Exam PCNSE Topic 1 Question 127 Discussion
Actual exam question for Palo Alto Networks's PCNSE exam
Question #: 127
Topic #: 1
Question #: 127
Topic #: 1
A company has recently migrated their branch office's PA-220S to a centralized Panorama. This Panorama manages a number of PA-7000 Series and PA-5200 Series devices All device group and template configuration is managed solely within Panorama They notice that commit times have drastically increased for the PA-220S after the migration What can they do to reduce commit times?
Suggested Answer: A Vote an answer
Explanation
According to the Palo Alto Networks documentation1, disabling "Share Unused Address and Service Objects with Devices" in Panorama Settings is a possible solution to reduce commit times for firewalls managed by Panorama. This option prevents Panorama from pushing address and service objects that are not used in any policy rules to the firewalls, which can reduce the size of the configuration and improve the commit performance. Therefore, the correct answer is A.
The other options are not relevant or effective for reducing commit times:
Update the apps and threat version using device-deployment: This option would not help because it is not related to the commit process. Updating the apps and threat version using device-deployment is a feature that allows Panorama to distribute content updates to firewalls without requiring a commit2.
Perform a device group push using the "merge with device candidate config" option: This option would not help because it is not related to the commit performance. Performing a device group push using the
"merge with device candidate config" option is a feature that allows Panorama to merge the local changes on a firewall with the Panorama configuration without overwriting them3.
Use "export or push device config bundle" to ensure that the firewall is integrated with the Panorama config: This option would not help because it is not related to the commit performance. Using "export or push device config bundle" is a feature that allows Panorama to export or push a complete configuration bundle to a firewall, which can be useful for troubleshooting or migrating configurations4.
References: 1: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CleLCAS 2:
https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/firewall-administration/manage-firewalls/manage-co
3:
https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/firewall-administration/manage-firewalls/manage-fi
4:
https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/firewall-administration/manage-firewalls/manage-fi
According to the Palo Alto Networks documentation1, disabling "Share Unused Address and Service Objects with Devices" in Panorama Settings is a possible solution to reduce commit times for firewalls managed by Panorama. This option prevents Panorama from pushing address and service objects that are not used in any policy rules to the firewalls, which can reduce the size of the configuration and improve the commit performance. Therefore, the correct answer is A.
The other options are not relevant or effective for reducing commit times:
Update the apps and threat version using device-deployment: This option would not help because it is not related to the commit process. Updating the apps and threat version using device-deployment is a feature that allows Panorama to distribute content updates to firewalls without requiring a commit2.
Perform a device group push using the "merge with device candidate config" option: This option would not help because it is not related to the commit performance. Performing a device group push using the
"merge with device candidate config" option is a feature that allows Panorama to merge the local changes on a firewall with the Panorama configuration without overwriting them3.
Use "export or push device config bundle" to ensure that the firewall is integrated with the Panorama config: This option would not help because it is not related to the commit performance. Using "export or push device config bundle" is a feature that allows Panorama to export or push a complete configuration bundle to a firewall, which can be useful for troubleshooting or migrating configurations4.
References: 1: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CleLCAS 2:
https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/firewall-administration/manage-firewalls/manage-co
3:
https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/firewall-administration/manage-firewalls/manage-fi
4:
https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/firewall-administration/manage-firewalls/manage-fi
by Stanford at Apr 03, 2025, 01:08 AM
0
0
0
10
Comments
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Report Comment
Commenting
You can sign-up / login (it's free).