Latest PCNSC Pass Guaranteed Exam Dumps with Accurate & Updated Questions
PCNSC Exam Brain Dumps - Study Notes and Theory
NEW QUESTION 31
A client has a sensitive application server in their data center and is particularly concerned about resource exhaustion because of distributed denial-of-service attacks.
How can the Palo Alto Networks NGFW be configured to specifically protect tins server against resource exhaustion originating from multiple IP address (DDoS attack)?
- A. Add a DoS Protection Profile with defined session count.
- B. Define a custom App-ID to ensure that only legitimate application traffic reaches the server
- C. Add QoS Profiles to throttle incoming requests.
- D. Add a Vulnerability Protection Profile to block the attack.
Answer: A
NEW QUESTION 32
Which two benefits come from assigning a Decrypting Profile to a Decryption rule with a" NO Decrypt" action? (Choose two.)
- A. Block sessions with expired certificates
- B. Block sessions with client authentication
- C. Block sessions with untrusted issuers
- D. Block sessions with unsuspected cipher suites
- E. Block credential phishing.
Answer: A,C
NEW QUESTION 33
The firewall identified a popular application as a unknown-tcp. Which options are available to identify the application? (Choose two.)
- A. Submit an App-ID request to Palo Alto Networks.
- B. Create a custom application.
- C. Create a Security policy to identify the customer application.
- D. Create a customer object for the customer application server to identify the custom application.
Answer: B,D
NEW QUESTION 34
A web server is hosted in the DMZ and the server re configured to listen for income connections on TCP port
443. A Security policies rules allowing access from the Trust zone to the DMZ zone needs to be configured to allow web-browsing access. The web server host its contents over Traffic from Trust to DMZ is being decrypted with a Forward Proxy rule.
Which combination of service and application, and order of Security policy rules needs to be configured to allow cleaned web-browsing traffic to the server on tcp/443?
- A. Rule#1 application web-brows.no service application-default, action allow Rule #2 application ssl. Service application-default, action allow
- B. Rule# 1 application: ssl; service application-default: action allow
Role # 2 application web browsing, service application default, action allow - C. Rule #1application web-browsing, service service imp action allow
Rule #2 application ssl. service application -default, action allow - D. Rule#1application: web-biows.no; service service-https action allow
Rule#2 application ssl. Service application-default, action allow
Answer: A
NEW QUESTION 35
An administrator needs to optimize traffic to prefer business-critical applications over non-critical applications.
QoS natively integrates with which feature to provide service quality?
- A. certification revocation
- B. Content-ID
- C. App-ID
- D. port inspection
Answer: C
NEW QUESTION 36
An organization has Palo Alto Networks MGfWs that send logs to remote monitoring and security management platforms. The network team has report has excessive traffic on the corporate WAN. How could the Palo Alto Networks NOFW administrator reduce WAN traffic while maintaining support for all the existing monitoring/security platforms?
- A. Any configuration on an M-500 would address the insufficient bandwidth concerns.
- B. forward logs from firewalls only to Panorama, and have Panorama forward log* lo other external service.
- C. Forward logs from external sources to Panorama for correlation, arid from Panorama send to the NGFW
- D. Configure log compression and optimization features on all remote firewalls.
Answer: B
NEW QUESTION 37
Which feature can be configured on VM-Series firewalls'?
- A. multiple virtual systems
- B. machine learning
- C. Globallprotect
- D. aggregate interlaces
Answer: C
NEW QUESTION 38
Which CLI command enables an administrator to view detail about the firewall including uptime. PAN -OS version, and serial number?
- A. Show session info
- B. Show system info
- C. Show system detail
- D. debug system details
Answer: B
NEW QUESTION 39
Which three user authentication services can be modified in to provide the Palo Alto Networks NGFW with both username and role names? (Choose three.)
- A. PAP
- B. RADIUS
- C. TACACS+
- D. SAML
- E. Kerberos
- F. LDAP
Answer: B,C,F
NEW QUESTION 40
A Security policy rule is configured with a Vulnerability Protection Profile and an action of Deny".
Which action will this configuration cause on the matched traffic?
- A. The configuration is invalid it will cause the firewall to Skip this Security policy rule A warning will be displayed during a command.
- B. The configuration is valid It will cause the firewall to deny the matched sessions. Any configured Security Profiles have no effect if the Security policy rule action is set to "Deny" The configuration will allow the matched session unless a vulnerability signature is detected. The "Deny" action will supersede the per. defined, severity defined actions defined in the associated Vulnerability Protection Profile.
- C. The configuration is invalid. The Profile Settings section will be- grayed out when the action is set to "Deny"
Answer: C
NEW QUESTION 41
A firewall administrator has been asked to configure a Palo Alto Networks NGFW to prevent against compromised hosts trying to phone-number or bacon out to eternal command-and-control (C2) servers.
Which Security Profile type will prevent these behaviors?
