Palo Alto Networks Certified Network Security Engineer practice questions

1. Question 1 of 25

   Select 3

   Which three user authentication services can be modified to provide the Palo Alto Networks NGFW with both usernames and role names? (Choose three.)

   • ATACACS+
   • BKerberos
   • CPAP
   • DLDAP
   • ESAML
   • FRADIUS

   Show answer

   Correct answer: A, E, F

   How others answered

   • AEF100%

   Explanation

   Correct: A,E,F The administrative accounts are DEFINED on an external SAML, TACACS+, or RADIUS server. The server performs both authentication and authorization. For authorization, you define Vendor-Specific Attributes (VSAs) on the TACACS+ or RADIUS server, or SAML attributes on the SAML server. PAN-OS maps the attributes to administrator roles, access domains, user groups, and virtual systems that you define on the firewall. Kerberos, LDAP, and PAP required the admin account to be locally defined on the firewall. https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/firewall-administration/manage-firewall-administrators/administrative-authentication.html

   Adapted from community discussion by ChiaPet75 · 2020-12-12 · 20 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   View community discussion4

   Candidate context

   Question 1 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNSE or CertExamHQ.

   1. C

      ChiaPet75

      2020-12-12

      20 upvotes

      Correct: A,E,F The administrative accounts are DEFINED on an external SAML, TACACS+, or RADIUS server. The server performs both authentication and authorization. For authorization, you define Vendor-Specific Attributes (VSAs) on the TACACS+ or RADIUS server, or SAML attributes on the SAML server. PAN-OS maps the attributes to administrator roles, access domains, user groups, and virtual systems that you define on the firewall. Kerberos, LDAP, and PAP required the admin account to be locally defined on the firewall. https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/firewall-administration/manage-firewall-administrators/administrative-authentication.html

   2. E

      Edu147

      2020-01-25

      9 upvotes

      Correct: A, E, F https://docs.paloaltonetworks.com/pan-os/8-0/pan-os-admin/firewall-administration/manage-firewall-administrators/administrative-authentication#

   3. U

      UFanat

      2022-12-23

      Selected A, E, F2 upvotes

      A E F https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/firewall-administration/manage-firewall-administrators/administrative-authentication Only AEF can map roles from external auth services. Other requires to manage roles locally on the firewall.

   4. K

      KAAK

      2021-01-30

      3 upvotes

      A,E,F https://docs.paloaltonetworks.com/pan-os/8-0/pan-os-admin/firewall-administration/manage-firewall-administrators/administrative-authentication

2. Question 2 of 25

   Which log file can be used to identify SSL decryption failures?

   • ATraffic
   • BACC
   • CConfiguration
   • DThreats

   Show answer

   Correct answer: A

   How others answered

   • A63%
   • B38%

   Only 63% agreed on this answer — treat it as contested rather than settled.

   Explanation

   A Always from the traffic log. Whether it is drilling down into traffic log details or enabling the decryption column. Acquaint yourself with this reference: https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/decryption/verify-decryption.html

   Adapted from community discussion by Daniel2020 · 2021-04-22 · 9 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • live.paloaltonetworks.com documentation

   View community discussion4

   Candidate context

   Question 2 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNSE or CertExamHQ.

   1. D

      Daniel2020

      2021-04-22

      9 upvotes

      A Always from the traffic log. Whether it is drilling down into traffic log details or enabling the decryption column. Acquaint yourself with this reference: https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/decryption/verify-decryption.html

   2. M

      Micutzu

      2024-05-05

      Selected A6 upvotes

      The question is about "log file" and SSL decrypt failures. ACC isn't a log file. SLL decrypt failures you can see on Decryption log and in Traffic log (Session End Reason column)

   3. D

      Daniel2020

      2021-07-26

      3 upvotes

      B - as from PAN-OS 10, troubleshooting SSL in done in the following process: 1. Check ACC decryption widgets to identify traffic that causes decryption issues 2. Drill down further using the Decryption Log. It is not A because that simply tells you if the traffic was or was not decrypted. It does not in any way provide you with a means for troubleshooting. The question is asking you to troubleshoot. Read "Troubleshoot and Monitor Decryption" for PAN-OS 10. It clearly lists your troubleshooting process for SSL decryption issues https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/decryption/troubleshoot-and-monitor-decryption.html

   4. B

      bmarks

      2021-08-09

      4 upvotes

      The Question is simply asking which 'log file' lists/identifies decrypt failures, not how and where do I troubleshoot them... The Application Command Center (ACC) is an analytical tool, not a log file. The only answer that makes sense is A Traffic log.

3. Question 3 of 25

   A company wants to install a NGFW firewall between two core switches on a VLAN trunk link. They need to assign each VLAN to its own zone and to assign untagged (native) traffic to its own zone. Which option differentiates multiple VLANs into separate zones?

   • ACreate V-Wire objects with two V-Wire interfaces and define a range of ג€0-4096ג€ in the ג€Tag Allowedג€ field of the V-Wire object.
   • BCreate V-Wire objects with two V-Wire subinterfaces and assign only a single VLAN ID to the ג€Tag Allowedג€ field of the V-Wire object. Repeat for every additional VLAN and use a VLAN ID of 0 for untagged traffic. Assign each interface/subinterface to a unique zone.
   • CCreate Layer 3 subinterfaces that are each assigned to a single VLAN ID and a common virtual router. The physical Layer 3 interface would handle untagged traffic. Assign each interface/subinterface to a unique zone. Do not assign any interface an IP address.
   • DCreate VLAN objects for each VLAN and assign VLAN interfaces matching each VLAN ID. Repeat for every additional VLAN and use a VLAN ID of 0 for untagged traffic. Assign each interface/subinterface to a unique zone.

   Show answer

   Correct answer: B

   How others answered

   • B100%

   Explanation

   Correct: B The question says that the firewall was installed on a "trunk" link between to core switches. This mean Layer-3 is not usable in this situation. "Virtual wire interfaces by default allow all untagged traffic. You can, however, use a virtual wire to connect two interfaces and configure either interface to block or allow traffic based on the virtual LAN (VLAN) tags. VLAN tag 0 indicates untagged traffic. You can also create multiple subinterfaces, add them into different zones, and then classify traffic according to a VLAN tag or a combination of a VLAN tag with IP classifiers (address, range, or subnet) to apply granular policy control for specific VLAN tags or for VLAN tags from a specific source IP address, range, or subnet." https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/networking/configure-interfaces/virtual-wire-interfaces/vlan-tagged-traffic.html

   Adapted from community discussion by ChiaPet75 · 2020-12-26 · 22 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   View community discussion4

   Candidate context

   Question 3 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNSE or CertExamHQ.

   1. C

      ChiaPet75

      2020-12-26

      22 upvotes

      Correct: B The question says that the firewall was installed on a "trunk" link between to core switches. This mean Layer-3 is not usable in this situation. "Virtual wire interfaces by default allow all untagged traffic. You can, however, use a virtual wire to connect two interfaces and configure either interface to block or allow traffic based on the virtual LAN (VLAN) tags. VLAN tag 0 indicates untagged traffic. You can also create multiple subinterfaces, add them into different zones, and then classify traffic according to a VLAN tag or a combination of a VLAN tag with IP classifiers (address, range, or subnet) to apply granular policy control for specific VLAN tags or for VLAN tags from a specific source IP address, range, or subnet." https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/networking/configure-interfaces/virtual-wire-interfaces/vlan-tagged-traffic.html

   2. S

      sapahsaph

      2021-05-17

      7 upvotes

      correct answer is B Virtual wire interfaces by default allow all untagged traffic. You can, however, use a virtual wire to connect two interfaces and configure either interface to block or allow traffic based on the virtual LAN (VLAN) tags. VLAN tag 0 indicates untagged traffic. You can also create multiple subinterfaces, add them into different zones, and then classify traffic according to a VLAN tag or a combination of a VLAN tag with IP classifiers (address, range, or subnet) to apply granular policy control for specific VLAN tags or for VLAN tags from a specific source IP address, range, or subnet.

   3. B

      bmarks

      2021-08-09

      4 upvotes

      Best Answer = B Based on PAN Documentation on Virtual Wire Subinterfaces: Virtual wire deployments can use virtual wire subinterfaces to separate traffic into zones. https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/networking/configure-interfaces/virtual-wire-interfaces/virtual-wire-subinterfaces.html C is L3 subinterfaces that will require an IP address to pass traffic

   4. K

      Knuckles

      2021-05-02

      4 upvotes

      Might want to read this. They do have subinterfaces bud. https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/networking/configure-interfaces/virtual-wire-interfaces/virtual-wire-subinterfaces.html

4. Question 4 of 25

   Which data flow describes redistribution of user mappings?

