Palo Alto Networks PCNSA Online Practice Questions and Exam Preparation

Palo Alto Networks PCNSA Online Questions & Answers

• Question 251:

  An administrator would like to block traffic to all high risk audio streaming applications, including new App-IDs introduced with content updates. Which filter should the administrator configure in the application filter object?

  A. The category is media, and the characteristic includes Evasive.
  B. The subcategory is audio-streaming, and the risk is 1.
  C. The subcategory is audio-streaming, and the risk is 5.
  D. The category is media, and the tag is high risk.
  C. The subcategory is audio-streaming, and the risk is 5.

  ---

  Explanation/Reference:

• Question 252:

  Which profile should be used to obtain a verdict regarding analyzed files?

  A. Advanced threat prevention
  B. Vulnerability profile
  C. WildFire analysis
  D. Content-ID
  C. WildFire analysis

  ---

  Explanation/Reference:

  WildFire Analysis Profiles Use a WildFire Analysis profile to enable the firewall to forward unknown files or email links for WildFire analysis. Specify files to be forwarded for analysis based on application, file type, and transmission direction (upload or download). Files or email links matched to the profile rule are forwarded to either the WildFire public cloud or the WildFire private cloud (hosted with a WF-500 appliance), depending on the analysis location defined for the rule. If a profile rule is set to forward files to the WildFire public cloud, the firewall also forwards files that match existing antivirus signatures, in addition to unknown files.

• Question 253:

  DRAG DROP

  Match the cyber-attack lifecycle stage to its correct description.

  Select and Place:

  

  

  ---

  Explanation/Reference:

• Question 254:

  A network security manager is asked to save a configuration to be used after a firewall reboot. When the configuration is ready, how should it be saved so that the changes are not lost?

  A. Save named configuration snapshot.
  B. Load named configuration snapshot.
  C. Revert to last saved configuration.
  D. Save candidate configuration.
  A. Save named configuration snapshot.

• Question 255:

  Which security policy rule would be needed to match traffic that passes between the Outside zone and Inside zone, but does not match traffic that passes within the zones?

  A. intrazone
  B. interzone
  C. universal
  D. global
  B. interzone

• Question 256:

  A systems administrator momentarily loses track of which is the test environment firewall and which is the production firewall. The administrator makes changes to the candidate configuration of the production firewall, but does not commit the changes. In addition the configuration was not saved prior to making the changes.

  Which action will allow the administrator to undo the changes?

  A. Revert to running configuration.
  B. Load named configuration snapshot, and choose the first item on the list.
  C. Revert to last saved configuration.
  D. Load configuration version, and choose the first item on the list.
  A. Revert to running configuration.

  ---

  Explanation/Reference:

• Question 257:

  With the PAN-OS 11.0 Nova release, which two attack options can new inline deep learning analysis engines detect and prevent? (Choose two.)

  A. Command injection attacks
  B. SSL attacks
  C. SQL injection attacks
  D. HTTP attacks
  A. Command injection attacks
  C. SQL injection attacks

  ---

  Explanation/Reference:

• Question 258:

  View the diagram.

  

  What is the most restrictive yet fully functional rule to allow general Internet and SSH traffic into both the DMZ and Untrust/lnternet zones from each of the lOT/Guest and Trust Zones?

  

  A. Option A
  B. Option B
  C. Option C
  D. Option D
  C. Option C

• Question 259:

  Which file is used to save the running configuration with a Palo Alto Networks firewall?

  A. running-config.xml
  B. run-config.xml
  C. running-configuration.xml
  D. run-configuratin.xml
  A. running-config.xml

• Question 260:

  Which firewall feature do you need to configure to query Palo Alto Networks service updates over a data-plane interface instead of the management interface?

  A. Data redistribution
  B. Dynamic updates
  C. SNMP setup
  D. Service route
  D. Service route

  ---

  Explanation/Reference:

  Reference: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGJCA0