Pass Your Palo Alto Networks PCNSE7 Exam Easy!

Hey,

The dump is still valid ?

Thanks

Which three options are available when creating a security profile? (Choose three)

A. Anti-Malware
B. File Blocking
C. Url Filtering
D. IDS/ISP
E. Threat Prevention
F. Antivirus

should be B C F

PLEASE SEND ME LATEST FILE, because i failed today exam

hi all,
i am from india, i failed the exam on 6 JANUARY 2017, because i found 30 new questions
CAN any one tell me INDIA QUESTION PAPER IS DIFFERENT OR NOT

Question 1

What is the URL for the full list of applications recognized by Palo Alto Networks?

http://www.Applipedia.com
http://www.MyApplipedia.com
http://applipedia.paloaltonetworks.com
http://applications.paloaltonetworks.com


Question 2

What does App-ID inspect to identify an application?

Source IP
Source Port
TTL
Data Payload
Hash
Encryption Key


Question 3

If malware is detected on the internet perimeter, what other places in the network might be affected?

Cloud
Endpoints
Branch Offices
All of the above
Data Center


Question 4

What are the major families of file types now supported by Wildfire in PAN-OS 7.0?

All executable files and all files with a MIME type
All executable files, PDF files, Microsft Office files and Adobe Flash applets
PE files, Microsoft Office, PDF, Java applets, APK, and Flash
All executable files, PDF files and Microsft Office files

Question 5

Which of the following are critical features of a Next Generation Firewall that provide Breach prevention? Choose two.
Alarm generation of known threats traversing the device
Application Visibility and URL Categorization
Endpoint and server scanning for known malware
Processing all traffic across all ports & protocols, in both directions
Centralized or distributed log collectors


Question 6

True or False: One of the advantages of Single Pass Parallel Processing (SP3) is that traffic can be scanned as it crosses the firewall with minimum amount of buffering, which in turn can allow advanced features like virus/malware scanning without effecting firewall performance
True False


Question 7

Which hardware platform should I consider if the customer needs at least 1 Gbps of Threat Prevention throughput and the ability to handle at least 250K sessions?

Any PA-5000 or PA-7000 series firewall
Only the PA-3060 firewall and higher
Any PA-3000, PA-5000, or PA-7000 series firewall
Only the PA-3050 firewall and higher


Question 8

True or False: DSRI degrades the performance of a firewall?
True False


Question 9

How quickly are Wildfire updates about previously unknown files now being delivered from the cloud to customers with a WildFire subscription (as of version 6.1)?

15 minutes
30 minutes
1 day
5 minutes
60 minutes


Question 10

Which of the following are valid Subscriptions for the Next Generation Platform? [Select All that apply]
URL Filtering
Support
User ID
Content ID
SSL Decryption
Threat Prevention
App ID

Question 11

Which hardware firewall platforms include both built-in front-to-back airflow and redundant power supplies?

All PA-5000 and PA-7000 series firewall platforms
All Palo Alto Networks hardware firewall platforms
The PA-3060 firewall platform
The PA-7000 series firewall platforms



Question 12

Select all the platform components that Wildfire automatically updates after finding malicious activity in previously unknown files, URLs and APKs?
Decrypt (Port-Mirroring)
Mobile (Global Protect)
Anti-Virus (Threat)
Content/Web Filtering (Pan-DB)
Anti-Malware signatures (WildFire)
Management (Panorama)
Anti Command & Control signatures (Threat)



Question 13

What are five benefits of Palo Alto Networks NGFWs (Next Generation Firewalls)? (Select the five correct answers.)
Convenient configuration Wizard
Comprehensive security platform designed to scale functionality over time
Predictable throughput
Easy-to-use GUI which is the same on all models
Seemless integration with the Threat Intelligence Cloud
Identical security subscriptions on all models



Question 14

What are the three key components of a successful Three Tab Demo? (Select the three correct answers.)
Providing visibility into recently occurring threats and showing how to block those threats
Showing how Palo Alto Networks' firewalls provide visibility into applications and control of those applications
Presenting the information in the Network and Device tabs
After setting match criteria in the Object tab showing how that data is presented in the logs
Showing which users are running which applications and provide a method for controlling application access on a by user



Question 15

What are the main benefits of WildFire? (Select the three correct answers.)
WildFire gathers information from possible threats detected by both NGFWs and Endpoints.
It's a sandboxing environment that can detect malware by observing the behavior of unknown files.
By using Palo Alto Networks' proprietary cloud-based architecture, quarantine holds on suspicious files are typically reduced to less than 30 seconds.
By collecting and distributing malware signatures from every major anti-virus vendor, WildFire can provide comprehensive protection.
Signatures for identified malware are quickly distributed globally to all Palo Alto Networks' customers' firewalls.



Question 16

The automated Correlation Engine uses correlation objects to analyze the logs for patterns. When a match occurs:

The Correlation Engine blocks the connection
The Correlation Engine generates a correlation event
The Correlation Engine displays a warning message to the end user
The Correlation Engine dumps the alarm log



Question 17

Which one of these is not a factor impacting sizing decisions?

Decryption
Sessions
Redundancy
Number of applications
Performance
Number of rules


Question 18

TRUE or FALSE: Many customers purchase Palo Alto Networks NGFWs (Next Generation Firewalls) just to gain previously unavailable levels of visibility into their traffic flows.

TRUE
FALSE



Question 19

A spike in dangerous traffic is observed. Which of the following PanOS tabs would an administrator utilize to identify culpable users.
ACC
Monitor
Objects
Network
Policies
Device


Question 20

True or False: PAN-DB is a service that aligns URLs with category types and is fed to the WildFire threat cloud.
True False

THANKS TO ALL,
I WRITE THE EXAM ON 31 12 2016 AND I PASSED IN THE EXAM, SO THANKS TO ALL OF THEM

@Anthony
i know for a fact these numbers below are wrong and i am looking for the correct answers also
5,8,9,10,14,17,20,21,26,32

@ANTONY MELVIN

Answer B as "show system log" command doesn't exist.

Event on the System log would like -
(subtype eq ha) and ( severity eq high ) and ( eventid eq state-change ) and ( description contains 'HA Group 1: Moved from state Passive to state Active' )

A or B?
A company has a pair of Palo Alto Networks firewalls configured as an Acitve/Passive High Availability (HA) pair.
What allows the firewall administrator to determine the last date a failover event occurred?
A. From the CLI issue use the show System log
B. Apply the filter subtype eq ha to the System log
C. Apply the filter subtype eq ha to the configuration log
D. Check the status of the High Availability widget on the Dashboard of the GUI

@MINT55, I COMPARED BUT I HAVE SOME DOUBT AND
THESE answer are really correct or some changes are there
if there means what changes are there.

SO PLEASE tell me the correct answer for 34 and 36.

1 B - CLICK the exception tab and then click show all sinatures.
2 AC
3 BE
4 D
5 C
6 C
7 BCF
8 C
9 A (people have input why this is not correct ) ??
10 BD
11 C
12 ABF
13 A
14 A
15 D
16 A
17 C
18 BCF
19 BD
20 A
21 D
22 BE
23 CD
24 A
25 CD
26 A
27 A
28 D
29 C
30 D
31 B (I was thinking that the menu would still be there even though no entrys is there, so D is wrong, is should be wrong also since only advanced wildfire REQUIRES a licens)
32 B
33 C
34 BDE or ADE
35 ABE
36 BEF OR ADF
37 A
38 A
39 D
40 B
41 B
42 A
43 B
44 AD (does anyone have a different answer and why ??)
45 D
46 C
47 BC
48 ACE
49 D
50 D
51 CD (Can anyone confirm ? the A is also right) ??

HI ALL,
THIS is my answer but i failed in the exam, so you tell me which answer was wrong please

1. Click the Exceptions tab and then click show all signatures.
2. The device are licensed and ready for deployment, The management interface has an IP ADDRESS OF 192.168.1.1 and allows SSH and HTTPS CONNECTIOS.
3. Configure Ethernet 1/1 as HA1 Backup, Configure the management interface as HA1 BACKUP
4. Click on the Bittorrent application link to view network activity.
5. It issues certificates encountered on the untrust security zone when clients attempt to connect to a site that has be decrypted.
6. Test cp-Policy-match
7. BLOCK, ALERT, CONTINUE.
8. Set the type to aggregate, check the Sessions box and set the Maximum concurrent Sessions to 4000.
9. Check the status of the high availability widget on the dashboard of the Gui
10. Test panoramas-connect 10.10.10.5, Show arp all I match 10.10.10.5.
11. Machine Certificate.
12. SNMP TRAP,Email,Syslog.
13. Vulnerability Protection Profiles applied to ourbound security policies with action set to block.
14. The Proxy IDs on the Palo Alto Networks Firewall do not match the Settings on the ASA.
15. Panorama automatically deletes older logs to create space for new ones.
16. Global Protect Linux.
17. Add the DNS App-ID to Rule2.
18. File Blocking, Url Filtering, Antivirus.
19. DOS Protection Profile, Zone Protection Profile
20. Qos Statistics
21. Classified Dos protection Policy using destination Ip only with a Protect action.
22. Enter the command request system system-mode logger then enter Y to confirm the change to log collector mode, Log in the Panorama CLI of the dedicated Log collector.
23. A NAT rule with a source of any untrust-L3 Zone to a destination of 10.1.1.100 in dmz-zone using service-https service, A security policy with a source of any from untrust-L3 zone to destination of 1.1.1.100 in dmz-L3 zone using web-browsing application.
24. Test security–policy-match source destinationdestination port
25. PAN-DB URL Filtering, DNS-based command-and-control-signatures.
26. Configuration and serial number files
27. Untrust-L3
28. Create a custom application without signatures, then create an application override policy that includes the source, Destination, Destination Port/Protocol and Custom Application of the traffic.
29. Pre-NAT addtess and Post NAT zones .
30. Blocked Activity
31. The Firewall does not have an acitive Wildfire Subscription.
32. Pre Rules.
33. 172.20.40.1
34. Dynamic routing, Network Pocessing, Signature Match.
35. XML API, 802.1X, Server Monitoring
36. Bengin, Grayware, Malware.
37. The packets are hardware offloaded to the offloaded processor on the dataplane.
38. Disable Server Response Inspection.
39. Device > Setup > Service > Service Route Configuration.
40. From the CLI, issue the show counter global filter packet-filter yes command.
41. Interface ehternet 1/3 is in Layer 2 mode and interface Ethernet ¼ is in Layer 3 mode.
42. Server Certificate
43. SubInterface
44. A report can be created that identifies unclassified traffic on the network, Different security profiles can be applied to traffic matching rules 2 and 3.
45. The management port may be used for a backup control conection.
46. VM-1000-HV
47. LOOP back, Layer 3
48. E-mail links, Jar files, portable Executable(PE) Files.
49. None of the firewall’s policies have been assigned a Log Forwarding profile.
50. TACACS+
51. Traffic utilizing UDP Port 16384 will now be identified as “rtp-base”, Traffic utilizing UDP Port 16384 will bypass the App-ID and content ID engines.

Hi all , any idea what is passing score for the exam

Thanks Rahul, I will have a try and see how is going, thanks again for your help.

Hi Eric,

Following are the answers that I think are correct:
1. B,D,E
2. A (note that the question says that imported back into FIREWALL not Panorama. If INTO Panorama then B)
3. C
4. B, C, F (not A because the profile is called Anti-Spyware and not Anti-Malware)
5. A, E, F
6. C, D
7. If the admin at branch office allowed to Override then Answer: Post Rules
If the admin at branch office NOT allowed to Override then Answer: Pre Rules
8. B, D
9. A, D (This is tricky. Carefully study the NAT Policy fields)
10. C
11. C
12. A
13. A, C
14. A, B, F
15. A, D
16. A,C,E
17. A, C
18. Not sure
19. A
20. C (but depends on the topology that is presented in the exam)
21. B
22. Not sure
23. Not sure
24. D

Thanks Rahul, I would like to check the following questions and answer which I am not sure, will you be able to help?