   • AUser-ID agent to firewall
   • BDomain Controller to User-ID agent
   • CUser-ID agent to Panorama
   • Dfirewall to firewall

   Show answer

   Correct answer: D

   How others answered

   • D100%

   Explanation

   This one is a little confusing but I do believe that the right answer is "A". Step 3-1 says "Configure the firewall to function as a User-ID agent. If redistribution enables the firewall to function as a User-ID agent for other devices then the correct data flow would be "User-ID agent to firewall" The answer is A https://docs.paloaltonetworks.com/pan-os/7-1/pan-os-admin/user-id/deploy-user-id-in-a-large-scale-network/configure-firewalls-to-redistribute-user-mapping-information/configure-user-id-redistribution.html#idc123940a-367d-4515-b45e-29c1d0aa2bd1 In later version of the PANOS documentation it doesn't mention configuring the firewall as a User-Id agent specifically but all the configuration for redistribution is done within the User-ID agent configuration itself. See Step 1-3 in the doc link below. https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/user-id/deploy-user-id-in-a-large-scale-network/redistribute-user-mappings-and-authentication-timestamps/configure-user-id-redistribution

   Adapted from community discussion by ChiaPet75 · 2020-12-12 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   View community discussion4

   Candidate context

   Question 4 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNSE or CertExamHQ.

   1. C

      cipri86

      2021-07-20

      8 upvotes

      D - Firewall to Firewall https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/user-id/deploy-user-id-in-a-large-scale-network/redistribute-user-mappings-and-authentication-timestamps/firewall-deployment-for-user-id-redistribution.html#ide3661b46-4722-4936-bb9b-181679306809

   2. J

      jpm_1506

      2021-06-16

      6 upvotes

      "The agents send the user mappings to firewalls, Log Collectors, or Panorama." so far not redistribution - just collection... then it says "Each appliance then can serve as redistribution points that forward the mappings to other firewalls, Log Collectors, or Panorama." so for it to be considered as redistribution it has to come from a firewall, panorama, or log collector. taht only leaves option "D" as an option as its the only one that sources userID from a fw, panorama ,or log collector.

   3. C

      ChiaPet75

      2020-12-12

      3 upvotes

      This one is a little confusing but I do believe that the right answer is "A". Step 3-1 says "Configure the firewall to function as a User-ID agent. If redistribution enables the firewall to function as a User-ID agent for other devices then the correct data flow would be "User-ID agent to firewall" The answer is A https://docs.paloaltonetworks.com/pan-os/7-1/pan-os-admin/user-id/deploy-user-id-in-a-large-scale-network/configure-firewalls-to-redistribute-user-mapping-information/configure-user-id-redistribution.html#idc123940a-367d-4515-b45e-29c1d0aa2bd1 In later version of the PANOS documentation it doesn't mention configuring the firewall as a User-Id agent specifically but all the configuration for redistribution is done within the User-ID agent configuration itself. See Step 1-3 in the doc link below. https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/user-id/deploy-user-id-in-a-large-scale-network/redistribute-user-mappings-and-authentication-timestamps/configure-user-id-redistribution

   4. R

      rammsdoct

      2020-11-26

      4 upvotes

      D. if it was collection of user ID it would be A, but instead is redistritbution. check example below. https://docs.paloaltonetworks.com/pan-os/7-1/pan-os-admin/user-id/deploy-user-id-in-a-large-scale-network/configure-firewalls-to-redistribute-user-mapping-information/firewall-deployment-for-user-id-redistribution.html#id127bc778-ffec-49c4-a9b2-5cf7b044be6e

5. Question 5 of 25

   An administrator just submitted a newly found piece of spyware for WildFire analysis. The spyware passively monitors behavior without the user's knowledge. What is the expected verdict from WildFire?

   • AMalware
   • BGrayware
   • CPhishing
   • DSpyware

   Show answer

   Correct answer: B

   How others answered

   • B53%
   • D48%

   Only 53% agreed on this answer — treat it as contested rather than settled.

   Explanation

   Answer is GRAYWARE. The question is specifically asking for "VERDICT". There is NO verdict called "SPYWARE". "Spyware" is included within the "Grayware" Verdict. See Below. Benign Indicates that the entry received a WildFire analysis verdict of benign. Files categorized as benign are safe and do not exhibit malicious behavior. Grayware Indicates that the entry received a WildFire analysis verdict of grayware. Files categorized as grayware do not pose a direct security threat but might display otherwise obtrusive behavior. Grayware can include adware, spyware, and Browser Helper Objects (BHOs). Phishing Indicates that WildFire assigned a link and analysis verdict of phishing. A phishing verdict indicates that the site to which the link directs users displayed credential phishing activity. Malicious Indicates that the entry received a WildFire analysis verdict of malicious. Samples categorized as malicious can pose a security threat. Malware can include viruses, C2 (command-and-control), worms, Trojans, Remote Access Tools (RATs), rootkits, and botnets. For samples that are identified as malware, the WildFire cloud generates and distributes a signature to prevent against future exposure.

   Adapted from community discussion by weze1336 · 2024-05-29 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   View community discussion4

   Candidate context

   Question 5 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNSE or CertExamHQ.

   1. W

      weze1336

      2024-05-29

      3 upvotes

      Answer is GRAYWARE. The question is specifically asking for "VERDICT". There is NO verdict called "SPYWARE". "Spyware" is included within the "Grayware" Verdict. See Below. Benign Indicates that the entry received a WildFire analysis verdict of benign. Files categorized as benign are safe and do not exhibit malicious behavior. Grayware Indicates that the entry received a WildFire analysis verdict of grayware. Files categorized as grayware do not pose a direct security threat but might display otherwise obtrusive behavior. Grayware can include adware, spyware, and Browser Helper Objects (BHOs). Phishing Indicates that WildFire assigned a link and analysis verdict of phishing. A phishing verdict indicates that the site to which the link directs users displayed credential phishing activity. Malicious Indicates that the entry received a WildFire analysis verdict of malicious. Samples categorized as malicious can pose a security threat. Malware can include viruses, C2 (command-and-control), worms, Trojans, Remote Access Tools (RATs), rootkits, and botnets. For samples that are identified as malware, the WildFire cloud generates and distributes a signature to prevent against future exposure.

   2. G

      gully300

      2023-01-15

      Selected B3 upvotes

      bartbernini Highly Voted 11 months, 2 weeks ago B Grayware. Although this *is* an example of spyware, that is not one of the four possible WildFire verdicts. From Palo Alto, "Grayware typically includes adware, spyware, and Browser Helper Objects (BHOs)." https://docs.paloaltonetworks.com/wildfire/9-1/wildfire-admin/wildfire-overview/wildfire-concepts/verdicts.html

   3. T

      TAKUM1y

      2022-10-06

      Selected B3 upvotes

      https://docs.paloaltonetworks.com/wildfire/10-0/wildfire-admin/wildfire-overview/wildfire-concepts/verdicts

   4. U

      UFanat

      2022-06-12

      Selected B2 upvotes

      Grayware—The sample does not pose a direct security threat, but might display otherwise obtrusive behavior. Grayware typically includes adware, spyware, and Browser Helper Objects (BHOs).

6. Question 6 of 25

   Which is the maximum number of samples that can be submitted to WildFire per day, based on a WildFire subscription?

   • A10,000
   • B15,000
   • C7,500
   • D5,000

   Show answer

   Correct answer: A

   How others answered

   • A100%

   Explanation

   answer is 1000 however its not listed in the choices, I assume option A is a typo error it should be 1000 not 10,000..if it is, correct answer is A. https://docs.paloaltonetworks.com/wildfire/9-0/wildfire-admin/submit-files-for-wildfire-analysis/manually-upload-files-to-the-wildfire-portal.html#:~:text=All%20Palo%20Alto%20Networks%20customers,a%20day%20for%20WildFire%20analysis.

   Adapted from community discussion by awtkas983 · 2020-06-30 · 12 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   View community discussion4

   Candidate context

   Question 6 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNSE or CertExamHQ.

   1. A

      awtkas983

      2020-06-30

      12 upvotes

      answer is 1000 however its not listed in the choices, I assume option A is a typo error it should be 1000 not 10,000..if it is, correct answer is A. https://docs.paloaltonetworks.com/wildfire/9-0/wildfire-admin/submit-files-for-wildfire-analysis/manually-upload-files-to-the-wildfire-portal.html#:~:text=All%20Palo%20Alto%20Networks%20customers,a%20day%20for%20WildFire%20analysis.

