PCNSC – Paloalto Certified Network Security Consultant – Gateway to Cyber Security and Computer Networks Learning

Certification Provider: Paloalto

Exam: Paloalto Certified Network Security Consultant

Exam Code: PCNSC

Total Question: 60

Question per Quiz: 50

Updated On: 12 April 2025

Note: In order to practice all the Q/A's, you have to practice multiple time. Question's and Answer's will be presented randomly and will help you get hands-on for real exam.

What configuration is necessary for Active/Active HA to synchronize sessions between peers?

Configure a floating IP address

Enable session Preemption on both peers

Enable session synchronization under the HA settings

Use the same virtual IP address on both peers

None

An existing customer who has deployed several Palo Alto Networks Next-Generation Firewalls would like to start using Device-ID to obtain policy rule recommendations They have also purchased a Support license, a Threat license a URL Filtering license, and a WildFire license for each firewall What additional license do they need to purchase?

an loT Security license (or the perimeter firewall

an loT Security license for each deployed firewall

a Cortex Data Lake license

an Enterprise Data Loss Prevention (DLP) license

None

A global corporate office has a large-scale network with only one User-ID agent, which creates a bottleneck near the User-ID agent server. Which solution in PAN -OS software would help in this case?

virtual wire mode

content inspection

redistribution of user mappings

application override

None

In preparation for a cutover event, what two process or procedure should be verified? (choose two)

Auditing

Logging and reporting

Change management Process

Roles and responsibility

A customer has a pair of Panorama HA appliances running local log collectors and wants to have log redundancy on logs forwarded from firewalls. Which two configuration options fulfill the customer’s requirement for log redundancy? (Choose two.)

Panorama configured in HA provides log redundancy.

Panorama operational mode needs to be Dedicated Log Collector.

Log redundancy must be enabled per Collector Group.

A Collector Group must contain at least two Log Collectors.

Which three steps must admin perform to load only objects from PANOS saved config file into VM-300 firewall that is in production? (Choose 3)

use load config partial command

use device config import in panorama

import names config snapshot through web interface

Load config in web interface and commit

enter config mode from CLI

What is the default port used by the Terminal Services agent to communicate with a firewall?

636

443

5009

5007

None

Which are two commands required to upgrade Expedition? (Choose two.)

sudo apt-get update

sudo apt-get install expedition-beta

sudo apt-get upgrade all

sudo apt-get update expedition

Your customer has asked you to set up tunnel monitoring on an IPSEC VPN tunnel between two offices. What three steps are needed to setup tunnel monitoring? (Choose three)

Enable tunnel monitoring on each IPsec tunnel

Add and IP address to each tunnel interface

Restart each IPSEC tunnel

Restart each IKE gateway

Create a monitoring profile

10.

An existing customer who has deployed several Palo Alto Networks Next-Generation Firewalls would like to start using Device-ID to obtain policy rule recommendations. They have also purchased a Support license, a Threat license, a URL Filtering license, and a WildFire license for each firewall. What additional license do they need to purchase?

an IoT Security license for each deployed firewall

a Cortex Data Lake license

an IoT Security license for the perimeter firewall

an Enterprise Data Loss Prevention (DLP) license

None

11.

A company has deployed an Active/Passive 5280 HA pair with BGP configured to the company’s ISP. The lead firewall engineer has set the HA Timer to “Recommended”. Upon failing over the HA pair, there is a two-minute outage and internet traffic is dropped. What should the engineer do to eliminate or minimize the outage in the future?

Enable Path Monitoring to the ISP

Change the HA Timer to “Advanced” with “Preemption Hold Time” of one minute

Ensure that “Graceful Restart” has been enabled on all peers

Change the HA Timer to “Aggressive”

None

12.

When creating a custom application signature, which field allows you to specify the layer 7 protocol details to match?

Protocol Decoder

Application

Pattern Match

Signature ID

None

13.

Which interface deployments support the Aggregate Ethernet Active configuration? (Choose three.)