1. B C D or B D E?
Which three fields can be included in a pcap filter? (Choose three)
A. Egress interface
B. Source IP
C. Rule number
D. Destination IP
E. Ingress interface

2. B or A?
A network security engineer is asked to perform a Return Merchandise Authorization (RMA) on a firewall
Which part of files needs to be imported back into the replacement firewall that is using Panorama?
A. Device state and license files
B. Configuration and serial number files
C. Configuration and statistics files
D. Configuration and Large Scale VPN (LSVPN) setups file

3. A or C?
Only two Trust to Untrust allow rules have been created in the Security policy
Rule1 allows google-base
Rule2 allows youtube-base
The youtube-base App-ID depends on google-base to function. The google-base App-ID implicitly uses SSL and web-browsing. When user try to access https://www.youtube.com in a web browser, they get an error indicating that the server cannot be found.
Which action will allow youtube.com display in the browser correctly?
A. Add SSL App-ID to Rule1
B. Create an additional Trust to Untrust Rule, add the web-browsing, and SSL App-ID's to it
C. Add the DNS App-ID to Rule2
D. Add the Web-browsing App-ID to Rule2

4. A B F or B C F?
Which three options are available when creating a security profile? (Choose three)
A. Anti-Malware
B. File Blocking
C. Url Filtering
D. IDS/ISP
E. Threat Prevention
F. Antivirus

5. A D F or A E F?
A company is upgrading its existing Palo Alto Networks firewall from version 7.0.1 to 7.0.4.
Which three methods can the firewall administrator use to install PAN-OS 7.0.4 across the enterprise? ( Choose three)
A. Download PAN-OS 7.0.4 files from the support site and install them on each firewall after manually uploading.
B. Download PAN-OS 7.0.4 to a USB drive and the firewall will automatically update after the USB drive is inserted in the firewall.
C. Push the PAN-OS 7.0.4 updates from the support site to install on each firewall.
D. Push the PAN-OS 7.0.4 update from one firewall to all of the other remaining after updating one firewall.
E. Download and install PAN-OS 7.0.4 directly on each firewall.
F. Download and push PAN-OS 7.0.4 from Panorama to each firewall.

6. B D or C D?
The web server is configured to listen for HTTP traffic on port 8080. The clients access the web server using the IP address 1.1.1.100 on TCP Port 80. The destination NAT rule is configured to translate both IP address and report to 10.1.1.100 on TCP Port 8080. Which NAT and security rules must be configured on the firewall? (Choose two)
A. A security policy with a source of any from untrust-I3 Zone to a destination of 10.1.1.100 in dmz-I3 zone using web-browsing application
B. A NAT rule with a source of any from untrust-I3 zone to a destination of 10.1.1.100 in dmz-zone using service-http service.
C. A NAT rule with a source of any from untrust-I3 zone to a destination of 1.1.1.100 in untrust-I3 zone using service-http service.
D. A security policy with a source of any from untrust-I3 zone to a destination of 1.1.1.100 in dmz-I3 zone using web-browsing application.

7. A or B?
A network administrator uses Panorama to push security polices to managed firewalls at branch offices. Which policy type should be configured on Panorama if the administrators at the branch office sites to override these products?
A. Pre Rules
B. Post Rules
C. Explicit Rules
D. Implicit Rules

8. A C or B D?
A logging infrastructure may need to handle more than 10,000 logs per second.
Which two options support a dedicated log collector function? (Choose two)
A. Panorama virtual appliance on ESX(i) only
B. M-500
C. M-100 with Panorama installed
D. M-100

9. C D?
A company hosts a publically accessible web server behind a Palo Alto Networks next generation firewall with the following configuration information.
Users outside the company are in the "Untrust-L3" zone
The web server physically resides in the "Trust-L3" zone.
Web server public IP address: 23.54.6.10
Web server private IP address: 192.168.1.10
Which two items must be NAT policy contain to allow users in the untrust-L3 zone to access the web server? (Choose two)
A. Untrust-L3 for both Source and Destination zone
B. Destination IP of 192.168.1.10
C. Untrust-L3 for Source Zone and Trust-L3 for Destination Zone
D. Destination IP of 23.54.6.10

10. C or A?
How is the Forward Untrust Certificate used?
A. It issues certificates encountered on the Untrust security zone when clients attempt to connect to a site that has be decrypted
B. It is used when web servers request a client certificate.
C. It is presented to clients when the server they are connecting to is signed by a certificate authority that is not trusted by firewall.
D. It is used for Captive Portal to identify unknown users.

