Palo Alto Networks PCNSA Online Practice Questions and Exam Preparation

Palo Alto Networks PCNSA Online Questions & Answers

• Question 1:

  What is an advantage for using application tags?

  A. They are helpful during the creation of new zones
  B. They help with the design of IP address allocations in DHCP.
  C. They help content updates automate policy updates
  D. They help with the creation of interfaces
  C. They help content updates automate policy updates

• Question 2:

  The Administrator profile “PCNSA Admin” is configured with an Authentication profile “Authentication Sequence PCNSA”.

  The Authentication Sequence PCNSA has a profile list with four Authentication profiles:

  Auth Profile LDAP -

  Auth Profile Radius -

  Auth Profile Local -

  Auth Profile TACACS After a network outage, the LDAP server is no longer reachable. The RADIUS server is still reachable but has lost the “PCNSA Admin” username and password.

  Which option describes the “PCNSA Admin” login capabilities after the outage?

  A. Auth OK because of the Auth Profile TACACS
  B. Auth KO because RADIUS server lost user and password for PCNSA Admin
  C. Auth OK because of the Auth Profile Local
  D. Auth KO because LDAP server is not reachable
  C. Auth OK because of the Auth Profile Local

  ---

  Explanation/Reference:

• Question 3:

  

  Given the topology, which zone type should interface E1/1 be configured with?

  A. Tap
  B. Tunnel
  C. Virtual Wire
  D. Layer3
  A. Tap

• Question 4:

  An administrator needs to add capability to perform real-time signature lookups to block or sinkhole all known malware domains.

  Which type of single unified engine will get this result?

  A. User-ID
  B. App-ID
  C. Security Processing Engine
  D. Content-ID
  D. Content-ID

  ---

  Explanation/Reference:

• Question 5:

  What are two differences between an application group and an application filter? (Choose two.)

  A. Application groups enable access to sanctioned applications explicitly, while application filters enable access to sanctioned applications implicitly.
  B. Application groups are static, while application filters are dynamic.
  C. Application groups dynamically group applications based on attributes, while application filters contain applications that are statically grouped.
  D. Application groups can be added to application filters, while application filters cannot be added to application groups.
  A. Application groups enable access to sanctioned applications explicitly, while application filters enable access to sanctioned applications implicitly.
  B. Application groups are static, while application filters are dynamic.

  ---

  Explanation/Reference:

• Question 6:

  Which option lists the attributes that are selectable when setting up an Application filters?

  A. Category, Subcategory, Technology, and Characteristic
  B. Category, Subcategory, Technology, Risk, and Characteristic
  C. Name, Category, Technology, Risk, and Characteristic
  D. Category, Subcategory, Risk, Standard Ports, and Technology
  B. Category, Subcategory, Technology, Risk, and Characteristic

  ---

  Explanation/Reference:

  Reference:

  https://docs.paloaltonetworks.com/pan-os/7-1/pan-os-web-interface-help/objects/objects- application- filters

• Question 7:

  Which type of administrator account cannot be used to authenticate user traffic flowing through the firewall's data plane?

  A. Kerberos user
  B. SAML user
  C. local database user
  D. local user
  D. local user

  ---

  Explanation/Reference:

• Question 8:

  An administrator needs to allow users to use their own office applications.

  How should the administrator configure the firewall to allow multiple applications in a dynamic environment?

  A. Create an Application Filter and name it Office Programs, the filter it on the business- systems category, office-programs subcategory
  B. Create an Application Group and add business-systems to it
  C. Create an Application Filter and name it Office Programs, then filter it on the business- systems category
  D. Create an Application Group and add Office 365, Evernote, Google Docs, and Libre Office
  A. Create an Application Filter and name it Office Programs, the filter it on the business- systems category, office-programs subcategory

  ---

  Explanation/Reference:

  An application filter is an object that dynamically groups applications based on application attributes that you define, including category, subcategory, technology, risk factor, and characteristic. This is useful when you want to safely enable access to applications that you do not explicitly sanction, but that you want users to be able to access. For example, you may want to enable employees to choose their own office programs (such as Evernote, Google Docs, or Microsoft Office 365) for business use. To safely enable these types of applications, you could create an application filter that matches on the Category business-systems and the Subcategory office-programs. As new applications office programs emerge and new App-IDs get created, these new applications will automatically match the filter you defined; you will not have to make any additional changes to your policy rulebase to safely enable any application that matches the attributes you defined for the filter. https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/app-id/use-application-objects- in -policy/create-an-application-filter.html

• Question 9:

  The administrator profile "SYS01 Admin" is configured with authentication profile "Authentication Sequence SYS01," and the authentication sequence SYS01 has a profile list with four authentication profiles:

  Auth Profile LDAP Auth Profile Radius Auth Profile Local Auth Profile TACACS

  After a network outage, the LDAP server is no longer reachable. The RADIUS server is still reachable but has lost the "SYS01 Admin" username and password.

  What is the "SYS01 Admin" login capability after the outage?

  A. Auth KO because RADIUS server lost user and password for SYS01 Admin
  B. Auth OK because of the Auth Profile TACACS
  C. Auth OK because of the Auth Profile Local
  D. Auth KO because LDAP server is not reachable
  C. Auth OK because of the Auth Profile Local

  ---

  Explanation/Reference:

  Reference: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PMdXCAW

• Question 10:

  Where can you apply URL Filtering policy in a Security policy rule?

  A. Within the applications selection
  B. Within a destination address
  C. Within a service type
  D. Within the actions tab
  D. Within the actions tab

  ---

  Explanation/Reference: