Pass the Paloalto Networks Paloalto Certifications and Accreditations PCNSC Questions and answers with ExamsMirror

When a packet from an existing session is received by a firewall that is part of an HA (High Availability) pair:

D.The firewall takes ownership of the session from the peer firewall

In a high-availability configuration, if a firewall in an HA pair receives a packet for an existing session that it is not currently handling, it will take ownership of that session from the peer firewall. This ensures seamless continuity of the session and maintains the stateful nature of the firewall's session handling.

References:

Palo Alto Networks - High Availability Concepts: https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/high-availability/ha-concepts

The security policy rule shown in the image is configured to permit traffic from a source zoneLAN-User-Zoneto a destination zoneServer-Zone. The applications allowed includetftp,ssl, andweb-browsing, and the action isallow. According to Iron Skillet day one configurations, which provide best practice security profiles for immediate deployment, the relevant security profile group used to secure internal traffic like this is theInternalprofile group.

Iron Skillet provides predefined configuration templates including security profile groups like Internal, External, and others to quickly secure traffic according to typical deployment scenarios.

References:

Palo Alto Networks - Iron Skillet Documentation:https://github.com/PaloAltoNetworks/iron-skillet

To non-disruptively monitor traffic coming from a port operating in promiscuous mode, the appropriate firewall interface type is:

D.TAP

A TAP (Test Access Point) interface allows the firewall to passively monitor network traffic without interfering with the actual flow of traffic. It is used to capture and analyze traffic for inspection, logging, and threat detection.

References:

Palo Alto Networks - TAP Mode: https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/networking/network-interface-configurations/tap-mode

To create a secure Antivirus Profile to address a virus spreading internally over SMB, the administrator should choose the following set of actions for the SMB decoder:

B.Action - Reset-Both; Wildfire Action - Reset-Both

Choosing "Reset-Both" for both the Antivirus Action and the Wildfire Action ensures that the connection is terminated on both the client and server sides whenever a virus is detected. This action helps prevent the spread of the virus by cutting off the infected connection immediately.

References:

Palo Alto Networks - Antivirus Profile Best Practices: https://docs.paloaltonetworks.com/best-practices

Palo Alto Networks - Creating and Configuring Antivirus Profiles: https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/threat-prevention/antivirus-profiles

The default port used by the Terminal Services agent to communicate with a Palo Alto Networks firewall is5007. The Terminal Services agent (TS agent) integrates with Microsoft Terminal Services to associate user information with sessions, enabling User-ID to accurately map user identities to security policies. Reference: Palo Alto Networks Terminal Services Agent Documentation.

To start using Device-ID to obtain policy rule recommendations, the customer needs to purchase:

A.a Cortex Data Lake license

The Cortex Data Lake is a cloud-based logging service that aggregates data from all Palo Alto Networks products and services. Device-ID uses this data to provide insights and recommendations for policy rules based on the identities of devices on the network.

References:

Palo Alto Networks - Cortex Data Lake: https://docs.paloaltonetworks.com/cortex/cortex-data-lake

Palo Alto Networks - Device-ID Overview: https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/policy/use-device-id-to-enforce-policy