Palo Alto Networks PCNSA Online Practice Questions and Exam Preparation

Palo Alto Networks PCNSA Online Questions & Answers

• Question 181:

  Which Security profile can be used to detect and block compromised hosts from trying to communicate with external command-and-control (C2) servers?

  A. URL Filtering
  B. Antivirus
  C. Vulnerability
  D. Anti-Spyware
  D. Anti-Spyware

• Question 182:

  View the diagram.

  

  What is the most restrictive, yet fully functional rule, to allow general Internet and SSH traffic into both the DMZ and Untrust/lnternet zones from each of the lOT/Guest and Trust Zones?

  

  A. Option A
  B. Option B
  C. Option C
  D. Option D
  B. Option B

  ---

  Explanation/Reference:

  A is incorrect - no internet access, DST addresses are too strictly definedd;

  C is incorrect - SRC and DST addresses do not correspond to Zones;

  D is incorrect - the SRC address does not match the SRC zone.

• Question 183:

  Which System log severity level would be displayed as a result of a user password change?

  A. Low
  B. Medium
  C. High
  D. Critical
  A. Low

• Question 184:

  Which prevention technique will prevent attacks based on packet count?

  A. zone protection profile
  B. URL filtering profile
  C. antivirus profile
  D. vulnerability profile
  A. zone protection profile

• Question 185:

  Which information is included in device state other than the local configuration?

  A. uncommitted changes
  B. audit logs to provide information of administrative account changes
  C. system logs to provide information of PAN-OS changes
  D. device group and template settings pushed from Panorama
  D. device group and template settings pushed from Panorama

  ---

  Explanation/Reference:

  Reference: https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-web-interface- help/device/device-setup-operations.html

• Question 186:

  An administrator wants to create a NAT policy to allow multiple source IP addresses to be translated to the same public IP address. What is the most appropriate NAT policy to achieve this?

  A. Dynamic IP and Port
  B. Dynamic IP
  C. Static IP
  D. Destination
  A. Dynamic IP and Port

• Question 187:

  During the App-ID update process, what should you click on to confirm whether an existing policy rule is affected by an App-ID update?

  A. check now
  B. review policies
  C. test policy match
  D. download
  B. review policies

  ---

  Explanation/Reference:

  Reference: https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/app-id/manage- new-app-ids-introduced-in-content-releases/review-new-app-id-impact-on-existing-policy- rules

• Question 188:

  Which path in PAN-OS 11.x would you follow to see how new and modified App-IDs impact a Security policy?

  A. Device > Dynamic Updates > Review App-IDs
  B. Objects > Dynamic Updates > Review App-IDs
  C. Objects > Dynamic Updates > Review Policies
  D. Device > Dynamic Updates > Review Policies
  D. Device > Dynamic Updates > Review Policies

  ---

  Explanation/Reference:

• Question 189:

  Which statement is true regarding a Best Practice Assessment?

  A. The BPA tool can be run only on firewalls
  B. It provides a percentage of adoption for each assessment data
  C. The assessment, guided by an experienced sales engineer, helps determine the areas of greatest risk where you should focus prevention activities
  D. It provides a set of questionnaires that help uncover security risk prevention gaps across all areas of network and security architecture
  B. It provides a percentage of adoption for each assessment data

  ---

  Explanation/Reference:

  Reference:

  https://docs.paloaltonetworks.com/best-practices/8-1/data-center-best-practices/data-center-best-practice-security-policy/use-palo-alto-networks- assessment-and-review-tools

• Question 190:

  Assume a custom URL Category Object of "NO-FILES" has been created to identify a specific website.

  How can file uploading/downloading be restricted for the website while permitting general browsing access to that website?

  A. Create a Security policy with a URL Filtering profile that references the site access setting of continue to NO-FILES
  B. Create a Security policy with a URL Filtering profile that references the site access setting of block to NO-FILES
  C. Create a Security policy that references NO-FILES as a URL Category qualifier, with an appropriate Data Filtering profile
  D. Create a Security policy that references NO-FILES as a URL Category qualifier, with an appropriate File Blocking profile
  D. Create a Security policy that references NO-FILES as a URL Category qualifier, with an appropriate File Blocking profile

  ---

  Explanation/Reference: