Certification Provider:Â Palo Alto NetworksExam:Â Palo Alto Networks Certified Network Security Engineer (PCNSE)Exam Code:Â PCNSE v10Total Question: 77Question per Quiz: 75Updated On: 05 April 2025Note: In order to practice all the Q/A's, you have to practice multiple time. Question's and Answer's will be presented randomly and will help you get hands-on for real exam. 1. Match each type of DoS attack to an example of that type of attack. Protocol Based -> SYN flood Attack Volumetric Based -> UDP Flood Attack Volumetric Based -> SYN Flood Attack Application Based -> Slowris None 2. Place the steps in the WildFire process workflow in their correct order. None 3. Which option is part of the content inspection process? Packet egress process Packet forwarding process IPsec tunnel encryption SSL Proxy re-encrypt None 4. The SSL Forward Proxy decryption policy is configured. The following four certificate authority (CA) certificates are installed on the firewall. An end-user visits the untrusted website https://www.firewall-do-not-trust-website.com. Which certificate authority (CA) certificate will be used to sign the untrusted webserver certificate? Forward-Untrust-Certificate Forward-Trust-Certificate Firewall-CA Firewall-Trusted-Root-CA None 5. In SSL Forward Proxy decryption, which two certificates can be used for certificate signing? (Choose two.) enterprise CA certificate client certificate wildcard server certificate self-signed CA certificate 6. Which two statements correctly identify the number of Decryption Broker security chains that are supported on a pair of decryption-forwarding interfaces'? (Choose two) L3 security chains support up to 64 security chains L3 security chains support up to 32 security chains A single transparent bridge security chain is supported per pair of interface A single transparent bridge security chain is supported per firewall 7. In a security-first network what is the recommended threshold value for content updates to be dynamically updated? 1 to 4 hours 24 hours 36 hours 6 to 12 hours None 8. What are three types of Decryption Policy rules? (Choose three.) SSL Forward Proxy SSL Inbound Inspection SSH Proxy Decryption Mirror Decryption Broker 9. An engineer must configure a new SSL decryption deployment Which profile or certificate is required before any traffic that matches an SSL decryption rule is decrypted? There must be a certificate with both the Forward Trust option and Forward Untrust option selected There must be a certificate with only the Forward Trust option selected A Decryption profile must be attached to the Decryption policy that the traffic matches A Decryption profile must be attached to the Security policy that the traffic matches None 10. Which configuration task is best for reducing load on the management plane? Disable pre-defined reports Enable session logging at start Set the URL filtering action to send alerts Disable logging on the default deny rule None 11. What are two common reasons to use a "No Decrypt" action to exclude traffic from SSL decryption? (Choose two.) the web server requires mutual authentication the website matches a sensitive category the website matches a category that is not allowed for most users the website matches a high-risk category 12. An administrator plans to deploy 15 firewalls to act as GlobalProtect gateways around the world Panorama will manage the firewalls. The firewalls will provide access to mobile users and act as edge locations to on-premises infrastructure. The administrator wants to scale the configuration out quickly and wants all of the firewalls to use the same template configuration. Which two solutions can the administrator use to scale this configuration? (Choose two.) variables virtual systems collector groups template stacks 13. An administrator is attempting to create policies tor deployment of a device group and template stack When creating the policies, the zone drop down list does not include the required zone. What must the administrator do to correct this issue? Specify the target device as the master device in the device group Add a firewall to both the device group and the template Add the template as a reference template in the device group Enable "Share Unused Address and Service Objects with Devices" in Panorama settings None 14. Which three items are import considerations during SD-WAN configuration planning? (Choose three.) the name of the ISP link requirements IP Addresses branch and hub locations 15. Your company has to Active Directory domain controllers spread across multiple WAN links All users authenticate to Active Directory Each link has substantial network bandwidth to support all mission-critical applications. The firewalls management plane is highly utilized Given this scenario which type of User-ID agent is considered a best practice by Palo Alto Networks? Citrix terminal server agent with adequate data-plane resource Windows-based User-ID agent on a standalone server PAN-OS integrated agent Captive Portal None 16. An administrator has a PA-820 firewall with an active Threat Prevention subscription. The administrator is considering adding a WildFire subscription How does adding the WildFire subscription improve the security posture of the organization? Wild Fire and Threat Prevention combine to provide the utmost security posture for the firewall