Palo Alto Networks PCNSA Online Practice Questions and Exam Preparation

Palo Alto Networks PCNSA Online Questions & Answers

• Question 211:

  An administrator wants to create a No-NAT rule to exempt a flow from the default NAT rule. What is the best way to do this?

  A. Create a Security policy rule to allow the traffic.
  B. Create a new NAT rule with the correct parameters and leave the translation type as None
  C. Create a static NAT rule with an application override.
  D. Create a static NAT rule translating to the destination interface.
  B. Create a new NAT rule with the correct parameters and leave the translation type as None

• Question 212:

  What does an application filter help you to do?

  A. It dynamically provides application statistics based on network, threat, and blocked activity,
  B. It dynamically filters applications based on critical, high, medium, low. or informational severity.
  C. It dynamically groups applications based on application attributes such as category and subcategory.
  D. It dynamically shapes defined application traffic based on active sessions and bandwidth usage.
  C. It dynamically groups applications based on application attributes such as category and subcategory.

• Question 213:

  Which Security profile would you apply to identify infected hosts on the protected network uwall user database?

  A. Anti-spyware
  B. Vulnerability protection
  C. URL filtering
  D. Antivirus
  A. Anti-spyware

• Question 214:

  When creating an address object, which option is available to select from the Type drop-down menu?

  A. IPv6 Address
  B. IP Netmask
  C. IPv4 Address
  D. IP Address Class
  B. IP Netmask

  ---

  Explanation/Reference:

• Question 215:

  Which three factors can be used to create malware based on domain generation algorithms? (Choose three.)

  A. Time of day
  B. URL custom categories
  C. Other unique values
  D. Cryptographic keys
  E. IP address
  A. Time of day
  C. Other unique values
  D. Cryptographic keys

  ---

  Explanation/Reference:

• Question 216:

  An administrator would like to protect against inbound threats such as buffer overflows and illegal code execution.

  Which Security profile should be used?

  A. Antivirus
  B. URL filtering
  C. Anti-spyware
  D. Vulnerability protection
  D. Vulnerability protection

  ---

  Explanation/Reference:

  Vulnerability Protection profiles protect against threats entering the network. For example, Vulnerability Protection profiles help protect against buffer overflows, illegal code execution, and other attempts to exploit system vulnerabilities.

• Question 217:

  An organization has some applications that are restricted for access by the Human Resources Department only, and other applications that are available for any known user in the organization. What object is best suited for this configuration?

  A. Application Group
  B. Tag
  C. External Dynamic List
  D. Application Filter
  A. Application Group

• Question 218:

  An administrator notices that protection is needed for traffic within the network due to malicious lateral movement activity. Based on the image shown, which traffic would the administrator need to monitor and block to mitigate the malicious activity?

  

  A. branch office traffic
  B. north-south traffic
  C. perimeter traffic
  D. east-west traffic
  D. east-west traffic

• Question 219:

  Based on the graphic, what is the purpose of the SSL/TLS Service profile configuration option?

  

  A. It defines the SSUTLS encryption strength used to protect the management interface.
  B. It defines the CA certificate used to verify the client's browser.
  C. It defines the certificate to send to the client's browser from the management interface.
  D. It defines the firewall's global SSL/TLS timeout values.
  C. It defines the certificate to send to the client's browser from the management interface.

  ---

  Explanation/Reference:

  Reference: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g00000 0ClFGCA0

• Question 220:

  What in the minimum frequency for which you can configure the firewall too check for new wildfire antivirus signatures?

  A. every 5 minutes
  B. every 1 minute
  C. every 24 hours
  D. every 30 minutes
  B. every 1 minute

  ---

  Explanation/Reference: