Free PCNSE Exam Braindumps
Palo Alto Networks Certified Network Security Engineer Questions 131–135 (page: 28)

Updated On: 10-Feb-2026

In which two types of deployment is active/active HA configuration supported? (Choose two.)

  1. Layer 3 mode
  2. TAP mode
  3. Virtual Wire mode
  4. Layer 2 mode

Answer(s): A,C



For which two reasons would a firewall discard a packet as part of the packet flow sequence? (Choose two.)

  1. ingress processing errors
  2. rule match with action “deny”
  3. rule match with action “allow”
  4. equal-cost multipath

Answer(s): A,B



Which logs enable a firewall administrator to determine whether a session was decrypted?

  1. Traffic
  2. Security Policy
  3. Decryption
  4. Correlated Event

Answer(s): A



An administrator needs to upgrade an NGFW to the most current version of PAN-OS® software. The following is occurring:

-Firewall has internet connectivity through e 1/1.
-Default security rules and security rules allowing all SSL and web-browsing traffic to and from any zone.
-Service route is configured, sourcing update traffic from e1/1.
-A communication error appears in the System logs when updates are performed.
-Download does not complete.

What must be configured to enable the firewall to download the current version of PAN-OS software?

  1. Static route pointing application PaloAlto-updates to the update servers
  2. Security policy rule allowing PaloAlto-updates as the application
  3. Scheduler for timed downloads of PAN-OS software
  4. DNS settings for the firewall to use for resolution

Answer(s): D



A client has a sensitive application server in their data center and is particularly concerned about session flooding because of denial-of-service attacks.

How can the Palo Alto Networks NGFW be configured to specifically protect this server against session floods originating from a single IP address?

  1. Add an Anti-Spyware Profile to block attacking IP address
  2. Define a custom App-ID to ensure that only legitimate application traffic reaches the server
  3. Add QoS Profiles to throttle incoming requests
  4. Add a tuned DoS Protection Profile

Answer(s): D



Viewing page 28 of 123
Viewing questions 136 - 140 out of 606 questions


Post your Comments and Discuss Palo Alto Networks PCNSE exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!