PCNSE Palo Alto Networks Firewall Configuration Flashcards

An administrator needs to configure the firewall to dynamically update security policies based on user identity obtained from Active Directory without installing an agent on every endpoint. Which feature should be used?

Answer: User-ID with WMI Probing

User-ID WMI Probing queries Windows Management Instrumentation on domain controllers to map IP addresses to usernames without requiring per-endpoint agents.

Which PAN-OS object type allows an administrator to reference a dynamically updated list of IP addresses, URLs, or domains that is maintained externally and automatically refreshed by the firewall?

Answer: External Dynamic List (EDL)

External Dynamic Lists (EDLs) allow the firewall to pull and automatically refresh IP, URL, or domain lists from an external web server at configured intervals.

When configuring a Site-to-Site VPN tunnel on a Palo Alto firewall, which IKE (Internet Key Exchange) parameter defines the lifetime of the Phase 1 (IKE) SA before it must be renegotiated?

Answer: Key Lifetime

The Key Lifetime parameter in the IKE Crypto Profile specifies how long the Phase 1 IKE Security Association remains valid before renegotiation is required.

A security engineer wants to prevent users from accessing newly registered domains that have been active for less than 30 days. Which PAN-OS feature directly enables this capability?

Answer: URL Filtering profile with 'newly registered domains' category

URL Filtering profiles include a 'Newly Registered Domains' category that can be blocked to prevent access to domains registered within the past 32 days.

In PAN-OS, what is the function of the 'Security Profile Group' object when applied to a security policy rule?

Answer: It groups multiple security profiles (AV, IPS, URL filtering, etc.) into a single reusable object applied to matching traffic

A Security Profile Group bundles Antivirus, Anti-spyware, Vulnerability Protection, URL Filtering, and other profiles into one object for simplified policy assignment.

Which Palo Alto Networks technology identifies applications regardless of port, protocol, or encryption by using application signatures, behavioral analysis, and heuristics?

Answer: App-ID

App-ID uses multiple identification mechanisms including application signatures, decryption, protocol decoding, and heuristics to identify applications independent of port or protocol.

An administrator configures a NAT policy on a Palo Alto firewall where the source IP is translated to an IP address from a pool. When the pool is exhausted, what happens to new connection attempts by default?

Answer: Connections are dropped silently

When a dynamic IP NAT pool is exhausted, new connections that require translation are dropped because no available translation address exists.