Palo Alto Networks Palo Alto Networks Certifications PCNSA Questions & Answers

• Question 131:

  In a File Blocking profile, which two actions should be taken to allow file types that support critical apps? (Choose two.)

  A. Clone and edit the Strict profile.

  B. Use URL filtering to limit categories in which users can transfer files.

  C. Set the action to Continue.

  D. Edit the Strict profile.

  Correct Answer: AD

• Question 132:

  Access to which feature requires the PAN-OS Filtering license?

  A. PAN-DB database

  B. DNS Security

  C. Custom URL categories

  D. URL external dynamic lists

  Correct Answer: A

  Reference:https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/getting- started/activate-licenses-andsubscriptions.html

• Question 133:

  Which dataplane layer of the graphic shown provides pattern protection for spyware and vulnerability exploits on a Palo Alto Networks Firewall?

  

  A. Signature Matching

  B. Network Processing

  C. Security Processing

  D. Security Matching

  Correct Answer: A

• Question 134:

  What is the main function of Policy Optimizer?

  A. reduce load on the management plane by highlighting combinable security rules

  B. migrate other firewall vendors' security rules to Palo Alto Networks configuration

  C. eliminate "Log at Session Start" security rules

  D. convert port-based security rules to application-based security rules

  Correct Answer: D

  Reference:https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-new-features/app-id- features/policy- optimizer.html

• Question 135:

  Which license must an Administrator acquire prior to downloading Antivirus Updates for use with the firewall?

  A. Threat Prevention License

  B. Threat Implementation License

  C. Threat Environment License

  D. Threat Protection License

  Correct Answer: A

• Question 136:

  URL categories can be used as match criteria on which two policy types? (Choose two.)

  A. authentication

  B. decryption

  C. application override

  D. NAT

  Correct Answer: AB

  Reference: https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/url-filtering/url- filtering-concepts/url-category-as-policy-match-criteria.html

• Question 137:

  Which definition describes the guiding principle of the zero-trust architecture?

  A. never trust, never connect

  B. always connect and verify

  C. never trust, always verify

  D. trust, but verity

  Correct Answer: C

  Reference: https://www.paloaltonetworks.com/cyberpedia/what-is-a-zero-trust-architecture

• Question 138:

  All users from the internal zone must be allowed only Telnet access to a server in the DMZ zone. Complete the two empty fields in the Security Policy rules that permits only this type of access.

  

  Choose two.

  A. Service = "any"

  B. Application = "Telnet"

  C. Service - "application-default"

  D. Application = "any"

  Correct Answer: BC

• Question 139:

  An administrator is reviewing the Security policy rules shown in the screenshot below. Which statement is correct about the information displayed?

  

  A. Eleven rules use the "Infrastructure* tag.

  B. The view Rulebase as Groups is checked.

  C. There are seven Security policy rules on this firewall.

  D. Highlight Unused Rules is checked.

  Correct Answer: B

• Question 140:

  When HTTPS for management and GlobalProtect are enabled on the same interface, which TCP port is used for management access?

  A. 80

  B. 8443

  C. 4443

  D. 443

  Correct Answer: C

  Reference: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g00000 0Cm8SCAS#:~:text=Details,using%20https%20on%20port%204443