QUESTION: 29

How would an administrator monitor/capture traffic on the management interface of the Palo Alto Networks NGFW?

Use the debug dataplane packet-diag set capture stage firewall file command.
Enable all four stages of traffic capture (TX, RX, DROP, Firewall).
Use the debug dataplane packet-diag set capture stage management file command.
Use the tcpdump command.

Answer(s): D

Reference:

https://live.paloaltonetworks.com/t5/Learning-Articles/How-to-Run-a-Packet-Capture/ta-p/62390

Reveal Solution Next Question

QUESTION: 30

An administrator needs to optimize traffic to prefer business-critical applications over non-critical applications. QoS natively integrates with which feature to provide service quality?

Port Inspection
Certificate revocation
Content-ID
App-ID

Answer(s): D

Reference:

https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/quality-of-service/qos- concepts/qos-for-applications-and-users#idaed4e749-80b4-4641-a37c-c741aba562e9

Reveal Solution Next Question

QUESTION: 31

A session in the Traffic log is reporting the application as “incomplete.” What does “incomplete” mean?

The three-way TCP handshake was observed, but the application could not be identified.
The three-way TCP handshake did not complete.
The traffic is coming across UDP, and the application could not be identified.
Data was received but was instantly discarded because of a Deny policy was applied before App-ID could be applied.

Answer(s): B

Reveal Solution Next Question

Refer to the exhibit.
An administrator is using DNAT to map two servers to a single public IP address. Traffic will be steered to the specific server based on the application, where Host A (10.1.1.100) receives HTTP traffic and Host B (10.1.1.101) receives SSH traffic.

Which two Security policy rules will accomplish this configuration? (Choose two.)

Untrust (Any) to Untrust (10.1.1.1), web-browsing - Allow
Untrust (Any) to Untrust (10.1.1.1), ssh - Allow
Untrust (Any) to DMZ (1.1.1.100), web-browsing - Allow
Untrust (Any) to DMZ (1.1.1.100), ssh - Allow
Untrust (Any) to DMZ (10.1.1.100, 10.1.1.101), ssh, web-browsing - Allow

Answer(s): C,D

Reveal Solution Next Question

Free PCNSE Exam Braindumps (page: 8)

QUESTION: 29

Reference:

QUESTION: 30

Reference:

QUESTION: 31

QUESTION: 32