ベスト良質なPalo Alto Networks PCNSE試験問題JPNTestリアル練習試験 [2025]
重要な試験問題でPalo Alto Networks Certified Network Security Engineer Exam一発合格
PCNSE認定は、サイバーセキュリティ業界でのキャリアを促進しようとしているネットワークセキュリティエンジニアにとって貴重な資産です。認定は世界的に認識されており、雇用主から非常に尊敬されています。 PCNSE認定は、Palo Alto Networks Technologiesにおける候補者の専門知識と、効果的なセキュリティソリューションを設計および実装する能力を示しています。また、エンタープライズネットワークを管理および保護するための知識とベストプラクティスを共有できる認定専門家のコミュニティへのアクセスを提供します。
質問 # 96
The firewall identifies a popular application as an unknown-tcp.
Which two options are available to identify the application? (Choose two.)
- A. Create a custom application.
- B. Submit an Apple-ID request to Palo Alto Networks.
- C. Create a Security policy to identify the custom application.
- D. Create a custom object for the custom application server to identify the custom application.
正解：A、D
解説：
Reference:
https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/app-id/use-application-objects-in-policy/cre custom-application
質問 # 97
As a best practice, logging at session start should be used in which case?
- A. Only when log at session end is enabled
- B. On all Allow rules
- C. Only on Deny rules
- D. While troubleshooting
正解：D
質問 # 98
An engineer is configuring SSL Inbound Inspection for public access to a company's application. Which certificate(s) need to be installed on the firewall to ensure that inspection is performed successfully?
- A. Self-signed CA and End-entity certificate
- B. Root CA and Intermediate CA(s)
- C. Self-signed certificate with exportable private key
- D. Intermediate CA (s) and End-entity certificate
正解：D
解説：
https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/decryption/configure-ssl-inbound-inspection We recommend uploading a certificate chain (a single file) to the firewall if your end-entity (leaf) certificate is signed by one or more intermediate certificates and your web server supports TLS 1.2 and Rivest, Shamir, Adleman (RSA) or Perfect Forward Secrecy (PFS) key exchange algorithms. Uploading the chain avoids client-side server certificate authentication issues. You should arrange the certificates in the file as follows: End-entity (leaf) certificate Intermediate certificates (in issuing order) (Optional) Root certificate
質問 # 99
An administrator has been asked to configure a Palo Alto Networks NGFW to provide protection against external hosts attempting to exploit a flaw in an operating system on an internal system.
Which Security Profile type will prevent this attack?
- A. Vulnerability Protection
- B. Antivirus
- C. URL Filtering
- D. Anti-Spyware
正解：A
解説：
Explanation/Reference: https://www.paloaltonetworks.com/documentation/80/pan-os/web-interface-help/objects/objects- security-profiles-vulnerability-protection
質問 # 100
Click the Exhibit button below,
A firewall has three PBF rules and a default route with a next hop of 172.20.10.1 that is configured in the default VR. A user named Will has a PC with a 192.168.10.10 IP address. He makes an HTTPS connection to
172.16.10.20.
Which is the next hop IP address for the HTTPS traffic from Will's PC?
- A. 172.20.10.1
- B. 172.20.40.1
- C. 172.20.30.1
- D. 172.20.20.1
正解：D
質問 # 101
A firewall engineer creates a source NAT rule to allow the company's internal private network 10.0.0.0/23 to access the internet. However, for security reasons, one server in that subnet (10.0.0.10/32) should not be allowed to access the internet, and therefore should not be translated with the NAT rule.
Which set of steps should the engineer take to accomplish this objective?
- A. 1- Create a NAT rule (NAT-Rule-1) and set the source address in the original packet to 10.0.0.0/23.
2. Check the box for negate option to negate this IP subnet from NAT translation. - B. 1. Create a source NAT rule (NAT-Rule-1) to translate 10.0.0/23 with source address translation set to dynamic IP and port.
2. Create another NAT rule (NAT-Rule-2) with source IP address in the original packet set to 10.0.0.10/32 and source translation set to none.
3. Place (NAT-Rule-2) above (NAT-Rule-1). - C. 1. Create a source NAT rule (NAT-Rule-1) to translate 10.0.0/23 with source address translation set to dynamic IP and port.
2. Create another NAT rule (NAT-Rule-2) with source IP address in the original packet set to 10.0.0.10/32 and source translation set to none.
3. Place (NAT-Rule-1) above (NAT-Rule-2). - D. 1. Create a NAT rule (NAT-Rule-1) and set the source address in the original packet to 10.0.0.10/32.
2. Check the box for negate option to negate this IP from the NAT translation.
正解：B
解説：
In Palo Alto Networks firewalls, the processing of NAT rules occurs in a top-down fashion, similar to security policies. To exclude a specific IP address from a broader source NAT rule, a more specific NAT rule must be placed above the broader rule.
