Most Recent Palo Alto Networks PCNSE Exam Questions & Answers

Based on the provided table, the GlobalProtect portal agent configuration includes four gateways with varying priorities and response times. Users will connect to the gateway with the highest priority and, if multiple gateways share the same priority, the one with the lowest response time.

Answer Determination

Prioritize by Priority Level:

East: Highest

South: High

West: Medium

Central: Low

Evaluate Response Times Within Each Priority:

East (Highest): 35 ms

South (High): 30 ms

West (Medium): 50 ms

Central (Low): 20 ms

Given the highest priority is 'East' with a response time of 35 ms, users will connect to the East gateway based on the highest priority.

When a URL matches multiple categories, the category chosen is the one that has the most severe action defined below (block being most severe and allow least severe).

1 block

2 override

3 continue

4 alert

5 allow

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClsmCAC

When sizing a decryption firewall deployment, two factors that should be considered are the encryption algorithm and the TLS protocol version. These factors affect the amount of resources and processing power that the firewall needs to decrypt and inspect SSL/TLS traffic.

The encryption algorithm is the method that the server and the client use to encrypt and decrypt the data exchanged in an SSL/TLS session. Different encryption algorithms have different levels of security and performance. For example, AES is a symmetric encryption algorithm that is faster and more efficient than RSA, which is an asymmetric encryption algorithm. However, RSA is more secure than AES because it uses public and private keys to encrypt and decrypt data, while AES uses a single shared key.The firewall must support the encryption algorithms that are used by the servers and clients that it decrypts, and it must have enough CPU and memory resources to handle the decryption workload12.

The TLS protocol version is the standard that defines how the server and the client establish and maintain an SSL/TLS session. Different TLS protocol versions have different features and requirements for encryption algorithms, cipher suites, certificates, handshake messages, etc. For example, TLS 1.3 is the latest and most secure version of TLS, which supports only strong encryption algorithms and cipher suites, such as AES-GCM and ChaCha20-Poly1305, and requires elliptic curve certificates.The firewall must support the TLS protocol versions that are used by the servers and clients that it decrypts, and it must have enough hardware acceleration resources to handle the decryption speed34.

The number of security zones in decryption policies and the number of blocked sessions are not relevant factors for sizing a decryption firewall deployment. The number of security zones in decryption policies only affects how the firewall matches traffic to decryption rules based on source and destination zones, but it does not affect the decryption performance or resource consumption.The number of blocked sessions only indicates how many sessions are denied by the firewall based on security policy or decryption policy rules, but it does not affect the decryption capacity or throughput56.