11. C or D?
Which Public Key infrastructure component is used to authenticate users for GlobalProtect when the Connect Method is set to pre-logon?
A. Certificate revocation list
B. Trusted root certificate
C. Machine certificate
D. Online Certificate Status Protocol

12. B or A?
An Administrator is configuring an IPSec VPN to a Cisco ASA at the administrator's home and experiencing issues completing the connection. The following is the output from the command:
What could be the cause of this problem?
A. The public IP addresses do not match for both the Palo Alto Networks Firewall and the ASA.
B. The proxy IDs on the Palo Alto Networks Firewall do not match the settings on the ASA.
C. The shared secerts do not match between the Palo Alto firewall and the ASA
D. The deed peer detection settings do not match between the Palo Alto Networks Firewall and the ASA

13. B D or A C?
The company's Panorama server (IP 10.10.10.5) is not able to manage a firewall that was recently deployed. The firewall's dedicated management port is being used to connect to the management network.
Which two commands may be used to troubleshoot this issue from the CLI of the new firewall? (Choose two)
A. test panoramas-connect 10.10.10.5
B. show panoramas-status
C. show arp all I match 10.10.10.5
D. topdump filter "host 10.10.10.5
E. debug dataplane packet-diag set capture on

14. A B F?
Which three log-forwarding destinations require a server profile to be configured? (Choose three)
A. SNMP Trap
B. Email
C. RADIUS
D. Kerberos
E. Panorama
F. Syslog

15. A B or A D?
A company has a policy that denies all applications it classifies as bad and permits only application it classifies as good. The firewall administrator created the following security policy on the company's firewall.
Which two benefits are gained from having both rule 2 and rule 3 presents? (Choose two)
A. A report can be created that identifies unclassified traffic on the network.
B. Different security profiles can be applied to traffic matching rules 2 and 3.
C. Rule 2 and 3 apply to traffic on different ports.
D. Separate Log forwarding profiles can be applied to rules 2 and 3.

16. A C E?
Which three options does the WF-500 appliance support for local analysis? (Choose three)
A. E-mail links
B. APK files
C. Jar files
D. PNG files
E. Portable Executable (PE) files

17. B C or A C?
Which two statements are correct for the out-of-box configuration for Palo Alto Networks NGFWs? (Choose two)
A. The devices are pre-configured with a virtual wire pair out the first two interfaces.
B. The devices are licensed and ready for deployment.
C. The management interface has an IP address of 192.168.1.1 and allows SSH and HTTPS connections.
D. A default bidirectional rule is configured that allows Untrust zone traffic to go to the Trust zone.
E. The interface are pingable.

18. A or D?
Company.com has an in-house application that the Palo Alto Networks device doesn't identify correctly. A Threat Management Team member has mentioned that this in-house application is very sensitive and all traffic being identified needs to be inspected by the Content-ID engine.
Which method should company.com use to immediately address this traffic on a Palo Alto Networks device?
A. Create a custom Application without signatures, then create an Application Override policy that includes the source, Destination, Destination Port/Protocol and Custom Application of the traffic.
B. Wait until an official Application signature is provided from Palo Alto Networks.
C. Modify the session timer settings on the closest referenced application to meet the needs of the in-house application
D. Create a Custom Application with signatures matching unique identifiers of the in-house application traffic

19. A or C?
A critical US-CERT notification is published regarding a newly discovered botnet. The malware is very evasive and is not reliably detected by endpoint antivirus software.
Furthermore, SSL is used to tunnel malicious traffic to command-and-control servers on the internet and SSL Forward Proxy Decryption is not enabled.
Which component once enabled on a perirneter firewall will allow the identification of existing infected hosts in an environment?
A. Anti-Spyware profiles applied outbound security policies with DNS Query action set to sinkhole
B. File Blocking profiles applied to outbound security policies with action set to alert
C. Vulnerability Protection profiles applied to outbound security policies with action set to block
D. Antivirus profiles applied to outbound security policies with action set to alert

20. B or C?
Click the Exhibit button below,
A firewall has three PBF rules and a default route with a next hop of 172.20.10.1 that is configured in the default VR. A user named Will has a PC with a 192.168.10.10 IP address. He makes an HTTPS connection to 172.16.10.20.
Which is the next hop IP address for the HTTPS traffic from Will's PC?
A. 172.20.30.1
B. 172.20.40.1
C. 172.20.20.1
D. 172.20.10.1

21. A or D?
A network security engineer has been asked to analyze Wildfire activity. However, the
Wildfire Submissions item is not visible form the Monitor tab.
What could cause this condition?
A. The firewall does not have an active WildFire subscription.
B. The engineer's account does not have permission to view WildFire Submissions.
C. A policy is blocking WildFire Submission traffic.
D. Though WildFire is working, there are currently no WildFire Submissions log entries.

