Palo Alto Networks Palo Alto Certifications and Accreditations PCNSA Questions & Answers

• Question 1:

  DRAG DROP

  Match the cyber-attack lifecycle stage to its correct description.

  Select and Place:

  

  Correct Answer:

  

• Question 2:

  DRAG DROP

  Drag the steps into the correct order to create a static route.

  Select and Place:

  

  Correct Answer:

  

• Question 3:

  An administrator needs to add capability to perform real-time signature lookups to block or sinkhole all known malware domains. Which type of single unified engine will get this result?

  A. User-ID

  B. App-ID

  C. Security Processing Engine

  D. Content-ID

  Correct Answer: D

• Question 4:

  An administrator is implementing an exception to an external dynamic list by adding an entry to the list manually. The administrator wants to save the changes, but the OK button is grayed out. What are two possible reasons the OK button is grayed out? (Choose two.)

  A. The entry contains wildcards.

  B. The entry is duplicated.

  C. The entry doesn't match a list entry.

  D. The entry matches a list entry.

  Correct Answer: BC

• Question 5:

  What does an administrator use to validate whether a session is matching an expected NAT policy?

  A. system log

  B. test command

  C. threat log

  D. config audit

  Correct Answer: B

  Reference: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g00000 0ClQSCA0

• Question 6:

  What can be achieved by disabling the Share Unused Address and Service Objects with Devices setting on Panorama?

  A. Increase the backup capacity for configuration backups per firewall

  B. Increase the per-firewall capacity for address and service objects

  C. Reduce the configuration and session synchronization time between HA pairs

  D. Reduce the number of objects pushed to a firewall

  Correct Answer: D

• Question 7:

  How does an administrator schedule an Applications and Threats dynamic update while delaying installation of the update for a certain amount of time?

  A. Disable automatic updates during weekdays

  B. Automatically "download and install" but with the "disable new applications" option used

  C. Automatically "download only" and then install Applications and Threats later, after the administrator approves the update

  D. Configure the option for "Threshold"

  Correct Answer: D

• Question 8:

  Access to which feature requires PAN-OS Filtering licens?

  A. PAN-DB database

  B. URL external dynamic lists

  C. Custom URL categories

  D. DNS Security

  Correct Answer: A

  Reference:https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/getting- started/activate-licenses-and-subscriptions.html

• Question 9:

  Which dynamic update type includes updated anti-spyware signatures?

  A. Applications and Threats

  B. GlobalProtect Data File

  C. Antivirus

  D. PAN-DB

  Correct Answer: A

• Question 10:

  The NetSec Manager asked to create a new firewall Local Administrator profile with customized privileges named NewAdmin. This new administrator has to authenticate without inserting any username or password to access the WebUI. What steps should the administrator follow to create the New_Admin Administrator profile?

  A. 1. Select the "Use only client certificate authentication" check box.

  2.

  Set Role to Role Based.

  3.

  Issue to the Client a Certificate with Common Name = NewAdmin

  B. 1. Select the "Use only client certificate authentication" check box.

  2.

  Set Role to Dynamic.

  3.

  Issue to the Client a Certificate with Certificate Name = NewAdmin

  C. 1. Set the Authentication profile to Local.

  2.

  Select the "Use only client certificate authentication" check box.

  3.

  Set Role to Role Based.

  D. 1. Select the "Use only client certificate authentication" check box.

  2.

  Set Role to Dynamic.

  3.

  Issue to the Client a Certificate with Common Name = New Admin

  Correct Answer: B