   2. F

      Frightened_Acrobat

      2023-03-07

      3 upvotes

      Actually... D is the only answer that fits. Total daily submissions for standard Wildfire is 150. There are two problems with including the query limits of 1050: a) 150 + 1050 != 1,000. b) The question specifically asks for "submissions." The only Wildfire limit that matches one of these numbers is D, 5,000. Prisma Cloud Compute limits daily Wildfire submissions to exactly 5,000. https://docs.paloaltonetworks.com/wildfire/u-v/wildfire-api/about-the-wildfire-api/wildfire-api-access-control/impose-api-limits

   3. Q

      qqqq123

      2020-08-29

      4 upvotes

      Yeah, seems like a mistake in answer options: "The WildFire API supports up to 1,000 file submissions and up to 10,000 queries a day." https://docs.paloaltonetworks.com/wildfire/9-0/wildfire-admin/wildfire-overview/wildfire-subscription

   4. G

      GivemeMoney

      2022-01-16

      4 upvotes

      https://docs.paloaltonetworks.com/wildfire/10-1/wildfire-admin/wildfire-overview/wildfire-subscription.html - "The WildFire API supports up to 1,000 file submissions and up to 10,000 queries a day."

7. Question 7 of 25

   Select 3

   Which three file types can be forwarded to WildFire for analysis as a part of the basic WildFire service? (Choose three.)

   • A.dll
   • B.exe
   • C.fon
   • D.apk
   • E.pdf
   • F.jar

   Show answer

   Correct answer: A, B, C

   How others answered

   • ABC100%

   Explanation

   A,B,C are the correct answer, as the question is asking for the file types can be forwarded to WildFire for analysis as a part of the "basic WildFire service" https://docs.paloaltonetworks.com/wildfire/9-0/wildfire-admin/wildfire-overview/wildfire-subscription.html the above page says: "The basic WildFire service is included as part of the Palo Alto Networks next generation firewall and does not require a WildFire subscription. With the basic WildFire service, the firewall can forward portable executable (PE) files for WildFire analysis" https://docs.paloaltonetworks.com/wildfire/9-0/wildfire-admin/wildfire-overview/wildfire-concepts/file-analysis.html the above page says what are the PE file types: "Portable Executable (PE) files. PEs include executable files, object code, DLLs, FON (fonts), and LNK files, A subscription is not required to forward PE files for WildFire analysis"

   Adapted from community discussion by TamerRouby · 2020-11-12 · 7 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   View community discussion4

   Candidate context

   Question 7 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNSE or CertExamHQ.

   1. M

      Mello

      2019-12-06

      33 upvotes

      As part of the basic subscription, wildwire only submits PE files. This would include .exe .dll .fon and .src

   2. E

      Edu147

      2020-01-24

      11 upvotes

      Correct answers A, B, C. https://docs.paloaltonetworks.com/wildfire/8-0/wildfire-admin/wildfire-overview/wildfire-subscription# First lines are the basic files supported, and middle lines the files supported with a paid subscription

   3. T

      TamerRouby

      2020-11-12

      7 upvotes

      A,B,C are the correct answer, as the question is asking for the file types can be forwarded to WildFire for analysis as a part of the "basic WildFire service" https://docs.paloaltonetworks.com/wildfire/9-0/wildfire-admin/wildfire-overview/wildfire-subscription.html the above page says: "The basic WildFire service is included as part of the Palo Alto Networks next generation firewall and does not require a WildFire subscription. With the basic WildFire service, the firewall can forward portable executable (PE) files for WildFire analysis" https://docs.paloaltonetworks.com/wildfire/9-0/wildfire-admin/wildfire-overview/wildfire-concepts/file-analysis.html the above page says what are the PE file types: "Portable Executable (PE) files. PEs include executable files, object code, DLLs, FON (fonts), and LNK files, A subscription is not required to forward PE files for WildFire analysis"

   4. W

      Waheedeladawy

      2023-10-28

      Selected A, B, C1 upvote

      Answer will be A & B & C Beacuse the Question ask for " basic WildFire service " find PaloAlto Docs talk about PAN WildFire Subscription https://docs.paloaltonetworks.com/wildfire/9-1/wildfire-admin/wildfire-overview/wildfire-subscription#idb6afc7db-1bcf-43e8-bdd3-7afffa9aadda it mention the basic WildFire service, the firewall can forward portable executable (PE) files for WildFire, and see Below Docs https://docs.paloaltonetworks.com/wildfire/9-1/wildfire-admin/wildfire-overview/wildfire-concepts/file-analysis says that PEs Filetype include executable files, object code, DLLs, FON (fonts), and LNK files so A & B & C will be correct

8. Question 8 of 25

   An administrator has been asked to configure active/active HA for a pair of firewalls. The firewalls use Layer 3 interfaces to send traffic to a single gateway IP for the pair. Which configuration will enable this HA scenario?

   • AThe two firewalls will share a single floating IP and will use gratuitous ARP to share the floating IP.
   • BEach firewall will have a separate floating IP, and priority will determine which firewall has the primary IP.
   • CThe firewalls do not use floating IPs in active/active HA.
   • DThe firewalls will share the same interface IP address, and device 1 will use the floating IP if device 0 fails.

   Show answer

   Correct answer: A

   How others answered

   • A57%
   • B43%

   Only 57% agreed on this answer — treat it as contested rather than settled.

   Explanation

   ANSWER: A https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/high-availability/ha-concepts/floating-ip-address-and-virtual-mac-address.html "each HA firewall interface has its own IP address and floating IP address. The interface IP address remains local to the firewall, but the floating IP address moves between the firewalls upon firewall failure. .... If a link or firewall fails or a path monitoring event causes a failover, the floating IP address and virtual MAC address move over to the functional firewall. ... The functioning firewall sends a gratuitous ARP to update the MAC tables of the connected switches to inform them of the change in floating IP address

   Adapted from community discussion by eyelasers1 · 2022-02-23 · 8 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   View community discussion4

   Candidate context

   Question 8 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNSE or CertExamHQ.

   1. E

      eyelasers1

      2022-02-23

      8 upvotes

      ANSWER: A https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/high-availability/ha-concepts/floating-ip-address-and-virtual-mac-address.html "each HA firewall interface has its own IP address and floating IP address. The interface IP address remains local to the firewall, but the floating IP address moves between the firewalls upon firewall failure. .... If a link or firewall fails or a path monitoring event causes a failover, the floating IP address and virtual MAC address move over to the functional firewall. ... The functioning firewall sends a gratuitous ARP to update the MAC tables of the connected switches to inform them of the change in floating IP address

   2. T

      TAKUM1y

      2022-10-12

      Selected A5 upvotes

      https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/high-availability/ha-concepts/floating-ip-address-and-virtual-mac-address

   3. G

      Gab99

      2023-02-18

      Selected A2 upvotes

      It depends, 1. With L3 Szenario with Active/Active deployment that behaves like Active/Passive deployment (Use Case: Configure Active/Active HA with Floating IP Address Bound to Active-Primary Firewall, https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/high-availability/set-up-activeactive-ha/determine-your-activeactive-use-case#id726797f4-7d7b-4204-b86c-42589d19e8ac) there is only ONE FLOATING IP. 2. There is also a use case with TWO FLOATING IPs, so please be careful with your assumptions. From the descritpion I would say "Standard L3 use case" (with active/active for faster failover), so only ONE FLOATING IP. >>>> ANSWER A But maybe the use case is the other, not 100% sure.

   4. X

      Xuzi

      2023-11-11

      Selected A1 upvote

      The active/active HA firewalls share a single floating IP address that you bind to whichever firewall is in the active-primary state. With only one floating IP address, network traffic flows predominantly to a single firewall, so this active/active deployment functions like an active/passive deployment. https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/high-availability/set-up-activeactive-ha/determine-your-activeactive-use-case/use-case-configure-activeactive-ha-with-floating-ip-address-bound-to-active-primary-firewall#id93973f10-2001-4ae4-b475-faa7e70967c1

9. Question 9 of 25

   Select 2

   SAML SLO is supported for which two firewall features? (Choose two.)

   • AGlobalProtect Portal
   • BCaptivePortal
   • CWebUI
   • DCLI

   Show answer

   Correct answer: A, C

   How others answered

   • AC100%

   Explanation

   Agree with Anoopmp: A and C SSO is available to administrators who access the web interface and to end users who access applications through GlobalProtect or Captive Portal. SLO is available to administrators and GlobalProtect end users, but not to Captive Portal end users. https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/authentication/authentication-types/saml

   Adapted from community discussion by santino · 2020-11-30 · 16 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   View community discussion4

   Candidate context

   Question 9 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNSE or CertExamHQ.

