Logo ExamsQA
Exit
Official Bank 0/374

Palo Alto Networks Certified Network Security Engineer (PCNSE7) - PaloAlto Networks Exam Questions

Last updated on June 20, 2026

97% Exam Compliance
374 Total Questions
1
Question
Which three split tunnel methods are supported by a globalProtect gateway? (Choose three.)
Select 3
Options
A Client Application Process
B URL Category
C Destination user/group
D Source Domain
E video streaming application
F Destination Domain
Discussion (0 comments)

to join the discussion

Community Discussion

No discussions yet. Be the first to ask!

2
Question
An organization has recently migrated its infrastructure and configuration to NGFWs, for which Panorama manages the devices. The organization is coming from a L2-L4 firewall vendor, but wants to use App-ID while identifying policies that are no longer needed.

Which Panorama tool can provide a solution?
Options
A Policy Optimizer
B Application Groups
C Config Audit
D Test Policy Match
Discussion (0 comments)

to join the discussion

Community Discussion

No discussions yet. Be the first to ask!

3
Question
SSL Forward Proxy decryption is configured, but the firewall uses Untrusted-CA to sign the website https://www.important-website.com certificate. End-users are receiving the "security certificate is not trusted" warning. Without SSL decryption, the web browser shows that the website certificate is trusted and signed by a well-known certificate chain Well-Known-Intermediate and Well-Known- Root-C
Options
A Clear the Forward Untrust Certificate check box on the Untrusted-CA certificate and commit the configuration
B Install the Well-Known-Intermediate-CA and Well-Known-Root-CA certificates on all end-user systems in the user and local computer stores
C Navigate to Device > Certificate Management > Certificates > Device Certificates, import Well- Known-Intermediate-CA and Well-Known-Root-CA, select the Trusted Root CA check box, and commit the configuration
D Navigate to Device > Certificate Management > Certificates > Default Trusted Certificate Authorities, import Well-Known-Intermediate-CA and Well-Known-Root-CA, select the Trusted Root CA check box, and commit the configuration
Discussion (0 comments)

to join the discussion

Community Discussion

No discussions yet. Be the first to ask!

4
Question
An engineer is bootstrapping a VM-Series Firewall Other than the /config folder, which three directories are mandatory as part of the bootstrap package directory structure? (Choose three.)
Select 3
Options
A /software
B /content
C /opt
D /license
E /piugins
Discussion (0 comments)

to join the discussion

Community Discussion

No discussions yet. Be the first to ask!

5
Question
The firewall is not downloading IP addresses from MineMeld. Based, on the image, what most likely is wrong?

Exhibit
Options
A The source address supports only files hosted with an ftp://
.
B A Certificate Profile that contains the client certificate needs to be selected.
C A Certificate Profile that contains the CA certificate needs to be selected.
D External Dynamic Lists do not support SSL connections.
Discussion (0 comments)

to join the discussion

Community Discussion

No discussions yet. Be the first to ask!

Finish Practice?

Are you sure you want to finish? This will end your practice session.