[Apr-2023] Dumps Brief Outline Of The PCNSC Exam - TroytecDumps
PCNSC Training & Certification Get Latest Paloalto Certifications and Accreditations
NEW QUESTION 19
A user's traffic traversing a Palo Alto Networks NGFW sometime can reach http//www company com At the session times out.
The NGFW has been configured with a PBF rule that the user's traffic matches when it goes to http //www company com.
How con the firewall be configured to automatically disable the PBF rule if the next hop goes down?
- A. Create and add a Monitor Profile with an action of Fail Over in the PBF rule in question.
- B. Create and add a Monitor Profile with an action of Wait Recover in the PBF rule in question.
- C. Enable and configure a Link Monitoring Profile for the external interface of the firewall.
- D. Configure path monitoring for tine next hop gateway on the default route in tin- virtual router.
Answer: A
NEW QUESTION 20
When a malware-infected host attempts to resolve a known command-and-control server, the traffic matches a security policy with DNS sinhole enabled, generating a traffic log.
What will be the destination IP Address in that log entry?
- A. The IP Address specified in the sinkhole configuration
- B. The IP Address of the command-and-control server
- C. The IP Address of one of the external DNS servers identified in the anti-spyware database
- D. The IP Address of sinkhole.paloaltonetworks.com
Answer: A
Explanation:
Explanation
https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Verify-DNS-Sinkhole-Function-is-Working/t
NEW QUESTION 21
Which administrative authentication method supports authorization by an external service?
- A. SSH keys
- B. LDAP
- C. RADIUS
- D. Certification
Answer: A
NEW QUESTION 22
Which two subscriptions are available when configuring panorama to push dynamic updates to connected devices? (Choose two.)
- A. Content-ID
- B. Application and Threats
- C. Antivirus
- D. User-ID
Answer: B,C
NEW QUESTION 23
An administrator sees several inbound sessions identified as unknown tcp in the Traffic logs. The administrator determines that these sessions are from external users accessing the company's propriety accounting application. The administrator wants to reliability identity this as their accounting application and to scan this traffic for threats.
Which option would achieve this result?
- A. Create an Application Override policy and a custom threat signature for the application.
- B. Create a custom App-ID and enable scanning on the advanced tab.
- C. Create a custom App-ID and use the "ordered condition cheek box.
- D. Create an Application Override policy
Answer: A
NEW QUESTION 24
Refer to the exhibit.
A web server in the DMZ is being mapped to a public address through DNAT.
Which Security policy rule will allow traffic to flow to the web server?
- A. Untrust (any) to Untrust (1. 1. 1. 100), web browsing - Allow
- B. Untrust (any) to DMZ (1. 1. 1. 100), web browsing - Allow
- C. Untrust (any) to DMZ (10. 1. 1. 100), web browsing - Allow
- D. Untrust (any) to Untrust (10. 1.1. 100), web browsing - Allow
Answer: A
NEW QUESTION 25
An administrator encountered problems with inbound decryption. Which option should the administrator investigate as part of triage?
- A. Root certificate imported into the firewall with "Trust" enabled
- B. Security policy rule allowing SSL to the target server
- C. importation of a certificate from an HSM
- D. firewall connectivity to a CRL
Answer: B
NEW QUESTION 26
Which virtual router feature determines if a specific destination IP address is reachable'?
- A. Heartbeat Monitoring
- B. Ping-Path
- C. Path Monitoring
- D. Failover
Answer: C
NEW QUESTION 27
An administrator wants multiple web servers in the DMZ to receive connections from the internet. Traffic destined for 206.15.22.9 port 80/TCP needs to be forwarded to the server at 10 1.22 Based on the information shown in the age, which NAT rule will forward web-browsing traffic correctly?
A)
B)
C)
D)
- A. Option D
- B. Option C
- C. Option B
- D. Option A
Answer: D
NEW QUESTION 28
Which two methods can be configured to validate the revocation status of a certificate? (Choose two)
- A. SSL /TLS Service Profile
- B. CRT
- C. CRL
- D. Cert-Validation-Profile
- E. OCSP
Answer: B,D
NEW QUESTION 29
An administrator has been asked to configure active/active HA for a pair of Palo Alto Networks NGFWs. The firewalls use layer 3 interface to send traffic to a single gateway IP for the pair.
Which configuration will enable this HA scenario?
- A. The firewalls will share the same interface IP address, and device 1 will use the floating IP if device 0 fails.
- B. The firewall do not use floating IPs in active/active HA.
- C. The two firewalls will share a single floating IP and will use gratuitous ARP to share the floating IP.
- D. Each firewall will have a separate floating IP. and priority will determine which firewall has the primary IP.
Answer: D
NEW QUESTION 30
An administrator creates a custom application containing Layer 7 signatures. The latest application and threat dynamic update is downloaded to the same NGFW. THE update contains application that matches the same traffic signatures as the customer application.
Which application should be used to identify traffic traversing the NGFW?
- A. System longs show an application errors and signature is used.
- B. Custom and downloaded application signature files are merged and are used
- C. custom application
- D. downloaded application
Answer: C
NEW QUESTION 31
An administrator needs to optimize traffic to prefer business-critical applications over non-critical applications.
QoS natively integrates with which feature to provide service quality?
- A. Content-ID
- B. App-ID
- C. port inspection
- D. certification revocation
Answer: B
NEW QUESTION 32
The firewall identified a popular application as a unknown-tcp. Which options are available to identify the application? (Choose two.)
- A. Create a customer object for the customer application server to identify the custom application.
- B. Submit an App-ID request to Palo Alto Networks.
- C. Create a Security policy to identify the customer application.
- D. Create a custom application.
Answer: A,D
NEW QUESTION 33
Which three options are supposed in HA Lite? (Choose three.)
- A. synchronization of IPsec security associations
- B. Virtual link
- C. session synchronization
- D. active/passive deployment
- E. Configuration synchronization
Answer: A,D,E
NEW QUESTION 34
......
Sample Questions for Palo Alto PCNSC Exam
What are the two Captive Portal modes? (Choose two.)
- proxy
- certificate
- web form
- transparent
- redirect
Which action is not required when multi-factor authentication and a SAML Identity Provider (IdP) are configured?
- create an Authentication Profile
- create an Authentication object
- create an Authentication policy rule
- configure NTLM settings
An Authentication policy rule has a HIP Profile. Where are the users being authenticated coming from?
- internal servers running UNIX (Solaris, HPUX, AIX, etc.)
- internal devices, such as Linux workstations
- external devices belonging to customers of the organization
- GlobalProtect connections through the internet
Certification Training for PCNSC Exam Dumps Test Engine: https://actualtests.troytecdumps.com/PCNSC-troytec-exam-dumps.html