Check the Available PCNSE Exam Dumps with 375 QA’s UPDATED 2026 [Q190-Q213]

Rate this post

Check the Available PCNSE Exam Dumps with 375 QA’s UPDATED 2026

Download PCNSE Exam Dumps Questions to get 100% Success in Palo Alto Networks

The PCNSE exam is a comprehensive and challenging test that requires candidates to have a deep understanding of the Palo Alto Networks platform and its various features. Candidates are expected to have hands-on experience working with the platform, as well as a strong understanding of networking concepts and security best practices. PCNSE exam consists of multiple-choice questions, as well as hands-on simulations that test candidates’ ability to configure and troubleshoot various aspects of the platform.

NO.190 How should an administrator enable the Advance Routing Engine on a Palo Alto Networks firewall?

Enable Advanced Routing Engine in Device > Setup > Session > Session Settings, then commit and reboot.

Enable Advanced Routing in Network > Virtual Routers > Router Settings > General, then commit and reboot.

Enable Advanced Routing in General Settings of Device > Setup > Management, then commit and reboot.

Enable Advanced Routing in Network > Virtual Routers > Redistribution Profiles and then commit.

NO.191 An engineer reviews high availability (HA) settings to understand a recent HA failover event Review the screenshot below.

Which tuner determines how long the passive firewall will wart before taking over as the active firewall after losing communications with the HA peer?

Additional Master Hold Up Time

Promotion Hold Time

Monitor Fail Hold Up Time

Heartbeat Interval

NO.192 When configuring a GlobalProtect Portal, what is the purpose of specifying an Authentication Profile?

To enable Gateway authentication to the Portal

To enable Portal authentication to the Gateway

To enable user authentication to the Portal

To enable client machine authentication to the Portal

NO.193 Refer to the exhibit.

Which certificates can be used as a Forward Trust certificate?

Certificate from Default Trust Certificate Authorities

Domain Sub-CA

Forward_Trust

Domain-Root-Cert

NO.194 An enterprise Information Security team has deployed policies based on AD groups to restrict user access to critical infrastructure systems. However, a recent phishing campaign against the organization has prompted Information Security to look for more controls that can secure access to critical assets. For users that need to access these systems. Information Security wants to use PAN-OS multi-factor authentication (MFA) integration to enforce MFA.
What should the enterprise do to use PAN-OS MFA?

Configure a Captive Portal authentication policy that uses an authentication sequence.

Configure a Captive Portal authentication policy that uses an authentication profile that references a RADIUS profile.

Create an authentication profile and assign another authentication factor to be used by a Captive Portal authentication policy.

Use a Credential Phishing agent to detect, prevent, and mitigate credential phishing campaigns.

Explanation
To use PAN-OS multi-factor authentication (MFA) to secure access to critical assets, the enterprise should configure a Captive Portal authentication policy that uses an authentication sequence. An authentication sequence is a feature that allows the firewall to enforce multiple authentication methods (factors) for users who access sensitive services or applications. An authentication sequence can include up to four factors, such as login and password, Voice, SMS, Push, or One-time Password (OTP) authentication. The firewall can integrate with MFA vendors through RADIUS or vendor APIs to provide the additional factors12.
To configure an authentication sequence, the enterprise needs to create an authentication profile for each factor and then add them to the sequence in the desired order. The enterprise also needs to create a Captive Portal authentication policy that matches the traffic that requires MFA and applies the authentication sequence to it.
The Captive Portal is a web page that the firewall displays to users who need to authenticate before accessing the network or the internet. The Captive Portal can be customized to include a welcome message, a login prompt, a disclaimer, a certificate download link, and a logout button34.
When a user tries to access a service or application that matches the Captive Portal authentication policy, the firewall redirects the user to the Captive Portal web form for the first factor. After the user successfully authenticates for the first factor, the firewall prompts the user for the second factor through RADIUS or vendor API integration. The firewall repeats this process until all factors in the sequence are completed or until one factor fails. If all factors are completed successfully, the firewall allows the user to access the service or application. If one factor fails, the firewall denies access and logs an event56.
Configuring a Captive Portal authentication policy that uses an authentication profile that references a RADIUS profile is not sufficient to use PAN-OS MFA. This option only provides one factor of authentication through RADIUS integration with an MFA vendor. To use multiple factors of authentication, an authentication sequence is required.
Creating an authentication profile and assigning another authentication factor to be used by a Captive Portal authentication policy is not correct to use PAN-OS MFA. This option does not specify how to create or apply an authentication sequence, which is necessary for enforcing multiple factors of authentication.
Using a Credential Phishing agent to detect, prevent, and mitigate credential phishing campaigns is not relevant to use PAN-OS MFA. This option is a feature of Palo Alto Networks Cortex XDR™ that helps protect endpoints from credential theft by malicious actors. It does not provide any MFA functionality for accessing critical assets.
References: Authentication Sequence, Configure Multi-Factor Authentication, Configure an Authentication Portal, Create an Authentication Profile, Create an Authentication Sequence, Create a Captive Portal Authentication Policy, [Credential Phishing Agent]

