Palo Alto Networks Certified Network Security Engineer - PCNSE7 Exam Practice Test
An administrator has configured the Palo Alto Networks NGFW's management interface to connect to the internet through a dedicated path that does not traverse back through the NGFW itself.
Which configuration setting or step will allow the firewall to get automatic application signature updates?
Which configuration setting or step will allow the firewall to get automatic application signature updates?
Correct Answer: C
Vote an answer
Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).
A company hosts a publicly accessible web server behind a Palo Alto Networks next- generation firewall with the following configuration information:
* Users outside the company are in the "Untrust-L3" zone.
* The web server physically resides in the "Trust-L3" zone.
* Web server public IP address: 23.54.6.10
* Web server private IP address: 192.168.1.10
Which two items must the NAT policy contain to allow users in the Untrust-L3 zone to access the web server? (Choose two.)
* Users outside the company are in the "Untrust-L3" zone.
* The web server physically resides in the "Trust-L3" zone.
* Web server public IP address: 23.54.6.10
* Web server private IP address: 192.168.1.10
Which two items must the NAT policy contain to allow users in the Untrust-L3 zone to access the web server? (Choose two.)
Correct Answer: A,C
Vote an answer
Site-A and Site-B have a site-to-site VPN set up between them. OSPF is configured to dynamically create the routes between the sites. The OSPF configuration in Site-A is configured properly, but the route for the tunner is not being established. The Site-B interfaces in the graphic are using a broadcast Link Type. The administrator has determined that the OSPF configuration in Site-B is using the wrong Link Type for one of its interfaces.
Which Link Type setting will correct the error?
Which Link Type setting will correct the error?
Correct Answer: D
Vote an answer
A company has a web server behind a Palo Alto Networks next-generation firewall that it wants to make accessible to the public at 1.1.1.1. The company has decided to configure a destination NAT Policy rule.
Given the following zone information:
*DMZ zone: DMZ-L3
*Public zone: Untrust-L3
*Guest zone: Guest-L3
*Web server zone: Trust-L3
*Public IP address (Untrust-L3): 1.1.1.1
*Private IP address (Trust-L3): 192.168.1.50
What should be configured as the destination zone on the Original Packet tab of NAT Policy rule?
Given the following zone information:
*DMZ zone: DMZ-L3
*Public zone: Untrust-L3
*Guest zone: Guest-L3
*Web server zone: Trust-L3
*Public IP address (Untrust-L3): 1.1.1.1
*Private IP address (Trust-L3): 192.168.1.50
What should be configured as the destination zone on the Original Packet tab of NAT Policy rule?
Correct Answer: B
Vote an answer
Several offices are connected with VPNs using static IPV4 routes. An administrator has been tasked with implementing OSPF to replace static routing.
Which step is required to accoumplish this goal?
Which step is required to accoumplish this goal?
Correct Answer: D
Vote an answer
An administrator encountered problems with inbound decryption. Which option should the administrator investigate as part of triage?
Correct Answer: D
Vote an answer
Which two mechanisms help prevent a spilt brain scenario an Active/Passive High Availability (HA) pair? (Choose two)
Correct Answer: D,E
Vote an answer
Which client software can be used to connect remote Linux client into a Palo Alto Networks Infrastructure without sacrificing the ability to scan traffic and protect against threats?
Correct Answer: D
Vote an answer
Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).
Only two Trust to Untrust allow rules have been created in the Security policy Rule1 allows google-base Rule2 allows youtube-base The youtube-base App-ID depends on google-base to function. The google-base App-ID implicitly uses SSL and web-browsing. When user try to accesss https://www.youtube.com in a web browser, they get an error indecating that the server cannot be found.
Which action will allow youtube.com display in the browser correctly?
Which action will allow youtube.com display in the browser correctly?
Correct Answer: D
Vote an answer
Which Panorama feature allows for logs generated by Panorama to be forwarded to an external Security Information and Event Management(SIEM) system?
Correct Answer: A
Vote an answer
Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).
An administrator pushes a new configuration from Panorama to a pair of firewalls that are configured as an active/passive HA pair.
Which NGFW receives the configuration from Panorama?
Which NGFW receives the configuration from Panorama?
Correct Answer: A
Vote an answer
Refer to the exhibit.
Which certificates can be used as a Forwarded Trust certificate?
Which certificates can be used as a Forwarded Trust certificate?
Correct Answer: A
Vote an answer
A network administrator uses Panorama to push security polices to managed firewalls at branch offices. Which policy type should be configured on Panorama if the administrators at the branch office sites to override these products?
Correct Answer: B
Vote an answer
Which method will dynamically register tags on the Palo Alto Networks NGFW?
Correct Answer: D
Vote an answer