Palo Alto Networks PCNSA Online Practice Questions and Exam Preparation

Palo Alto Networks PCNSA Online Questions & Answers

• Question 201:

  How are service routes used in PAN-OS?

  A. By the OSPF protocol, as part of Dijkstra's algorithm, to give access to the various services offered in the network
  B. To statically route subnets so they are joinable from, and have access to, the Palo Alto Networks external services
  C. For routing, because they are the shortest path selected by the BGP routing protocol
  D. To route management plane services through data interfaces rather than the management interface
  D. To route management plane services through data interfaces rather than the management interface

• Question 202:

  An administrator is investigating a log entry for a session that is allowed and has the end reason of aged-out. Which two fields could help in determining if this is normal? (Choose two.)

  A. Packets sent/received
  B. IP Protocol
  C. Action
  D. Decrypted
  A. Packets sent/received
  B. IP Protocol

  ---

  Explanation/Reference:

  When monitoring the traffic logs using Monitor > logs > Traffic, some traffic is seen with the Session End Reason as aged-out. Any traffic that uses UDP or ICMP is seen will have session end reason as aged-out in the traffic log. This is because unlike TCP, there is there is no way for a graceful termination of UDP session and so aged-out is a legitimate session-end reason for UDP (and ICMP) sessions. Link: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PMjLCAW

• Question 203:

  When HTTPS for management and GlobalProtect are enabled on the same interface, which TCP port is used for management access?

  A. 80
  B. 8443
  C. 4443
  D. 443
  C. 4443

  ---

  Explanation/Reference:

  Reference: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g00000 0Cm8SCAS#:~:text=Details,using%20https%20on%20port%204443

• Question 204:

  Based on the graphic which statement accurately describes the output shown in the server monitoring panel?

  

  A. The User-ID agent is connected to a domain controller labeled lab-client.
  B. The host lab-client has been found by the User-ID agent.
  C. The host lab-client has been found by a domain controller.
  D. The User-ID agent is connected to the firewall labeled lab-client.
  A. The User-ID agent is connected to a domain controller labeled lab-client.

• Question 205:

  Which attribute can a dynamic address group use as a filtering condition to determine its membership?

  A. tag
  B. wildcard mask
  C. IP address
  D. subnet mask
  A. tag

  ---

  Explanation/Reference:

  Dynamic Address Groups: A dynamic address group populates its members dynamically using looks ups for tags and tag-based filters. Dynamic address groups are very useful if you have an extensive virtual infrastructure where changes in virtual machine location/IP address are frequent. For example, you have a sophisticated failover setup or provision new virtual machines frequently and would like to apply policy to traffic from or to the new machine without modifying the configuration/rules on the firewall. https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-web-interface-help/objects/objects- address-groups

• Question 206:

  Which User-ID agent would be appropriate in a network with multiple WAN links, limited network bandwidth, and limited firewall management plane resources?

  A. Windows-based agent deployed on the internal network
  B. PAN-OS integrated agent deployed on the internal network
  C. Citrix terminal server deployed on the internal network
  D. Windows-based agent deployed on each of the WAN Links
  A. Windows-based agent deployed on the internal network

  ---

  Explanation/Reference:

  Another reason to choose the Windows agent over the integrated PAN-OS agent is to save processing cycles on the firewall's management plane.

• Question 207:

  Complete the statement. A security profile can block or allow traffic____________

  A. on unknown-tcp or unknown-udp traffic
  B. after it is matched by a security policy that allows traffic
  C. before it is matched by a security policy
  D. after it is matched by a security policy that allows or blocks traffic
  B. after it is matched by a security policy that allows traffic

  ---

  Explanation/Reference:

  Security profiles are objects added to policy rules that are configured with an action of allow.

• Question 208:

  The NetSec Manager asked to create a new firewall Local Administrator profile with customized privileges named New_Admin. This new administrator has to authenticate without inserting any username or password to access the WebUI. What steps should the administrator follow to create the New_Admin Administrator profile?

  A. 1. Set the Authentication profile to Local. 2. Select the "Use only client certificate authentication" check box. 3. Set Role to Role Based.
  B. 1. Select the "Use only client certificate authentication" check box. 2. Set Role to Dynamic. 3. Issue to the Client a Certificate with Certificate Name = New Admin
  C. 1. Select the "Use only client certificate authentication" check box. 2. Set Role to Dynamic. 3. Issue to the Client a Certificate with Common Name = New_Admin
  D. 1. Select the "Use only client certificate authentication" check box. 2. Set Role to Role Based. 3. Issue to the Client a Certificate with Common Name = New Admin
  D. 1. Select the "Use only client certificate authentication" check box. 2. Set Role to Role Based. 3. Issue to the Client a Certificate with Common Name = New Admin

  ---

  Explanation/Reference:

• Question 209:

  By default, what is the maximum number of templates that can be added to a template stack?

  A. 6
  B. 8
  C. 10
  D. 12
  B. 8

  ---

  Explanation/Reference:

  Reference: https://www.mbtechtalker.com/panorama-templates-and-template-stacks/#:~:text=A%20Template%20Stack%20is%20essentially,be%20applied%20to%20multiple%20firewalls

• Question 210:

  How does an administrator schedule an Applications and Threats dynamic update while delaying installation of the update for a certain amount of time?

  A. Disable automatic updates during weekdays
  B. Automatically "download and install" but with the "disable new applications" option used
  C. Automatically "download only" and then install Applications and Threats later, after the administrator approves the update
  D. Configure the option for "Threshold"
  D. Configure the option for "Threshold"