PCNSE Multiple Select — 10 Questions

Question 1

Which TWO statements are true about TLS version 1.3 support in Palo Alto Networks decryption?

Accepted Answer

TLS 1.3 decryption is supported in PAN-OS 9.0 and later.. TLS 1.3 decryption support was introduced in PAN-OS 9.0, enabling the firewall to decrypt and inspect TLS 1.3 traffic. This allows organizations to maintain visibility into encrypted traffic using the latest TLS protocol without requiring additional hardware or software upgrades beyond the PAN-OS version.

Answer

TLS 1.3 decryption uses the same proxy ciphers as TLS 1.2.

Answer

TLS 1.3 decryption requires the firewall to have a hardware security module (HSM).

Answer

TLS 1.3 decryption is only supported for inbound inspection (SSL Inbound Inspection).

Question 2

Which TWO of the following are mandatory requirements for forming an active/passive HA pair between two Palo Alto Networks firewalls? (Choose exactly two.)

Accepted Answer

Both firewalls must be the same hardware model.. For an active/passive HA pair, both firewalls must be the same hardware model to ensure identical hardware resources (e.g., CPU, memory, ASICs) and port layouts. This is a mandatory requirement because the HA synchronization process relies on matching hardware capabilities to avoid configuration mismatches and failover failures.

Answer

Both firewalls must have the same number of active VLANs.

Answer

Both firewalls must use the same management interface IP address.

Answer

Both firewalls must have identical license subscriptions.

Question 3

Which TWO factors should be considered when designing an authentication enforcement strategy? (Choose two.)

Accepted Answer

Application type. Authentication enforcement in Palo Alto Networks is configured via Authentication Policies, which support match criteria such as source user, source IP, destination IP, application, service/port, and schedule (time of day). While many factors are possible, the most important considerations when designing an authentication enforcement strategy are the type of application being accessed (to determine if authentication is required) and the user group membership (to apply different authentication requirements to different user groups). Time of day and source IP are secondary factors that can be used for fine-tuning but are not primary design factors.

Answer

Time of day

Answer

Source IP address

Answer

Destination port

Question 4

Which TWO of the following are valid methods to collect logs from a Palo Alto Networks firewall for reporting and forensics?

Accepted Answer

Local storage on the firewall's management disk (MP) and export via the web interface.. The firewall's management plane (MP) includes a local log storage partition that can hold logs (e.g., traffic, threat, system) and allows export via the web interface (Monitor > Logs > Export). This provides a built-in method for log collection without requiring external infrastructure. Option E is correct because syslog (UDP/TCP, RFC 3164 or RFC 5424) is a standard protocol supported by Palo Alto firewalls to forward all log types to an external collector for centralized reporting and forensics.

Answer

Export to Microsoft Azure Sentinel directly without any intermediate.

Answer

SNMPv3 traps for all log types.

Answer

Email alerts for all threat logs.

Question 5

Which THREE are valid methods to provide redundancy for outbound internet traffic in a Palo Alto Networks firewall?

Accepted Answer

Active/Passive HA with floating IP. Active/Passive HA with floating IP (Option A) is valid because the passive firewall assumes the active firewall's IP address upon failover, ensuring outbound traffic continues via the same default gateway. ECMP with equal cost routes (Option B) distributes outbound traffic across multiple paths and provides redundancy by automatically failing over if one path is lost. Policy Based Forwarding combined with path monitoring (Option C) allows you to define forwarding policies based on traffic attributes and monitor path health, redirecting traffic if a monitored path fails.

Answer

Active/Passive HA with virtual router synchronization

Answer

Use of multiple public IPs with NAT rules

Question 6

Which TWO configurations are required on a GlobalProtect portal to enable automatic tunnel configuration for macOS clients? (Choose two.)

Accepted Answer

Enable Automatic Tunnel. Options B and E are correct. To enable automatic tunnel configuration for macOS clients, the GlobalProtect portal must have 'Enable Automatic Tunnel' checked and a tunnel interface specified. This allows the portal to push the necessary tunnel settings to macOS clients. Option A (GlobalProtect client package) is used to distribute the client, not specifically for automatic tunnel configuration. Option C (Gateway IP pool) is a gateway setting, not a portal configuration. Option D (PanGPS) is a helper service for GPS location, not required for automatic tunnel.

Answer

GlobalProtect client package assigned to macOS

Answer

Gateway IP Pool configured

Answer

PanGPS (Pan GlobalProtect Service) enabled

Question 7

A systems administrator needs to configure log forwarding to an external syslog server for Security policies. Which two actions are required to achieve this? (Choose two.)

Accepted Answer

Create a syslog server profile under Device > Server Profiles > Syslog.. A syslog server profile must first be created under Device > Server Profiles > Syslog to define the external syslog server's IP address, port (default 514), and transport protocol (UDP/TCP). This profile is a prerequisite for any log forwarding to an external syslog server.

Answer

Create an SNMP trap profile under Device > Server Profiles > SNMP Trap.

Answer

Directly apply the syslog server profile to each Security policy rule.

Answer

Enable log forwarding under the firewall's Device > Setup > Logging and Reporting settings.

Question 8

Which TWO of the following are prerequisites for configuring high availability on Palo Alto Networks firewalls? (Choose two.)

Accepted Answer

Both firewalls must run the same software version. Both firewalls in a high availability (HA) pair must run the same PAN-OS software version to ensure configuration synchronization and stateful failover compatibility. The HA synchronization process uses the HA2 link to replicate configurations and session state, and version mismatches can cause sync failures or unexpected behavior during failover.

Answer

Both firewalls must have management IPs in different subnets

Answer

Both firewalls must have the same interface naming

Answer

Both firewalls must have the same licenses

Question 9

Which THREE are common causes of high CPU utilization on a Palo Alto Networks firewall? (Choose three.)

Accepted Answer

Large number of dynamic IP address group lookups.. A large number of dynamic IP address group lookups can cause high CPU utilization because each lookup requires the firewall to evaluate the dynamic group membership in real time, often involving LDAP or other directory queries. This process is computationally expensive, especially when policies trigger frequent lookups for every new session, leading to sustained CPU spikes.

Answer

Insufficient disk space on the log partition.

Answer

BGP prefix flapping causing route recalculations.

Question 10

An administrator is troubleshooting low throughput for a business-critical application that is identified as web-browsing instead of the custom app. The firewall is in inline mode. Which THREE potential causes should be investigated?

Accepted Answer

The application signature is outdated.. If the application signature is outdated, the firewall may fail to identify the custom application correctly, instead classifying it as web-browsing. App-ID relies on regularly updated signatures to match application traffic; an outdated signature can cause misidentification, leading to incorrect policy application and reduced throughput for the intended application.

Answer

SSL decryption is not enabled.

Answer

The firewall is in tap mode.