Paloalto Networks PCNSE7 Exam Questions 2021

NEW QUESTION 1
Which three settings are defined within the Templates object of Panorama? (Choose three.)

• A. Setup
• B. Virtual Routers
• C. Interfaces
• D. Security
• E. Application Override

Answer: ADE

NEW QUESTION 2
Which item enables a firewall administrator to see details about traffic that is currently active through the NGFW?

• A. ACC
• B. System Logs
• C. App Scope
• D. Session Browser

Answer: D

NEW QUESTION 3
Which Security Policy Rule configuration option disables antivirus and anti-spyware scanning of server-to-client flows only?

• A. Disable Server Response Inspection
• B. Apply an Application Override
• C. Disable HIP Profile
• D. Add server IP Security Policy exception

Answer: A

NEW QUESTION 4
A company hosts a publicly accessible web server behind a Palo Alto Networks next- generation firewall with the following configuration information:
* Users outside the company are in the "Untrust-L3" zone.
* The web server physically resides in the "Trust-L3" zone.
* Web server public IP address: 23.54.6.10
* Web server private IP address: 192.168.1.10
Which two items must the NAT policy contain to allow users in the Untrust-L3 zone to access the web server? (Choose two.)

• A. Destination IPof 23.54.6.10
• B. UntrustL3 for both Source and Destination Zone
• C. Destination IP of 192.168.1.10
• D. UntrustL3 for Source Zone and Trust-L3 for Destination Zone

Answer: AB

NEW QUESTION 5
Which two methods can be used to mitigate resource exhaustion of an application server? (Choose two)

• A. Vulnerability Object
• B. DoS Protection Profile
• C. Data Filtering Profile
• D. Zone Protection Profile

Answer: BD

NEW QUESTION 6
Which three rule types are available when defining policies in Panorama? (Choose three.)

• A. Pre Rules
• B. Post Rules
• C. Default Rules
• D. Stealth Rules
• E. Clean Up Rules

Answer: ABC

Explanation: https://www.paloaltonetworks.com/documentation/71/pan-os/web-interface-help/panorama-web-interface/defining-policies-on-panorama

NEW QUESTION 7
A company hosts a publically accessible web server behind a Palo Alto Networks next generation firewall with the following configuration information.
✑ Users outside the company are in the "Untrust-L3" zone
✑ The web server physically resides in the "Trust-L3" zone.
✑ Web server public IP address: 23.54.6.10
✑ Web server private IP address: 192.168.1.10
Which two items must be NAT policy contain to allow users in the untrust-L3 zone to access the web server? (Choose two)

• A. Untrust-L3 for both Source and Destination zone
• B. Destination IP of 192.168.1.10
• C. Untrust-L3 for Source Zone and Trust-L3 for Destination Zone
• D. Destination IP of 23.54.6.10

Answer: CD

NEW QUESTION 8
An Administrator is configuring an IPSec VPN toa Cisco ASA at the administrator's home and experiencing issues completing the connection. The following is th output from the command:
less mp-log ikemgr.log:

What could be the cause of this problem?

• A. The public IP addresse do not match for both the Palo Alto Networks Firewall and the ASA.
• B. The Proxy IDs on the Palo Alto Networks Firewall do not match the settings on the ASA.
• C. The shared secerts do not match between the Palo Alto firewall and the ASA
• D. The deed peer detection settings do not match between the Palo Alto Networks Firewall and the ASA

Answer: B

NEW QUESTION 9
Which URL Filtering Security Profile action logs the URL Filtering category to the URL Filtering log?

• A. Log
• B. Alert
• C. Allow
• D. Default

Answer: B

Explanation: https://www.paloaltonetworks.com/documentation/70/pan-os/pan-os/url- filtering/url-filtering-profile-actions

NEW QUESTION 10
How can a Palo Alto Networks firewall be configured to send syslog messages in a format compatible with non-standard syslog servers?

• A. Enable support for non-standard syslog messages under device management
• B. Check the custom-format check box in the syslog server profile
• C. Select a non-standard syslog server profile
• D. Create a custom log format under the syslog server profile

Answer: D

NEW QUESTION 11
When is it necessary to activate a license when provisioning a new Palo Alto Networks firewall?