LACP in Virtual Wire

LACP in Layer 3

LACP in Layer 2

LLDP in Layer 3

LACP in TAP

14.

What information is necessary to properly plan the deployment of a Panorama hardware appliance for firewall management?

Wiring, power, Console access, and management interface connectivity

ESXi Server location and routing to the Panorama appliance

Panorama Mode, number of managed devices, CPU, and memory allocation in the hypervisor

Virtual router, zones, and interface configuration of the dataplane interface

None

15.

What are the three predefined external dynamic lists in PAN-OS that customers receive with their content and threat updates? (Choose three.)

command-and-control IP addresses

embargoed-country IP addresses

bulletproof IP addresses

known-malicious IP addresses

high-risk IP addresses

16.

In Panorama, the web interface displays the security rules in evaluation order. Organize the security rules in the order in which they will be evaluated?

Shared pre-rules -> Device group pre-rules -> Local firewall-rules ->Device group post-rules -> Shared post-rules

Shared pre-rules -> Device group pre-rules ->Device group post-rules -> Shared post-rules -> Local firewall-rules

Shared pre-rules ->Local firewall-rules -> Device group pre-rules ->Device group post-rules -> Shared post-rules

Shared pre-rules -> Shared post-rules -> Device group pre-rules -> Local firewall-rules ->Device group post-rules

None

17.

An administrator pushes a new configuration from panorama to a pair of firewalls that are configured as active/passive HA pair. Which NGFW receives the configuration from panorama?

both active and passive firewalls which then sync with each other

both active and passive firewalls independently and with no sync afterward

the passive firewall, which then synchronize to active firewall

the active firewall, which then synchronize to passive firewall

None

18.

A company’s network operations engineer is documenting a solution and wants to know the default priority setting for an LACP connection. If no changes are made to the default configuration settings for the LACP, which priority setting should you share with the engineer?

32,768

100

65,535

None

19.

A firewall configuration is being migrated by Expedition from a third-party vendor to a Palo Alto Networks Next-Generation Firewall (NGFW.). Expedition flags one service as invalid following the import of the original configuration file. An engineer investigates and finds the invalid service to be ping which is used by the security policies. Which action should the engineer take?

Remove ping service from all the policies which reference it.

Create an Application Override policy to override the ping service classification with ping application.

Use the search & replace in Expedition to replace the ping service classification with ping application.

Ignore the invalid flag in Expedition for the firewall to accept ping service.

None

20.

Examine the configured Security policy rule. Which day one/Iron Skillet Security Profile Group is used to secure the traffic that is permitted through this rule?

Internal

Inbound

Default

Outbound

None

21.

In an HA (High Availability) setup, what is the purpose of the HA3 link?

Synchronize configuration changes

Transmit HA control traffic

Synchronize session state information

Exchange heartbeats between the devices

None

22.

Match the APP-ID Adoption Task with it's order in the process.

None

23.

Instead of disabling App-IDs regularly, a security policy rule is going to be configured to temporarily allow new App-IDs. In which two circumstances is it valid to disable App-IDs as part of content update? (Choose two.)

when an organization operates a mission-critical network and has zero tolerance for downtime

when you want to immediately benefit from the latest threat prevention

when planning to enable the App-IDs immediately

when disabling facebook-base to disable all other Facebook App-IDs

24.

Identify the Stakeholder with their Role when planning a Firewall, Panorama, and Cortex XDR Deployment. (Select correct 4)

Network Engineer -> manages the routing, switching, and general device interconnectivity

Security Administrator -> Manages the software distribution method for Cortex XDR Client

Security Engineer-> Manages the software distribution method for Cortex XDR Client

Security Operation Analyst -> Manages the alerts and responds to threats identified to the network or endpoints.

Security Administrator-> Determines the security, logging, reporting requirement and manages the security policy

Security Engineer -> Determines the security, logging, reporting requirement and manages the security policy

25.

After you run command "sudo apt-get update", which command will you run to install?

sudo apt-get install expedition-beta

sudo apt-get install expedition

sudo apt-get expedition install

sudo apt-get upgrade

None

26.

A customer has a five-year-old firewall in production in the time since the firewall was installed, the IT team deleted unused security policies on a regular basis but they did not remove the address objects and groups that were part ofthese security policies. What is the best way to delete all of the unused address objects on the firewall?

Import the configuration in Expedition, remove unused address objects, and reimport the configuration.

Search each address object with Global Find and delete if it shows that the address object is not referenced

Using CLI execute requestconfiguration address-objectsremove-unused-objects.

Go to Address Objects under the Objects tab and click on Remove unused objects

None

27.

when disabling facebook-base to disable all other Facebook App-IDs

when an organization operates a mission-critical network and has zero tolerance for downtime

when you want to immediately benefit from the latest threat prevention

when planning to enable the App-IDs immediately

28.

Your customer believes that the Panorama appliance is being overwhelmed by the logs from deployed Palo Alto Networks Next-Generation Firewalls. What CLI command can you run to determine the number of logs per second sent by each firewall?

debug log-receiver statistics

show log traffic

show logging status

debug log-sender statistics

None

29.

Which CLI command should you use to verify whether all SFP, SFP+, or QSFP modules are installed in a firewall?

show system state filter sys.s*.p*.phy

show system state filter sys.p*.phy

show interface detail

show system info

None

30.

What is the preferred method for gathering User-ID mappings from Citrix VDI servers?

GlobalProtect with an internal gateway

The Windows User-ID agent

Agentless Server Monitoring

The Terminal Services agent

None

31.

A customer recently purchased a license for URL filtering and is having trouble activating PAN-DB. Which two commands can be used to troubleshoot this issue? (Choose two.)

request license info

request url-database license info

show device setting pan-db

show system setting url-database

32.

In an HA active/active configuration, what is the purpose of APR load sharing?

share an IP address and provide gateway services

sync the ARP table between the two firewalls

protect internal networks from an ARP flooding attack

share all IP addresses and provide Layer 4 through Layer 7 services when failure is detected

None

33.

An administrator has been asked to configure active/active HA for a pair of Palo Alto Networks NGFWs. The firewalls use layer 3 interface to send traffic to a single gateway IP for the pair. Which configuration will enable this HA scenario?

The firewall do not use floating IPs in active/active

The firewalls will share the same interface IP address, and device 1 will use the floating IP if device 0 fails.

Each firewall will have a separate floating IP. and priority will determine which firewall has the primary IP

The two firewalls will share a single floating IP and will use gratuitous ARP to share the floating IP

None

34.

When creating a custom application signature, which field allows you to specify the layer 7 protocol details to match?

Application

Pattern Match

Protocol Decoder

Signature ID

None

35.

Which two options describe the behavior of the “Direction” property in a WildFire Analysis Profile rule? (Choose two.)

The both direction option matches all files, but only if the transfer is started by the connection initiator.

The upload direction option matches only files that were uploaded to the internet by a user on the Inside network.

The download direction option matches files that the connection initiator received from the service it connected to.

The both direction option matches all files that are seen by the firewall, regardless of whether the transfer is started by the connection initiator or responder.

36.

Match the task for servr setting in group mapping with its order in the process.

None

37.

A customer's Palo Alto Networks NGFW currently has only one security policy allowing all traffic They have identified that this is a substantial security risk and have heard that the Expedition tool can help them extract security policies from an "allow any" rule What should the consultant say about Expedition?

Expedition cannot parse log files and therefore cannot be used for this purpose

By using the Machine Learning feature Expedition can parse the traffic log files related to the policy and extract security rules for matching traffic

Live firewall traffic can be viewed on Expedition when connected to a firewall, and Expedition can automatically create and push policies to the firewall

he log files can be viewed on Expedition, and right-clicking a log entry gives the option to create security policy from the log entry.