   1. S

      santino

      2020-11-30

      16 upvotes

      Agree with Anoopmp: A and C SSO is available to administrators who access the web interface and to end users who access applications through GlobalProtect or Captive Portal. SLO is available to administrators and GlobalProtect end users, but not to Captive Portal end users. https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/authentication/authentication-types/saml

   2. T

      TamerRouby

      2020-11-12

      4 upvotes

      A, C are the correct answer as it is saying SLO, not SSO https://docs.paloaltonetworks.com/pan-os/8-0/pan-os-admin/authentication/configure-saml-authentication https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/authentication/configure-saml-authentication.html

   3. U

      UFanat

      2022-12-15

      Selected A, C2 upvotes

      A and C. Not B!!!!! Don't' mess SSO and SLO: https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/authentication/configure-saml-authentication SSO is available to administrators and to GlobalProtect and Authentication Portal end users. SLO is available to administrators and GlobalProtect end users, but not to Authentication Portal end users. Administrators can use SAML to authenticate to the firewall web interface, but not to the CLI.

   4. T

      trashboat

      2021-10-29

      3 upvotes

      A & C are correct: "You cannot enable SLO for Authentication (Captive) Portal users." https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-web-interface-help/device/device-server-profiles-saml-identity-provider

10. Question 10 of 25

    Select 2

    Which two features can be used to tag a username so that it is included in a dynamic user group? (Choose two.)

    • Alog forwarding auto-tagging
    • BXML API
    • CGlobalProtect agent
    • DUser-ID Windows-based agent

    Show answer

    Correct answer: A, B

    How others answered

    • AB55%
    • BD41%

    Only 55% agreed on this answer — treat it as contested rather than settled.

    Explanation

    From the PCNSE study guide, Dynamic User Groups (page 106): Usernames also can be tagged and untagged using the autotagging feature in a Log Forwarding Profile. You also can program another utility to invoke PAN-OS XML API commands to tag or untag usernames. In the web interface you can use logical AND or OR operators with the tags to better filter or match against. You can configure a timeout value that determines when a username will be untagged automatically. Based on that paragraph, A&B are the correct answers.

    Adapted from community discussion by PuckinWebGuy · 2021-02-18 · 34 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    View community discussion4

    Candidate context

    Question 10 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNSE or CertExamHQ.

    1. P

       PuckinWebGuy

       2021-02-18

       34 upvotes

       From the PCNSE study guide, Dynamic User Groups (page 106): Usernames also can be tagged and untagged using the autotagging feature in a Log Forwarding Profile. You also can program another utility to invoke PAN-OS XML API commands to tag or untag usernames. In the web interface you can use logical AND or OR operators with the tags to better filter or match against. You can configure a timeout value that determines when a username will be untagged automatically. Based on that paragraph, A&B are the correct answers.

    2. M

       MS_NW

       2020-07-19

       15 upvotes

       BD https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-new-features/user-id-features/dynamic-user-groups.html To dynamically register tags, you can use: the XML API the User-ID agent Panorama the web interface on the firewall

    3. A

       Andromeda1800

       2023-12-12

       Selected A, B8 upvotes

       I think confusion comes from mixing two different "tools" 1. auto-tagging users to include them in DUG and 2. dynamically register tags. Those are two different operations. -to auto-tag users to DUG: auto-tagging in log-forwarding, XML API -to dynamically add tags: XML API, Panorama, User-ID -to statically add tags: WebUI

    4. G

       gustavok

       2022-03-30

       Selected A, B5 upvotes

       Please check the OS version of the documentation links you are referring to. The following link is for PAN-OS Version 10.1: https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/datasheets/education/pcnse-study-guide.pdf Here you can see that there are two features to tag user names to dynamic user groups: the auto-tagging feature in a Log Forwarding Profile or invoke PAN-OS XML API commands to tag or untag usernames so the solution would be A & B

11. Question 11 of 25

    Select 2

    SD-WAN is designed to support which two network topology types? (Choose two.)

    • Apoint-to-point
    • Bhub-and-spoke
    • Cfull-mesh
    • Dring

    Show answer

    Correct answer: B, C

    How others answered

    • BC100%

    Explanation

    SD-WAN supports a full mesh topology, in addition to the hub-spoke topology. The mesh can consist of branches with or without hubs. Use full mesh when the branches need to communicate with each other directly. https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-new-features/sd-wan-features/sd-wan-full-mesh-vpn-cluster-with-ddns-service.html BC

    Adapted from community discussion by jordan_gsi · 2021-09-14 · 10 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    View community discussion4

    Candidate context

    Question 11 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNSE or CertExamHQ.

    1. J

       jordan_gsi

       2021-09-14

       10 upvotes

       SD-WAN supports a full mesh topology, in addition to the hub-spoke topology. The mesh can consist of branches with or without hubs. Use full mesh when the branches need to communicate with each other directly. https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-new-features/sd-wan-features/sd-wan-full-mesh-vpn-cluster-with-ddns-service.html BC

    2. A

       alexblue

       2021-01-29

       3 upvotes

       BC The CloudGenix SD-WAN supports both hub-and-spoke and limited scale full-mesh designs managed through a cloud-based portal. https://www.paloaltonetworks.nl/apps/pan/public/downloadResource?pagePath=/content/pan/en_US/resources/guides/pan-os-secure-sd-wan-deployment-guide

    3. S

       santino

       2020-11-30

       3 upvotes

       I think it is A and B Full Mesh SD-WAN VPN topology is not supported in PAN-OS 9.1.0. https://docs.paloaltonetworks.com/sd-wan/1-0/sd-wan-admin/configure-sd-wan/create-a-vpn-cluster.html

    4. C

       ChiaPet75

       2020-12-12

       1 upvote

       Correct: A,C Hub-and-Spoke is the default topology for PaloAlto SD-WAN Auto VPN Topology Creation - VPN clusters simplify the creation of complex VPN topologies using logical groupings of branches and hubs to accelerate the configuration and deployment of secure communications between all locations. (I guess this could be considered full-mesh but only in the logical sense.) https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-release-notes/pan-os-9-1-release-information/features-introduced-in-pan-os-9-1/sd-wan-features Full mesh is not supported in PAN-OS version 9.1.0 https://docs.paloaltonetworks.com/sd-wan/1-0/sd-wan-admin/configure-sd-wan/create-a-vpn-cluster.html

12. Question 12 of 25

    Which User-ID method maps IP addresses to usernames for users connecting through an 802.1x-enabled wireless network device that has no native integration with PAN-OSֲ® software?

    • AXML API
    • BPort Mapping
    • CClient Probing
    • DServer Monitoring

    Show answer

    Correct answer: A

    How others answered

    • A76%
    • D21%

    Explanation

    it looks like the docs have changed and are more clear now. XML API seems to be the right answer in this case, otherwise syslog could be possible too but that is not an anwer here. Server monitoring is not right because it assumes you are using some kind of AD server. Answer: A

    Adapted from community discussion by mtberdaan · 2021-12-18 · 18 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    View community discussion4

    Candidate context

    Question 12 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNSE or CertExamHQ.

    1. M

       mtberdaan

       2021-12-18

       18 upvotes

       it looks like the docs have changed and are more clear now. XML API seems to be the right answer in this case, otherwise syslog could be possible too but that is not an anwer here. Server monitoring is not right because it assumes you are using some kind of AD server. Answer: A

    2. C

       Cro13

       2024-12-04

       Selected A4 upvotes

       A is correct In the pcnse study guide : XML API: The PAN-OS XML API is used in cases where standard user mapping methods might not work—for example, as third-party VPNs or 802.1x-enabled wireless networks

    3. B

       Blut

       2021-10-03

       3 upvotes

       XML API is the correct ans.. User-ID XML APIFor other types of user access that cannot be mapped using any of the standard user mapping methods or Captive Portal—for example, to add mappings of users connecting from a third-party VPN solution or users connecting to a 802.1x enabled wireless network—you can use the User-ID XML API to capture login events and send them to the User-ID agent or directly to the firewall. See Send User Mappings to User-ID Using the XML API for details. Copyright © 2007-2015 Palo Alto Networks https://studylib.net/doc/8891763/user-id---palo-alto-networks Refer - Page -9

    4. X

       Xuzi

       2024-05-06

       2 upvotes

       User-ID provides many out-of-the box methods for obtaining user mapping information. However, you might have applications or devices that capture user information but cannot natively integrate with User-ID. For example, you might have a custom, internally developed application or a device that no standard user mapping method supports. In such cases, you can use the PAN-OS XML API to create custom scripts that send the information to the PAN-OS integrated User-ID agent or directly to the firewall. The PAN-OS XML API uses standard HTTP requests to send and receive data. API calls can be made directly from command line utilities such as cURL or using any scripting or application framework that supports POST and GET requests.