• A. When configuring Certificate Profiles
• B. When configuring GlobalProtect portal
• C. When configuring User Activity Reports
• D. When configuring Antivirus Dynamic Updates

Answer: D

NEW QUESTION 12
After Migrating from an ASA firewall to a Palo Alto Networks Firewall, the VPN connection between a remote network and the Palo Alto Networks Firewall is not establishing correctly. The following entry is appearing in the logs:
Pfs group mismatched: my:0 peer:2
Which setting should be changed on the Palo Alto Networks Firewall to resolve this error message?

• A. Update- the IPSec Crypto profile for the Vendor IPSec Tunnel from group2 to no-pfs.
• B. Update the IKE Crypto profile for the Vendor IKE gateway from no pfs to group2.
• C. Update the IKE Crypto profile for the Vendor IKE gateway from group2 to no pfs
• D. Update the IPSec Crypto profile for the Vendor IPSec Tunnel from no-pfs to group2.

Answer: D

NEW QUESTION 13
Which Device Group option is assigned by default in Panorama whenever a new device group is created to manage a Firewall?

• A. Master
• B. Universal
• C. Shared
• D. Global

Answer: C

NEW QUESTION 14
Which setting allow a DOS protection profile to limit the maximum concurrent sessions from a source IP address?

• A. Set the type to Aggregate, clear the session’s box and set the Maximum concurrent Sessions to 4000.
• B. Set the type to Classified, clear the session’s box and set the Maximum concurrent Sessions to 4000.
• C. Set the type Classified, check the Sessions box and set the Maximum concurrent Sessions to 4000.
• D. Set the type to aggregate, check the Sessions box and set the Maximum concurrent Sessions to 4000.

Answer: C

NEW QUESTION 15
Server Message Block (SMB), a common file-sharing application, is slow when passing through a Palo Alto Networks firewall. The Network Security Administrator created an application override policy, assigning all SMB traffic to a custom application, to resolve the slowness issue.
Why does this configuration resolve the issue?

• A. Layer 7 processing has been disabled for SMB traffic.
• B. Layer 4 processing has been disabled for the SMB traffic.
• C. Zone protection is no longer being applied.
• D. Security policy assignment is being done more efficiently.

Answer: A

NEW QUESTION 16
An administrator has users accessing network resources through Citrix XenApp 7 x. Which User-ID mapping solution will map multiple users who are using Citrix to connect to the network and access resources?

• A. Client Probing
• B. Terminal Services agent
• C. GlobalProtect
• D. Syslog Monitoring

Answer: C

NEW QUESTION 17
An administrator needs to optimize traffic to prefer business-critical applications over non- critical applications.
QoS natively integrates with which feature to provide service quality?

• A. Port Inspection
• B. Certificate revocation
• C. Content-ID
• D. App-ID

Answer: D

NEW QUESTION 18
If the firewall has the link monitoring configuration, what will cause a failover?

• A. ethernet1/3 and ethernet1/6 going down
• B. ethernet1/3 going down
• C. ethernet1/3 or Ethernet1/6 going down
• D. ethernet1/6 going down

Answer: A

NEW QUESTION 19
Which command can be used to validate a Captive Portal policy?

• A. eval captive-portal policy <criteria>
• B. request cp-policy-eval <criteria>
• C. test cp-policy-match <criteria>
• D. debug cp-policy <criteria>

Answer: C

NEW QUESTION 20
An administrator is using Panorama and multiple Palo Alto Networks NGFWs. After upgrading all devices to the latest PAN-OS® software, the administrator enables log forwarding from the firewalls to Panorama. Pre-existing logs from the firewalls are not appearing in Panorama.
Which action would enable the firewalls to send their pre-existing logs to Panorama?

• A. Use the import option to pull logs into Panorama.
• B. A CLI command will forward the pre-existing logs to Panorama.
• C. Use the ACC to consolidate pre-existing logs.
• D. The log database will need to exported form the firewalls and manually imported intoPanorama.

Answer: B