None

38.

Which routing configuration should you recommend to a customer who wishes to actively use multiple pathways to the same destination?

RIPv2

BGP

ECMP

OSPF

None

39.

What is exchanged through the HA2 link?

session synchronization

hello heartbeats

HA state information

User-ID in information

None

40.

With its improved reliability and automation, Expedition 2 will install by using which of the following?

Ubuntu 16.04 and higher

Windows Server 2016

Red Hat Enterprise Linux (RHEL) 9

Ubuntu 20.04

None

41.

Which Panorama operational mode is necessary to manage a large number of firewalls and also act as a log collector?

Management Only

Log Collector Only

Management and Log Collector

Dedicated Log Collector

None

42.

Your customer wants to implement Active/Active High Availability for their PA-5260 pair. Which three of the following HA configurations should your customer ensure they use to meet these requirements? (Choose three.)

The following conditions are true in their environment:
-They are using multiple Layer 3 interfaces to process traffic.
-Their routing topology requires the use of Network Address Translation policies to ensure that traffic can reach its destinations correctly.
-They prefer to have the session workload distributed as evenly as possible to ensure both firewalls have lower resource utilization.
-They make use of dynamic routing protocols on their virtual routers for route-based redundancy.
-They chose to go with Active/Active for failover speed reasons.

Session selection algorithm – First Packet

Session selection algorithm – Primary Device

HA1A, HA1B, and HA2 interfaces

HA1A, HA1B, HA2, and HA3 interfaces

Active/Active HA Binding in the NAT policies

43.

Which Palo Alto Network feature allows you to create dynamic security policies based on the behavior of the device in your network?

Dynamic Address Group

Cortex XDR

APP-ID

Behavioral Threat Detection

None

44.

Which of the following is a primary use case for the Decryption Broker feature?

Decrypting outbound SSL traffic

Aggregating traffic logs from different sources

Sharing decrypted traffic with multiple security appliances

Managing multiple decryption rules

None

45.

A URL is categorized as both health-and-medicine and abused-drugs. ... Which two actions will be taken when this URL is visited? (Choose two.)

allow

continue

block

log

46.

A customer has firewalls deployed at multiple data centers globally, and which are managed by a single Panorama pair. Each data center has multiple PA-7080 firewalls running PAN-OS 9.0. What are two recommended logging infrastructures across the data centers if the customer needs to log? (Choose two.)

Single log collector in the main data center

Cortex Data Lake

Distributed log collector

Mixed mode Panorama

47.

In a HA active/active configuration, which task does the session setup firewall perform?

threat scanning

NAT

Traffic log generation

decryption

None

48.

Which of the following must be enabled to use Threat Prevention features such as Anti-Virus and Anti-spyware on firewall?

Global Protect

URL Filtering

Wildfire Subscription

Security Profiles

None

49.

In preparation for a cutover event, what two processes or procedures should be verified? (Choose 2)

roles and responsibilites

change management requirements

logging and reporting

auditing

50.

TAC has requested a PCAP on your Panorama lo see why the DNS app is having intermittent issues resolving FODN What is the appropriate CLI command?

tcpdump snaplen 0 filter "port 53"

tcpdump snaplen 53 filter "port 53"

tcp dump snaplen 53 filter "tcp 53"

tcp dump snap-en 0 filter "app dns"

None

Time's up

Follow Us

PCNSC – Paloalto Certified Network Security Consultant

Fortinet NSE5 Forti Manager v7.2

No Comment! Be the first one.

Leave a Reply Cancel reply

Popular

Get Free eBooks

IPv6 Addressing and Prefix

Social

Newsletter

Follow Us

Type and hit Enter to search

PCNSC – Paloalto Certified Network Security Consultant

Share Article

Fortinet NSE5 Forti Manager v7.2

No Comment! Be the first one.

Leave a Reply Cancel reply

Popular

Get Free eBooks

IPv6 Addressing and Prefix

Social

Newsletter