Palo Alto Networks PCNSE Practice Exams
Last updated on Oct 21,2026- Exam Code: PCNSE
- Exam Name: Palo Alto Networks Certified Network Security Engineer Exam
- Certification Provider: Palo Alto Networks
- Latest update: Oct 21,2026
An administrator has been tasked with configuring decryption policies.
Which decryption best practice should they consider?
- A . Consider the local, legal, and regulatory implications and how they affect which traffic can be decrypted.
- B . Decrypt all traffic that traverses the firewall so that it can be scanned for threats.
- C . Place firewalls where administrators can opt to bypass the firewall when needed.
- D . Create forward proxy decryption rules without Decryption profiles for unsanctioned applications.
Which three external authentication services can the firewall use to authenticate admins into the Palo Alto Networks NGFW without creating administrator account on the firewall? (Choose three.)
- A . RADIUS
- B . TACACS+
- C . Kerberos
- D . LDAP
- E . SAML
An engineer needs to configure a standardized template for all Panorama-managed firewalls. These settings will be configured on a template named "Global" and will be included in all template stacks.
Which three settings can be configured in this template? (Choose three.)
- A . Log Forwarding profile
- B . SSL decryption exclusion
- C . Email scheduler
- D . Login banner
- E . Dynamic updates
In a template, which two objects can be configured? (Choose two.)
- A . SD-WAN path quality profile
- B . Monitor profile
- C . IPsec tunnel
- D . Application group
A company wants to add threat prevention to the network without redesigning the network routing.
What are two best practice deployment modes for the firewall? (Choose two.)
- A . VirtualWire
- B . Layer3
- C . TAP
- D . Layer2
Where can a service route be configured for a specific destination IP?
- A . Use Network > Virtual Routers, select the Virtual Router > Static Routes > IPv4
- B . Use Device > Setup > Services > Services
- C . Use Device > Setup > Services > Service Route Configuration > Customize > Destination
- D . Use Device > Setup > Services > Service Route Configuration > Customize > IPv4
The decision to upgrade PAN-OS has been approved. The engineer begins the process by upgrading the Panorama servers, but gets an error when attempting the install.
When performing an upgrade on Panorama to PAN-OS. what is the potential cause of a failed install?
- A . Outdated plugins
- B . Global Protect agent version
- C . Expired certificates
- D . Management only mode
Refer to the exhibit.
Based on the screenshots above, and with no configuration inside the Template Stack itself, what access will the device permit on its Management port?
- A . The firewall will allow HTTP Telnet, HTTPS, SSH, and Ping from IP addresses defined as $permitted-subnet-1.
- B . The firewall will allow HTTP Telnet, HTTPS, SSH, and Ping from IP addresses defined as $permitted-subnet-2.
- C . The firewall will allow HTTP, Telnet, SNMP, HTTPS, SSH and Ping from IP addresses defined as $permitted-subnet-1 and $permitted-subnet-2.
- D . The firewall will allow HTTP, Telnet, HTTPS, SSH, and Ping from IP addresses defined as $permitted-subnet-1 and $permitted-subnet-2.
Refer to the exhibit.
Based on the screenshots above, and with no configuration inside the Template Stack itself, what access will the device permit on its Management port?
- A . The firewall will allow HTTP Telnet, HTTPS, SSH, and Ping from IP addresses defined as $permitted-subnet-1.
- B . The firewall will allow HTTP Telnet, HTTPS, SSH, and Ping from IP addresses defined as $permitted-subnet-2.
- C . The firewall will allow HTTP, Telnet, SNMP, HTTPS, SSH and Ping from IP addresses defined as $permitted-subnet-1 and $permitted-subnet-2.
- D . The firewall will allow HTTP, Telnet, HTTPS, SSH, and Ping from IP addresses defined as $permitted-subnet-1 and $permitted-subnet-2.
Which GlobalProtect gateway selling is required to enable split-tunneling by access route, destination domain, and application?
- A . No Direct Access to local networks
- B . Tunnel mode
- C . iPSec mode
- D . Satellite mode