NO.195 A firewall administrator needs to check which egress interface the firewall will use to route the IP 10.2.5.3.
Which command should they use?

test routing route ip 10.2.5.3 *

test routing route ip 10.2.5.3 virtual-router default

test routing fib-lookup ip 10.2.5.0/24 virtual-router default

test routing fib-lookup ip 10.2.5.3 virtual-router default

NO.196 Which feature must you configure to prevent users form accidentally submitting their corporate credentials to a phishing website?

URL Filtering profile

Zone Protection profile

Anti-Spyware profile

Vulnerability Protection profile

NO.197 When a new firewall joins a high availability (HA) cluster, the cluster members will synchronize all existing sessions over which HA port?

HA1

HA3

HA2

HA4

NO.198 View the GlobalProtect configuration screen capture.
What is the purpose of this configuration?

It configures the tunnel address of all internal clients to an IP address range starting at 192.168.10.1.

It forces an internal client to connect to an internal gateway at IP address 192.168.10.1.

It enables a client to perform a reverse DNS lookup on 192.168.10.1 to detect that it is an internal client.

It forces the firewall to perform a dynamic DNS update, which adds the internal gateway’s hostname and IP address to the DNS server.

NO.199 Please match the terms to their corresponding definitions.

NO.200 Refer to the exhibit.

Which certificate can be used as the Forward Trust certificate?

Domain Sub-CA

Domain-Root-Cert

Certificate from Default Trusted Certificate Authorities

Forward-Trust

NO.201 What are the differences between using a service versus using an application for Security Policy match?

Use of a “service” enables the firewall to take immediate action with the first observed packet based on port numbers. Use of an “application” allows the firewall to take immediate action if the port being used is a member of the application standard port list.

There are no differences between “service” or “application”. Use of an “application” simplifies configuration by allowing use of a friendly application name instead of port numbers.

Use of a “service” enables the firewall to take immediate action with the first observed packet based on port numbers. Use of an “application” allows the firewall to take action after enough packets allow for App-ID identification regardless of the ports being used

Use of a “service” enables the firewall to take action after enough packets allow for App-ID identification

NO.202 A firewall engineer creates a new App-ID report under Monitor > Reports > Application Reports > New Application to monitor new applications on the network and better assess any Security policy updates the engineer might want to make.
How does the firewall identify the New App-ID characteristic?

It matches to the New App-IDs downloaded in the last 30 days.

It matches to the New App-IDs downloaded in the last 90 days

It matches to the New App-IDs installed since the last time the firewall was rebooted

It matches to the New App-IDs in the most recently installed content releases.

NO.203 Which is the maximum number of samples that can be submitted to WildFire per day, based on wildfire subscription?

15,000

10,000

75,00

5,000

NO.204 A firewall should be advertising the static route 10 2 0 0/24 into OSPF The configuration on the neighbor is correct but the route is not in the neighbor’s routing table Which two configurations should you check on the firewall’? (Choose two )

Within the redistribution profile ensure that Redist is selected

In the redistribution profile check that the source type is set to “ospf”

In the OSFP configuration ensure that the correct redistribution profile is selected in the OSPF Export Rules section

Ensure that the OSPF neighbor state is “2-Way”

NO.205 Which two options prevent the firewall from capturing traffic passing through it? (Choose two.)

