Palo-Alto-Networks PCNSA Exam Dumps

Palo-Alto-Networks PCNSA Sample Question Answers

Question # 1

Which Security profile would you apply to identify infected hosts on the protected network using DNS traffic? 

A. URL traffic 
B. vulnerability protection 
C. anti-spyware 
D. antivirus 

Show Answer

Question # 2

Which two firewall components enable you to configure SYN flood protection thresholds? (Choose two.)

A. QoS profile 
B. DoS Protection profile 
C. Zone Protection profile 
D. DoS Protection policy 

Show Answer

Question # 3

What is the main function of Policy Optimizer? 

A. reduce load on the management plane by highlighting combinable security rules 
B. migrate other firewall vendors' security rules to Palo Alto Networks configuration 
C. eliminate œLog at Session Start security rules
D. convert port-based security rules to application-based security rules 

Show Answer

Question # 4

How does an administrator schedule an Applications and Threats dynamic update while delaying installation of the update for a certain amount of time?

A. Disable automatic updates during weekdays 
B. Automatically œdownload and install but with the œdisable new applications option used 
C. Automatically œdownload only and then install Applications and Threats later, after the administrator approves the update
D. Configure the option for œThreshold 

Show Answer

Question # 5

You receive notification about new malware that infects hosts through malicious files transferred by FTP. Which Security profile detects and protects your internal networks from this threat after you update your firewall's threat signature database?

A. URL Filtering profile applied to inbound Security policy rules. 
B. Data Filtering profile applied to outbound Security policy rules. 
C. Antivirus profile applied to inbound Security policy rules. 
D. Vulnerability Prote ction profile applied to outbound Security policy rules. 

Show Answer

Question # 6

Which rule type is appropriate for matching traffic both within and between the source and destination zones?

A. interzone 
B. shadowed 
C. intrazone 
D. universal 

Show Answer

Question # 7

What must be considered with regards to content updates deployed from Panorama? 

A. Content update schedulers need to be configured separately per device group. 
B. Panorama can only install up to five content versions of the same type for potential rollback scenarios. 
C. A PAN-OS upgrade resets all scheduler configurations for content updates. 
D. Panorama can only download one content update at a time for content updates of the same type. 

Show Answer

Question # 8

During the packet flow process, which two processes are performed in application identification? (Choose two.)

A. pattern based application identification 
B. application override policy match 
C. session application identified 
D. application changed from content inspection 

Show Answer

Question # 9

What does an administrator use to validate whether a session is matching an expected NAT policy? 

A. system log 
B. test command 
C. threat log 
D. config audit 

Show Answer

Question # 10

What is the purpose of the automated commit recovery feature? 

A. It reverts the Panorama configuration. 
B. It causes HA synchronization to occur automatically between the HA peers after a push from Panorama.
C. It reverts the firewall configuration if the firewall recognizes a loss of connectivity to Panorama after the change
D. It generates a config log after the Panorama configuration successfully reverts to the last running configuration.

Show Answer

Question # 11

According to the best practices for mission critical devices, what is the recommended interval for antivirus updates?

A. by minute 
B. hourly 
C. daily 
D. weekly 

Show Answer

Question # 12

Which Security policy match condition would an administrator use to block traffic from IP addresses on the Palo Alto Networks EDL of Known Malicious IP Addresses list?

A. destination address 
B. source address
C. destination zone 
D. source zone 

Show Answer

Question # 13

URL categories can be used as match criteria on which two policy types? (Choose two.) 

A. authentication 
B. decryption 
C application override 
D. NAT 

Show Answer

Question # 14

Starting with PAN-OS version 9.1, application dependency information is now reported in which two locations? (Choose two.)

A. on the App Dependency tab in the Commit Status window 
B. on the Policy Optimizer's Rule Usage page 
C. on the Application tab in the Security Policy Rule creation window 
D. on the Objects > Applications browser pages 

Show Answer

Question # 15

What action will inform end users when their access to Internet content is being restricted? 

A. Create a custom 'URL Category' object with notifications enabled. 
B. Publish monitoring data for Security policy deny logs. 
C. Ensure that the 'site access" setting for all URL sites is set to 'alert'. 
D. Enable 'Response Pages' on the interface providing Internet access. 

Show Answer

Question # 16

What is a recommended consideration when deploying content updates to the firewall from Panorama?

A. Before deploying content updates, always check content release version compatibility. 
B. Content updates for firewall A/P HA pairs can only be pushed to the active firewall. 
C. Content updates for firewall A/A HA pairs need a defined master device. 
D. After deploying content updates, perform a commit and push to Panorama. 

Show Answer

Question # 17

Which information is included in device state other than the local configuration? 

