How many Select Two (Multi-Select) Questions questions are on this page?

This page has 20 Select Two (Multi-Select) Questions scenario questions for the PCNSE exam, each with detailed explanations and wrong-answer analysis.

How should I approach PCNSE scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Palo Alto Networks Certified Network Security Engineer PCNSE questions

Scenario-based practice

Select Two (Multi-Select) Questions

Practise Palo Alto Networks Certified Network Security Engineer PCNSE practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

PCNSE

exam code

Palo Alto Networks

vendor

Scenario guide

How to approach select two (multi-select) questions

Multi-select questions tell you to 'Choose TWO' or 'Choose THREE'. Getting partial credit is not a thing — you must select all correct answers with no incorrect ones. The stem always states how many to choose, so trust it. These questions require precision, not best-guess elimination.

Quick answer

Select Two (Multi-Select) Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1hardmulti select

Full question →

Which TWO statements are true about TLS version 1.3 support in Palo Alto Networks decryption?

A
TLS 1.3 decryption uses the same proxy ciphers as TLS 1.2.
Why wrong: TLS 1.3 uses completely different cipher suites and key exchange mechanisms.
B
TLS 1.3 decryption is supported in PAN-OS 9.0 and later.
Palo Alto Networks introduced TLS 1.3 decryption starting from PAN-OS 9.0.
C
TLS 1.3 decryption requires the firewall to have a hardware security module (HSM).
Why wrong: No HSM is required; decryption is done via software.
D
TLS 1.3 decryption is only supported for inbound inspection (SSL Inbound Inspection).
Why wrong: TLS 1.3 decryption is supported for both forward proxy and inbound inspection.
E
TLS 1.3 decryption is supported for both forward proxy and inbound inspection.
Both decryption types support TLS 1.3.

Select Two (Multi-Select) Questions

How to approach select two (multi-select) questions

Quick answer

Related PCNSE topic practice pages

Manage, Monitor and Operate practice questions

Securing Traffic and App-ID practice questions

Securing Users and Applications with Authentication practice questions

Decryption and SSL Inspection practice questions

Managing Troubleshooting and High Availability practice questions

Deploy and Configure Firewalls practice questions

Core Concepts and Architecture practice questions

Secure Access and VPN practice questions

Troubleshoot practice questions

PCNSE fundamentals practice questions

PCNSE scenario practice questions

PCNSE troubleshooting practice questions

Practice scenarios

Which TWO statements are true about TLS version 1.3 support in Palo Alto Networks decryption?

Which TWO of the following are mandatory requirements for forming an active/passive HA pair between two Palo Alto Networks firewalls? (Choose exactly two.)

Which TWO factors should be considered when designing an authentication enforcement strategy? (Choose two.)

Which TWO of the following are valid methods to collect logs from a Palo Alto Networks firewall for reporting and forensics?

Which THREE are valid methods to provide redundancy for outbound internet traffic in a Palo Alto Networks firewall?

Which TWO configurations are required on a GlobalProtect portal to enable automatic tunnel configuration for macOS clients? (Choose two.)

A systems administrator needs to configure log forwarding to an external syslog server for Security policies. Which two actions are required to achieve this? (Choose two.)

Which TWO of the following are prerequisites for configuring high availability on Palo Alto Networks firewalls? (Choose two.)

Which THREE are common causes of high CPU utilization on a Palo Alto Networks firewall? (Choose three.)

An administrator is troubleshooting low throughput for a business-critical application that is identified as web-browsing instead of the custom app. The firewall is in inline mode. Which THREE potential causes should be investigated?

Based on the exhibit, which THREE conclusions can be drawn?

Exhibit

Which TWO commands can be used to check the status of an IPSec tunnel on a Palo Alto Networks firewall?

Which TWO methods can be used to export logs from Panorama to an external system? (Choose two.)

Which THREE factors are considered when a Palo Alto Networks firewall performs application identification (App-ID) on a session? (Choose three.)

Which TWO of the following are valid considerations when configuring Log Forwarding for Panorama? (Choose two.)

Which TWO actions can help App-ID correctly identify a custom application that communicates over TCP port 8443 using SSL/TLS with a known internal hostname?

Which two are prerequisites for deploying a Palo Alto Networks firewall in a high-availability active/passive pair? (Choose two.)

Which TWO of the following are minimum required configurations to enable User-ID on a Palo Alto Networks firewall? (Choose exactly two.)

A security administrator needs to block an application that uses multiple ports, including dynamic ports. Which of the following methods can be used to block this application using App-ID? (Choose two.)