Palo Alto Networks Certified Network Security Engineer Exam (PCNSE) Free Practice Test

Question 1

Users are intermittently being cut off from local resources whenever they connect to GlobalProtect. After researching, it is determined that this is caused by an incorrect setting on one of the NGFWs. Which action will resolve this issue?

A. Change the "GlobalProtect Portal -> Agent -> App -> Split Tunnel -> No direct access to local network" setting to "off"

B. Change the "GlobalProtect Gateway -> Agent -> Network Services -> Split Tunnel -> No direct access to local network" setting to "off"

C. Change the "GlobalProtect Portal -> Satellite -> Gateways -> No direct access to local network" setting to "off"

D. Change the "GlobalProtect Gateway -> Agent -> Client Settings -> Split Tunnel -> No direct access to local network" setting to "off"

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 2

A company needs to preconfigure firewalls to be sent to remote sites with the least amount of reconfiguration.
Once deployed, each firewall must establish secure tunnels back to multiple regional data centers to include the future regional data centers.
Which VPN configuration would adapt to changes when deployed to the future site?

A. Preconfigured PPTP Tunnels

B. Preconfigured IPsec tunnels

C. Preconfigured GlobalProtect client

D. Preconfigured GlobalProtect satellite

Correct Answer: D

Question 3

A company wants to add threat prevention to the network without redesigning the network routing.
What are two best practice deployment modes for the firewall? (Choose two.)

A. VirtualWire

B. TAP

C. Layer2

D. Layer3

Correct Answer: A,C

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 4

What action does a firewall take when a Decryption profile allows unsupported modes and unsupported traffic with TLS 1.2 protocol traverses the firewall?

A. It blocks all communication with the server indefinitely.

B. It automatically adds the server to the SSL Decryption Exclusion list.

C. It generates an decryption error message but allows the traffic to continue decryption.

D. It downgrades the protocol to ensure compatibility.

Correct Answer: B

Question 5

An engineer manages a high availability network and requires fast failover of the routing protocols. The engineer decides to implement BFD.
Which three dynamic routing protocols support BFD? (Choose three.)

A. OSPFv3 virtual link

B. RIP

C. IGRP

D. OSPF

E. BGP

Correct Answer: B,D,E

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 6

An administrator pushes a new configuration from Panorama to a pair of firewalls that are configured as an active/passive HA pair. Which NGFW receives the configuration from Panorama?

A. Both the active and passive firewalls independently, with no synchronization afterward

B. Both the active and passive firewalls, which then synchronize with each other

C. The Passive firewall, which then synchronizes to the active firewall

D. The active firewall, which then synchronizes to the passive firewall

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 7

Why would a traffic log list an application as "not-applicable"?

A. The TCP connection terminated without identifying any application data

B. The firewall denied the traffic before the application match could be performed.

C. There was not enough application data after the TCP connection was established

D. The application is not a known Palo Alto Networks App-ID.

Correct Answer: B

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 8

An administrator troubleshoots an issue that causes packet drops.
Which log type will help the engineer verify whether packet buffer protection was activated?

A. Traffic

B. Threat

C. Data Filtering

D. Configuration

Correct Answer: B

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Welcome to TestSimulate

Palo Alto Networks Certified Network Security Engineer (PCNSE) Free Practice Test