13. Question 13 of 25

    A bootstrap USB flash drive has been prepared using a Linux workstation to load the initial configuration of a Palo Alto Networks firewall. The USB flash drive was formatted using file system ntfs and the initial configuration is stored in a file named init-cfg.txt. The contents of init-cfg.txt in the USB flash drive are as follows:

    

    The USB flash drive has been inserted in the firewalls' USB port, and the firewall has been powered on. Upon boot, the firewall fails to begin the bootstrapping process. The failure is caused because:

    • Athe bootstrap.xml file is a required file, but it is missing
    • Bnit-cfg.txt is an incorrect filename, the correct filename should be init-cfg.xml
    • CThe USB must be formatted using the ext4 file system
    • DThere must be commas between the parameter names and their values instead of the equal symbols
    • EThe USB drive has been formatted with an unsupported file system

    Show answer

    Correct answer: E

    How others answered

    • E90%

    Explanation

    As per PA it will support FAT32 and ext3 so the correct ans is E ( Unsupported File System ) The USB flash drive that bootstraps a hardware-based Palo Alto Networks firewall must support one of the following: • File Allocation Table 32 (FAT32) • Third Extended File System (ext3)

    Adapted from community discussion by Blut · 2021-10-02 · 11 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    View community discussion4

    Candidate context

    Question 13 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNSE or CertExamHQ.

    1. B

       Blut

       2021-10-02

       11 upvotes

       As per PA it will support FAT32 and ext3 so the correct ans is E ( Unsupported File System ) The USB flash drive that bootstraps a hardware-based Palo Alto Networks firewall must support one of the following: • File Allocation Table 32 (FAT32) • Third Extended File System (ext3)

    2. U

       UFanat

       2022-12-18

       Selected E3 upvotes

       File name should be init-cfg.txt (not xml) (B is incorrect) Config looks fine according to: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/firewall-administration/bootstrap-the-firewall/sample-init-cfgtxt-files (D is not correct) option A - looks stupid Supported file systems ext3 and FAT32, so it should be E https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/firewall-administration/bootstrap-the-firewall/usb-flash-drive-support

    3. M

       MrR0bot

       2023-07-31

       Selected E2 upvotes

       E is correct https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/firewall-administration/bootstrap-the-firewall/usb-flash-drive-support The USB flash drive that bootstraps a hardware-based Palo Alto Networks firewall must support one of the following: File Allocation Table 32 (FAT32) Third Extended File System (ext3)

    4. T

       Trung2735

       2022-02-17

       3 upvotes

       The link https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/firewall-administration/bootstrap-the-firewall/usb-flash-drive-support.html

14. Question 14 of 25

    Select 2

    An administrator accidentally closed the commit window/screen before the commit was finished. Which two options could the administrator use to verify the progress or success of that commit task? (Choose two.)

    • ATask Manager
    • BSystem Logs
    • CTraffic Logs
    • DConfiguration Logs

    Show answer

    Correct answer: A, B

    How others answered

    • AB92%

    Explanation

    The correct answer is A and B. I don't know if this information used to be contained within system logs, but they are no longer there; this information is only available within the task manager and configuration logs. https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/monitoring/view-and-manage-logs/log-types-and-severity-levels/config-logs https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-web-interface-help/web-interface-basics/task-manager.html

    Adapted from community discussion by bartbernini · 2022-08-05 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    View community discussion4

    Candidate context

    Question 14 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNSE or CertExamHQ.

    1. C

       confusion

       2022-09-18

       Selected A, B3 upvotes

       AB is what I would select here. Question says "progress or success". The System log on one of my FWs says things like: "Commit job succeeded. Completion time = date time, JobID=number. User = username" and also "Commit job started processing. Dequeue time = date time. JobID=number. User = username", so this can show progress and/or success. Task Manager is obviously correct and can show progress and/or success. I would not go for D. Configuration Logs as there you can see success or fail and the exact config diff, but you can't find progress.

    2. B

       bartbernini

       2022-08-05

       Selected A, B2 upvotes

       The correct answer is A and B. I don't know if this information used to be contained within system logs, but they are no longer there; this information is only available within the task manager and configuration logs. https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/monitoring/view-and-manage-logs/log-types-and-severity-levels/config-logs https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-web-interface-help/web-interface-basics/task-manager.html

    3. T

       TAKUM1y

       2023-04-15

       Selected A, B2 upvotes

       A: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-web-interface-help/web-interface-basics/task-manager B:https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/monitoring/view-and-manage-logs/log-types-and-severity-levels/system-logs

    4. U

       UFanat

       2022-12-11

       3 upvotes

       D is wrong. Configurations Logs shows only commit submission but not completion. For Completion you must go to System Logs

15. Question 15 of 25

    When overriding a template configuration locally on a firewall, what should you consider?

    • APanorama will update the template with the overridden value.
    • BThe firewall template will show that it is out of sync within Panorama.
    • COnly Panorama can revert the override.
    • DPanorama will lose visibility into the overridden configuration.

    Show answer

    Correct answer: D

    How others answered

    • D93%

    Explanation

    The correct answer is D. "When you override a setting on the firewall, the firewall saves that setting to its local configuration and Panorama no longer manages the setting." "If you push a configuration with Force Template Values enabled, all overridden values on the firewall are replaced with values from the template. Before you use this option, check for overridden values on the firewalls to ensure your commit does not result in any unexpected network outages or issues caused by replacing those overridden values." Although this doesn't explicitly indicate that you lose visibility, it definitely implies by advising you to check local firewall settings before forcing template values. https://docs.paloaltonetworks.com/panorama/8-1/panorama-admin/panorama-overview/centralized-firewall-configuration-and-update-management/templates-and-template-stacks.html https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-web-interface-help/panorama-web-interface/panorama-commit-operations.html

    Adapted from community discussion by bartbernini · 2022-08-06 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • live.paloaltonetworks.com documentation

    View community discussion4

    Candidate context

    Question 15 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNSE or CertExamHQ.

    1. B

       bartbernini

       2022-08-06

       Selected D4 upvotes

       The correct answer is D. "When you override a setting on the firewall, the firewall saves that setting to its local configuration and Panorama no longer manages the setting." "If you push a configuration with Force Template Values enabled, all overridden values on the firewall are replaced with values from the template. Before you use this option, check for overridden values on the firewalls to ensure your commit does not result in any unexpected network outages or issues caused by replacing those overridden values." Although this doesn't explicitly indicate that you lose visibility, it definitely implies by advising you to check local firewall settings before forcing template values. https://docs.paloaltonetworks.com/panorama/8-1/panorama-admin/panorama-overview/centralized-firewall-configuration-and-update-management/templates-and-template-stacks.html https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-web-interface-help/panorama-web-interface/panorama-commit-operations.html

    2. L

       lol12

       2023-04-30

       Selected D2 upvotes

       D for me unless revert is not the same as force template back to FW... https://docs.paloaltonetworks.com/panorama/10-2/panorama-admin/panorama-overview/centralized-firewall-configuration-and-update-management/templates-and-template-stacks

    3. T

       TAKUM1y

       2023-04-15

       Selected D2 upvotes

       https://docs.paloaltonetworks.com/panorama/10-2/panorama-admin/panorama-overview/centralized-firewall-configuration-and-update-management/templates-and-template-stacks

    4. D

       drrealest

       2022-06-15

       2 upvotes

       it is A , Panorama allows you to override values a firewall received from a template and will let you know its a local value after youve changed it https://docs.paloaltonetworks.com/panorama/9-0/panorama-admin/manage-firewalls/manage-templates-and-template-stacks/override-a-template-setting/override-a-template-setting-on-the-firewall.html

16. Question 16 of 25

    An engineer must configure a new SSL decryption deployment. Which profile or certificate is required before any traffic that matches an SSL decryption rule is decrypted?

    • AA Decryption profile must be attached to the Decryption policy that the traffic matches.
    • BThere must be a certificate with both the Forward Trust option and Forward Untrust option selected.
    • CA Decryption profile must be attached to the Security policy that the traffic matches.
    • DThere must be a certificate with only the Forward Trust option selected.

    Show answer

    Correct answer: D

    How others answered

    • D61%
    • A32%

    Only 61% agreed on this answer — treat it as contested rather than settled.

    Explanation

    I think it is A. For example, in SSL Inbound Inspection you do SSL decryption and don't need Forward Trust or Untrust Certificate. You only need a decrypt policy with a decrypt profile.

