Free Palo Alto Networks PCNSE Exam Dumps Questions & Answers

A firewall engineer is migrating port-based rules to application-based rules by using the Policy Optimizer.
The engineer needs to ensure that the new application-based rules are future-proofed, and that they will continue to match if the existing signatures for a specific application are expanded with new child applications. Which action will meet the requirement while ensuring that traffic unrelated to the specific application is not matched?

• A.  Add specific applications that are seen when creating cloned rules
• B.  Add the relevant container application when creating cloned rules
• C.  Create an application filter based on the existing application category and risk
• D.  Create a custom application and define it by the correct TCP and UDP ports

Which three methods are supported for split tunneling in the GlobalProtect Gateway? (Choose three.)

• A.  video streaming application
• B.  Source Domain
• C.  Destination user/group
• D.  Client Application Process
• E.  Destination Domain
• F.  URL Category

An engineer troubleshooting a VPN issue needs to manually initiate a VPN tunnel from the CLI Which CLI command can the engineer use?

• A.  test vpn tunnel
• B.  test vpn ike-sa
• C.  test vpn gateway
• D.  test vpn flow

A company CISO updates the business Security policy to identify vulnerable assets and services and deploy protection for quantum-related attacks. As a part of this update, the firewall team is reviewing the cryptography used by any devices they manage. The firewall architect is reviewing the Palo Alto Networks NGFWs for their VPN tunnel configurations. It is noted in the review that the NGFWs are running PAN-OS
11.2. Which two NGFW settings could the firewall architect recommend to deploy protections per the new policy? (Choose two)

• A.  IKEv2 with Hybrid Key exchange
• B.  IKEv2 with Post-Quantum Pre-shared Keys
• C.  IPsec with Hybrid ID exchange
• D.  IKEv1 only to deactivate the use of public key encryption

A network engineer has discovered that asymmetric routing is causing a Palo Alto Networks firewall to drop traffic. The network architecture cannot be changed to correct this.
Which two actions can be taken on the firewall to allow the dropped traffic permanently? (Choose two.)

• A.  # set deviceconfig setting session tcp-reject-non-syn no
• B.  > set session tcp-reject-non-syn no
• C.  Navigate to Network > Zone Protection Click AddSelect Packet Based Attack Protection > TCP/IP Drop Set "Reject Non-syn-TCP" to No Set "Asymmetric Path" to Bypass
• D.  Navigate to Network > Zone Protection Click AddSelect Packet Based Attack Protection > TCP/IP Drop Set "Reject Non-syn-TCP" to Global Set "Asymmetric Path" to Global