Pre-Summer Special - Limited Time 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: top65certs

Paloalto Networks PCNSE Questions Answers

Page: 22 / 25
Total 334 questions

Palo Alto Networks Certified Security Engineer (PCNSE) PAN-OS 11.0 Questions and Answers

Question 85

Which two policy components are required to block traffic in real time using a dynamic user group (DUG)? (Choose two.)

Options:

A.

A Deny policy for the tagged traffic

B.

An Allow policy for the initial traffic

C.

A Decryption policy to decrypt the traffic and see the tag

D.

A Deny policy with the "tag" App-ID to block the tagged traffic

Question 86

An engineer decides to use Panorama to upgrade devices to PAN-OS 10.2.

Which three platforms support PAN-OS 10.2? (Choose three.)

Options:

A.

PA-220

B.

PA-800 Series

C.

PA-5000 Series

D.

PA-500

E.

PA-3400 Series

Question 87

The server team is concerned about the high volume of logs forwarded to their syslog server, it is determined that DNS is generating the most logs per second. The risk and compliance team requests that any Traffic logs indicating port abuse of port 53 must still be forwarded to syslog. All other DNS. Traffic logs can be exclude from syslog forwarding. How should syslog log forwarding be configured?

Options:

A.

With (port,dst neq 53)’ Traffic log filter Object > Log Forwarding.

B.

With ‘(port dst neq 53)’ Traffic log filter inside Device > log Settings.

C.

With ‘(app neq dns-base)’’ Traffic log filter inside Device> Log Settings.

D.

With ‘(app neq dns-base)’’ Traffic log filter inside Objects> Log Forwarding

Question 88

A company has configured GlobalProtect to allow their users to work from home. A decrease in performance for remote workers has been reported during peak-use hours.

Which two steps are likely to mitigate the issue? (Choose TWO)

Options:

A.

Exclude video traffic

B.

Enable decryption

C.

Block traffic that is not work-related

D.

Create a Tunnel Inspection policy

Page: 22 / 25
Total 334 questions