiple IP address (DDoS attack)?
- A. Add a Vulnerability Protection Profile to block the attack.
- B. Add a DoS Protection Profile with defined session count.
- C. Add QoS Profiles to throttle incoming requests.
- D. Define a custom App-ID to ensure that only legitimate application traffic reaches the server
Answer: B
NEW QUESTION # 56
What is the purpose of the WildFire Analysis Profile in a security policy?
- A. To configure the WildFire subscription settings
- B. To enable WildFire to analyze all network traffic
- C. To specify which files are sent to WildFire for analysis
- D. To define the action to be taken on files analyzed by WildFire
Answer: C
NEW QUESTION # 57
The firewall identified a popular application as a unknown-tcp. Which options are available to identify the application? (Choose two.)
- A. Create a custom application.
- B. Create a Security policy to identify the customer application.
- C. Submit an App-ID request to Palo Alto Networks.
- D. Create a customer object for the customer application server to identify the custom application.
Answer: A,D
NEW QUESTION # 58
Which two log types are necessary to fully investigate a network intrusion? (Choose two)
- A. Threat log
- B. System log
- C. Traffic log
- D. URL Filtering log
Answer: A,C
NEW QUESTION # 59
An administrator has users accessing network resources through Citrix XenApp 7 .x. Which User-ID mapping solution will map multiple mat who using Citrix to connect to the network and access resources?
- A. Client Probing
- B. Globa1Protect
- C. Syslog Monitoring
- D. Terminal Services agent
Answer: D
NEW QUESTION # 60
An administrator wants multiple web servers in the DMZ to receive connections from the internet. Traffic destined for 206.15.22.9 port 80/TCP needs to be forwarded to the server at 10 1.22 Based on the information shown in the age, which NAT rule will forward web-browsing traffic correctly?
A)
B)
C)
D)
- A. Option C
- B. Option A
- C. Option B
- D. Option D
Answer: B
NEW QUESTION # 61
......
Latest 100% Passing Guarantee - Brilliant PCNSC Exam Questions PDF: https://realdumps.prep4sures.top/PCNSC-real-sheets.html