Free Paloalto Networks PCNSE Practice Exam with Questions & Answers | Set: 7

High Availability (HA) timer settings in PAN-OS control failover speed and stability. The Recommended profile (Option D) is the default and provides balanced timers (e.g., 1000ms heartbeat interval) suitable for typical deployments, ensuring reliable failover without excessive sensitivity.

Option A (Critical profile) uses faster timers (e.g., 100ms) for critical environments, not typical ones. Option B (Moderate) isn’t a predefined profile. Option C (Aggressive) uses fast timers (e.g., 200ms), not slower ones. Documentation specifies "Recommended" for standard use.

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-cli-quick-start/use-the-cli/use-secure-copy-to-import-and-export-files/export-and-import-a-complete-log-database-logdb

https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/app-id/disable-the-sip-application-level-gateway-alg

https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/system-log-fields#id9502d0c7-67d3-4f74-a0a9-3fdd671afd28

Quantum-related attack protection requires cryptography resistant to quantum computing, such as post-quantum algorithms. In PAN-OS 11.2, IKEv2 with Hybrid Key Exchange (Option B) combines classical and quantum-resistant algorithms for key exchange, enhancing VPN security. IKEv2 with Post-Quantum Pre-shared Keys (PPK) (Option C) uses pre-shared keys designed to resist quantum attacks, supported in IKEv2 configurations.

Option A (IKEv1 only) weakens security by avoiding PFS and modern cryptography. Option D (IPsec with Hybrid ID exchange) is not a valid PAN-OS feature. Documentation confirms IKEv2 enhancements for quantum resistance.

https://live.paloaltonetworks.com/t5/general-topics/what-is-a-master-device-in-device-groups/td-p/15032

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PMtpCAG

Regardless of whether you generate Forward Trust certificates from your Enterprise Root CA or use a self-signed certificate generated on the firewall, generate a separate subordinate Forward Trust CA certificate for each firewall. The flexibility of using separate subordinate CAs enables you to revoke one certificate when you decommission a device (or device pair) without affecting the rest of the deployment and reduces the impact in any situation in which you need to revoke a certificate. Separate Forward Trust CAs on each firewall also helps troubleshoot issues because the CA error message the user sees includes information about the firewall the traffic is traversing. If you use the same Forward Trust CA on every firewall, you lose the granularity of that information.

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/decryption/configure-ssl-forward-proxy