Palo Alto Networks Certified Security Engineer (PCNSE) PAN-OS 8.0: PCNSE8

A web server is hosted in the DMZ, and the server is configured to listen for incoming connections only on TCP port 8080. A Security policy rule allowing access from the Trust zone to the DMZ zone need to be configured to enable we

browsing access to the server.

Which application and service need to be configured to allow only cleartext web-browsing traffic to thins server on tcp/8080.

A. application: web-browsing; service: application-default

B. application: web-browsing; service: service-https

C. application: ssl; service: any

D. application: web-browsing; service: (custom with destination TCP port 8080)

A client has a sensitive application server in their data center and is particularly concerned about resource exhaustion because of distributed denial-of-service attacks. How can the Palo Alto Networks NGFW be configured to specifically protect this server against resource exhaustion originating from multiple IP addresses (DDoS attack)?

A. Define a custom App-ID to ensure that only legitimate application traffic reaches the server.

B. Add a Vulnerability Protection Profile to block the attack.

C. Add QoS Profiles to throttle incoming requests.

D. Add a DoS Protection Profile with defined session count.

Which two mechanisms help prevent a spilt brain scenario an Active/Passive High Availability (HA) pair? (Choose two)

A. Configure the management interface as HA3 Backup

B. Configure Ethernet 1/1 as HA1 Backup

C. Configure Ethernet 1/1 as HA2 Backup

D. Configure the management interface as HA2 Backup

E. Configure the management interface as HA1 Backup

F. Configure ethernet1/1 as HA3 Backup