Free PCNSE Exam Braindumps
Palo Alto Networks Certified Network Security Engineer Questions 276–280 (page: 57)

Updated On: 10-Feb-2026

A network security engineer is attempting to peer a virtual router on a PAN-OS firewall with an external router using the BGP protocol. The peer relationship is not establishing. What command could the engineer run to see the current state of the BGP state between the two devices?

  1. show routing protocol bgp rib-out
  2. show routing protocol bgp peer
  3. show routing protocol bgp summary
  4. show routing protocol bgp state

Answer(s): B



What is the best description of the HA4 Keep-alive Threshold (ms)?

  1. the timeframe that the local firewall waits before going to Active state when another cluster member is preventing the cluster from fully synchronizing
  2. the timeframe within which the firewall must receive keepalives from a cluster member to know that the cluster member is functional
  3. the maximum interval between hello packets that are sent to verify that the HA functionality on the other firewall is operational
  4. the time that a passive or active-secondary firewall will wait before taking over as the active or active-primary firewall

Answer(s): B



An engineer is tasked with enabling SSL decryption across the environment. What are three valid parameters of an SSL Decryption policy? (Choose three.)

  1. GlobalProtect HIP
  2. source users
  3. App-ID
  4. URL categories
  5. source and destination IP addresses

Answer(s): B,D,E



An engineer is configuring Packet Buffer Protection on ingress zones to protect from single-session DoS attacks. Which sessions does Packet Buffer Protection apply to?

  1. It applies to existing sessions and is not global
  2. It applies to existing sessions and is global
  3. It applies to new sessions and is global
  4. It applies to new sessions and is not global

Answer(s): B



What are two best practices for incorporating new and modified App-IDs? (Choose two.)

  1. Run the latest PAN-OS version in a supported release tree to have the best performance for the new App-IDs
  2. Study the release notes and install new App-IDs if they are determined to have low impact
  3. Configure a security policy rule to allow new App-IDs that might have network-wide impact
  4. Perform a Best Practice Assessment to evaluate the impact of the new or modified App-IDs

Answer(s): B,C



Viewing page 57 of 123
Viewing questions 281 - 285 out of 606 questions


Post your Comments and Discuss Palo Alto Networks PCNSE exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!