22. B D E or A D E?
Which three functions are found on the dataplane of a PA-5050? (Choose three)
A. Protocol Decoder
B. Dynamic routing
C. Management
D. Network Processing
E. Signature Match

23. D or A?
Which setting allow a DOS protection profile to limit the maximum concurrent sessions from a source IP address?
A. Set the type to Aggregate, clear the session’s box and set the Maximum concurrent Sessions to 4000.
B. Set the type to Classified, clear the session’s box and set the Maximum concurrent Sessions to 4000.
C. Set the type to Classified, check the Sessions box and set the Maximum concurrent Sessions to 4000.
D. Set the type to aggregate, check the Sessions box and set the Maximum concurrent Sessions to 4000.

24. A or D?
A company has a pair of Palo Alto Networks firewalls configured as an Acitve/Passive High Availability (HA) pair.
What allows the firewall administrator to determine the last date a failover event occurred?
A. From the CLI issue use the show System log
B. Apply the filter subtype eq ha to the System log
C. Apply the filter subtype eq ha to the configuration log
D. Check the status of the High Availability widget on the Dashboard of the GUI

Just passed last week. All the questions are valid. BUT MANY ANSWERS ARE WRONG.
For Example, for Global Protect there is no Linux Agent. The correct Answer is "Third-party X-Auth IPsec Clients".

So please post the questions that you are not sure of and I will post the correct answers.

Will post a few questions that I have for there is conflicting information and hoping other will be able to provide the correct answers - Thanks

Hi every body,
I justed pass to day. This dump have 90% Q in exam.

Hi every body,
I justed pass to day. This dump have 90% Q in exam.

HI MINT55,
I FAILED THE EXAM
SO
PLEASE POST ANSWER ALONE PLESE AND NOT A,B,C,D.

Hi please assist with the dumps

Hi Minit55,

The answers you gave are not arranged according to the other answered like from MR A and pierre. Can you please provide according to the proper arrangements because we dont know the questions in your every answer. Thanks

Answers I PASSED WITH 18-11-2016
MY VCE PLAYER HAS NO PROBLEM OPENING ??

1 C
2 CD
3 D
4 A
5 A
6 A
7 B
8 BCF
9 A
10 D
11 C
12 ADF
13 A
14 B
15 D (be aware A says WITHOUT)
16 A
17 D
18 BDE
19 C
20 ABE
21 ABF
22 C
23 D
24 B ( NOT 100% SURE, BUT ONLY ADVANCED FEATURES REQUIRES LICENS, AND ON LOGS WOULD NT REMOVE THE TAB)
25 BD
26 C
27 (ERROR IN FILE, BUT BOTH ha 1 OPTIONS)
28 BD
29 AD
30 BD
31 C
32 BCF
33 D
34 B
35 CD
36 AEF
37 D
38 A
39 D
40 C
41 A (PROXY ID IS IN PHASE 2)
42 D
43 A (REAL TIME STATS)
44 CD
45 B (if we do PRE our rules would be first matched)

46 A
47 BC
48 A
49 C
50 A
51 C (SINGLE IP)
52 AD
53 AC
54 D
55 BE
56 B
57 B ( NOT 100% SURE HERE)
58 ACE
59 A
60 ADE

Hi All, the Answers will be updated tonight "! Very sorry for the delay.

@ Jude,
We checked the file.
File is correct.
You can write a letter to the support of your VCE player.

Hi

Error opening the file, please re upload.

Thank you very much.

Hi, can you please post the answers here..I cant able to open the vce file.

Hi Minit55,

Is this the answers you used in exam?

Hi, this file is not opening with A+ VCE player. Anyone was able to get it working ?
Also, is there any difference between it and the other one Pierre 51 questions ?