    Adapted from community discussion by vansardo · 2021-12-27 · 22 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    View community discussion4

    Candidate context

    Question 16 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNSE or CertExamHQ.

    1. V

       vansardo

       2021-12-27

       22 upvotes

       I think it is A. For example, in SSL Inbound Inspection you do SSL decryption and don't need Forward Trust or Untrust Certificate. You only need a decrypt policy with a decrypt profile.

    2. M

       Micutzu

       2021-12-13

       9 upvotes

       I believe that in this case the correct answer is D. I tested in my lab and Isn't a must to have a Forward Untrust Certificate. It's a must to have the Forward Trust Certificate defined. Once you create a Decryption Policy Rule, you cannot commit without having a Forward Trust Certificate defined.

    3. K

       Knowledge33

       2023-06-11

       Selected D5 upvotes

       I just did it on my PAN. The decryption profile is not mandatory. It's optional, but the certificate with "forward trust" is mandatory.

    4. C

       ConfuzedOne

       2023-06-02

       Selected D1 upvote

       I think this question / answer set must be entered incorrectly - the question/answer pairing itself is not complete - we need to know whether we're talking inbound SSL decryption or outbound SSL forward Proxy.... If it's inbound SSL decryption then then options B and D are completly bunk. and as pointed out in some other comments, Palo's official documentation states decryption profiles are optional, but the question is about what is required. NO RIGHT ANSWER HERE If this is for outbound SSL Forward Proxy, again, Palo's documentation says the profile is optional, so answers A and C are completely bunk. Answer B completely defeats the purpose of the use of trusted and untrusted certificates - you need 2 certs, 1 trusted and 1 not trusted, so you would not have the same cert be both trusted and not trusted. That leaves option D - There must be a certificate with only the Forward Trust option selected... so if there's anything close to right, it seems Option D is it.

17. Question 17 of 25

    Select 2

    What are two common reasons to use a "No Decrypt" action to exclude traffic from SSL decryption? (Choose two.)

    • Athe web server requires mutual authentication
    • Bthe website matches a category that is not allowed for most users
    • Cthe website matches a high-risk category
    • Dthe website matches a sensitive category

    Show answer

    Correct answer: A, D

    How others answered

    • AD100%

    Explanation

    For mutual authentication we must configure SSL Decryption Exclusion and once we include a destination into SSL Decryption Exclusion all the decryption policy rules are bypassed, therefor there is not action of "NO DECRYPT". "No decrypt" it's only inside decryption policy rule. https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/decryption/decryption-exclusions/create-a-policy-based-decryption-exclusion.html "Traffic that originates or is destined for executives or other users whose traffic shouldn’t be decrypted." = restricted/limited group of users In my opinion the correct answers are B&D.

    Adapted from community discussion by Micutzu · 2022-06-13 · 5 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    View community discussion4

    Candidate context

    Question 17 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNSE or CertExamHQ.

    1. P

       Plato22

       2022-06-11

       11 upvotes

       A and D: https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/decryption/decryption-exclusions/create-a-policy-based-decryption-exclusion

    2. M

       Micutzu

       2022-06-13

       5 upvotes

       For mutual authentication we must configure SSL Decryption Exclusion and once we include a destination into SSL Decryption Exclusion all the decryption policy rules are bypassed, therefor there is not action of "NO DECRYPT". "No decrypt" it's only inside decryption policy rule. https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/decryption/decryption-exclusions/create-a-policy-based-decryption-exclusion.html "Traffic that originates or is destined for executives or other users whose traffic shouldn’t be decrypted." = restricted/limited group of users In my opinion the correct answers are B&D.

    3. M

       Micutzu

       2022-06-16

       3 upvotes

       https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/decryption/decryption-exclusions/palo-alto-networks-predefined-decryption-exclusions.html The firewall provides a predefined SSL Decryption Exclusion list to exclude from decryption commonly used sites that break decryption because of technical reasons such as pinned certificates and mutual authentication.

    4. T

       TAKUM1y

       2023-04-16

       Selected A, D2 upvotes

       A:https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/decryption/decryption-exclusions/exclude-a-server-from-decryption B:https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/decryption/decryption-exclusions/create-a-policy-based-decryption-exclusion

18. Question 18 of 25

    Select 2

    An administrator plans to deploy 15 firewalls to act as GlobalProtect gateways around the world. Panorama will manage the firewalls. The firewalls will provide access to mobile users and act as edge locations to on-premises infrastructure. The administrator wants to scale the configuration out quickly and wants all of the firewalls to use the same template configuration. Which two solutions can the administrator use to scale this configuration? (Choose two.)

    • Avirtual systems
    • Btemplate stacks
    • Cvariables
    • Dcollector groups

    Show answer

    Correct answer: B, C

    How others answered

    • BC62%
    • BD23%
    • AB15%

    Only 62% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Answers are B, C. Clearly, this is a question about templates, template stacks and variables in Panorama. The key to answering this question is to understand template capabilities and exceptions. You cannot use templates or template stacks to set firewall modes, but as an exception, Panorama can push default vsys settings in a template to firewalls that don't support them or don't have any vsys configured. Since these PANs will be shipped world-wide, you will benefit from the use of variables to serve as placeholder objects based on configuration needs.

    Adapted from community discussion by Whizdhum · 2024-06-15 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    View community discussion4

    Candidate context

    Question 18 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNSE or CertExamHQ.

    1. P

       Plato22

       2022-06-11

       15 upvotes

       Another wrong answer. Should be B and C: https://docs.paloaltonetworks.com/panorama/10-0/panorama-admin/panorama-overview/centralized-firewall-configuration-and-update-management/templates-and-template-stacks

    2. M

       Marcyy

       2022-06-10

       6 upvotes

       Should be BC. https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/manage-firewalls/manage-templates-and-template-stacks/configure-template-or-template-stack-variables.html

    3. B

       Beluga123

       2023-11-05

       Selected B, C1 upvote

       Template Variables allow you to assign a dynamic value in a template configuration you can overwrite later in a template stack. This can be particularly useful for IPv4 addresses you do not know value when configuring a template. The IPv4 template variable can be referenced in different parts of the template configuration like in Global Protect configuration. Procedure When you are using IPv4 template variable for Gateway and/or Portal in Global Protect Configuration, you have to be sure this variable is also used to configure IP setting of the physical interface. You have to verify this in Template configuration but also in Template stack configuration. Template stack can contain more than one template, setting IPv4 configuration with conflicting values; the First template applied will prevail. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PO4UCAW

    4. R

       Rowdy_47

       2023-08-25

       Selected B, C1 upvote

       Cannot be A: Virtual systems are separate, logical firewall instances within a single physical Palo Alto Networks firewall. - FWs are being deployed around the world and acting as edge locations on premisis https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/virtual-systems/virtual-systems-overview Cannot be D: Panorama uses Log Collectors to aggregate logs from managed firewalls. When generating reports, Panorama queries the Log Collectors for log information, providing you visibility into all the network activity that your firewalls monitor. https://docs.paloaltonetworks.com/panorama/10-2/panorama-admin/panorama-overview/centralized-logging-and-reporting/managed-collectors-and-collector-groups A Collector Group is 1 to 16 managed collectors that operate as a single logical log collection unit. Therefore must be B and C which make the most sense

19. Question 19 of 25

    As a best practice, which URL category should you target first for SSL decryption?

    • AHealth and Medicine
    • BHigh Risk
    • COnline Storage and Backup
    • DFinancial Services

    Show answer

    Correct answer: B

    How others answered

    • B88%

    Explanation

    Plan to decrypt the riskiest traffic first (URL Categories most likely to harbor malicious traffic, such as gaming or high-risk) and then decrypt more as you gain experience. Alternatively, decrypt the URL Categories that don’t affect your business first (if something goes wrong, it won’t affect business), for example, news feeds. - Taken from PANOS10 best practices found in https://docs.paloaltonetworks.com/best-practices/10-0/decryption-best-practices/decryption-best-practices/plan-ssl-decryption-best-practice-deployment

    Adapted from community discussion by Jheax · 2023-04-30 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    View community discussion4

    Candidate context

    Question 19 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNSE or CertExamHQ.

