Top Quality PCNSE7 Study Guides 2021

NEW QUESTION 1
Support for which authentication method was added in PAN-OS 7.0?

• A. RADIUS
• B. LDAP
• C. Diameter
• D. TACACS+

Answer: D

NEW QUESTION 2
A network design calls for a "router on a stick" implementation with a PA-5060 performing inter-VLAN routing All VLAN-tagged traffic will be forwarded to the PA-5060 through a single dot1q trunk interface
Which interface type and configuration setting will support this design?

• A. Trunk interface type with specified tag
• B. Layer 3 interface type with specified tag
• C. Layer 2 interface type with a VLAN assigned
• D. Layer 3 subinterface type with specified tag

Answer: D

NEW QUESTION 3
How is the Forward Untrust Certificate used?

• A. It issues certificates encountered on the Untrust security zone when clients attempt to connect to a site that has be decrypted/
• B. It is used when web servers request a client certificate.
• C. It is presented to clients when the server they are connecting to is signed by a certificate authority that is not trusted by firewall.
• D. It is used for Captive Portal to identify unknown users.

Answer: C

NEW QUESTION 4
Which client software can be used to connect remote Linux client into a Palo Alto Networks Infrastructure without sacrificing the ability to scan traffic and protect against threats?

• A. X-Auth IPsec VPN
• B. GlobalProtect Apple IOS
• C. GlobalProtect SSL
• D. GlobalProtect Linux

Answer: A

Explanation: ( http://blog.webernetz.net/2014/03/31/palo-alto-globalprotect-for-linux-with-vpnc/ )

NEW QUESTION 5
Which two statements are correct for the out-of-box configuration for Palo Alto Networks NGFWs? (Choose two)

• A. The devices are pre-configured with a virtual wire pair out the first two interfaces.
• B. The devices are licensed and ready for deployment.
• C. The management interface has an IP address of 192.168.1.1 and allows SSH and HTTPS connections.
• D. A default bidirectional rule is configured that allows Untrust zone traffic to go to the Trust zone.
• E. The interface are pingable.

Answer: BC

NEW QUESTION 6
The IT department has received complaints abou VoIP call jitter when the sales staff is making or receiving calls. QoS is enabled on all firewall interfaces, but there is no QoS policy written in the rulebase. The IT manager wants to find out what traffic is causing the jitter in real time when a user reports the jitter.
Which feature can be used to identify, in real time, the applications taking up the most bandwidth?

• A. QoS Statistics
• B. Applications Report
• C. Application Command Center (ACC)
• D. QoS Log

Answer: A

NEW QUESTION 7
An administrator needs to upgrade a Palo Alto Networks NGFW to the most current version of PAN-OS® software. The firewall has internet connectivity through an Ethernet interface, but no internet connectivity from the management interface. The Security policy has the default security rules and a rule that allows all web-browsing traffic from any to any zone.
What must the administrator configure so that the PAN-OS® software can be upgraded?

• A. Security policy rule
• B. CRL
• C. Service route
• D. Scheduler

Answer: A

NEW QUESTION 8
A client is deploying a pair of PA-5000 series firewalls using High Availability (HA) in Active/Passive mode. Which statement is true about this deployment?

• A. The two devices must share a routable floating IP address
• B. The two devices may be different models within the PA-5000 series
• C. The HA1 IP address from each peer must be on a different subnet
• D. The management port may be used for a backup control connection

Answer: D

NEW QUESTION 9
An administrator needs to determine why users on the trust zone cannot reach certain websites. The only information available is shown on the following image. Which configuration change should the administrator make?
A)

B)

C)

D)

E)

• A. Option A
• B. Option B
• C. Option C
• D. Option D
• E. Option E

Answer: B

NEW QUESTION 10
Which URL Filtering Security Profile action togs the URL Filtering category to the URL Filtering log?

• A. Log
• B. Alert
• C. Allow
• D. Default

Answer: B

NEW QUESTION 11
A global corporate office has a large-scale network with only one User-ID agent, which creates a bottleneck near the User-ID agent server. Which solution in PAN-OS® software
would help in this case?

