Palo Alto Networks Palo Alto Networks Certifications PCNSA Questions & Answers

• Question 221:

  You have been tasked to configure access to a new web server located in the DMZ.

  Based on the diagram what configuration changes are required in the NGFW virtual router to route traffic from the 10 1 1 0/24 network to 192 168 1 0/24?

  

  A. Add a route with the destination of 192 168 1 0/24 using interface Eth 1/3 with a next- hop of 192.168 1.10

  B. Add a route with the destination of 192 168 1 0/24 using interface Eth 1/2 with a next- hop of 172.16.1.2

  C. Add a route with the destination of 192 168 1 0/24 using interface Eth 1/3 with a next- hop of 172.16.1.2

  D. Add a route with the destination of 192 168 1 0/24 using interface Eth 1/3 with a next- hop of 192.168.1.254

  Correct Answer: C

• Question 222:

  An administrator would like to protect against inbound threats such as buffer overflows and illegal code execution.

  Which Security profile should be used?

  A. Antivirus

  B. URL filtering

  C. Anti-spyware

  D. Vulnerability protection

  Correct Answer: D

  Vulnerability Protection profiles protect against threats entering the network. For example, Vulnerability Protection profiles help protect against buffer overflows, illegal code execution, and other attempts to exploit system vulnerabilities.

• Question 223:

  Choose the option that correctly completes this statement. A Security Profile can block or allow traffic ____________.

  A. on either the data place or the management plane.

  B. after it is matched by a security policy rule that allows traffic.

  C. before it is matched to a Security policy rule.

  D. after it is matched by a security policy rule that allows or blocks traffic.

  Correct Answer: B

  Reference:

  https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/policy/security-policy.html

  After a packet has been allowed by the Security policy, Security Profiles are used to scan packets for threats, vulnerabilities, viruses, spyware, malicious URLs, data exfiltration, and exploitation software.

• Question 224:

  Which type of security rule will match traffic between the Inside zone and Outside zone, within the Inside zone, and within the Outside zone?

  A. global

  B. intrazone

  C. interzone

  D. universal

  Correct Answer: D

  References: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g0000 00ClomCAC

• Question 225:

  Which two firewall components enable you to configure SYN flood protection thresholds? (Choose two.)

  A. QoS profile

  B. DoS Protection profile

  C. Zone Protection profile

  D. DoS Protection policy

  Correct Answer: BC

  Reference: https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/policy/security-profiles

• Question 226:

  When creating a Source NAT policy, which entry in the Translated Packet tab will display the options Dynamic IP and Port, Dynamic, Static IP, and None?

  

  A. Translation Type

  B. Interface

  C. Address Type

  D. IP Address

  Correct Answer: A

• Question 227:

  Which type of administrator account cannot be used to authenticate user traffic flowing through the firewall's data plane?

  A. Kerberos user

  B. SAML user

  C. local database user

  D. local user

  Correct Answer: D

• Question 228:

  Which Security policy action will message a user's browser thai their web session has been terminated?

  A. Reset server

  B. Deny

  C. Drop

  D. Reset client

  Correct Answer: B

• Question 229:

  What is the correct process tor creating a custom URL category?

  A. Objects > Security Profiles > URL Category > Add

  B. Objects > Custom Objects > URL Filtering > Add

  C. Objects > Security Profiles > URL Filtering > Add

  D. Objects > Custom Objects > URL Category > Add

  Correct Answer: D

• Question 230:

  Which rule type is appropriate for matching traffic both within and between the source and destination zones?

  A. interzone

  B. shadowed

  C. intrazone

  D. universal

  Correct Answer: D