Pre-Summer Special - Limited Time 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: top65certs

Palo Alto Certifications and Accreditations PCNSE Syllabus Exam Questions Answers

Page: 17 / 25
Total 334 questions

Palo Alto Networks Certified Security Engineer (PCNSE) PAN-OS 11.0 Questions and Answers

Question 65

A company has recently migrated their branch office's PA-220S to a centralized Panorama. This Panorama manages a number of PA-7000 Series and PA-5200 Series devices All device group and template configuration is managed solely within Panorama

They notice that commit times have drastically increased for the PA-220S after the migration

What can they do to reduce commit times?

Options:

A.

Disable "Share Unused Address and Service Objects with Devices" in Panorama Settings.

B.

Update the apps and threat version using device-deployment

C.

Perform a device group push using the "merge with device candidate config" option

D.

Use "export or push device config bundle" to ensure that the firewall is integrated with the Panorama config.

Question 66

An engineer is tasked with decrypting web traffic in an environment without an established PKI When using a self-signed certificate generated on the firewall which type of certificate should be in? approved web traffic?

Options:

A.

An Enterprise Root CA certificate

B.

The same certificate as the Forward Trust certificate

C.

A Public Root CA certificate

D.

The same certificate as the Forward Untrust certificate

Question 67

An engineer has been given approval to upgrade their environment to the latest version of PAN-OS. The environment consists of both physical and virtual firewalls, a virtual Panorama, and virtual log collectors. What is the recommended order of operational steps when upgrading?

Options:

A.

Upgrade the firewalls, upgrade log collectors, upgrade Panorama

B.

Upgrade the firewalls, upgrade Panorama, upgrade the log collectors

C.

Upgrade Panorama, upgrade the log collectors, upgrade the firewalls

D.

Upgrade the log collectors, upgrade the firewalls, upgrade Panorama

Question 68

A network security administrator wants to enable Packet-Based Attack Protection in a Zone Protection profile. What are two valid ways to enable Packet-Based Attack Protection? (Choose two.)

Options:

A.

ICMP Drop

B.

TCP Drop

C.

SYN Random Early Drop

D.

TCP Port Scan Block

Page: 17 / 25
Total 334 questions