[Oct 02, 2021] Updates Up to 365 days On Valid PCNSC Braindumps

Best QualityPCNSC Exam Questions  Palo Alto Networks Test To Gain Brilliante Result

NEW QUESTION 14
Which DoS protection mechanism detects and prevents session exhaustion attacks?

• A. TCP Port Scan Protection
• B. Flood Protection
• C. Pocket Based Attack Protection
• D. Resource Protection

Answer: D

 

NEW QUESTION 15
Refer to the exhibit.

An administrator cannot see any of the Traffic logs from the Palo Alto Networks NGFW on Panorama. The configuration problem seems to be on the firewall side. Where is the best place on the Palo Alto Networks NGFW to check whether the configuration is correct?
A)

B)

C)

D)

• A. Option A
• B. Option D
• C. Option B
• D. Option C

Answer: B

 

NEW QUESTION 16
A Company needs to preconfigured firewalls to be sent to remote sites with the least amount of preconfiguration. Once deployed, each firewall must establish secure tunnels back to multiple regional data centers to include the future regional data centers.
Which VPN configuration would adapt to changes when deployed to Hie future site?

• A. preconfigured GlobalProtcet client
• B. preconfigured GlobalProtcet satellite
• C. preconfigured iPsec tunnels
• D. preconfigured PPTP Tunnels

Answer: B

 

NEW QUESTION 17
An administrator using an enterprise PKI needs to establish a unique chain of trust to ensure mutual authentication between panorama and the managed firewall and Log Collectors. How would the administrator establish the chain of trust?

• A. Set up multiple-factor authentication.
• B. Configure strong password
• C. Enable LDAP or RADIUS integration.
• D. Use custom certificates.

Answer: D

 

NEW QUESTION 18
How would an administrator monitor/capture traffic on the management interface of the Palo Alto Networks NGFW?

• A. Enable all four stage of traffic capture (TX, RX, DROP, Firewall)
• B. Use the tcpdump command
• C. USe the debug dataplane packet-dia set capture stage firewall file command
• D. Use the debug dataplane packet-diag set capture stage management file command

Answer: B

 

NEW QUESTION 19
An administrator accidentally closed the commit window/screen before the commit was finished. Which two options could the administrator use to verify the progress or success of that commit task? (Choose two.) A)

B)

C)

D)

• A. Option A
• B. Option D
• C. Option C
• D. Option B

Answer: A,C,D

 

NEW QUESTION 20
A web server is hosted in the DMZ and the server re configured to listen for income connections on TCP port
443. A Security policies rules allowing access from the Trust zone to the DMZ zone needs to be configured to allow web-browsing access. The web server host its contents over Traffic from Trust to DMZ is being decrypted with a Forward Proxy rule.
Which combination of service and application, and order of Security policy rules needs to be configured to allow cleaned web-browsing traffic to the server on tcp/443?

• A. Rule#1 application web-brows.no service application-default, action allow Rule #2 application ssl. Service application-default, action allow
• B. Rule# 1 application: ssl; service application-default: action allow
  Role # 2 application web browsing, service application default, action allow
• C. Rule #1application web-browsing, service service imp action allow
  Rule #2 application ssl. service application -default, action allow
• D. Rule#1application: web-biows.no; service service-https action allow
  Rule#2 application ssl. Service application-default, action allow

Answer: A

 

NEW QUESTION 21
A Security policy rule is configured with a Vulnerability Protection Profile and an action of Deny".
Which action will this configuration cause on the matched traffic?

• A. The configuration is valid It will cause the firewall to deny the matched sessions. Any configured Security Profiles have no effect if the Security policy rule action is set to "Deny" The configuration will allow the matched session unless a vulnerability signature is detected. The "Deny" action will supersede the per. defined, severity defined actions defined in the associated Vulnerability Protection Profile.
• B. The configuration is invalid. The Profile Settings section will be- grayed out when the action is set to "Deny"
• C. The configuration is invalid it will cause the firewall to Skip this Security policy rule A warning will be displayed during a command.

Answer: B

 

NEW QUESTION 22
Which User-ID method should b configured to map addresses to usernames for users connected through a terminal server?