C . Place a more specific NAT rule above the broader one:
Create a source NAT rule (NAT-Rule-1) to translate the broader network range (10.0.0.0/23) with dynamic IP and port translation. This rule allows the majority of the subnet to access the internet through NAT.
Create another NAT rule (NAT-Rule-2) with the source IP address in the original packet set specifically to the IP address that should not be translated (10.0.0.10/32). In this rule, set the source translation to none, indicating that this traffic should not be translated and thus not allowed to access the internet.
Place NAT-Rule-2 above NAT-Rule-1 in the NAT policy list. This ensures that the more specific rule (NAT-Rule-2) is evaluated first. If traffic matches NAT-Rule-2, it will not be translated or allowed to the internet, effectively excluding the specific server from internet access.
This configuration leverages the principle of specificity and the order of operation in NAT policies to exclude a specific IP address from source NAT translation, thereby preventing it from accessing the internet.
質問 # 102
What happens when an A/P firewall cluster synchronizes IPsec tunnel security associations (SAs)?
- A. Phase 1 and Phase 2 SAs are synchronized over HA2 links.
- B. Phase 2 SAs are synchronized over HA2 links.
- C. Phase 1 and Phase 2 SAs are synchronized over HA3 links.
- D. Phase 1 SAs are synchronized over HA1 links.
正解：B
解説：
Explanation
From the Palo Alto documentation below, "when a VPN is terminated on a Palo Alto firewall HA pair, not all IPSEC related information is synchronized between the firewalls... This is an expected behavior. IKE phase 1 SA information is NOT synchronized between the HA firewalls." And from the second link, "Data link (HA2) is used to sync sessions, forwarding tables, IPSec security associations, and ARP tables between firewalls in the HA pair. Data flow on the HA2 link is always unidirectional (except for the HA2 keep-alive). It flows from the active firewall to the passive firewall."
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HAuZCAW&lang=en_US%E
https://help.aryaka.com/display/public/KNOW/Palo+Alto+Networks+NFV+Technical+Brief
質問 # 103
The firewall is not downloading IP addresses from MineMeld. Based, on the image, what most likely is wrong?
- A. The source address supports only files hosted with an ftp://<address/file>.
- B. External Dynamic Lists do not support SSL connections.
- C. A Certificate Profile that contains the CA certificate needs to be selected.
- D. A Certificate Profile that contains the client certificate needs to be selected.
正解：C
質問 # 104
When using the predefined default profile, the policy will inspect for viruses on the decoders. Match each decoder with its default action.
Answer options may be used more than once or not at all.
正解：
解説：
Explanation
IMAP , POP3 , SMTP - > Alert
HTTP,FTP,SMB -> Reset-both
質問 # 105
Which CLI command enables an administrator to check the CPU utilization of the dataplane?
- A. debug running resources
- B. show running resource-monitor
- C. debug data-plane dp-cpu
- D. show system resources
正解：B
解説：
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClXwCAK
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CluDCAS
質問 # 106
Which three options are supported in HA Lite? (Choose three.)
- A. Virtual link
- B. Active/passive deployment
- C. Configuration synchronization
- D. Session synchronization
- E. Synchronization of IPsec security associations
正解：B、C、E
解説：
HA Lite is an active/passive deployment that provides configuration synchronization and some run-time data synchronization such as IPsec security associations. It does not support session synchronization (HA2), and therefore does not offer stateful failover.
質問 # 107
Which interface configuration will accept specific VLAN IDs?
- A. Trunk Interface
- B. Subinterface
- C. Tab Mode
- D. Access Interface
正解：B
解説：
You can only assign a single VLAN to a subinterface, and not to the physical interface. Each subinterface must have a VLAN ID before it can pass traffic.
http://www.cisco.com/c/en/us/td/docs/security/asa/asa72/configuration/guide/conf_gd/intrface.htm l
質問 # 108
Place the steps in the WildFire process workflow in their correct order.
正解：
解説：
質問 # 109
How is an address object of type IP range correctly defined?
- A. 192.168 40 1, 192.168 40.255
- B. 192 168 40 1-255
- C. 192 168 40 1-192 168 40 255
- D. 192.168 40 1/24
正解：C
質問 # 110
An administrator would like to determine which action the firewall will take for a specific CVE. Given the screenshot below, where should the administrator navigate to view this information?
- A. The profile rule threat name
- B. Exceptions lab
- C. The profile rule action
- D. CVE column
正解：C
質問 # 111
Which two virtualization platforms officially support the deployment of Palo Alto Networks VM- Series firewalls? (Choose two.)
- A. Boot Strap Virtualization Module (BSVM)
- B. Kernel Virtualization Module (KVM)
- C. Red Hat Enterprise Virtualization (RHEV)
- D. Microsoft Hyper-V
正解：B、D
解説：
Reference: https://www.paloaltonetworks.com/products/secure-the-network/virtualized-next- generation-firewall/vm-series
質問 # 112
While troubleshooting an issue, a firewall administrator performs a packet capture with a specific filter. The administrator sees drops for packets with a source IP address of 10.1.1.1.
