Palo Alto Networks Palo Alto Networks Certifications PCNSA Questions & Answers

• Question 261:

  Which license must an administrator acquire prior to downloading Antivirus updates for use with the firewall?

  A. URL filtering

  B. Antivirus

  C. WildFire

  D. Threat Prevention

  Correct Answer: D

• Question 262:

  Which three configuration settings are required on a Palo Alto networks firewall management interface?

  A. default gateway

  B. netmask

  C. IP address

  D. hostname

  E. auto-negotiation

  Correct Answer: ABC

  Reference: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClN7CAK

• Question 263:

  What are three valid information sources that can be used when tagging users to dynamic user groups? (Choose three.)

  A. Blometric scanning results from iOS devices

  B. Firewall logs

  C. Custom API scripts

  D. Security Information and Event Management Systems (SIEMS), such as Splun

  E. DNS Security service

  Correct Answer: BCD

  https://docs.paloaltonetworks.com/best-practices/10-1/user-id-best-practices/user-id-best-practices/user-id-best-practices-for-dynamic-user-groups

• Question 264:

  What can be achieved by disabling the Share Unused Address and Service Objects with Devices setting on Panorama?

  A. Increase the backup capacity for configuration backups per firewall

  B. Increase the per-firewall capacity for address and service objects

  C. Reduce the configuration and session synchronization time between HA pairs

  D. Reduce the number of objects pushed to a firewall

  Correct Answer: D

• Question 265:

  What does an administrator use to validate whether a session is matching an expected NAT policy?

  A. system log

  B. test command

  C. threat log

  D. config audit

  Correct Answer: B

  Reference: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g00000 0ClQSCA0

• Question 266:

  The Palo Alto Networks NGFW was configured with a single virtual router named VR-1 What changes are required on VR-1 to route traffic between two interfaces on the NGFW?

  A. Add zones attached to interfaces to the virtual router

  B. Add interfaces to the virtual router

  C. Enable the redistribution profile to redistribute connected routes

  D. Add a static routes to route between the two interfaces

  Correct Answer: B

• Question 267:

  A company moved its old port-based firewall to a new Palo Alto Networks NGFW 60 days ago. Which utility should the company use to identify out-of-date or unused rules on the firewall?

  A. Rule Usage Filter > No App Specified

  B. Rule Usage Filter >Hit Count > Unused in 30 days

  C. Rule Usage Filter > Unused Apps

  D. Rule Usage Filter > Hit Count > Unused in 90 days

  Correct Answer: D

• Question 268:

  Given the image, which two options are true about the Security policy rules. (Choose two.)

  

  A. The Allow Office Programs rule is using an Application Filter

  B. In the Allow FTP to web server rule, FTP is allowed using App-ID

  C. The Allow Office Programs rule is using an Application Group

  D. In the Allow Social Networking rule, allows all of Facebook's functions

  Correct Answer: AD

  In the Allow FTP to web server rule, FTP is allowed using port based rule and not APP-ID.

• Question 269:

  Which stage of the cyber-attack lifecycle makes it important to provide ongoing education to users on spear phishing links, unknown emails, and risky websites?

  A. reconnaissance

  B. delivery

  C. exploitation

  D. installation

  Correct Answer: B

  Weaponization and Delivery: Attackers will then determine which methods to use in order to deliver malicious payloads. Some of the methods they might utilize are automated tools, such as exploit kits, spear phishing attacks with malicious

  links, or attachments and malvertizing.

  Gain full visibility into all traffic, including SSL, and block high-risk applications. Extend those protections to remote and mobile devices. Protect against perimeter breaches by blocking malicious or risky websites through URL filtering. Block

  known exploits, malware and inbound command-and-control communications using multiple threat prevention disciplines, including IPS, anti- malware, anti-CnC, DNS monitoring and sinkholing, and file and content blocking. Detect unknown

  malware and automatically deliver protections globally to thwart new attacks.

  Provide ongoing education to users on spear phishing links, unknown emails, risky websites, etc.

  https://www.paloaltonetworks.com/cyberpedia/how-to-break-the-cyber-attack-lifecycle

• Question 270:

  When creating a custom URL category object, which is a valid type?

  A. domain match

  B. host names

  C. wildcard

  D. category match

  Correct Answer: D

  Reference:https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-web-interface- help/objects/objects-custom-objects-url-category.html