    1. J

       Jheax

       2023-04-30

       Selected B2 upvotes

       Plan to decrypt the riskiest traffic first (URL Categories most likely to harbor malicious traffic, such as gaming or high-risk) and then decrypt more as you gain experience. Alternatively, decrypt the URL Categories that don’t affect your business first (if something goes wrong, it won’t affect business), for example, news feeds. - Taken from PANOS10 best practices found in https://docs.paloaltonetworks.com/best-practices/10-0/decryption-best-practices/decryption-best-practices/plan-ssl-decryption-best-practice-deployment

    2. M

       Mucho9999

       2022-12-29

       4 upvotes

       The test is based off of 10.0 High risk is the first to decrypt. https://docs.paloaltonetworks.com/best-practices/10-0/decryption-best-practices/decryption-best-practices/plan-ssl-decryption-best-practice-deployment.html

    3. T

       TAKUM1y

       2023-10-16

       Selected B3 upvotes

       https://docs.paloaltonetworks.com/best-practices/10-2/decryption-best-practices/decryption-best-practices/plan-ssl-decryption-best-practice-deployment

    4. D

       datz

       2023-05-28

       2 upvotes

       Interestingly Both seems to be BPA: This answer might have 2 answers in the exam. Create policy to decrypt the rest of the traffic by configuring SSL Forward Proxy, SSL Inbound Inspection, and SSH Proxy rules. Always decrypt the online-storage-and-backup, web-based-email, web-hosting, personal-sites-and-blogs, content-delivery-networks, and high-risk URL categories. https://docs.paloaltonetworks.com/best-practices/10-1/decryption-best-practices/decryption-best-practices/deploy-ssl-decryption-using-best-practices

20. Question 20 of 25

    Which type of interface does a firewall use to forward decrypted traffic to a security chain for inspection?

    • ALayer 3
    • BLayer 2
    • CTap
    • DDecryption Mirror

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    Decryption Broker: Forwarding Interfaces A firewall enabled as a decryption broker uses a pair of dedicated Layer 3 interfaces to forward decrypted traffic to a security chain for inspection. The decryption forwarding interfaces must be assigned to a brand new virtual router https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/decryption/decryption-broker/decryption-broker-concepts/decryption-broker-forwarding-interfaces

    Adapted from community discussion by UFanat · 2022-12-12 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    View community discussion4

    Candidate context

    Question 20 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNSE or CertExamHQ.

    1. U

       UFanat

       2022-12-12

       Selected A3 upvotes

       Decryption Broker: Forwarding Interfaces A firewall enabled as a decryption broker uses a pair of dedicated Layer 3 interfaces to forward decrypted traffic to a security chain for inspection. The decryption forwarding interfaces must be assigned to a brand new virtual router https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/decryption/decryption-broker/decryption-broker-concepts/decryption-broker-forwarding-interfaces

    2. M

       Marcyy

       2022-06-12

       4 upvotes

       Initially thought it was D but A is correct. Configure security chain devices with Layer 3 interfaces to connect to the security chain network. These Layer 3 interfaces must have an assigned IP address and subnet mask. https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/decryption/decryption-broker/security-chain-layer-3-guidelines.html

    3. T

       TAKUM1y

       2023-04-22

       Selected A3 upvotes

       https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/decryption/decryption-broker/decryption-broker-concepts/decryption-broker-security-chain-layer-3#id182QM0B0S9D

    4. D

       DavidBackham2020

       2022-07-15

       2 upvotes

       This is a shitty question. Assuiming, the firewall is decrypting the traffic, I would go with D: https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/decryption/decryption-concepts/decryption-mirroring.html Assuming the firewall is part of a Security Chain and the traffic is already decrypted (not decrypted on the firewall), I would go with A: https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-networking-admin/network-packet-broker/configure-routed-layer-3-security-chains

21. Question 21 of 25

    The manager of the network security team has asked you to help configure the company's Security Profiles according to Palo Alto Networks best practice. As part of that effort, the manager has assigned you the Vulnerability Protection profile for the Internet gateway firewall. Which action and packet-capture setting for items of high severity and critical severity best matches Palo Alto Networks best practice?

    • Aaction 'reset-server' and packet capture 'disable'
    • Baction 'default' and packet capture 'single-packet'
    • Caction 'reset-both' and packet capture 'extended-capture'
    • Daction 'reset-both' and packet capture 'single-packet'

    Show answer

    Correct answer: D

    How others answered

    • D70%
    • C30%

    Only 70% agreed on this answer — treat it as contested rather than settled.

    Explanation

    answer is C "Enable extended-capture for critical, high, and medium severity events and single-packet capture for low severity events. " https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-web-interface-help/objects/objects-security-profiles-vulnerability-protection

    Adapted from community discussion by mysteryzjoker · 2022-09-12 · 24 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    View community discussion4

    Candidate context

    Question 21 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNSE or CertExamHQ.

    1. M

       mysteryzjoker

       2022-09-12

       24 upvotes

       answer is C "Enable extended-capture for critical, high, and medium severity events and single-packet capture for low severity events. " https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-web-interface-help/objects/objects-security-profiles-vulnerability-protection

    2. S

       secdaddy

       2022-10-12

       5 upvotes

       See the best practices document (kudos to GBD35055 for the URL) : The best practice Anti-Spyware profile retains the default Action to reset the connection when the firewall detects a medium, high, or critical severity threat, and enables single packet capture (PCAP) for those threats. https://docs.paloaltonetworks.com/best-practices/10-2/data-center-best-practices/data-center-best-practice-security-policy/how-to-create-data-center-best-practice-security-profiles/create-the-data-center-best-practice-anti-spyware-profile

    3. B

       Betty2022

       2023-08-06

       Selected D3 upvotes

       D is correct Question asks for Best Practice Internet Gateway Vulnerability Protection Profile. https://docs.paloaltonetworks.com/best-practices/internet-gateway-best-practices/best-practice-internet-gateway-security-policy/create-best-practice-security-profiles Change the Action in the three brute force rules to reset-both and Packet Capture to single-packet to transition from alerting on brute-force attack events to blocking them. Consolidate critical, high, and medium severity events for servers and clients into one rule. Set the Action to reset-both and set Packet Capture to single-packet. This simplifies the profile and works because the profile uses the same action and the same packet capture settings for these severities.

    4. G

       GBD35055

       2022-10-06

       4 upvotes

       D is correct. https://docs.paloaltonetworks.com/best-practices/9-1/internet-gateway-best-practices/best-practice-internet-gateway-security-policy/create-best-practice-security-profiles

22. Question 22 of 25

    What is considered the best practice with regards to zone protection?

    • AUse separate log-forwarding profiles to forward DoS and zone threshold event logs separately from other threat logs
    • BReview DoS threat activity (ACC > Block Activity) and look for patterns of abuse
    • CSet the Alarm Rate threshold for event-log messages to high severity or critical severity
    • DIf the levels of zone and DoS protection consume too many firewall resources, disable zone protection

    Show answer

    Correct answer: A

    How others answered

    • A83%

    Explanation

    A Disabling zone protection because not enough resources is hardly best practices. Best practice would be to size the appliance accordingly in the first place and so make D obsolete. Then A is correct. https://docs.paloaltonetworks.com/best-practices/dos-and-zone-protection-best-practices/dos-and-zone-protection-best-practices/deploy-dos-and-zone-protection-using-best-practices

    Adapted from community discussion by lol12 · 2023-06-23 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    View community discussion4

    Candidate context

    Question 22 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNSE or CertExamHQ.

    1. L

       lol12

       2023-06-23

       Selected A3 upvotes

       A Disabling zone protection because not enough resources is hardly best practices. Best practice would be to size the appliance accordingly in the first place and so make D obsolete. Then A is correct. https://docs.paloaltonetworks.com/best-practices/dos-and-zone-protection-best-practices/dos-and-zone-protection-best-practices/deploy-dos-and-zone-protection-using-best-practices

    2. C

       certprep2021

       2023-09-08

       Selected A3 upvotes

       https://docs.paloaltonetworks.com/best-practices/dos-and-zone-protection-best-practices/dos-and-zone-protection-best-practices/follow-post-deployment-dos-and-zone-protection-best-practices "For easier management, use separate log forwarding profiles to forward DoS and zone threshold event logs separately from other Threat logs."

    3. A

       al12345

       2023-03-20

       Selected A3 upvotes

       https://docs.paloaltonetworks.com/best-practices/10-1/dos-and-zone-protection-best-practices/dos-and-zone-protection-best-practices/deploy-dos-and-zone-protection-using-best-practices Log Forwarding—For easier management, forward DoS logs separately from other Threat logs directly to administrators via email and to a log server.

    4. 3

       34f7d3a

       2024-06-14

       Selected A2 upvotes

       Log Forwarding—For easier management, forward DoS logs separately from other Threat logs directly to administrators via email and to a log server. - https://docs.paloaltonetworks.com/best-practices/dos-and-zone-protection-best-practices/dos-and-zone-protection-best-practices/deploy-dos-and-zone-protection-using-best-practices

23. Question 23 of 25

    Given the following snippet of a WildFire submission log, did the end-user get access to the requested information and why or why not?

