PCNSE PCNSE Palo Alto Networks Firewall Configuration 3

Question 1

An administrator needs to configure the firewall to dynamically update security policies based on user identity obtained from Active Directory without installing an agent on every endpoint. Which feature should be used?

Accepted Answer

User-ID with WMI Probing

Answer

User-ID WMI Probing queries Windows Management Instrumentation on domain controllers to map IP addresses to usernames without requiring per-endpoint agents.

Question 2

Which PAN-OS object type allows an administrator to reference a dynamically updated list of IP addresses, URLs, or domains that is maintained externally and automatically refreshed by the firewall?

Accepted Answer

External Dynamic List (EDL)

Answer

External Dynamic Lists (EDLs) allow the firewall to pull and automatically refresh IP, URL, or domain lists from an external web server at configured intervals.

Question 3

When configuring a Site-to-Site VPN tunnel on a Palo Alto firewall, which IKE (Internet Key Exchange) parameter defines the lifetime of the Phase 1 (IKE) SA before it must be renegotiated?

Accepted Answer

Key Lifetime

Answer

The Key Lifetime parameter in the IKE Crypto Profile specifies how long the Phase 1 IKE Security Association remains valid before renegotiation is required.

Question 4

A security engineer wants to prevent users from accessing newly registered domains that have been active for less than 30 days. Which PAN-OS feature directly enables this capability?

Accepted Answer

URL Filtering profile with 'newly registered domains' category

Answer

URL Filtering profiles include a 'Newly Registered Domains' category that can be blocked to prevent access to domains registered within the past 32 days.

Question 5

In PAN-OS, what is the function of the 'Security Profile Group' object when applied to a security policy rule?

Accepted Answer

It groups multiple security profiles (AV, IPS, URL filtering, etc.) into a single reusable object applied to matching traffic

Answer

A Security Profile Group bundles Antivirus, Anti-spyware, Vulnerability Protection, URL Filtering, and other profiles into one object for simplified policy assignment.

PCNSE Exam Practice Test

PCNSE Exam Practice Test

PCNSE PCNSE Palo Alto Networks Firewall Configuration 3