PCNSE Certification Exam Questions with AI Explanations

QUESTION: 111

Based on the following image, what is the correct path of root, intermediate, and end-user certificate?

Palo Alto Networks > Symantec > VeriSign
VeriSign > Symantec > Palo Alto Networks
Symantec > VeriSign > Palo Alto Networks
VeriSign > Palo Alto Networks > Symantec

Answer(s): B

An administrator wants a new Palo Alto Networks NGFW to obtain automatic application updates daily, so it is configured to use a scheduler for the application database. Unfortunately, they required the management network to be isolated so that it cannot reach the Internet.

Which configuration will enable the firewall to download and install application updates automatically?

Download and install application updates cannot be done automatically if the MGT port cannot reach the Internet.
Configure a service route for Palo Alto Networks Services that uses a dataplane interface that can route traffic to the Internet, and create a Security policy rule to allow the traffic from that interface to the update servers if necessary.
Configure a Policy Based Forwarding policy rule for the update server IP address so that traffic sourced from the management interfaced destined for the update servers goes out of the interface acting as your Internet connection.
Configure a Security policy rule to allow all traffic to and from the update servers.

Answer(s): B

Reveal Solution Next Question

QUESTION: 113

A company wants to install a NGFW firewall between two core switches on a VLAN trunk link. They need to assign each VLAN to its own zone and to assign untagged (native) traffic to its own zone.

Which option differentiates multiple VLANs into separate zones?

Create V-Wire objects with two V-Wire interfaces and define a range of “0-4096” in the “Tag Allowed” field of the V-Wire object.
Create V-Wire objects with two V-Wire subinterfaces and assign only a single VLAN ID to the “Tag Allowed” field of the V-Wire object. Repeat for every additional VLAN and use a VLAN ID of 0 for untagged traffic. Assign each interface/subinterface to a unique zone.
Create Layer 3 subinterfaces that are each assigned to a single VLAN ID and a common virtual router. The physical Layer 3 interface would handle untagged traffic. Assign each interface/subinterface to a unique zone. Do not assign any interface an IP address.
Create VLAN objects for each VLAN and assign VLAN interfaces matching each VLAN I Repeat for every additional VLAN and use a VLAN ID of 0 for untagged traffic. Assign each interface/subinterface to a unique zone.

Answer(s): B

Reveal Solution Next Question