support@Free-Braindumps.com
Register Login
Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
CrowdStrike
Anthropic
All Vendors
  1. Home
  2. Exams
  3. Palo Alto Networks
  4. PCNSE

Free PCNSE Exam Braindumps
Palo Alto Networks Certified Network Security Engineer Questions 146–150 (page: 31)

Updated On: 10-Feb-2026
Page 31 of 123
PDF with 606 Questions

Which two actions would be part of an automatic solution that would block sites with untrusted certificates without enabling SSL Forward Proxy? (Choose two.)

  1. Create a no-decrypt Decryption Policy rule.
  2. Configure an EDL to pull IP addresses of known sites resolved from a CRL.
  3. Configure a Dynamic Address Group for untrusted sites.
  4. Create a Security Policy rule with a vulnerability Security Profile attached.
  5. Enable the “Block sessions with untrusted issuers” setting.

Answer(s): A,D


Reference:

https://www.paloaltonetworks.com/documentation/71/pan-os/web-interface-help/objects/objects-decryption-profile



An administrator is defining protection settings on the Palo Alto Networks NGFW to guard against resource exhaustion. When platform utilization is considered, which steps must the administrator take to configure and apply packet buffer protection?

  1. Enable and configure the Packet Buffer Protection thresholds.
    Enable Packet Buffer Protection per ingress zone.
  2. Enable and then configure Packet Buffer thresholds.
    Enable Interface Buffer protection.
  3. Create and Apply Zone Protection Profiles in all ingress zones.
    Enable Packet Buffer Protection per ingress zone.
  4. Configure and apply Zone Protection Profiles for all egress zones.
    Enable Packet Buffer Protection per egress zone.
  5. Enable per-vsys Session Threshold alerts and triggers for Packet Buffer Limits.
    Enable Zone Buffer Protection per zone.

Answer(s): A


Reference:

https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/zone-protection-and-dos-protection/configure-zone-protection-to-increase-network-security/configure-packet-buffer-protection



What is the purpose of the firewall decryption broker?

  1. decrypt SSL traffic and then send it as cleartext to a security chain of inspection tools.
  2. force decryption of previously unknown cipher suites
  3. reduce SSL traffic to a weaker cipher before sending it to a security chain of inspection tools.
  4. inspect traffic within IPsec tunnels

Answer(s): A


Reference:

https://www.paloaltonetworks.com/documentation/81/pan-os/newfeaturesguide/decryption-features/decryption-broker



SAML SLO is supported for which two firewall features? (Choose two.)

  1. GlobalProtect Portal
  2. CaptivePortal
  3. WebUI
  4. CLI

Answer(s): A,C


Reference:

https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/authentication/configure-saml-authentication



What are the two behavior differences between Highlight Unused Rules and the Rule Usage Hit counter when a firewall is rebooted? (Choose two.)

  1. Rule Usage Hit counter will not be reset
  2. Highlight Unused Rules will highlight all rules.
  3. Highlight Unused Rules will highlight zero rules.
  4. Rule Usage Hit counter will reset.

Answer(s): A,B



  PDF
Viewing page 31 of 123
Viewing questions 151 - 155 out of 606 questions


Post your Comments and Discuss Palo Alto Networks PCNSE exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!