How can the administrator further investigate these packet drops by looking at the global counters for this packet capture filter?
- A. > debug dataplane packet-diag set capture stage drop
- B. > show counter global filter delta yes I match 10.1.1-1
- C. > show counter global filter severity drop
- D. > show counter global filter packet-filter yes delta yes
正解：D
質問 # 113
Which option enables a Palo Alto Networks NGFW administrator to schedule Application and Threat updates while applying only new content IDs to traffic?
- A. Select download-and-install, with "Disable new apps in content update" selected
- B. Select download-and-install
- C. Select disable application updates and select "Install only Threat updates"
- D. Select download-only
正解：B
質問 # 114
Which Panorama administrator types require the configuration of at least one access domain? (Choose two)
- A. Template Admin
- B. Custom Panorama Admin
- C. Role Based
- D. Device Group
- E. Dynamic
正解：A、D
解説：
Explanation
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClETCA0
質問 # 115
Which Panorama feature allows for logs generated by Panorama to be forwarded to an external Security Information and Event Management(SIEM) system?
- A. Panorama Log Settings
- B. Panorama Log Templates
- C. Collector Log Forwarding for Collector Groups
- D. Panorama Device Group Log Forwarding
正解：A
解説：
https://www.paloaltonetworks.com/documentation/61/panorama/panorama_adminguide/ma nage-log-collection/enable-log-forwarding-from-panorama-to-external-destinations
質問 # 116
A bootstrap USB flash drive has been prepared using a Windows workstation to load the initial configuration of a Palo Alto Networks firewall that was previously being used in a lab. The USB flash drive was formatted using file system FAT32 and the initial configuration is stored in a file named init-cfg txt. The firewall is currently running PAN-OS 10.0 and using a lab config The contents of init-cfg txi in the USB flash drive are as follows:
The USB flash drive has been inserted in the firewalls' USB port, and the firewall has been restarted using command:> request resort system Upon restart, the firewall fails to begin the bootstrapping process. The failure is caused because
- A. The USB must be formatted using the ext3 file system, FAT32 is not supported
- B. PANOS version must be 91.x at a minimum but the firewall is running 10.0.x
- C. The hostname is a required parameter, but it is missing in init-cfg txt
- D. The bootstrap.xml file is a required file but it is missing
- E. Firewall must be in factory default state or have all private data deleted for bootstrapping
正解：A
解説：
Explanation
https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/firewall-administration/bootstrap-the-firewall/bootst
質問 # 117
A session in the Traffic log is reporting the application as "incomplete." What does "incomplete" mean?
- A. The traffic is coming across USP, and the application could not be identified.
- B. The three-way TCP handshake did not complete.
- C. The three-way TCP handshake was observed, but the application could not be identified.
- D. Data was received but was instantly discarded because of a Deny policy was applied before App-ID could be applied.
正解：A
質問 # 118
A customer is replacing their legacy remote access VPN solution The current solution is in place to secure internet egress and provide access to resources located in the main datacenter for the connected clients.
Prisma Access has been selected to replace the current remote access VPN solution. During onboarding the following options and licenses were selected and enabled
What must be configured on Prisma Access to provide connectivity to the resources in the datacenter?
- A. Configure a mobile user gateway in the region closest to the datacenter to enable connectivity to the datacenter
- B. Configure a service connection to provide connectivity to the datacenter
- C. Configure Dynamic Routing to provide connectivity to the datacenter
- D. Configure a remote network to provide connectivity to the datacenter
正解：D
質問 # 119
A users traffic traversing a Palo Alto networks NGFW sometimes can reach http //www company com At other times the session times out. At other times the session times out The NGFW has been configured with a PBF rule that the user traffic matches when it goes to
http://www.company.com goes to http://www company com
How can the firewall be configured to automatically disable the PBF rule if the next hop goes down?
- A. Create and add a monitor profile with an action of wait recover in the PBF rule in question
- B. Configure path monitoring for the next hop gateway on the default route in the virtual router
- C. Create and add a monitor profile with an action of fail over in the PBF rule in question
- D. Enable and configure a link monitoring profile for the external interface of the firewall
正解：C
質問 # 120
......
PCNSE認定試験は、ファイアウォールテクノロジー、ネットワークセキュリティ、脅威防止、VPN、管理など、さまざまな分野のセキュリティエンジニアのスキルと知識をテストするように設計されています。この試験の目的は、Palo Alto Networks Technologiesを使用して安全なネットワークを設計および実装する候補者の能力を検証することを目的としています。この認定試験は、Palo Alto Networks製品とソリューションを使用して実践的な経験がある人なら誰でも利用できます。
PCNSE試験問題集合格保証：https://www.jpntest.com/shiken/PCNSE-mondaishu
ベスト良質なPalo Alto Networks PCNSE試験問題：https://drive.google.com/open?id=1pp1R3i9UKd4QQkHtLSs6aOwggIHg7iT4