A. uncommitted changes 
B. audit logs to provide information of administrative account changes 
C. system logs to provide information of PAN-OS changes 
D. device group and template settings pushed from Panorama 

Show Answer

Question # 18

An administrator is troubleshooting an issue with traffic that matches the intrazone-default rule, which is set to default configuration. What should the administrator do?

A. change the logging action on the rule 
B. review the System Log 
C. refresh the Traffic Log 
D. tune your Traffic Log filter to include the dates 

Show Answer

Question # 19

When is the content inspection performed in the packet flow process? 

A. after the application has been identified 
B. after the SSL Proxy re-encrypts the packet 
C. before the packet forwarding process 
D. before session lookup 

Show Answer

Question # 20

During the App-ID update process, what should you click on to confirm whether an existing policy rule is affected by an App-ID update?

A. check now
B. review policies 
C. test policy match 
D. download 

Show Answer

Question # 21

When creating a custom URL category object, which is a valid type? 

A. domain match 
B. host names 
C. wildcard 
D. category match 

Show Answer

Question # 22

When HTTPS for management and GlobalProtect are enabled on the same interface, which TCP port is used for management access? 

A. 80 
B. 8443 
C. 4443 
D. 443 

Show Answer

Question # 23

What two authentication methods on the Palo Alto Networks firewalls support authentication and authorization for role-based access control? (Choose two.)

A. SAML 
B. TACACS+ 
C. LDAP 
D. Kerberos 

Show Answer

Question # 24

Choose the option that correctly completes this statement. A Security Profile can block or allow traffic ____________. 

A. on either the data place or the management plane. 
B. after it is matched by a security policy rule that allows traffic. 
C. before it is matched to a Security policy rule. 
D. after it is matched by a security policy rule that allows or blocks traffic. 

Show Answer

Question # 25

Which two features can be used to tag a username so that it is included in a dynamic user group? (Choose two.) 

A. GlobalProtect agent 
B. XML API 
C. User-ID Windows-based agent 
D. log forwarding auto-tagging 

Show Answer

Question # 26

For the firewall to use Active Directory to authenticate users, which Server Profile is required in the Authentication Profile?

A. TACACS+ 
B. RADIUS 
C. LDAP 
D. SAML 

Show Answer

Question # 27

Which type of security policy rule will match traffic that flows between the Outside zone and inside zone, but would not match traffic that flows within the zones?

A. global 
B. intrazone 
C. interzone 
D. universal 

Show Answer

Question # 28

Which license is required to use the Palo Alto Networks built-in IP address EDLs? 

A. DNS Security 
B. Threat Prevention 
C. WildFire 
D. SD-Wan 

Show Answer

Question # 29

Which component is a building block in a Security policy rule? 

A. decryption profile 
B. destination interface 
C. timeout (min) 
D. application 

Show Answer

Question # 30

An administrator would like to use App-ID's deny action for an application and would like that action updated with dynamic updates as new content becomes available. Which security policy action causes this?

A. Reset server 
B. Reset both 
C. Deny 
D. Drop 

Show Answer

Question # 31

Which DNS Query action is recommended for traffic that is allowed by Security policy and matches Palo Alto Networks Content DNS Signatures?

A. block 
B. sinkhole 
C. alert 
D. allow 

Show Answer

Question # 32

Which stage of the cyber-attack lifecycle makes it important to provide ongoing education to users on spear phishing links, unknown emails, and risky websites?

A. reconnaissance 
B. delivery 
C. exploitation 
D. installation 

Show Answer

Question # 33

If using group mapping with Active Directory Universal Groups, what must you do when configuring the User-ID?

A. Create an LDAP Server profile to connect to the root domain of the Global Catalog server on port 3268 or 3269 for SSL
B. Configure a frequency schedule to clear group mapping cache 
C. Configure a Primary Employee ID number for user-based Security policies 
D. Create a RADIUS Server profile to connect to the domain controllers using LDAPS on port 636 or 389

Show Answer

Question # 34

Which administrative management services can be configured to access a management interface? 

A. HTTP, CLI, SNMP, HTTPS 
B. HTTPS, SSH telnet SNMP 
C. SSH: telnet HTTP, HTTPS 
D. HTTPS, HTTP. CLI, API 

Show Answer

Question # 35

Which feature would be useful for preventing traffic from hosting providers that place few restrictions on content, whose services are frequently used by attackers to distribute illegal or unethical material?

A. Palo Alto Networks Bulletproof IP Addresses 
B. Palo Alto Networks C&C IP Addresses 
C. Palo Alto Networks Known Malicious IP Addresses 
D. Palo Alto Networks High-Risk IP Addresses 

Show Answer

Question # 36

Which attribute can a dynamic address group use as a filtering condition to determine its membership?

A. tag 
B. wildcard mask 
C. IP address 
D. subnet mask 

Show Answer