Free PCNSE Exam Braindumps
Palo Alto Networks Certified Network Security Engineer Questions 281–285 (page: 58)

Updated On: 10-Feb-2026

The manager of the network security team has asked you to help configure the company's Security Profiles according to Palo Alto Networks best practice. As part of that effort, the manager has assigned you the Vulnerability Protection profile for the Internet gateway firewall. Which action and packet-capture setting for items of high severity and critical severity best matches Palo Alto Networks best practice?

  1. action 'reset-server' and packet capture 'disable'
  2. action 'default' and packet capture 'single-packet'
  3. action 'reset-both' and packet capture 'extended-capture'
  4. action 'reset-both' and packet capture 'single-packet'

Answer(s): D



An engineer needs to redistribute User-ID mappings from multiple data centers. Which data flow best describes redistribution of user mappings?

  1. User-ID agent to firewall
  2. firewall to firewall
  3. Domain Controller to User-ID agent
  4. User-ID agent to Panorama

Answer(s): B



An administrator is attempting to create policies for deployment of a device group and template stack. When creating the policies, the zone drop-down list does not include the required zone.

What can the administrator do to correct this issue?

  1. Add a firewall to both the device group and the template
  2. Add the template as a reference template in the device group
  3. Enable "Share Unused Address and Service Objects with Devices" in Panorama settings
  4. Specify the target device as the master device in the device group

Answer(s): B



What best describes the HA Promotion Hold Time?

  1. the time that the passive firewall will wait before taking over as the active firewall after communications with the HA peer have been lost
  2. the time that is recommended to avoid a failover when both firewalls experience the same link/path monitor failure simultaneously
  3. the time that is recommended to avoid an HA failover due to the occasional flapping of neighboring devices
  4. the time that a passive firewall with a low device priority will wait before taking over as the active firewall if the firewall is operational again

Answer(s): A



A user at an internal system queries the DNS server for their web server with a private IP of 10.250.241.131 in the DMZ. The DNS server returns an address of the web servers public address, 200.1.1.10. In order to reach the web server, which security rule and U-Turn NAT rule must be configured on the firewall?


  1. NAT Rule:
    Source Zone: Untrust_L3
    Source IP: Any
    Destination Zone: DMZ
    Destination IP: 200.1.1.10
    Destination Translation address: 10.250.241.131
    Security Rule:
    Source IP: Any
    Destination Zone: DMZ
    Destination IP: 10.250.241.131

  2. NAT Rule:
    Source Zone: Trust_L3
    Source IP: Any
    Destination Zone: DMZ
    Destination IP: 200.1.1.10
    Destination Translation address: 10.250.241.131
    Security Rule:
    Source Zone: Untrust-L3
    Source IP: Any
    Destination Zone: DMZ
    Destination IP: 10.250.241.131

  3. NAT Rule:
    Source Zone: Untrust_L3
    Source IP: Any
    Destination Zone: Untrust_L3
    Destination IP: 200.1.1.10
    Destination Translation address: 10.250.241.131
    Security Rule:
    Source Zone: Untrust-L3
    Source IP: Any
    Destination Zone: DMZ
    Destination IP: 10.250.241.131

  4. NAT Rule:
    Source Zone: Trust_L3
    Source IP: Any
    Destination Zone: Untrust_L3
    Destination IP: 200.1.1.10
    Destination Translation address: 10.250.241.131
    Security Rule:
    Source Zone: Trust-L3
    Source IP: Any
    Destination Zone: DMZ
    Destination IP: 200.1.1.10

Answer(s): A



Viewing page 58 of 123
Viewing questions 286 - 290 out of 606 questions


Post your Comments and Discuss Palo Alto Networks PCNSE exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!