    

    • ANo, because WildFire classified the severity as ג€highג€
    • BYes, because the action is set to ג€allowג€
    • CNo, because WildFire categorized a file with the verdict ג€maliciousג€
    • DYes, because the action is set to ג€alertג€

    Show answer

    Correct answer: B

    How others answered

    • B62%
    • C24%

    Only 62% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Here are my thoughts, but I don't have a wildfire license so I cannot confirm in the lab: 1. From https://docs.paloaltonetworks.com/wildfire/9-1/wildfire-admin/monitor-wildfire-activity/about-wildfire-logs-and-reporting - we learn that the action column tells us whether the firewall allowed or blocked the file. So the file was not blocked by the firewall (either allow or alert). Keep in mind that the wildfire submission and verdict doesn't happen in real time, so the action cannot be determined by verdict as this is at least 5 minutes later. 2. Which rows in the image apply to the question? I *think* that the last 2 'type = file' are not relevant, not sure if they are even wildfire items, so this leaves the the 5 'wildfire' rows each with action=allow. 3. I also *think* that files with an earlier verdict of malicious would have found their way into the virus pattern database.

    Adapted from community discussion by djedeen · 2023-07-23 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • live.paloaltonetworks.com documentation
    • live.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    View community discussion4

    Candidate context

    Question 23 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNSE or CertExamHQ.

    1. D

       djedeen

       2023-07-23

       Selected B4 upvotes

       Here are my thoughts, but I don't have a wildfire license so I cannot confirm in the lab: 1. From https://docs.paloaltonetworks.com/wildfire/9-1/wildfire-admin/monitor-wildfire-activity/about-wildfire-logs-and-reporting - we learn that the action column tells us whether the firewall allowed or blocked the file. So the file was not blocked by the firewall (either allow or alert). Keep in mind that the wildfire submission and verdict doesn't happen in real time, so the action cannot be determined by verdict as this is at least 5 minutes later. 2. Which rows in the image apply to the question? I *think* that the last 2 'type = file' are not relevant, not sure if they are even wildfire items, so this leaves the the 5 'wildfire' rows each with action=allow. 3. I also *think* that files with an earlier verdict of malicious would have found their way into the virus pattern database.

    2. G

       GohanF2

       2023-08-11

       3 upvotes

       Answer is B. With the Wildfire subscription you can have Inline Machine Learning for further analysis of the threat samples and the time for getting a verdict of the sample is within the same day but between 10 t 15 min. With no license, you can still get the verdict but within 24 hrs. However, the verdict of Wildfire is independent of the action of the security rule. if it is set to alert or allow, it will allow the traffic even if the verdict is malicious due that is not instant process ( which means in real -time the traffic won't get block ) now , this is a nasty question due that the columns has file and wildfire , for the wildfire rows , we have allow as an action and " allow" doesn't log any of the traffic but alert yes. I'll stick with B

    3. W

       Whizdhum

       2024-06-16

       Selected B2 upvotes

       Answer is B. The submission logs include details about a given sample, including the following information: 1) The Verdict column indicates whether the sample is benign, malicious, phishing, or grayware. 2) The Action column indicates whether the firewall allowed or blocked the sample. 3) The Severity column indicates how much of a threat a sample poses to an organization using the following values: critical, high, medium, low, and informational. The values for the severity levels are determined by a combination of verdict and action values. For example, High is a result of a malicious sample with the action set to allow.

    4. D

       duckduckgooo

       2023-10-04

       4 upvotes

       Going to go with B https://live.paloaltonetworks.com/t5/general-topics/wildfire-submission-entries-with-severity-high-showing-action/td-p/143516

24. Question 24 of 25

    An administrator needs to assign a specific DNS server to one firewall within a device group. Where would the administrator go to edit a template variable at the device level?

    • APDF Export under Panorama > templates
    • BVariable CSV export under Panorama > templates
    • CManaged Devices > Device Association
    • DManage variables under Panorama > templates

    Show answer

    Correct answer: D

    How others answered

    • D70%
    • B30%

    Only 70% agreed on this answer — treat it as contested rather than settled.

    Explanation

    You can define variables (PanoramaTemplates) for templates and template stacks or you can edit existing variables for an individual device (PanoramaManaged DevicesSummary). Variables are configuration components defined on the template or template stack that provide flexibility and re-usability when you use Panorama to manage firewall configurations. You can use variables to replace: An IP address (includes IP Netmask, IP Range, and FQDN) in all areas of the configuration. Interfaces in an IKE Gateway configuration (Interface) and in an HA configuration (Group ID). Configuration elements in your SD-WAN configuration (AS Number, QoS Profile, Egress Max, Link Tag). https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-web-interface-help/panorama-web-interface/panorama-templates/panorama-templates-template-variable

    Adapted from community discussion by al12345 · 2022-09-23 · 7 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    View community discussion4

    Candidate context

    Question 24 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNSE or CertExamHQ.

    1. A

       al12345

       2022-09-23

       Selected D7 upvotes

       You can define variables (PanoramaTemplates) for templates and template stacks or you can edit existing variables for an individual device (PanoramaManaged DevicesSummary). Variables are configuration components defined on the template or template stack that provide flexibility and re-usability when you use Panorama to manage firewall configurations. You can use variables to replace: An IP address (includes IP Netmask, IP Range, and FQDN) in all areas of the configuration. Interfaces in an IKE Gateway configuration (Interface) and in an HA configuration (Group ID). Configuration elements in your SD-WAN configuration (AS Number, QoS Profile, Egress Max, Link Tag). https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-web-interface-help/panorama-web-interface/panorama-templates/panorama-templates-template-variable

    2. P

       PaloSteve

       2023-07-27

       5 upvotes

       "you can edit existing variables for an individual device (Panorama> Managed Devices> Summary". That is not the Panorama> templates location, which just seems to be where you can create and find the templates, but not edit them. So I think Bryan is right with Answer B. Updated link for that article is- https://docs.paloaltonetworks.com/panorama/11-0/panorama-admin/manage-firewalls/manage-templates-and-template-stacks/import-and-overwrite-existing-template-stack-variables. Export the existing template stack variables. Select Panorama> Templates and select a template or template stack. Select Variable CSV> Export. Open the exported CSV. Edit the CSV file. Import the CSV file back to same place as the export and Commit. NOTE: When you push a device group configuration with references to template or template stack variables, you must Edit Selections and Include Device and Network Templates.

    3. J

       juan_L

       2022-09-11

       4 upvotes

       Regarding the shared link, the correct is D: Edit Existing Template Variable You can edit a template variable definition for a template or template stack at any point after the variable is created (PanoramaTemplates). Manage the template variables to select a variable and edit available values as needed.

    4. B

       BryanSalazar

       2023-06-11

       4 upvotes

       The answer is B: The only way to edit the variable is by importing it as CSV https://docs.paloaltonetworks.com/panorama/9-1/panorama-admin/manage-firewalls/manage-templates-and-template-stacks/import-and-overwrite-existing-template-stack-variables

25. Question 25 of 25

    Select 2

    A customer has an application that is being identified as unknown-tcp for one of their custom PostgreSQL database connections. Which two configuration options can be used to correctly categorize their custom database application? (Choose two.)

    • AApplication Override policy.
    • BSecurity policy to identify the custom application.
    • CCustom application.
    • DCustom Service object.

    Show answer

    Correct answer: A, C

    How others answered

    • AC54%
    • BC46%

    Only 54% agreed on this answer — treat it as contested rather than settled.

    Explanation

    B and C is correct, if we are choosing C custom application then in the security policy we need to choose Custom Application.

    Adapted from community discussion by dhanala · 2020-07-05 · 21 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    View community discussion4

    Candidate context

    Question 25 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNSE or CertExamHQ.

    1. D

       dhanala

       2020-07-05

       21 upvotes

       B and C is correct, if we are choosing C custom application then in the security policy we need to choose Custom Application.

    2. M

       Moomyao

       2020-06-30

       7 upvotes

       The correct is B and C. Application override policy does not let you classify an application but it stops at layer 4.

    3. K

       Kane002

       2021-11-17

       6 upvotes

       A and C. It's unknown-tcp, you don't have the signature. You need an application override as a temporary fix or a custom application with the signature to permanently solve it.

    4. G

       gondolf

       2022-04-24

       6 upvotes

       As of april 2022, the correct answer for this question is A and C according to Palo Alto's PCNSE practice exam on the Beacon portal.

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNSE practice, question 1 of 25