Free Palo Alto Networks PCNSE Exam Questions

Question 1

Which tool will allow review of the policy creation logic to verify that unwanted traffic is not allowed?

A : Managed Devices Health

B : Test Policy Match

C : Preview Changes

D : Policy Optimizer

Answer: B

Question 2

Panorama is being used to upgrade the PAN-OS version on a pair of firewalls in an active/passive high availability (HA) configuration. The Palo Alto Networks best practice upgrade steps have been completed in Panorama (Panorama upgraded, backups made, content updates, and disabling "Preemptive" pushed), and the firewalls are ready for upgrade. What is the next best step to minimize downtime and ensure a smooth transition?

A : Upgrade both HA peers at the same time using Panorama’s "Group HA Peers" option to ensure version consistency

B : Suspend the active firewall, upgrade it first, and reboot to verify it comes back online before upgrading the passive peer

C : Perform the upgrade on the active firewall first while keeping the passive peer online to maintain failover capability

D : Upgrade only the passive peer first, reboot it, restore HA functionality, and then upgrade the active peer

Answer: D

Question 3

Panorama is being used to upgrade the PAN-OS version on a pair of firewalls in an active/passive high availability (HA) configuration. The Palo Alto Networks best practice upgrade steps have been completed in Panorama (Panorama upgraded, backups made, content updates, and disabling "Preemptive" pushed), and the firewalls are ready for upgrade. What is the next best step to minimize downtime and ensure a smooth transition?

A : Upgrade both HA peers at the same time using Panorama’s "Group HA Peers" option to ensure version consistency

B : Suspend the active firewall, upgrade it first, and reboot to verify it comes back online before upgrading the passive peer

C : Perform the upgrade on the active firewall first while keeping the passive peer online to maintain failover capability

D : Upgrade only the passive peer first, reboot it, restore HA functionality, and then upgrade the active peer

Answer: D

Question 4

A firewall architect is attempting to install a new Palo Alto Networks NGFW. The company has previously had issues moving all administrative functions onto a data plane interface to meet the design limitations of the environment. The architect is able to access the device for HTTPS and SSH; however, the NGFW can neither validate licensing nor get updates. Which action taken by the architect will resolve this issue?

A : Create a service route that sets the source interface to the data plane interface in question

B : Validate that all upstream devices will allow and properly route the outbound traffic to the external destinations needed

C : Create a loopback from the management interface to the data plane interface, then make a service route from the management interface to the data plane interface

D : Enable OCSP for the data plane interface so the firewall will create a certificate with the data plane interface’s IP

Answer: B

Question 5

Which tool will allow review of the policy creation logic to verify that unwanted traffic is not allowed?

A : Managed Devices Health

B : Test Policy Match

C : Preview Changes

D : Policy Optimizer

Answer: B