PCNSE Practice Questions
Prepare for PCNSE with more than an answer.
- Exam fee
- $175 USD
- Level
- Professional
- Valid for
- 2 years
Domains covered on the exam 5
- Planning and Core Concepts19%
- Deploy and Configure32%
- Deploy and Configure Firewalls Using Panorama13%
- Manage and Operate16%
- Troubleshooting20%
- 1
If a template stack is assigned to a device and the stack includes three templates with overlapping settings, which settings are published to the device when the template stack is pushed?
Show answer details
Correct answer: D
D
- 2
SAML SLO is supported for
Which two firewall features? (Choose two.)
Show answer details
- 3
If the firewall has the following link monitoring configuration,
What will cause a failover?
Show answer details
Correct answer: C
C
- 4
A firewall administrator has been asked to configure a Palo Alto Networks NGFW to prevent against compromised hosts trying to phone-home or beacon out to external command-and-control (C2) servers.
Which Security Profile type will prevent these behaviors?
Show answer details
Correct answer: D
- 5
An administrator is troubleshooting an issue where an internal web application is intermittently inaccessible to users. The traffic passes through a PA-5260 in an Active/Passive HA pair. During the issue, the administrator runs
show session all filter source destinationand observes that the session has a flag of 'NS'. What does the 'NS' flag indicate and what is a likely cause?sequenceDiagram participant User participant Active_FW as Active Firewall participant Passive_FW as Passive Firewall participant Web_Server as Web Server User->>Active_FW: SYN Active_FW->>Web_Server: SYN Note over Active_FW,Passive_FW: Session created, state synchronized Web_Server->>Active_FW: SYN/ACK Active_FW->>User: SYN/ACK User->>Active_FW: ACK (Handshake complete) loop Data Transfer User->>Active_FW: HTTP Request Active_FW->>Web_Server: HTTP Request end Note right of Web_Server: Server fails to respond User->>Active_FW: New SYN (Retransmission) Note left of Active_FW: Firewall sees new SYN for existing session Active_FW-->>User: No response (Session state is NS)Show answer details
Correct answer: D
The 'NS' flag in a session's details stands for Non-SYN TCP. This flag is set when the firewall receives a TCP packet that is not a SYN packet, but it has no existing session matching the packet's parameters. A common cause for this is asymmetric routing, where the initial SYN packet goes through the firewall, but the SYN/ACK response from the server returns via a different path, bypassing the firewall. When the client then sends the next packet (e.g., an ACK or PSH), the firewall sees it as a non-SYN packet for an unknown session and drops it, leading to intermittent connectivity.
- 6
Which three authentication factors does PAN-OS® software support for MFA? (Choose three.)
Show answer details
Correct answer: B, D, E
B,D,E--Reference: https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/authentication/configure-multi-factor-authentication
- 7
Which two subscriptions are available when configuring Panorama to push dynamic updates to connected devices? (Choose two.)
Show answer details
Correct answer: A, C
- 8
An administrator sees several inbound sessions identified as unknown-tcp in the Traffic logs. The administrator determines that these sessions are from external users accessing the company’s proprietary accounting application. The administrator wants to reliably identify this traffic as their accounting application and to scan this traffic for threats.
Which option would achieve this result?
Show answer details
Correct answer: D
D
- 9
If an administrator does not possess a website’s certificate,
Which SSL decryption mode will allow the Palo Alto Networks NGFW to inspect traffic when users browse to HTTP(S) websites?
Show answer details
Correct answer: D
D
- 10
Which two are valid ACC GlobalProtect Activity tab widgets? (Choose two.)
Show answer details
Correct answer: A, D
