PCSFE practice test

1. Question 1 · 1

   How is traffic directed to a Palo Alto Networks firewall integrated with Cisco ACI?

   Choose one answer.

   • By using contracts between endpoint groups that send traffic to the firewall using a shared policy
   • Through a virtual machine (VM) monitor domain
   • Through a policy-based redirect (PBR)
   • By creating an access policy

2. Question 2 · 1

   Which deployment method should a GCP administrator use to deploy a VM-Series firewall to secure east-west traffic between Virtual Private Clouds (VPCs)?

   Choose one answer.

   • Internet gateway
   • Hybrid IPSec VPN
   • Segmentation gateway
   • GlobalProtect

3. Question 3 · 1

   What are three attributes monitored by the Panorama AWS plugin? (Choose three.)

   Choose all answers that apply.

   • Private DNS name
   • Subnet ID
   • IAM instance profile
   • VPC ID
   • Public DNS name

4. Question 4 · 1

   In the Cloud NGFW for AWS distributed outbound architecture model, what is the first hop the traffic takes from the source?

   Choose one answer.

   • Internet gateway
   • Cloud NGFW
   • NGFW endpoint
   • NAT gateway

5. Question 5 · 1

   Which port / interface must be assigned as the HA2 link when deploying VM-Series firewalls in High Availability (HA) on Amazon Web Services (AWS)?

   Choose one answer.

   • HA2
   • MGT port
   • HSCI port
   • Ethernet1/1

6. Question 6 · 1

   A system engineer is working on the Proof of Concept (POC) for Cloud Next-Generation Firewall (NGFW) for Azure using an existing Panorama setup. However, connection with the Cloud NGFW instance. What could be the cause of this issue?

   Choose one answer.

   • There has not been an upgrade to the PAN-OS 10.2.
   • Cloud NGFW plugin has not been installed.
   • Valid device certificate is missing.
   • Necessary ports 8443 and 443 for communication between Cloud NGFW and Panorama are blocked.

7. Question 7 · 1

   A system engineer managing a deployment of CN-Series with Panorama (software version 11.0) installs the Kubernetes Plugin. When the installation is complete, templates are present. What are the names of two of these templates and for what are they used? (Choose two.)

   Choose all answers that apply.

   • K8S-Network-Setup used for daemonset
   • K8S-Network-Setup-V2 used for Kubernetes as a service deployment
   • K8S-Network-Setup-V3 used for Kubernetes as a service deployment
   • K8S-Network-Setup-V3 used for CNF daemonset

8. Question 8 · 1

   Which protocol is used for communicating between VM-Series firewalls and a gateway load balancer in Amazon Web Services (AWS)?

   Choose one answer.

   • VRLAN
   • Geneve
   • GRE
   • VMLAN

9. Question 9 · 1

   In which area of the Customer Support Portal should a firewall administrator complete the steps to deactivate an accidentally deleted VM-Series firewall and free up Software NGFW Credits?

   Choose one answer.

   • Resources
   • Tools
   • Assets
   • Support Cases

10. Question 10 · 1

    A cloud infrastructure architect wants to monitor NGFW in production running on Amazon Web Services (AWS). It is known that the software firewalls are able to publish native PAN-OS metrics to AWS CloudWatch. The cloud infrastructure architect is unable to browse any firewall metrics on CloudWatch. Which two features are needed to remediate this issue? (Choose two.)

    Choose all answers that apply.

    • IAM policy with action = "cloudwatch:PutMetricData"
    • IAM policy with action = "cloudwatch:SharetMetricData"
    • CloudWatch Monitoring with namespace = VMseries
    • CloudWatch Monitoring with namespace = aws

11. Question 11 · 1

    Which two components are required for Intelligent Traffic Offload (ITO) on a VM-Series firewall? (Choose two.)

    Choose all answers that apply.

    • PAN-OS 10.1 or later
    • VM-Series plugin 2.1.0 or later
    • VM-Series plugin 3.1.0 or later
    • PAN-OS 9.1 or later

12. Question 12 · 1

    When using Ansible with PAN-OS, which type of connection method should be used?

    Choose one answer.

    • OpenSSH
    • Local
    • Paramiko
    • Smart

13. Question 13 · 1

    To which service does the Cloud NGFW for Azure send its logs?

    Choose one answer.

    • Kinesis Data Firehose
    • S3 Bucket
    • CloudWatch Log Group
    • Log Analytics Workspace

14. Question 14 · 1

    Which automation tools should be used to create policies for Cloud NGFW for AWS?

    Choose one answer.

    • Ansible, Terraform, and Panorama Console
    • Panorama Console and Panorama API only
    • Terraform, Panorama Console, and Panorama API
    • Panorama API, Ansible, Terraform, and Panorama Console

15. Question 15 · 1

    Which two elements of the Palo Alto Networks platform architecture enable security orchestration in a software-defined network (SDN)? (Choose two.)

    Choose all answers that apply.

    • Full set of APIs enabling programmatic control of policy and configuration
    • VXLAN support for network-layer abstraction
    • Dynamic Address Groups to adapt Security policies dynamically
    • NVGRE support for advanced VLAN integration

Paid access to all 77 questions

Each purchase applies to this certification. Prices are one-time payments, not monthly subscriptions.