• A. Application override
• B. Redistribution of user mappings
• C. Virtual Wire mode
• D. Content inspection

Answer: B

NEW QUESTION 12
Which authentication source requires the installation of Palo Alto Networks software, other than PAN-OS 7x, to obtain a username-to-IP-address mapping?

• A. Microsoft Active Directory
• B. Microsoft Terminal Services
• C. Aerohive Wireless Access Point
• D. Palo Alto Networks Captive Portal

Answer: B

NEW QUESTION 13
Which CLI command enables an administrator to view details about the firewall including uptime, PAN-OS® version, and serial number?

• A. debug system details
• B. show session info
• C. show system info
• D. show system details

Answer: C

NEW QUESTION 14
A network administrator uses Panorama to push security polices to managed firewalls at branch offices. Which policy type should be configured on Panorama if the administrators at the branch office sites to override these products?

• A. Pre Rules
• B. Post Rules
• C. Explicit Rules
• D. Implicit Rules

Answer: A

NEW QUESTION 15
A client is concerned about resource exhaustion because of denial-of-service attacks against their DNS servers.
Which option will protect the individual servers?

• A. Enable packet buffer protection on the Zone Protection Profile.
• B. Apply an Anti-Spyware Profile with DNS sinkholing.
• C. Use the DNS App-ID with application-default.
• D. Apply a classified DoS Protection Profile.

Answer: A

NEW QUESTION 16
Only two Trust to Untrust allow rules have been created in the Security policy Rule1 allows google-base
Rule2 allows youtube-base
The youtube-base App-ID depends on google-base to function. The google-base App-ID implicitly uses SSL and web-browsing. When user try to accesss https://www.youtube.com in a web browser, they get an error indecating that the server cannot be found.
Which action will allow youtube.com display in the browser correctly?

• A. Add SSL App-ID to Rule1
• B. Create an additional Trust to Untrust Rule, add the web-browsing, and SSL App-ID's to it
• C. Add the DNS App-ID to Rule2
• D. Add the Web-browsing App-ID to Rule2

Answer: C

NEW QUESTION 17
If the firewall is configured for credential phishing prevention using the “Domain Credential Filter” method, which login will be detected as credential theft?

• A. Mapping to the IP address of the logged-in user.
• B. First four letters of the username matching any valid corporate username.
• C. Using the same user’s corporate username and password.
• D. Marching any valid corporate username.

Answer: A

NEW QUESTION 18
A host attached to Ethernet 1/4 cannot ping the default gateway. The widget on the dashboard shows Ethernet 1/1 and Ethernet 1/4 to be green. The IP address of Ethernet 1/1 is 192.168.1.7 and the IP address of Ethernet 1/4 is 10.1.1.7. The default gateway is attached to Ethernet 1/1. A default route is properly configured.
What can be the cause of this problem?

• A. No Zone has been configured on Ethernet 1/4.
• B. Interface Ethernet 1/1 is in Virtual Wire Mode.
• C. DNS has not been properly configured on the firewall.
• D. DNS has not been properly configured on the host.

Answer: A

NEW QUESTION 19
An administrator has enabled OSPF on a virtual router on the NGFW. OSPF is not adding new routes to the virtual router.
Which two options enable the administrator to troubleshoot this issue? (Choose two.)

• A. View Runtime Stats in the virtual router.
• B. View System logs.
• C. Add a redistribution profile to forward as BGP updates.
• D. Perform a traffic pcap at the routing stage.

Answer: AC

NEW QUESTION 20
An administrator creates a custom application containing Layer 7 signatures. The latest application and threat dynamic update is downloaded to the same NGFW. The update contains an application that matches the same traffic signatures as the custom application.
Which application should be used to identify traffic traversing the NGFW?

• A. Custom application
• B. System logs show an application error and neither signature is used.
• C. Downloaded application
• D. Custom and downloaded application signature files are merged and both are used

Answer: A