Palo Alto Networks Palo Alto Networks Certifications PCNSA Questions & Answers

• Question 181:

  Which two matching criteria are used when creating a Security policy involving NAT? (Choose two.)

  A. Post-NAT address

  B. Post-NAT zone

  C. Pre-NAT zone

  D. Pre-NAT address

  Correct Answer: BD

  Reference: https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/networking/nat/nat-policy-rules/nat-policy-overview

• Question 182:

  To use Active Directory to authenticate administrators, which server profile is required in the authentication profile?

  A. domain controller

  B. TACACS+

  C. LDAP

  D. RADIUS

  Correct Answer: C

• Question 183:

  What are two valid selections within an Antivirus profile? (Choose two.)

  A. deny

  B. drop

  C. default

  D. block-ip

  Correct Answer: BC

  Reference: https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/policy/security-profiles

• Question 184:

  Which DNS Query action is recommended for traffic that is allowed by Security policy and matches Palo Alto Networks Content DNS Signatures?

  A. block

  B. sinkhole

  C. alert

  D. allow

  Correct Answer: B

  To enable DNS sinkholing for domain queries using DNS security, you must activate your DNS Security subscription, create (or modify) an Anti-Spyware policy to reference the DNS Security service, configure the log severity and policy settings for each DNS signature category, and then attach the profile to a security policy rule. https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/threat-prevention/dns- security/enable-dns-security

• Question 185:

  Which option is part of the content inspection process?

  A. IPsec tunnel encryption

  B. Packet egress process

  C. SSL Proxy re-encrypt

  D. Packet forwarding process

  Correct Answer: C

• Question 186:

  Which two settings allow you to restrict access to the management interface? (Choose two )

  A. enabling the Content-ID filter

  B. administrative management services

  C. restricting HTTP and telnet using App-ID

  D. permitted IP addresses

  Correct Answer: AC

• Question 187:

  Which two rule types allow the administrator to modify the destination zone? (Choose two )

  A. interzone

  B. intrazone

  C. universal

  D. shadowed

  Correct Answer: AC

• Question 188:

  Which statement is true regarding a Prevention Posture Assessment?

  A. The Security Policy Adoption Heatmap component filters the information by device groups, serial numbers, zones, areas of architecture, and other categories

  B. It provides a set of questionnaires that help uncover security risk prevention gaps across all areas of network and security architecture

  C. It provides a percentage of adoption for each assessment area

  D. It performs over 200 security checks on Panorama/firewall for the assessment

  Correct Answer: B

• Question 189:

  Which Palo Alto network security operating platform component provides consolidated policy creation and centralized management?

  A. Prisma SaaS

  B. Panorama

  C. AutoFocus

  D. GlobalProtect

  Correct Answer: B

• Question 190:

  Which update option is not available to administrators?

  A. New Spyware Notifications

  B. New URLs

  C. New Application Signatures

  D. New Malicious Domains

  E. New Antivirus Signatures

  Correct Answer: B