PCNSE Exam Questions and Answers | Exam-Dumps (Page: 5)

QUESTION: 21

What are two benefits of nested device groups in Panorama? (Choose two.)

Reuse of the existing Security policy rules and objects
Requires configuring both function and location for every device
All device groups inherit settings from the Shared group
Overwrites local firewall configuration

Answer(s): A,C

Reveal Solution Next Question

QUESTION: 22

Which Captive Portal mode must be configured to support MFA authentication?

NTLM
Redirect
Single Sign-On
Transparent

Answer(s): B

Reference:

https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/authentication/configure-multi- factor-authentication

Reveal Solution Next Question

QUESTION: 23

An administrator needs to implement an NGFW between their DMZ and Core network. EIGRP Routing between the two environments is required.

Which interface type would support this business requirement?

Virtual Wire interfaces to permit EIGRP routing to remain between the Core and DMZ
Layer 3 or Aggregate Ethernet interfaces, but configuring EIGRP on subinterfaces only
Tunnel interfaces to terminate EIGRP routing on an IPsec tunnel (with the GlobalProtect License to support LSVPN and EIGRP protocols)
Layer 3 interfaces, but configuring EIGRP on the attached virtual router

Answer(s): A

Reveal Solution Next Question

QUESTION: 24

A speed/duplex negotiation mismatch is between the Palo Alto Networks management port and the switch port to which it connects.

How would an administrator configure the interface to 1Gbps?

set deviceconfig interface speed-duplex 1Gbps-full-duplex
set deviceconfig system speed-duplex 1Gbps-duplex
set deviceconfig system speed-duplex 1Gbps-full-duplex
set deviceconfig Interface speed-duplex 1Gbps-half-duplex

Answer(s): C

Reference:

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Change-the-Speed-and-Duplex-of-the-Management-Port/ta-p/59034

Reveal Solution Next Question

A web server is hosted in the DMZ, and the server is configured to listen for incoming connections only on TCP port 8080. A Security policy rule allowing access from the Trust zone to the DMZ zone need to be configured to enable we browsing access to the server.

Which application and service need to be configured to allow only cleartext web-browsing traffic to thins server on tcp/8080?

application: web-browsing; service: application-default
application: web-browsing; service: service-https
application: ssl; service: any
application: web-browsing; service: (custom with destination TCP port 8080)

Answer(s): D

Reveal Solution Next Question

Palo Alto Networks PCNSE Exam (page: 5)
Palo Alto Networks Certified Network Security Engineer
Updated on: 12-Jan-2026

QUESTION: 21

QUESTION: 22

Reference:

QUESTION: 23

QUESTION: 24

Reference:

QUESTION: 25

Palo Alto Networks PCNSE Exam (page: 5) Palo Alto Networks Certified Network Security Engineer Updated on: 12-Jan-2026

QUESTION: 21

QUESTION: 22

Reference:

QUESTION: 23

QUESTION: 24

Reference:

QUESTION: 25

Palo Alto Networks PCNSE Exam (page: 5)
Palo Alto Networks Certified Network Security Engineer
Updated on: 12-Jan-2026