Palo Alto Networks PCNSA Online Practice Questions and Exam Preparation

Palo Alto Networks PCNSA Online Questions & Answers

• Question 11:

  An interface can belong to how many Security Zones?

  A. 1
  B. 2
  C. 3
  D. 4
  A. 1

  ---

  Explanation/Reference:

  Reference: https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_SecurityManagement_AdminGuide/Topics-SECMG/Security-Zones.htm#:~:text=A%20Security%20Gateway%20interface%20can,in%20the%20same% 20Security%20Zone

• Question 12:

  Which statements is true regarding a Heatmap report?

  A. When guided by authorized sales engineer, it helps determine te areas of greatest security risk.
  B. It provides a percentage of adoption for each assessment area.
  C. It runs only on firewall.
  D. It provides a set of questionnaires that help uncover security risk prevention gaps across all areas of network and security architecture.
  B. It provides a percentage of adoption for each assessment area.

  ---

  Explanation/Reference:

  Reference: https://live.paloaltonetworks.com/t5/best-practice-assessment-blogs/the-best- practice-assessment-bpa-tool-for-ngfw-and-panorama/ba-p/248343

• Question 13:

  Your company occupies one floor in a single building you have two active directory domain controllers on a single networks the firewall s management plane is only slightly utilized. Which user-ID agent sufficient in your network?

  A. PAN-OS integrated agent deployed on the firewall
  B. Windows-based agent deployed on the internal network a domain member
  C. Citrix terminal server agent deployed on the network
  D. Windows-based agent deployed on each domain controller
  A. PAN-OS integrated agent deployed on the firewall

  ---

  Explanation/Reference:

  Reference:

  https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/user-id/map-ip-addresses-to- users/configureuser-mapping-using-the-windows-user-id- agent/configure-the-windows- based-user-id- agent-for-usermapping.html

• Question 14:

  Which Security profile generates an alert based on a threshold when the action is set to Alert?

  A. Vulnerability Protection
  B. Antivirus
  C. DoS protection
  D. Anti-Spyware
  C. DoS protection

  ---

  Explanation/Reference:

  DoS Protection profiles set thresholds that protect against new session IP flood attacks and provide resource protection (maximum concurrent session limits for specified endpoints and resources). DoS Protection profiles protect specific devices (classified profiles) and groups of devices (aggregate profiles) against SYN, UDP, ICMP, ICMPv6, and Other IP flood attacks. Configuring Flood Protection thresholds in a DoS Protection profile is similar to configuring Flood Protection in a Zone Protection profile, but Zone Protection profiles protect entire ingress zones, while DoS protection profiles and policy rules are granular and targeted, and can even be classified to a single device (IP address). The firewall measures the aggregate number of connections-per-second (CPS) to a group of devices (aggregate profile) or measures the CPS to individual devices (classified profile).

• Question 15:

  An administrator would like to follow the best-practice approach to log the traffic that traverses the firewall. What action should they take?

  A. Enable both Log at Session Start and Log at Session End.
  B. Enable Log at Session End.
  C. Enable Log at Session Start.
  D. Disable all logging options.
  B. Enable Log at Session End.

  ---

  Explanation/Reference:

  Reference: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Clt5CAC

• Question 16:

  Which two matching criteria are used when creating a Security policy involving NAT? (Choose two.)

  A. Post-NAT address
  B. Post-NAT zone
  C. Pre-NAT zone
  D. Pre-NAT address
  B. Post-NAT zone
  D. Pre-NAT address

  ---

  Explanation/Reference:

  Reference: https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/networking/nat/nat-policy-rules/nat-policy-overview

• Question 17:

  Which setting is available to edit when a tag is created on the local firewall?

  A. Color
  B. Location
  C. Order
  D. Priority
  A. Color

  ---

  Explanation/Reference:

• Question 18:

  DRAG DROP

  Arrange the correct order that the URL classifications are processed within the system.

  Select and Place:

  

  

  ---

  Explanation/Reference:

• Question 19:

  An administrator configured a Security policy rule with an Antivirus Security profile. The administrator did not change the action for the profile. If a virus gets detected, how will the firewall handle the traffic?

  A. It allows the traffic because the profile was not set to explicitly deny the traffic.
  B. It drops the traffic because the profile was not set to explicitly allow the traffic.
  C. It uses the default action assigned to the virus signature.
  D. It allows the traffic but generates an entry in the Threat logs.
  C. It uses the default action assigned to the virus signature.

  ---

  Explanation/Reference:

  "Default-For each threat signature and Antivirus signature that is defined by Palo Alto Networks, a default action is specified internally. Typically, the default action is an alert or a reset-both. " https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/policy/security-profiles

• Question 20:

  Which URL Filtering Profile action does not generate a log entry when a user attempts to access a URL?

  A. override
  B. allow
  C. block
  D. continue
  B. allow