Palo Alto Networks Palo Alto Networks Certifications PCNSA Questions & Answers

• Question 251:

  Which attribute can a dynamic address group use as a filtering condition to determine its membership?

  A. tag

  B. wildcard mask

  C. IP address

  D. subnet mask

  Correct Answer: A

  Dynamic Address Groups: A dynamic address group populates its members dynamically using looks ups for tags and tag-based filters. Dynamic address groups are very useful if you have an extensive virtual infrastructure where changes in virtual machine location/IP address are frequent. For example, you have a sophisticated failover setup or provision new virtual machines frequently and would like to apply policy to traffic from or to the new machine without modifying the configuration/rules on the firewall. https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-web-interface-help/objects/objects- address-groups

• Question 252:

  Which dynamic update type includes updated anti-spyware signatures?

  A. Applications and Threats

  B. GlobalProtect Data File

  C. Antivirus

  D. PAN-DB

  Correct Answer: A

• Question 253:

  The NetSec Manager asked to create a new firewall Local Administrator profile with customized privileges named NewAdmin. This new administrator has to authenticate without inserting any username or password to access the WebUI. What steps should the administrator follow to create the New_Admin Administrator profile?

  A. 1. Select the "Use only client certificate authentication" check box.

  2.

  Set Role to Role Based.

  3.

  Issue to the Client a Certificate with Common Name = NewAdmin

  B. 1. Select the "Use only client certificate authentication" check box.

  2.

  Set Role to Dynamic.

  3.

  Issue to the Client a Certificate with Certificate Name = NewAdmin

  C. 1. Set the Authentication profile to Local.

  2.

  Select the "Use only client certificate authentication" check box.

  3.

  Set Role to Role Based.

  D. 1. Select the "Use only client certificate authentication" check box.

  2.

  Set Role to Dynamic.

  3.

  Issue to the Client a Certificate with Common Name = New Admin

  Correct Answer: B

• Question 254:

  Identify the correct order to configure the PAN-OS integrated USER-ID agent.

  1.

  create a service account on the Domain Controller with sufficient permissions to execute the User- ID agent

  2.

  define the address of the servers to be monitored on the firewall

  3.

  add the service account to monitor the server(s)

  4.

  commit the configuration, and verify agent connection status

  A. 2-3-4-1

  B. 1-4-3-2

  C. 3-1-2-4

  D. 1-3-2-4

  Correct Answer: D

• Question 255:

  Based on the security policy rules shown, ssh will be allowed on which port?

  

  A. 80

  B. 53

  C. 22

  D. 23

  Correct Answer: C

• Question 256:

  Where within the firewall GUI can all existing tags be viewed?

  A. Network > Tags

  B. Monitor > Tags

  C. Objects > Tags

  D. Policies > Tags

  Correct Answer: C

  Reference: https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/policy/use-tags-to-group-and-visually-distinguish-objects/create-and-apply-tags

• Question 257:

  How does an administrator schedule an Applications and Threats dynamic update while delaying installation of the update for a certain amount of time?

  A. Disable automatic updates during weekdays

  B. Automatically "download and install" but with the "disable new applications" option used

  C. Automatically "download only" and then install Applications and Threats later, after the administrator approves the update

  D. Configure the option for "Threshold"

  Correct Answer: D

• Question 258:

  Access to which feature requires PAN-OS Filtering licens?

  A. PAN-DB database

  B. URL external dynamic lists

  C. Custom URL categories

  D. DNS Security

  Correct Answer: A

  Reference:https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/getting- started/activate-licenses-and-subscriptions.html

• Question 259:

  How is the hit count reset on a rule?

  A. select a security policy rule, right click Hit Count > Reset

  B. with a dataplane reboot

  C. Device > Setup > Logging and Reporting Settings > Reset Hit Count

  D. in the CLI, type command reset hitcount

  Correct Answer: A

• Question 260:

  An administrator needs to allow users to use only certain email applications.

  How should the administrator configure the firewall to restrict users to specific email applications?

  A. Create an application filter and filter it on the collaboration category, email subcategory.

  B. Create an application group and add the email applications to it.

  C. Create an application filter and filter it on the collaboration category.

  D. Create an application group and add the email category to it.

  Correct Answer: B