PCNSE Question 204

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose B1

  Palo Alto Networks firewalls and Panorama appliances use SSL/TLS to secure connections to the Authentication Portal, GlobalProtect portals and gateways, the management interface, HTTPS websites that require password access (URL admin override), and the User-ID™ syslog listening service. You can create an SSL/TLS service profile to define the <<server certificate>>, SSL/TLS protocol versions, and ciphers supported for connections to these services. Cipher suites are automatically selected based on the protocol versions chosen. However, you can disable individual ciphers as needed. If a service request involves a protocol version outside the specified range, the firewall or Panorama appliance downgrades or upgrades the connection to a supported version. To activate an SSL/TLS service profile, attach the profile to the settings for a specific service.

• 1

  I think the grammar is the confusing bit. I see server certificates as what external servers send to the firewall to establish a session. In fact in the below link someone else provided, the PAN team referred to it as a SIGNED CERTIFICATE. As such if one were to go with the options presented from face value, you are almost forced to select option C, whereas the PAN team really should use better grammar and just say signed certificates which is option B. Good lord!! https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/certificate-management/configure-an-ssltls-service-profile

• Chose B1

  Server Certificate as it's a signed cert