PCNSC – Paloalto Certified Network Security Consultant

How can you verify that new security policy is correctly blocking traffic without disrupting network?

In Panorama, the web interface displays the security rules in evaluation order. Organize the security rules in the order in which they will be evaluated?

A company’s network operations engineer is documenting a solution and wants to know the default priority setting for an LACP connection. If no changes are made to the default configuration settings for the LACP, which priority setting should you share with the engineer?

Your customer believes that the Panorama appliance is being overwhelmed by the logs from deployed Palo Alto Networks Next-Generation Firewalls. What CLI command can you run to determine the number of logs per second sent by each firewall?

What is the preferred method for gathering User-ID mappings from Citrix VDI servers?

Which of the following is a primary use case for the Decryption Broker feature?

Which CLI command should you use to verify whether all SFP, SFP+, or QSFP modules are installed in a firewall?

Which of the following must be enabled to use Threat Prevention features such as Anti-Virus and Anti-spyware on firewall?

Which routing configuration should you recommend to a customer who wishes to actively use multiple pathways to the same destination?

Your customer has asked you to set up tunnel monitoring on an IPSEC VPN tunnel between two offices. What three steps are needed to setup tunnel monitoring? (Choose three)

TAC has requested a PCAP on your Panorama lo see why the DNS app is having intermittent issues resolving FODN What is the appropriate CLI command?

What command can you use to check the status of GlobalProtect clients connected to the firewall?

A customer has deployed a GlobalProtect portal and gateway as its remote-access VPN solution for its fleet of Windows 10 laptops The customer wants to use Host information Profile (HIP) data collected at the GlobalProtect gateway throughout its enterprise as an additional means of policy enforcement What additional licensing must the customer purchase?

SSL Forward Proxy decryption is enabled on the firewall. When clients use Chrome to browse to HTTPS sites, the firewall returns the Forward Trust certificate, even when accessing websites with invalid certificates. The clients need to be presented with a browser warning error with the option to proceed to websites with invalid certificates. Which two options will satisfy this requirement? (Choose two.)

In Expedition, which objects are classified as “Ghost objects”?

In an HA (High Availability) setup, what is the purpose of the HA3 link?

Match the APP-ID Adoption Task with it's order in the process.

A customer's Palo Alto Networks NGFW currently has only one security policy allowing all traffic They have identified that this is a substantial security risk and have heard that the Expedition tool can help them extract security policies from an "allow any" rule What should the consultant say about Expedition?

When creating a custom application signature, which field allows you to specify the layer 7 protocol details to match?

A customer’s Palo Alto Networks NGFW currently has only one security policy allowing all traffic. They have identified that this is a substantial security risk and have heard that the Expedition tool can help them extract security policies from an “allow any” rule. What should the consultant say about Expedition?

A company has deployed an Active/Passive 5280 HA pair with BGP configured to the company’s ISP. The lead firewall engineer has set the HA Timer to “Recommended”. Upon failing over the HA pair, there is a two-minute outage and internet traffic is dropped. What should the engineer do to eliminate or minimize the outage in the future?

When creating a custom application signature, which field allows you to specify the layer 7 protocol details to match?

A firewall configuration is being migrated by Expedition from a third-party vendor to a Palo Alto Networks Next-Generation Firewall (NGFW.). Expedition flags one service as invalid following the import of the original configuration file. An engineer investigates and finds the invalid service to be ping which is used by the security policies. Which action should the engineer take?

Which Palo Alto Network feature allows you to create dynamic security policies based on the behavior of the device in your network?

An administrator has been asked to configure active/active HA for a pair of Palo Alto Networks NGFWs. The firewalls use layer 3 interface to send traffic to a single gateway IP for the pair. Which configuration will enable this HA scenario?

An administrator pushes a new configuration from panorama to a pair of firewalls that are configured as active/passive HA pair. Which NGFW receives the configuration from panorama?

Identify the Stakeholder with their Role when planning a Firewall, Panorama, and Cortex XDR Deployment. (Select correct 4)

In a HA active/active configuration, which task does the session setup firewall perform?

Match the task for servr setting in group mapping with its order in the process.

A customer recently purchased a license for URL filtering and is having trouble activating PAN-DB. Which two commands can be used to troubleshoot this issue? (Choose two.)

An existing customer who has deployed several Palo Alto Networks Next-Generation Firewalls would like to start using Device-ID to obtain policy rule recommendations. They have also purchased a Support license, a Threat license, a URL Filtering license, and a WildFire license for each firewall. What additional license do they need to purchase?

Instead of disabling App-IDs regularly, a security policy rule is going to be configured to temporarily allow new App-IDs. In which two circumstances is it valid to disable App-IDs as part of content update? (Choose two.)

Instead of disabling App-IDs regularly, a security policy rule is going to be configured to temporarily allow new App-IDs. In which two circumstances is it valid to disable App-IDs as part of content update? (Choose two.)

Which two options describe the behavior of the “Direction” property in a WildFire Analysis Profile rule? (Choose two.)

A customer has a pair of Panorama HA appliances running local log collectors and wants to have log redundancy on logs forwarded from firewalls. Which two configuration options fulfill the customer’s requirement for log redundancy? (Choose two.)

In preparation for a cutover event, what two process or procedure should be verified? (choose two)

Which three steps must admin perform to load only objects from PANOS saved config file into VM-300 firewall that is in production? (Choose 3)

Which are two commands required to upgrade Expedition? (Choose two.)

What is exchanged through the HA2 link?

A customer has firewalls deployed at multiple data centers globally, and which are managed by a single Panorama pair. Each data center has multiple PA-7080 firewalls running PAN-OS 9.0. What are two recommended logging infrastructures across the data centers if the customer needs to log? (Choose two.)

Examine the configured Security policy rule. Which day one/Iron Skillet Security Profile Group is used to secure the traffic that is permitted through this rule?

A global corporate office has a large-scale network with only one User-ID agent, which creates a bottleneck near the User-ID agent server. Which solution in PAN -OS software would help in this case?

What happens when a packet from an existing session is received by a firewall that

What information is necessary to properly plan the deployment of a Panorama hardware appliance for firewall management?

An existing customer who has deployed several Palo Alto Networks Next-Generation Firewalls would like to start using Device-ID to obtain policy rule recommendations They have also purchased a Support license, a Threat license a URL Filtering license, and a WildFire license for each firewall What additional license do they need to purchase?

Which command is used to install Expedition tool for migration? (Choose 2)

After you run command "sudo apt-get update", which command will you run to install?

A customer has a five-year-old firewall in production in the time since the firewall was installed, the IT team deleted unused security policies on a regular basis but they did not remove the address objects and groups that were part ofthese security policies. What is the best way to delete all of the unused address objects on the firewall?

Which Panorama operational mode is necessary to manage a large number of firewalls and also act as a log collector?

Which category of Vulnerability Signature is mostly like to trigger false positive alerts?