Free PCNSE Practice Exam Questions

A network security engineer is attempting to peer a virtual router on a PAN-OS firewall with an external router using the BGP protocol. The peer relationship is not establishing. What command could the engineer run to see the current state of the BGP state between the two devices?

A. show routing protocol bgp summary

B. show routing protocol bgp rib-out

C. show routing protocol bgp state

D. show routing protocol bgp peer

An engineer has been given approval to upgrade their environment to the latest version of PAN-OS.
The environment consists of both physical and virtual firewalls, a virtual Panorama, and virtual log collectors.
What is the recommended order of operational steps when upgrading?

A. Upgrade the log collectors, upgrade the firewalls, upgrade Panorama

B. Upgrade the firewalls, upgrade log collectors, upgrade Panorama

C. Upgrade Panorama, upgrade the log collectors, upgrade the firewalls

D. Upgrade the firewalls, upgrade Panorama, upgrade the log collectors

C. Upgrade Panorama, upgrade the log collectors, upgrade the firewalls

Explanation: When planning an upgrade in an environment that includes Panorama, firewalls, and log collectors, it's crucial to follow the recommended sequence to ensure compatibility and minimize disruptions. Palo Alto Networks recommends the following order:
Upgrade Panorama: Start with Panorama because it's the central management platform. Upgrading Panorama first ensures that it's compatible with the new PANOS versions that the managed devices (firewalls and log collectors) will be upgraded to. Panorama must be able to support the new versions for it to manage and monitor the devices effectively.
Upgrade the log collectors: Next, upgrade the log collectors. Since log collectors work closely with Panorama to aggregate and store logs from the firewalls, they should be upgraded after Panorama to ensure compatibility. Upgrading the log collectors ensures they can handle the log formats and features introduced in the new PAN-OS version.
Upgrade the firewalls: Finally, upgrade the firewalls. The firewalls are the last components to be upgraded to ensure that they remain compatible with the management and log collection infrastructure. Upgrading the firewalls last minimizes the risk of compatibility issues with Panorama and log collectors.
This sequence ensures that all components are compatible and that the management and logging infrastructure can fully support the firewalls running the latest PAN-OS version.

An administrator needs to identify which NAT policy is being used for internet traffic. From the Monitor tab of the firewall GUI, how can the administrator identify which NAT policy is in use for a traffic flow?

A. Click Session Browser and review the session details.

B. Click Traffic view and review the information in the detailed log view.

C. Click Traffic view; ensure that the Source or Destination NAT columns are included and review the information in the detailed log view.

D. Click App Scope > Network Monitor and filter the report for NAT rules.

A. Click Session Browser and review the session details.

Explanation: Traffic view in the Monitor tab of the firewall GUI can display the information about the NAT policy that is in use for a traffic flow, if the Source or Destination NAT columns are included and reviewed in the detailed log view1. The Source NAT column shows the translated source IP address and port, and the Destination NAT column shows the translated destination IP address and port2. These columns can help the administrator identify which NAT policy is applied to the traffic flow based on the pre-NAT and post-NAT addresses and ports.

An administrator Just enabled HA Heartbeat Backup on two devices However, the status on tie firewall's dashboard is showing as down High Availability.

What could an administrator do to troubleshoot the issue?

A. Go to Device > High Availability> General > HA Pair Settings > Setup and configuring the peer IP for heartbeat backup

B. Check peer IP address In the permit list In Device > Setup > Management > Interfaces > Management Interface Settings

C. Go to Device > High Availability > HA Communications> General> and check the Heartbeat Backup under Election Settings

D. Check peer IP address for heartbeat backup to Device > High Availability > HA Communications > Packet Forwarding settings.

B. Check peer IP address In the permit list In Device > Setup > Management > Interfaces > Management Interface Settings

An administrator configures a preemptive active-passive high availability (HA) pair of firewalls and configures the HA election settings on firewall-02 with a device priority value of 100, and firewall-01 with a device priority value of 90. When firewall-01 is rebooted, is there any action taken by the firewalls?

A. No - Neither firewall takes any action because firewall-01 cannot be rebooted when configured with device priority of 90.

B. No - Neither firewall takes any action because firewall-02 is already the active-primary member.

C. Yes - Firewall-02 takes over as the active-primary firewall; firewall-01 takes over as the active-primary member after it becomes functional.

D. Yes - Firewall-02 takes over as the active-primary firewall; firewall-02 remains the active-primary member after firewall-01 becomes functional.

C. Yes - Firewall-02 takes over as the active-primary firewall; firewall-01 takes over as the active-primary member after it becomes functional.

Pass exam with Dumps4free or we will provide you with three additional months of access for FREE.

PCNSE Practice Test