WildFire and Threat Prevention combine to minimize the attack surface After 24 hours Wild Fire signatures are included in the antivirus update Protection against unknown malware can be provided in near real-time None 17. When you navigate to Network: > GlobalProtect > Portals > Method section, which three options are available? (Choose three) user-logon (always on) post-logon (always on) on-demand (manual user initiated connection) pre-logon then on-demand certificate-logon 18. In an HA failover scenario what occurs when sessions match an SSL Forward Proxy Decryption policy? HA Sync occurs the firewall allows the session Put does not decrypt the session. HA Sync does not occur the firewall drops the session. A Sync does not occur the existing session is transferred to the active firewall. HA Sync occurs the session is sent to testpath None 19. Which value in the Application column indicates UDP traffic that did not match an App-ID signature? unknown-ip incomplete unknown-udp not-applicable None 20. The UDP-4501 protocol-port is used between which two GlobalProtect components? GlobalProtect app and GlobalProtect portal GlobalProtect app and GlobalProtect gateway GlobalProtect portal and GlobalProtect gateway GlobalProtect app and GlobalProtect satellite None 21. An administrator is considering upgrading the Palo Alto Networks NGFW and central management Panorama version What is considered best practice for this scenario? Export the device state, perform the update, and then import the device state. Upgrade the firewall first, wait at least 24 hours, and then upgrade the Panorama version. Upgrade Panorama to a version at or above the target firewall version. Perform the Panorama and firewall upgrades simultaneously. None 22. During the packet flow process, which two processes are performed in application identification? (Choose two.) application override policy match session application identified pattern based application identification application changed from content inspection 23. What are the two behavior differences between Highlight Unused Rules and the Rule Usage Hit counter when a firewall is rebooted? (Choose two.) Highlight Unused Rules will highlight all rules. Rule Usage Hit counter will reset. Rule Usage Hit counter will not be reset Highlight Unused Rules will highlight zero rules. 24. Which two mechanisms help prevent a spilt brain scenario an Active/Passive High Availability (HA) pair? (Choose two) Configure Ethernet 1/1 as HA1 Backup Configure the management interface as HA2 Backup Configure Ethernet 1/1 as HA2 Backup Configure the management interface as HA3 Backup 25. Which two are valid ACC Global Protect Activity tab widgets? (Choose two.) Global Protect Quarantine Activity Successful Global Protect Deployed Activity Global Protect Deployment Activity Successful Global Protect Connection Activity 26. An administrator needs firewall access on a trusted interface. Which two components are required to configure certificate based, secure authentication to the Web Ul? (Choose two ) certificate authority (CA) certificate client certificate server certificate certificate profile 27. What does SSL decryption require to establish a firewall as a trusted third party and to establish trust between a client and server to secure an SSL/TLS connection? link state profiles certificates stateful firewall connection None 28. A network administrator wants to use a certificate for the SSL/TLS Service Profile. Which type of certificate should the administrator use? machine certificate client certificate certificate authority (CA) certificate server certificate None 29. PBF can address which two scenarios? (Select Two) routing FTP to a backup ISP link to save bandwidth on the primary ISP link providing application connectivity the primary circuit fail enabling the firewall to bypass Layer 7 inspection forwarding all traffic by using source port 78249 to a specific egress interface 30. What are three reasons for excluding a site from SSL decryption? (Choose three.) mutual authentication certificate pinning unsupported browser version the website is not present in English unsupported ciphers 31. Given the following snippet of a Wild Fire submission log. did the end-user get access to the requested information and why or why not? Yes. because the action is set to "allow '' No because WildFire classified the seventy as "high." No because WildFire categorized a file with the verdict "malicious" Yes, because the action is set to "alert" None 32. What are two common reasons to use a "No Decrypt" action to exclude traffic from SSL decryption? (Choose two.) the web server requires mutual authentication the website matches a category that is not allowed for most users the website matches a sensitive category the website matches a high-risk category 33. Place the steps to onboard a ZTP firewall into Panorama/CSP/ZTP-Service in the correct order. None 34. When planning to configure SSL Froward Proxy on a PA 5260, a user asks how SSL decryption can be implemented using phased approach in alignment with Palo Alto Networks best practices What should you recommend? Enable SSL decryption for known malicious destination IP addresses Enable SSL decryption for source users and known malicious URL categories Enable SSL decryption for known malicious source IP addresses Enable SSL decryption for malicious source users None 35. What are three reasons why an installed session can be identified with the application incomplete" tag? (Choose three.) There is not enough application data after the TCP connection was established The TCP connection was terminated without identifying any application data There was no application data after the TCP connection was established The TCP connection did not fully establish The client sent a TCP segment with the PUSH flag set 36. An administrator wants to upgrade a firewall HA pair to PAN-OS 11.1. The firewalls are currently running PAN-OS 10.1.4-h1. Which upgrade path maintains synchronization of the HA session (and prevents network outage)? Upgrade directly to the target major version Upgrade one major version at a time Upgrade two major versions at a time Upgrade one major version at a time None 37. An existing NGFW customer requires direct interne! access offload locally at each site and iPSec connectivity to all branches over public internet. One requirement is mat no new SD-WAN hardware be introduced to the environment. What is the best solution for the customer? Configure policy-based forwarding Configure a remote network on PAN-OS Upgrade to a PAN-OS SD-WAN subscription Deploy Prisma SD-WAN with Prisma Access None 38. Which two features require another license on the NGFW? (Choose two.) Decryption Broker SSL Inbound Inspection SSL Forward Proxy Decryption Mirror 39. When you import the configuration of an HA pair into Panorama, how do you prevent the import from affecting ongoing traffic? Disable HA Disable the HA2 link Disable config Sync Set the passive link state to 'shutdown' None 40. An engineer must configure the Decryption Broker feature Which Decryption Broker security chain supports bi-directional traffic flow? Transparent Proxy security chain Transparent Bridge security chain Layer 2 security chain Layer 3 security chain None 41. Which action disables Zero Touch Provisioning (ZTP) functionality on a ZTP firewall during the onboarding process? performing a local firewall commit removing the Panorama serial number from the ZTP service performing a factory reset of the firewall removing the firewall as a managed device in Panorama None 42. An administrator needs to implement an NGFW between their DMZ and Core network EIGRP Routing between the two environments is required Which interface type would support this business requirement? Layer 3 or Aggregate Ethernet interfaces but configuring EIGRP on sub interfaces only Layer 3 interfaces but configuring EIGRP on the attached virtual router Tunnel interfaces to terminate EIGRP routing on an IPsec tunnel {with the Global Protect License to support LSVPN and EIGRP protocols) Virtual Wire interfaces to permit EIGRP routing to remain between the Core and DMZ None 43. SD-WAN is designed to support which two network topology types? (Choose two.) point-to-point full-mesh hub-and-spoke ring 44. Match each Global Protect component to the purpose of that component. None 45. Which two features can be used to tag a username so that it is included in a dynamic user group? (Choose two.) User-ID Windows-based agent Global Protect agent XML API log forwarding auto-tagging 46. An organization is building a Bootstrap Package to deploy Palo Alto Networks VM-Series firewalls into their Microsoft Azure. Which two statements are correct regarding the bootstrap package contents? (Choose two) The bootstrap xml file allows for automated deployment of VM-Series firewalls with full network and policy configurations. The init-cfg txt and bootstrap.xml files are both optional configuration items for the /config folder The /config /content and /software folders are mandatory while the /license and /plugin folders are optional The bootstrap package is stored on an AFS share or a discrete container file bucket The directory structure must include a /config /content, /software and /license folders 47. Which two statements correctly identify the number of Decryption Broker security chains that are supported on a pair of decryption-forwarding interfaces'? (Choose two) A single transparent bridge security chain is supported per firewall L3 security chains support up to 64 security chains A single transparent bridge security chain is supported per pair of interfaces L3 security chains support up to 32 security chains 48. When you configure an active/active high availability pair which two links can you use? (Choose two) Console Backup HA2 backup HA3 HSCI-C 49. An administrator receives the following error message. How should the administrator identify the root cause of this error message?"IKE phase-2 negotiation failed when processing Proxy ID. Received local id 192. 168.33.33/24 type IPv4 address protocol 0 port 0, received remote id172.16.33.33/24 type IPv4 address protocol 0 port 0." In the IPSec Crypto profile configuration, verify that PFS is either enabled on both VPN peers or disabled on both VPN peers. Check whether the VPN peer on one end is set up correctly using policy-based VPN. Verify that the IP addresses can be pinged and that routing issues are not causing the connection failure. In the IKE Gateway configuration, verify that the IP address for each VPN peer is accurate. None 50. A critical US-CERT notification is published regarding a newly discovered botnet. The malware is very evasive and is not reliably detected by endpoint antivirus software. Furthermore, SSL is used to tunnel malicious traffic to command-and-control servers on the internet and SSL Forward Proxy Decryption is not enabled. Which component once enabled on a perirneter firewall will allow the identification of existing infected hosts in an environment? Vulnerability Protection profiles applied to outbound security policies with action set to block Anti-Spyware profiles applied outbound security policies with DNS Query action set to sinkhole File Blocking profiles applied to outbound security policies with action set to alert Antivirus profiles applied to outbound security policies with action set to alert None 51. To ensure that a Security policy has the highest priority, how should an administrator configure a Security policy in the device group hierarchy? Reference the targeted device's templates in the target device group Clone the security policy and add it to the other device groups Add the policy in the shared device group as a pre-rule Add the policy to the target device group and apply a master device to the device group None 52. What are two valid deployment options for Decryption Broker? (Choose two) Transparent Mirror Security Chain Layer 3 Security Chain Layer 2 Security Chain Transparent Bridge Security Chain 53. The manager of the network security team has asked you to help configure the company's Security Profiles according to Palo Alto Networks best practice. As part of that effort, the manager has assigned you the Vulnerability Protection profile for the internet gateway firewall. Which action and packet-capture setting for items of high severity and critical severity best matches Palo Alto Networks best practice'? action 'default' and packet capture 'single-packet' action 'reset-both' and packet capture 'single-packet' action 'reset-server' and packet capture 'disable' action 'reset-both' and packet capture 'extended-capture' None 54. A network administrator wants to use a certificate for the SSL/TLS Service Profile Which type of certificate should the administrator use? client certificate server certificate machine certificate certificate authority (CA) certificate None 55. Which Device Group option is assigned by default in Panorama whenever a new device group is created to manage a Firewall? Universal Global Master Shared None 56. What are two characteristic types that can be defined for a variable? (Choose two) path group IP netmask FQDN zone 57. Which three split tunnel methods are supported by a Global Protect Gateway? (Choose three.) Client Application Process Destination user/group Destination Domain video streaming application Source Domain URL Category 58. During the process of developing a decryption strategy and evaluating which websites are required for corporate users to access, several sites have been identified that cannot be decrypted due to technical reasons. In this case, the technical reason is unsupported ciphers. Traffic to these sites will therefore be blocked if decrypted How should the engineer proceed? Install the unsupported cipher into the firewall to allow the sites to be decrypted Add the sites to the SSL Decryption Exclusion list to exempt them from decryption Allow the firewall to block the sites to improve the security posture Create a Security policy to allow access to those sites None 59. Which Security Policy Rule configuration option disables antivirus and anti-spyware scanning of server-to-client flows only? Disable Server Response Inspection Apply an Application Override Disable HIP Profile Add server IP Security Policy exception None 60. An administrator has 850 firewalls The administrator's central-management Panorama instance deploys dynamic updates to the firewalls The administrator notices that the dynamic updates from Panorama do not appear on some of the firewalls. If Panorama pushes the configuration of a dynamic update schedule to managed firewalls, but the configuration does not appear what is the root cause? No service route is configured on the firewalls to Palo Alto Networks update servers Panorama has no connection to Palo Alto Networks update servers Locally-defined dynamic update settings take precedence over the settings that Panorama pushed Panorama does not have valid licenses to push the dynamic updates None 61. When overriding a template configuration locally on a firewall, what should you consider? Panorama will lose visibility into the overridden configuration Only Panorama can revert the override Panorama will update the template with the overridden value The firewall template will show that it is out of sync within Panorama None 62. An engineer is planning an SSL decryption implementation Which of the following statements is a best practice for SSL decryption? Obtain an enterprise CA-signed certificate for the Forward Trust certificate Use the same Forward Trust certificate on all firewalls in the network Use an enterprise CA-signed certificate for the Forward Untrust certificate Obtain a certificate from a publicly trusted root CA for the Forward Trust certificate None 63. What happens when an A/P firewall cluster synchronies IPsec tunnel security associations (SAs)? Phase 1 SAs are synchronized over HA1 links Phase 1 and Phase 2 SAs are synchronized over HA2 links Phase 1 and Phase 2 SAs are synchronized over HA3 links