Palo Alto Networks PCNSA Online Practice Questions and Exam Preparation

Palo Alto Networks PCNSA Online Questions & Answers

• Question 161:

  What is the main function of the Test Policy Match function?

  A. verify that policy rules from Expedition are valid
  B. confirm that rules meet or exceed the Best Practice Assessment recommendations
  C. confirm that policy rules in the configuration are allowing/denying the correct traffic
  D. ensure that policy rules are not shadowing other policy rules
  C. confirm that policy rules in the configuration are allowing/denying the correct traffic

  ---

  Explanation/Reference:

  Test the policy rules in your running configuration to ensure that your policies appropriately allow and deny traffic and access to applications and websites in compliance with your business needs and requirements. https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/policy/test-policy-rule-traffic-matches

• Question 162:

  Which statement best describes a common use of Policy Optimizer?

  A. Policy Optimizer on a VM-50 firewall can display which Layer 7 App-ID Security policies have unused applications.
  B. Policy Optimizer can add or change a Log Forwarding profile for each Security policy selected.
  C. Policy Optimizer can display which Security policies have not been used in the last 90 days.
  D. Policy Optimizer can be used on a schedule to automatically create a disabled Layer 7 App-ID Security policy for every Layer 4 policy that exists. Admins can then manually enable policies they want to keep and delete ones they want to remove.
  C. Policy Optimizer can display which Security policies have not been used in the last 90 days.

• Question 163:

  Which security policy match condition would an administrator use to block traffic to IP addresses on the Palo Alto Networks Bulletproof IP Addresses list?

  A. source address
  B. destination address
  C. source zone
  D. destination zone
  B. destination address

  ---

  Explanation/Reference:

• Question 164:

  Which two App-ID applications will need to be allowed to use Facebook-chat? (Choose two.)

  A. facebook
  B. facebook-chat
  C. facebook-base
  D. facebook-email
  B. facebook-chat
  C. facebook-base

• Question 165:

  Which five Zero Trust concepts does a Palo Alto Networks firewall apply to achieve an integrated approach to prevent threats? (Choose five.)

  A. User identification
  B. Filtration protection
  C. Vulnerability protection
  D. Antivirus
  E. Application identification
  F. Anti-spyware
  A. User identification
  C. Vulnerability protection
  D. Antivirus
  E. Application identification
  F. Anti-spyware

  ---

  Explanation/Reference:

  ACDEF

• Question 166:

  In a File Blocking profile, which two actions should be taken to allow file types that support critical apps? (Choose two.)

  A. Clone and edit the Strict profile.
  B. Use URL filtering to limit categories in which users can transfer files.
  C. Set the action to Continue.
  D. Edit the Strict profile.
  A. Clone and edit the Strict profile.
  D. Edit the Strict profile.

• Question 167:

  An administrator wants to prevent access to media content websites that are risky.

  Which two URL categories should be combined in a custom URL category to accomplish this goal? (Choose two)

  A. streaming-media
  B. high-risk
  C. recreation-and-hobbies
  D. known-risk
  A. streaming-media
  B. high-risk

  ---

  Explanation/Reference:

• Question 168:

  Which three types of Source NAT are available to users inside a NGFW? (Choose three.)

  A. Static Port
  B. Dynamic IP and Port (DIPP)
  C. Dynamic IP
  D. Static IP and Port (SIPP)
  E. Static IP
  B. Dynamic IP and Port (DIPP)
  C. Dynamic IP
  E. Static IP

  ---

  Explanation/Reference:

• Question 169:

  Which action would an administrator take to ensure that a service object will be available only to the selected device group?

  A. create the service object in the specific template
  B. uncheck the shared option
  C. ensure that disable override is selected
  D. ensure that disable override is cleared
  B. uncheck the shared option

  ---

  Explanation/Reference:

  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm1tCAC

• Question 170:

  Based on the show security policy rule would match all FTP traffic from the inside zone to the outside zone?

  

  A. internal-inside-dmz
  B. engress outside
  C. inside-portal
  D. intercone-default
  C. inside-portal

  ---

  Explanation/Reference: