PCNSE Panorama Management and Logging 2 — Questions and Answers
Question 1: In Panorama, what is the difference between Pre-Rules and Post-Rules in a Device Group?
- Pre-Rules are for NAT and Post-Rules are for security
- Pre-Rules are evaluated before local firewall rules; Post-Rules are evaluated after (Correct answer)
- Pre-Rules apply only to inbound traffic; Post-Rules apply to outbound
- Pre-Rules are temporary; Post-Rules are permanent
Correct answer: Pre-Rules are evaluated before local firewall rules; Post-Rules are evaluated after
Pre-Rules are processed before local firewall rules on the managed device, while Post-Rules are processed after local firewall rules, giving administrators control over policy override behavior.
Question 2: What happens when you push a configuration from Panorama to a managed firewall?
- The firewall reboots automatically
- Panorama-managed policies and templates are committed and activated on the firewall (Correct answer)
- The firewall's local configuration is permanently deleted
- Only log forwarding profiles are updated
Correct answer: Panorama-managed policies and templates are committed and activated on the firewall
A Panorama push commits the centrally managed configurations (policies, objects, templates) to the managed firewall, making them active.
Question 3: Which feature in Panorama allows administrators to group multiple templates to simplify large-scale deployments?
- Device Groups
- Template Stacks (Correct answer)
- Log Forwarding Profiles
- Collector Groups
Correct answer: Template Stacks
Template Stacks allow multiple templates to be layered together, with higher-priority templates overriding lower ones, simplifying configuration management for large environments.
Question 4: In Panorama, what does a Collector Group define?
- A group of administrators with shared permissions
- A set of Log Collectors that work together to store and manage logs (Correct answer)
- A group of firewalls sharing the same template
- A cluster of Panorama management servers
Correct answer: A set of Log Collectors that work together to store and manage logs
A Collector Group is a logical grouping of Log Collectors that share log storage responsibilities and are managed as a unit for log retention and forwarding.
Question 5: What is the maximum number of firewalls a single Panorama M-600 appliance can manage?
- 500
- 1,000
- 5,000 (Correct answer)
- 10,000
Correct answer: 5,000
A single Panorama M-600 appliance can manage up to 5,000 devices, making it suitable for large enterprise and service provider deployments.
Question 6: Which Panorama feature enables automatic provisioning of new firewalls without manual configuration?
- Dynamic Address Groups
- Zero Touch Provisioning (ZTP) (Correct answer)
- Policy Optimizer
- Tag-Based Forwarding
Correct answer: Zero Touch Provisioning (ZTP)
Zero Touch Provisioning allows new Palo Alto firewalls to be automatically registered, assigned to Device Groups and Template Stacks, and configured via Panorama without manual intervention.
PCNSE Panorama Management and Logging 2
In Panorama, what is the difference between Pre-Rules and Post-Rules in a Device Group?