The firewall is in multi-vsys mode.

The traffic is offloaded.

The traffic does not match the packet capture filter.

The firewall’s DP CPU is higher than 50%.

NO.206 A company wants to install a PA-3060 firewall between two core switches on a VLAN trunk link.
They need to assign each VLAN to its own zone and assign untagged (native) traffic to its own zone.
Which option differentiates multiple VLANs into separate zones?

Create V-Wire objects with two V-Wire interfaces and define a range of “0-4096” in the “Tag Allowed” field of the V-Wire object.

Create V-Wire objects with two V-Wire subinterfaces and assign only a single VLAN ID to the
“Tag Allowed” field of the V-Wire object. Repeat for every additional VLAN and use a VLAN ID of 0 for untagged traffic. Assign each interface/subinterface to a unique zone.

Create Layer 3 subinterfaces that are each assigned to a single VLAN ID and a common virtual router.
The physical Layer 3 interface would handle untagged traffic. Assign each interface/subinterface to a unique zone. Do not assign any interface an IP address.

Create VLAN objects for each VLAN and assign VLAN interfaces matching each VLAN ID.
Repeat for every additional VLAN and use a VLAN ID of 0 for untagged traffic. Assign each interface/subinterface to a unique zone.

NO.207 A Security policy rule is configured with a Vulnerability Protection Profile and an action of
‘Deny”.
Which action will this cause configuration on the matched traffic?

The configuration is invalid. The Profile Settings section will be grayed out when the Action is set to “Deny”.

The configuration will allow the matched session unless a vulnerability is detected. The
“Deny” action will supersede the per-severity defined actions defined in the associated Vulnerability Protection Profile.

The configuration is invalid. It will cause the firewall to skip this Security policy rule. A warning will be displayed during a commit.

The configuration is valid. It will cause the firewall to deny the matched sessions. Any configured Security Profiles have no effect if the Security policy rule action is set to “Deny.”

NO.208 Refer to exhibit.

An organization has Palo Alto Networks NGFWs that send logs to remote monitoring and security management platforms. The network team has reported excessive traffic on the corporate WAN.
How could the Palo Alto Networks NGFW administrator reduce WAN traffic while maintaining support for all existing monitoring/ security platforms?

Forward logs from firewalls only to Panorama and have Panorama forward logs to other external services.

Forward logs from external sources to Panorama for correlation, and from Panorama send them to the NGFW.

Configure log compression and optimization features on all remote firewalls.

Any configuration on an M-500 would address the insufficient bandwidth concerns.

NO.209 An administrator needs to upgrade a Palo Alto Networks NGFW to the most current version of PAN- OS software. The firewall has internet connectivity through an Ethernet interface, but no internet connectivity from the management interface. The Security policy has the default security rules and a rule that allows all web-browsing traffic from any to any zone. What must the administrator configure so that the PAN-OS software can be upgraded?

Security policy rule

CRL

Service route

Scheduler

NO.210 A firewall administrator wants to avoid overflowing the company syslog server with traffic logs.
What should the administrator do to prevent the forwarding of DNS traffic logs to syslog?

Disable logging on security rules allowing DNS.

Go to the Log Forwarding profile used to forward traffic logs to syslog. Then, under traffic logs match list, create a new filter with application not equal to DNS.

Create a security rule to deny DNS traffic with the syslog server in the destination

Go to the Log Forwarding profile used to forward traffic logs to syslog. Then, under traffic logs match list, create a new filter with application equal to DNS.

NO.211 Which User-ID method should be configured to map IP addresses to usernames for users connected through a terminal server?

port mapping

server monitoring

client probing

XFF headers

NO.212 Which operation will impact the performance of the management plane?

Decrypting SSL sessions

Generating a SaaS Application report

Enabling DoS protection

Enabling packet buffer protection

NO.213 An administrator configures a site-to-site IPsec VPN tunnel between a PA-850 and an external customer on their policy-based VPN devices.
What should an administrator configure to route interesting traffic through the VPN tunnel?

Proxy IDs

ToS Header

GRE Encapsulation

Tunnel Monitor