Palo Alto Networks Certified Network Security Engineer (PCNSE) — Question 453

An engineer troubleshoots a Panorama-managed firewall that is unable to reach the DNS servers configured via a global template. As a troubleshooting step, the engineer needs to configure a local DNS server in place of the template value.

Which two actions can be taken to ensure that only the specific firewall is affected during this process? (Choose two.)

Answer options

• A. Override the DNS server on the template stack.
• B. Configure the DNS server locally on the firewall.
• C. Change the DNS server on the global template.
• D. Configure a service route for DNS on a different interface.

Correct answer: A, B

Explanation

Choosing option A allows for a temporary change in the template while keeping the global settings intact for other firewalls. Option B directly configures the DNS server on the specific firewall, ensuring no impact on the overall template. Options C and D would either change the global template affecting all firewalls or not specifically address the individual firewall's need.