Phase 2 SAs are synchronized over HA2 finks None 64. An internal system is not functioning. The firewall administrator has determined that the incorrect egress interface is being used After looking at the configuration, the administrator believes that the firewall is not using a static route What are two reasons why the firewall might not use a static route"? (Choose two.) path monitoring on the static route disabling of the static route duplicate static route no install on the route 65. Refer to the exhibit. An administrator cannot see any if the Traffic logs from the Palo Alto Networks NGFW on Panorama. The configuration problem seems to be on the firewall side. Where is the best place on the Palo Alto Networks NGFW to check whether the configuration is correct? None 66. When an in-band data port is set up to provide access to required services, what is required for an interface that is assigned to service routes? You must set the interface to Layer 2 Layer 3. or virtual wire You must enable DoS and zone protection The interface must be used for traffic to the required services You must use a static IP address None 67. The following objects and policies are defined in a device group hierarchy. Dallas-Branch has Dallas-FW as a member of the Dallas-Branch device-group NYC-DC has NYC-FW as a member of the NYC-DC device-group What objects and policies will the Dallas-FW receive if "Share Unused Address and Service Objects" is enabled in Panorama? Address Objects -Shared Address1 -Shared Address2 -Branch Address1 Policies -Shared Policy1 -Branch Policy1 Address Objects -Shared Address1 -Shared Address2 -Branch Address1 -DC Address1 Policies -Shared Policy1 -Shared Policy2 -Branch Policy1 Address Objects -Shared Address1 -Shared Address2 -Branch Address1 Policies -Shared Policy1 -Shared Policy2 -Branch Policy1 Address Objects -Shared Address1 -Branch Address1 Policies -Shared Policy1 -Branch Policy1 None 68. Before you upgrade a Palo Alto Networks NGFW, what must you do? Make sure that the firewall is running a version of antivirus software and a version of WildFire that support the licensed subscriptions. Export a device state of the firewall Make sure that the PAN-OS support contract is valid for at least another year Make sure that the firewall is running a supported version of the app + threat update None 69. As a best practice, which URL category should you target first for SSL decryption? Financial Services High Risk Online Storage and Backup Health and Medicine None 70. An administrator notices that an interface configuration has been overridden locally on a firewall. They require an configuration to be managed from Panorama and overrides are not allowed. What is one way the administrator can meet this requirement? Perform a commit force from the CLI of the firewall. Reload the running configuration and perform a Firewall local commit. Perform a template commit push from Panorama using the "Force Template Values'' option Perform a device-group commit push from Panorama using the "Include Device and Network Templates" option. None 71. Which User-ID mapping method should be used in a high-security environment where all IP address-to-user mappings should always be explicitly known? PAN-OS integrated User-ID agent LDAP Server Profile configuration Windows-based User-ID agent Global Protect None 72. In a Panorama template which three types of objects are configurable? (Choose three) HIP objects QoS profiles certificate profiles security profiles interface management profiles 73. What are three valid qualifiers for a Decryption Policy Rule match? (Choose three) App-ID Destination Zone Custom URL Category User-ID Source Interface 74. Which three statements accurately describe Decryption Mirror? (Choose three.) Use of Decryption Mirror might enable malicious users with administrative access to the firewall to harvest sensitive information that is submitted via an encrypted channel Decryption, storage, inspection and use of SSL traffic are regulated in certain countries You should consult with your corporate counsel before activating and using Decryption Mirror in a production environment Decryption Mirror requires a tap interface on the firewall Only management consent is required to use the Decryption Mirror feature 75. A variable name must start with which symbol? $ & ! # None 76. Which three options are supported in HA Lite? (Choose three.) Configuration synchronization Virtual link Active/passive deployment Synchronization of IPsec security associations Session synchronization 77. Which rule type controls end user SSL traffic to external websites? SSL Inbound Inspection SSH Proxy SSL Forward Proxy SSL Outbound Proxyless Inspection None Time's up
An engineer is planning an SSL decryption implementation Which of the following statements is a best practice for SSL decryption? correct answer: Obtain an enterprise CA-signed certificate for the Forward Trust certificate https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/decryption/configure-ssl-forward-proxyReply
An engineer is planning an SSL decryption implementation Which of the following statements is a best practice for SSL decryption?
correct answer: Obtain an enterprise CA-signed certificate for the Forward Trust certificate
https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/decryption/configure-ssl-forward-proxy