support@Free-Braindumps.com
Register Login
Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
CrowdStrike
Anthropic
All Vendors
  1. Home
  2. Exams
  3. Palo Alto Networks
  4. PCNSE

Free PCNSE Exam Braindumps
Palo Alto Networks Certified Network Security Engineer Questions 176–180 (page: 37)

Updated On: 10-Feb-2026
Page 37 of 123
PDF with 606 Questions

An organization has recently migrated its infrastructure and configuration to NGFWs, for which Panorama manages the devices. The organization is coming from a L2-L4 firewall vendor, but wants to use App-ID while identifying policies that are no longer needed.
Which Panorama tool can help this organization?

  1. Test Policy Match
  2. Application Groups
  3. Policy Optimizer
  4. Config Audit

Answer(s): C



An organization is building a Bootstrap Package to deploy Palo Alto Networks VM-Series firewalls into their AWS tenant. Which two statements are correct regarding the bootstrap package contents? (Choose two.)

  1. The bootstrap package is stored on an AFS share or a discrete container file bucket.
  2. The bootstrap.xml file allows for automated deployment of VM-Series firewalls with full network and policy configurations.
  3. The /config, /content and /software folders are mandatory while the /license and /plugin folders are optional.
  4. The init-cfg.txt and bootstrap.xml files are both optional configuration items for the /config folder.
  5. The directory structure must include a /config, /content, /software and /license folders.

Answer(s): B,E



Which Panorama objects restrict administrative access to specific device-groups?

  1. admin roles
  2. authentication profiles
  3. templates
  4. access domains

Answer(s): D


Reference:

https://docs.paloaltonetworks.com/panorama/9-1/panorama-admin/panorama-overview/role-based-access-control/access-domains



An engineer is planning an SSL decryption implementation.
Which of the following statements is a best practice for SSL decryption?

  1. Obtain an enterprise CA-signed certificate for the Forward Trust certificate.
  2. Use an enterprise CA-signed certificate for the Forward Untrust certificate.
  3. Use the same Forward Trust certificate on all firewalls in the network.
  4. Obtain a certificate from a publicly trusted root CA for the Forward Trust certificate.

Answer(s): A


Reference:

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/decryption/configure-ssl-forward-proxy



An administrator receives the following error message:

"IKE phase-2 negotiation failed when processing Proxy ID. Received local id 192. 168.33.33/24 type IPv4 address protocol 0 port 0, received remote id 172.16.33.33/24 type IPv4 address protocol 0 port 0."

How should the administrator identify the root cause of this error message?

  1. Verify that the IP addresses can be pinged and that routing issues are not causing the connection failure.
  2. Check whether the VPN peer on one end is set up correctly using policy-based VPN.
  3. In the IKE Gateway configuration, verify that the IP address for each VPN peer is accurate.
  4. In the IPSec Crypto profile configuration, verify that PFS is either enabled on both VPN peers or disabled on both VPN peers.

Answer(s): B


Reference:

https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/vpns/set-up-site-to-site-vpn/interpret-vpn-error-messages.html



  PDF
Viewing page 37 of 123
Viewing questions 181 - 185 out of 606 questions


Post your Comments and Discuss Palo Alto Networks PCNSE exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!