PCNSE試験無料問題集（375題）「Palo Alto Networks Certified Network Security Engineer 認定」

出題：1

An engineer must configure a new SSL decryption deployment.
Which profile or certificate is required before any traffic that matches an SSL decryption rule is decrypted?

A. A Decryption profile must be attached to the Decryption policy that the traffic matches.

B. There must be a certificate with both the Forward Trust option and Forward Untrust option selected.

C. A Decryption profile must be attached to the Security policy that the traffic matches.

D. There must be a certificate with only the Forward Trust option selected.

正解：B 解答を投票する

出題：2

An engineer needs to collect User-ID mappings from the company's existing proxies.
What two methods can be used to pull this data from third party proxies? (Choose two.)

A. Client probing

B. Server Monitoring

C. Syslog

D. XFF Headers

正解：C,D 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：3

An engineer troubleshooting a VPN issue needs to manually initiate a VPN tunnel from the CLI Which CLI command can the engineer use?

A. test vpn flow

B. test vpn ike-sa

C. test vpn tunnel

D. test vpn gateway

正解：B 解答を投票する

出題：4

A security engineer is informed that the vulnerability protection profile of their on-premises Palo Alto Networks firewall is triggering on a common Threat ID, and which has been determined to be a false positive.
The engineer is asked to resolve the issue as soon as possible because it is causing an outage for a critical service The engineer opens the vulnerability protection profile to add the exception, but the Threat ID is missing.
Which action is the most operationally efficient for the security engineer to find and implement the exception?

A. Review high severity system logs to identify why the threat is missing in Vulnerability Profile Exceptions.

B. Review traffic logs to add the exception from there.

C. Open a support case.

D. Select 'Show all signatures' within the Vulnerability Protection Profile under 'Exceptions'.

正解：D 解答を投票する

出題：5

A firewall administrator is changing a packet capture filter to troubleshoot a specific traffic flow Upon opening the newly created packet capture, the administrator still sees traffic for the previous fitter What can the administrator do to limit the captured traffic to the newly configured filter?

A. In the GUI under Monitor > Packet Capture > Manage Filters under the Non-IP field, select "exclude"

B. In the GLH under Monitor > Packet Capture > Manage Filters under Ingress Interface select an interface

C. Command line > debug dataplane packet-diag clear filter-marked-session all

D. Command line> debug dataplane packet-diag clear filter all

正解：D 解答を投票する

出題：6

Given the following snippet of a WildFire submission log did the end-user get access to the requested information and why or why not?

A. No, because the severity is high and the verdict is malicious.

B. No, because this is an example from a defeated phishing attack

C. Yes, because the action is set to allow.

D. Yes, because the action is set to alert

正解：C 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：7

An administrator is attempting to create policies tor deployment of a device group and template stack. When creating the policies, the zone drop down list does not include the required zone.
What must the administrator do to correct this issue?

A. Specify the target device as the master device in the device group

B. Enable "Share Unused Address and Service Objects with Devices" in Panorama settings

C. Add the template as a reference template in the device group

D. Add a firewall to both the device group and the template

正解：C 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：8

A firewall administrator is changing a packet capture filter to troubleshoot a specific traffic flow. Upon opening the newly created packet capture, the administrator still sees traffic for the previous filter.
What can the administrator do to limit the captured traffic to the newly configured filter?

A. In the GUI under Monitor > Packet Capture > Manage Filters, under Ingress Interface, select an interface.

B. In the GUI under Monitor > Packet Capture > Manage Filters, under the Non-IP field, select "exclude."

C. Command line: > debug dataplane packet-diag clear filter all

D. Command line: > debug dataplane packet-diag clear filter-marked-session all

正解：C 解答を投票する

出題：9

An administrator is using Panorama to manage multiple firewalls. After upgrading all devices to the latest PAN-OS software, the administrator enables log forwarding from the firewalls to Panorama.
However, pre-existing logs from the firewalls are not appearing in Panorama.
Which action should be taken to enable the firewalls to send their pre-existing logs to Panorama?

A. Use the ACC to consolidate the logs.

B. Use the scp logdb export command.

C. Export the log database.

D. Use the import option to pull logs.

正解：B 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：10

A network administrator is trying to prevent domain username and password submissions to phishing sites on some allowed URL categories Which set of steps does the administrator need to take in the URL Filtering profile to prevent credential phishing on the firewall?

A. Choose the URL categories in the User Credential Submission column and set action to block Select the User credential Detection tab and select Use Domain Credential Filter Commit

B. Choose the URL categories in the User Credential Submission column and set action to block Select the URL filtering settings and enable Domain Credential Filter Commit

C. Choose the URL categories in the User Credential Submission column and set action to block Select the User credential Detection tab and select use IP User Mapping Commit

D. Choose the URL categories on Site Access column and set action to block Click the User credential Detection tab and select IP User Mapping Commit

正解：A 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：11

Which three split tunnel methods are supported by a globalProtect gateway? (Choose three.)

A. Source Domain

B. Destination user/group

C. video streaming application

D. Destination Domain

E. Client Application Process

F. URL Category

正解：C,D,E 解答を投票する

出題：12

An engineer is designing a deployment of multi-vsys firewalls.
What must be taken into consideration when designing the device group structure?

A. Multiple vsys and firewalls can be assigned to a device group, and a multi-vsys firewall can have each vsys in a different device group.

B. Only one vsys or one firewall can be assigned to a device group, except for a multi-vsys firewall, which must have all its vsys in a single device group.

C. Multiple vsys and firewalls can be assigned to a device group, and a multi-vsys firewall must have all its vsys in a single device group.

D. Only one vsys or one firewall can be assigned to a device group, and a multi-vsys firewall can have each vsys in a different device group.

正解：A 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

PCNSE試験無料問題集「Palo Alto Networks Certified Network Security Engineer 認定」