Pass the Paloalto Networks Paloalto Certifications and Accreditations PCNSC Questions and answers with CertsForce

In Panorama, security rules are evaluated in a specific order to determine which rule applies to the traffic. The correct evaluation order is as follows:

Shared pre-rules(evaluated first)

Device group pre-rules(evaluated second)

Local firewall rules(evaluated third)

Device group post-rules(evaluated fourth)

Shared post-rules(evaluated fifth)

This order ensures that the most generic rules (shared across all devices) are evaluated first, followed by more specific rules at the device group and local firewall levels, and then the post-rules.

References:

Palo Alto Networks - Panorama Admin Guide: https://docs.paloaltonetworks.com/panorama/10-0/panorama-admin/policy/policy-precedence-and-evaluation-order

Palo Alto Networks - Security Policy Evaluation: https://knowledgebase.paloaltonetworks.com

To start using Device-ID to obtain policy rule recommendations, the customer needs to purchase:

A.a Cortex Data Lake license

The Cortex Data Lake is a cloud-based logging service that aggregates data from all Palo Alto Networks products and services. Device-ID uses this data to provide insights and recommendations for policy rules based on the identities of devices on the network.

References:

Palo Alto Networks - Cortex Data Lake: https://docs.paloaltonetworks.com/cortex/cortex-data-lake

Palo Alto Networks - Device-ID Overview: https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/policy/use-device-id-to-enforce-policy

The category of Vulnerability Signatures that is most likely to trigger false positive alerts is:

C.info-leak

Information leakage signatures are designed to detect attempts to access or disclose sensitive information. These signatures can be prone to false positives because benign activities or legitimate data transmissions can sometimes be mistakenly identified as information leaks.

References:

Palo Alto Networks - Managing False Positives in Threat Prevention: https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/threat-prevention/manage-false-positives-in-threat-prevention

Palo Alto Networks - Vulnerability Protection: https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/threat-prevention/vulnerability-protection

To create a secure Antivirus Profile to address a virus spreading internally over SMB, the administrator should choose the following set of actions for the SMB decoder:

B.Action - Reset-Both; Wildfire Action - Reset-Both

Choosing "Reset-Both" for both the Antivirus Action and the Wildfire Action ensures that the connection is terminated on both the client and server sides whenever a virus is detected. This action helps prevent the spread of the virus by cutting off the infected connection immediately.

References:

Palo Alto Networks - Antivirus Profile Best Practices: https://docs.paloaltonetworks.com/best-practices

Palo Alto Networks - Creating and Configuring Antivirus Profiles: https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/threat-prevention/antivirus-profiles

When a packet from an existing session is received by a firewall that is part of an HA (High Availability) pair:

D.The firewall takes ownership of the session from the peer firewall

In a high-availability configuration, if a firewall in an HA pair receives a packet for an existing session that it is not currently handling, it will take ownership of that session from the peer firewall. This ensures seamless continuity of the session and maintains the stateful nature of the firewall's session handling.

References:

Palo Alto Networks - High Availability Concepts: https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/high-availability/ha-concepts