Palo Alto Networks PCNSA Online Practice Questions and Exam Preparation

Palo Alto Networks PCNSA Online Questions & Answers

• Question 241:

  Based on the security policy rules shown, ssh will be allowed on which port?

  

  A. 80
  B. 53
  C. 22
  D. 23
  C. 22

• Question 242:

  An administrator is troubleshooting an issue with traffic that matches the intrazone-default rule, which is set to default configuration. What should the administrator do?

  A. change the logging action on the rule
  B. review the System Log
  C. refresh the Traffic Log
  D. tune your Traffic Log filter to include the dates
  A. change the logging action on the rule

• Question 243:

  Which action results in the firewall blocking network traffic with out notifying the sender?

  A. Drop
  B. Deny
  C. Reset Server
  D. Reset Client
  B. Deny

• Question 244:

  Which DNS Query action is recommended for traffic that is allowed by Security policy and matches Palo Alto Networks Content DNS Signatures?

  A. block
  B. sinkhole
  C. alert
  D. allow
  B. sinkhole

  ---

  Explanation/Reference:

  To enable DNS sinkholing for domain queries using DNS security, you must activate your DNS Security subscription, create (or modify) an Anti-Spyware policy to reference the DNS Security service, configure the log severity and policy settings for each DNS signature category, and then attach the profile to a security policy rule. https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/threat-prevention/dns- security/enable-dns-security

• Question 245:

  The Administrator profile “PCNSA Admin” is configured with an Authentication profile “Authentication Sequence PCNSA”. The Authentication Sequence PCNSA has a profile list with four Authentication profiles:

  1.

  Auth Profile LDAP

  2.

  Auth Profile Radius

  3.

  Auth Profile Local

  4.

  Auth Profile TACACS

  After a network outage, the LDAP server is no longer reachable. The RADIUS server is still reachable but has lost the “PCNSA Admin” username and password.

  Which option describes the “PCNSA Admin” login capabilities after the outage?

  A. Auth OK because of the Auth Profile TACACS
  B. Auth KO because RADIUS server lost user and password for PCNSA Admin
  C. Auth OK because of the Auth Profile Local
  D. Auth KO because LDAP server is not reachable
  C. Auth OK because of the Auth Profile Local

  ---

  Explanation/Reference:

• Question 246:

  

  Given the network diagram, traffic should be permitted for both Trusted and Guest users to access general Internet and DMZ servers using SSH. web-browsing and SSL applications Which policy achieves the desired results?

  

  A. Option A
  B. Option B
  C. Option C
  D. Option D
  C. Option C

• Question 247:

  Based on the screenshot what is the purpose of the included groups?

  

  A. They are only groups visible based on the firewall's credentials.
  B. They are used to map usernames to group names.
  C. They contain only the users you allow to manage the firewall.
  D. They are groups that are imported from RADIUS authentication servers.
  B. They are used to map usernames to group names.

  ---

  Explanation/Reference:

  Reference:

  https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/user-id/map-users-to- groups.html

• Question 248:

  Which two Security profile actions can only be applied to DoS Protection profiles? (Choose two.)

  A. Reset-server
  B. Reset-both
  C. SYN cookies
  D. Random Early Drop
  C. SYN cookies
  D. Random Early Drop

  ---

  Explanation/Reference:

• Question 249:

  An administrator would like to determine the default deny action for the application dns- over-https. Which action would yield the information?

  A. View the application details in beacon paloaltonetworks.com
  B. Check the action for the Security policy matching that traffic
  C. Check the action for the decoder in the antivirus profile
  D. View the application details in Objects > Applications
  D. View the application details in Objects > Applications

• Question 250:

  The compliance officer requests that all evasive applications need to be blocked on all perimeter firewalls out to the internet The firewall is configured with two zones;

  1.

  trust for internal networks

  2.

  untrust to the internet

  Based on the capabilities of the Palo Alto Networks NGFW, what are two ways to configure a security policy using App-ID to comply with this request? (Choose two )

  A. Create a deny rule at the top of the policy from trust to untrust with service application-default and add an application filter with the evasive characteristic
  B. Create a deny rule at the top of the policy from trust to untrust over any service and select evasive as the application
  C. Create a deny rule at the top of the policy from trust to untrust with service application-default and select evasive as the application
  D. Create a deny rule at the top of the policy from trust to untrust over any service and add an application filter with the evasive characteristic
  A. Create a deny rule at the top of the policy from trust to untrust with service application-default and add an application filter with the evasive characteristic
  D. Create a deny rule at the top of the policy from trust to untrust over any service and add an application filter with the evasive characteristic

  ---

  Explanation/Reference:

  https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-web-interface-help/objects/objects-applications/applications-overview