← Back to exam page

PCNSE – Palo Alto Networks Certified Network Security Engineer

Loading demo links...

Showing 7–9 of 20 questions

Question 7

An administrator is seeing one of the firewalls in a HA active/passive pair moved to 'suspended" state due to Non-functional loop. Which three actions will help the administrator troubleshool this issue? (Choose three.)

Select all that apply, then click Submit answer.

  • ○

    Use the CLI command show high-availability flap-statistics
  • ○

    Check the HA Link Monitoring interface cables.
  • ○

    Check the High Availability > Link and Path Monitoring settings.
  • ○

    Check High Availability > Active/Passive Settings > Passive Link State
  • ○

    Check the High Availability > HA Communications > Packet Forwarding settings.
Question 8

An engineer is deploying multiple firewalls with common configuration in Panorama.

What are two benefits of using nested device groups? (Choose two.)

Select all that apply, then click Submit answer.

Question 9

An engineer is tasked with configuring a Zone Protection profile on the untrust zone.

Which three settings can be configured on a Zone Protection profile? (Choose three.)

Select all that apply, then click Submit answer.

  • ○

    Ethernet SGT Protection
  • ○

    Protocol Protection
    Protocol Protection: Protocol protection is used to limit or block traffic that uses certain protocols or application functions. For example, a Zone Protection profile can be configured to block traffic that uses non-standard protocols, such as IP-in-IP, or to limit the number of concurrent sessions for certain protocols, such as SIP.
  • ○

    DoS Protection
    DoS Protection: DoS protection is used to protect against various types of denial-of-service (DoS) attacks, such as SYN floods, UDP floods, ICMP floods, and others. A Zone Protection profile can be configured to limit the rate of traffic for certain protocols or to drop traffic that matches specific patterns, such as malformed packets or packets with invalid headers.
  • ○

    Reconnaissance Protection
    Reconnaissance Protection: Reconnaissance protection is used to prevent attackers from gathering information about the network, such as by using port scans or other techniques. A Zone Protection profile can be configured to limit the rate of traffic for certain types of reconnaissance, such as port scans or OS fingerprinting, or to drop traffic that matches specific patterns, such as packets with invalid flags or payloads.
  • ○

    Resource Protection