• A. port mapping
• B. server monitoring
• C. XFF header
• D. Client probing

Answer: A

 

NEW QUESTION 23
Which feature prevents the submission of login information into website froms?

• A. file blocking
• B. User-ID
• C. data filtering
• D. credential phishing prevention

Answer: D

 

NEW QUESTION 24
Which two benefits come from assigning a Decrypting Profile to a Decryption rule with a" NO Decrypt" action? (Choose two.)

• A. Block sessions with expired certificates
• B. Block sessions with untrusted issuers
• C. Block sessions with client authentication
• D. Block sessions with unsuspected cipher suites
• E. Block credential phishing.

Answer: A,B

 

NEW QUESTION 25
Which virtual router feature determines if a specific destination IP address is reachable'?

• A. Path Monitoring
• B. Ping-Path
• C. Heartbeat Monitoring
• D. Failover

Answer: A

 

NEW QUESTION 26
A Palo Alto Networks NGFW just submitted a file lo WildFire tor analysis Assume a 5-minute window for analysis. The firewall is configured to check for verdicts every 5 minutes.
How quickly will the firewall receive back a verdict?

• A. 5 to 10 minutes
• B. 10 to 15 minutes
• C. 5 minutes
• D. More than 15 minutes

Answer: A

 

NEW QUESTION 27
The administrator has enabled BGP on a virtual router on the Palo Alto Networks NGFW, but new routes do not seem to be populating the virtual router.
Which two options would help the administrator Troubleshoot this issue? (Choose two.)

• A. View the ACC lab to isolate routing issues.
• B. View the Runtime Stats and look for problems with BGP configuration
• C. View the System logs and look for error messages about BGP
• D. Perform a traffic pcap on the NGFW lo see any BGP problems

Answer: A,B

 

NEW QUESTION 28
During the packet flow process, which two processes are performed in application identification? (Choose two.)

• A. Application changed from content inspection
• B. pattern based application identification
• C. application override policy match
• D. session application identified

Answer: C,D

 

NEW QUESTION 29
Winch three steps will reduce the CPU utilization on the management plane? (Choose three. ) Disable logging at session start in Security policies.

• A. Disable SNMP on the management interface.
• B. Disable predefined reports.
• C. Application override of SSL application.
• D. Reduce the traffic being decrypted by the firewall.

Answer: A,B,D

 

NEW QUESTION 30
An administrator has been asked to configure active/active HA for a pair of Palo Alto Networks NGFWs. The firewalls use layer 3 interface to send traffic to a single gateway IP for the pair.
Which configuration will enable this HA scenario?

• A. Each firewall will have a separate floating IP. and priority will determine which firewall has the primary IP.
• B. The firewalls will share the same interface IP address, and device 1 will use the floating IP if device 0 fails.
• C. The firewall do not use floating IPs in active/active HA.
• D. The two firewalls will share a single floating IP and will use gratuitous ARP to share the floating IP.

Answer: A

 

NEW QUESTION 31
Which PAN-OS policy must you configure to force a user to provide additional credential before he is allowed to access an internal application that contains highly sensitive business data?

• A. Decryption policy
• B. Authentication policy
• C. Application Override policy
• D. Security policy

Answer: B

 

NEW QUESTION 32
A client has a sensitive application server in their data center and is particularly concerned about resource exhaustion because of distributed denial-of-service attacks.
How can the Palo Alto Networks NGFW be configured to specifically protect tins server against resource exhaustion originating from multiple IP address (DDoS attack)?

• A. Define a custom App-ID to ensure that only legitimate application traffic reaches the server
• B. Add QoS Profiles to throttle incoming requests.
• C. Add a DoS Protection Profile with defined session count.
• D. Add a Vulnerability Protection Profile to block the attack.

Answer: C

 

NEW QUESTION 33
An administrator needs to optimize traffic to prefer business-critical applications over non-critical applications.
QoS natively integrates with which feature to provide service quality?

• A. Content-ID
• B. certification revocation
• C. App-ID
• D. port inspection

Answer: C

 

NEW QUESTION 34
......

Focus on PCNSC All-in-One Exam Guide For Quick Preparation: https://www.testsimulate.com/PCNSC-study-materials.html