Palo Alto Networks Certified Network Security Engineer - PCNSE7 FREE EXAM DUMPS QUESTIONS & ANSWERS]

Question 1

What are two benefits of nested device groups in Panorama? (Choose two.)

A. Overwrites local firewall configuration B. Requires configuring both function and location for every device C. Reuse of the existing Security policy rules and objects D. All device groups inherit settings form the Shared group

Discussion 0

Correct Answer: B,D Vote an answer

Question 2

How does an administrator schedule an Applications and Threats dynamic update while delaying installation of the update for a certain amount of time?

A. Configure the option for "Threshold". B. Automatically "download only" and then install Applications and Threats later, after the administrator approves the update. C. Automatically "download and install" but with the "disable new applications" option used. D. Disable automatic updates during weekdays.

Discussion 0

Correct Answer: B Vote an answer

Question 3

The web server is configured to listen for HTTP traffic on port 8080. The clients access the web server using the IP address 1.1.1.100 on TCP Port 80. The destination NAT rule is configured to translate both IP address and report to 10.1.1.100 on TCP Port 8080.

Which NAT and security rules must be configured on the firewall? (Choose two)

A. A security policy with a source of any from untrust-I3 zone to a destination of 1.1.100 in dmz-I3 zone using web-browsing application. B. A NAT rule with a source of any from untrust-I3 zone to a destination of 10.1.1.100 in dmz-zone using service-http service. C. A NAT rule with a source of any from untrust-I3 zone to a destination of 1.1.1.100 in untrust-I3 zone using service-http service. D. A security policy with a source of any from untrust-I3 Zone to a destination of 10.1.1.100 in dmz-I3 zone using web-browsing application

Discussion 0

Correct Answer: A,B Vote an answer

Question 4

A company has a policy that denies all applications it classifies as bad and permits only application it classifies as good. The firewall administrator created the following security policy on the company's firewall.

Which interface configuration will accept specific VLAN IDs?
Which two benefits are gained from having both rule 2 and rule 3 presents? (choose two)

A. A report can be created that identifies unclassified traffic on the network. B. Separate Log Forwarding profiles can be applied to rules 2 and 3. C. Different security profiles can be applied to traffic matching rules 2 and 3. D. Rule 2 and 3 apply to traffic on different ports.

Discussion 0

Correct Answer: B,C Vote an answer

Question 5

VPN traffic intended for an administrator's Palo Alto Networks NGFW is being maliciously intercepted and retransmitted by the interceptor. When creating a VPN tunnel, which protection profile can be enabled to prevent this malicious behavior?

A. Replay B. Web Application C. Zone Protection D. DoS Protection

Discussion 0

Correct Answer: C Vote an answer

Question 6

A user's traffic traversing a Palo Alto Networks NGFW sometimes can reach
http://www.company.com. At other times the session times out. The NGFW has been configured with a PBF rule that the user's traffic matches when it goes to
http://www.company.com.
How can the firewall be configured automatically disable the PBF rule if the next hop goes down?

A. Create and add a Monitor Profile with an action of Fail Over in the PBF rule in question. B. Enable and configure a Link Monitoring Profile for the external interface of the firewall. C. Create and add a Monitor Profile with an action of Wait Recover in the PBF rule in question. D. Configure path monitoring for the next hop gateway on the default route in the virtual router.

Discussion 0

Correct Answer: D Vote an answer

Question 7

A network security engineer has a requirement to allow an external server to access an internal web server.
The internal web server must also initiate connections with the external server.
What can be done to simplify the NAT policy?

A. Create a new Destination NAT Policy rule that matches the existing traffic and enable the Bi-directional option B. Configure ECMP to handle matching NAT traffic C. Configure a NAT Policy rule with Dynamic IP and Port D. Create a new Source NAT Policy rule that matches the existing traffic and enable the Bi- directional option

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 8

A customer wants to set up a VLAN interface for a Layer 2 Ethernet port.
Which two mandatory options are used to configure a VLAN interface? (Choose two.)

A. ARP entries B. Netflow Profile C. Virtual router D. Security zone

Discussion 0

Correct Answer: B,D Vote an answer

Question 9

Company.com has an in-house application that the Palo Alto Networks device doesn't identify correctly. A Threat Management Team member has mentioned that this in-house application is very sensitive and all traffic being identified needs to be inspected by the Content-ID engine.
Which method should company.com use to immediately address this traffic on a Palo Alto Networks device?

A. Wait until an official Application signature is provided from Palo Alto Networks. B. Modify the session timer settings on the closest referanced application to meet the needs of the in-house application C. Create a custom Application without signatures, then create an Application Override policy that includes the source, Destination, Destination Port/Protocol and Custom Application of the traffic. D. Create a Custom Application with signatures matching unique identifiers of the in-house application traffic

Discussion 0

Correct Answer: D Vote an answer