- A. Anti-Spyware
- B. Antivirus
- C. Wildfire
- D. Vulnerability Protection
Answer: A
NEW QUESTION 42
View the GlobalProtect configuration screen capture.
What is the purpose of this configuration?
- A. It configures the tunnel address of all internal clients lo an IP address range starting at 192 168 10 1.
- B. It enables a Client to perform a reverse DNS lookup on 192 .168. 10 .1. to delect it is an internal client.
- C. It forces an internal client to connect to an internal gateway at IP address 192 168 10 I.
- D. It forces the firewall to perform a dynamic DNS update, Which adds the internal gateway's hostname and IP address to the DNS server.
Answer: B
NEW QUESTION 43
An administrator encountered problems with inbound decryption. Which option should the administrator investigate as part of triage?
- A. firewall connectivity to a CRL
- B. Security policy rule allowing SSL to the target server
- C. Root certificate imported into the firewall with "Trust" enabled
- D. importation of a certificate from an HSM
Answer: B
NEW QUESTION 44
Which three file types can be forward to WildMFire for analysis a part of the basic WildMFire service?
- A. .pdf
- B. .exe
- C. .fon
- D. .apk
- E. .jar
- F. .dil
Answer: A,D,E
NEW QUESTION 45
An administrator has enabled OSPF on a virtual router on the NGFW OSPF is not adding new routes to the virtual router.
Which two options enable the administrator top troubleshoot this issue? (Choose two.)
- A. Add a redistribution profile to forward as BGP updates.
- B. View System logs.
- C. View Runtime Status virtual router.
- D. Perform a traffic pcap at the routing stage.
Answer: B,C
NEW QUESTION 46
An administrator has users accessing network resources through Citrix XenApp 7 .x. Which User-ID mapping solution will map multiple mat who using Citrix to connect to the network and access resources?
- A. Globa1Protect
- B. Syslog Monitoring
- C. Client Probing
- D. Terminal Services agent
Answer: D
NEW QUESTION 47
An administrator accidentally closed the commit window/screen before the commit was finished. Which two options could the administrator use to verify the progress or success of that commit task? (Choose two.) A)
B)
C)
D)
- A. Option B
- B. Option C
- C. Option D
- D. Option A
Answer: A,B,D
NEW QUESTION 48
Which DoS protection mechanism detects and prevents session exhaustion attacks?
- A. Pocket Based Attack Protection
- B. TCP Port Scan Protection
- C. Flood Protection
- D. Resource Protection
Answer: D
NEW QUESTION 49
Which two methods can be used to verify firewall connectivity to Autofocus? (Choose two. )
- A. Check the WebUl Dashboard Autofocus widget
- B. Verify AutoFocus is enabled below Device Management tab
- C. Check the license
- D. Verify AutoFocus status using the CLI "test"command.
- E. Check for WildFire forwarding logs.
Answer: A,C
NEW QUESTION 50
A Palo Alto Networks NGFW just submitted a file lo WildFire tor analysis Assume a 5-minute window for analysis. The firewall is configured to check for verdicts every 5 minutes.
How quickly will the firewall receive back a verdict?
- A. 10 to 15 minutes
- B. 5 minutes
- C. 5 to 10 minutes
- D. More than 15 minutes
Answer: C
NEW QUESTION 51
Which two action would be part of an automatic solution that would block sites with untrusted certificates without enabling SSL forward proxy? (Choose two.)
- A. Create a Security Policy rule with vulnerability Security Profile attached.
- B. Create a no-decrypt Decryption Policy rule.
- C. Configure an EDL to pull IP Addresses of known sites resolved from a CRL.
- D. Configure a Dynamic Address Group for untrusted sites.
- E. Enable the "Block seasons with untrusted Issuers- setting.
Answer: A,E
NEW QUESTION 52
An administrator sees several inbound sessions identified as unknown tcp in the Traffic logs. The administrator determines that these sessions are from external users accessing the company's propriety accounting application. The administrator wants to reliability identity this as their accounting application and to scan this traffic for threats.
Which option would achieve this result?
- A. Create an Application Override policy
- B. Create an Application Override policy and a custom threat signature for the application.
- C. Create a custom App-ID and use the "ordered condition cheek box.
- D. Create a custom App-ID and enable scanning on the advanced tab.
Answer: B
NEW QUESTION 53
A session in the Traffic log is reporting the application as "incomplete" What does "incomplete" mean?
- A. The three-way TCP handshake did not complete.
- B. The traffic is coming across UDP, and the application could not be identified.
- C. The three-way TCP handshake was observed, but the application could not be identified.
- D. Data was received but wan instantly discarded because of a Deny policy was applied before App ID could be applied.
Answer: A
NEW QUESTION 54
......
Pass Palo Alto Networks PCNSC Test Practice Test Questions Exam Dumps: https://passleader.bootcamppdf.com/PCNSC-exam-actual-tests.html