Nov-2023 Palo Alto Networks PCSFE Actual Questions and 100% Cover Real Exam Questions [Q25-Q39]

4/5 - (3 votes)

Nov-2023 Palo Alto Networks PCSFE Actual Questions and 100% Cover Real Exam Questions

PCSFE Free Exam Questions and Answers PDF Updated on Nov-2023

Q25. Why are VM-Series firewalls and hardware firewalls that are external to the Kubernetes cluster problematic for protecting containerized workloads?

They are located outside the cluster and have no visibility into application-level cluster traffic.

They do not scale independently of the Kubernetes cluster.

They are managed by another entity when located inside the cluster.

They function differently based on whether they are located inside or outside of the cluster.

Q26. Which protocol is used for communicating between VM-Series firewalls and a gateway load balancer in Amazon Web Services (AWS)?

VRLAN

Geneve

GRE

VMLAN

Q27. Which two mechanisms could trigger a high availability (HA) failover event? (Choose two.)

Heartbeat polling

Ping monitoring

Session polling

Link monitoring

Q28. Where do CN-Series devices obtain a VM-Series authorization key?

Panorama

Local installation

GitHub

Customer Support Portal

Q29. Which offering inspects encrypted outbound traffic?

WildFire

TLS decryption

Content-ID

Advanced URL Filtering (AURLF)

Q30. What is a benefit of network runtime security?

It more narrowly focuses on one security area and requires careful customization integration and maintenance

It removes vulnerabilities that have been baked into containers.

It is siloed to enhance workload security.

It identifies unknown vulnerabilities that cannot be identified by known Common Vulnerability and Exposure (CVE) lists.

Q31. Which PAN-OS feature allows for automated updates to address objects when VM-Series firewalls are setup as part of an NSX deployment?

Boundary automation

Hypervisor integration

Bootstrapping

Dynamic Address Group

Q32. How does a CN-Series firewall prevent exfiltration?

It employs custom-built signatures based on hash

It distributes incoming virtual private cloud (VPC) traffic across the pool of VM-Series firewalls.

It provides a license deactivation API key.

It inspects outbound traffic content and blocks suspicious activity.

Q33. Which two public cloud platforms does the VM-Series plugin support? (Choose two.)

Azure

llBM Cloud

Amazon Web Services

lOCI

Q34. Which two criteria are required to deploy VM-Series firewalls in high availability (HA)? (Choose two.)

Assignment of identical licenses and subscriptions

Deployment on a different host

Configuration of asymmetric routing

Deployment on same type of hypervisor

Q35. Which two configuration options does Palo Alto Networks recommend for outbound high availability (HA) design in Amazon Web Services using a VM-Series firewall? (Choose two.)

Transit VPC and Security VPC

Traditional active-active HA

Transit gateway and Security VPC

Traditional active-passive HA

Q36. When implementing active-active high availability (HA), which feature must be configured to allow the HA pair to share a single IP address that may be used as the network’s gateway IP address?

ARP load sharing

Floating IP address

HSRP

VRRP

Q37. A customer in a VMware ESXi environment wants to add a VM-Series firewall and partition an existing group of virtual machines (VMs) in the same subnet into two groups. One group requires no additional security, but the second group requires substantially more security.
How can this partition be accomplished without editing the IP addresses or the default gateways of any of the guest VMs?

Edit the IP address of all of the affected VMs. www*

Create a new virtual switch and use the VM-Series firewall to separate virtual switches using virtual wire mode. Then move the guests that require more security into the new virtual switch.

Create a Layer 3 interface in the same subnet as the VMs and then configure proxy Address Resolution Protocol (ARP).

Send the VLAN out of the virtual environment into a hardware Palo Alto Networks firewall in Layer 3 mode. Use the same IP address as the old default gateway, then delete it.

Q38. What is a design consideration for a prospect who wants to deploy VM-Series firewalls in an Amazon Web Services (AWS) environment?

Special AWS plugins are needed for load balancing.

Resources are shared within the cluster.

Only active-passive high availability (HA) is supported.

High availability (HA) clusters are limited to fewer than 8 virtual appliances.

Q39. How are CN-Series firewalls licensed?

Data-plane vCPU

Service-plane vCPU

Management-plane vCPU

Control-plane vCPU