Palo Alto Networks PCNSA Online Practice Questions and Exam Preparation

Palo Alto Networks PCNSA Online Questions & Answers

• Question 271:

  Which two configuration settings shown are not the default? (Choose two.)

  

  A. Enable Security Log
  B. Server Log Monitor Frequency (sec)
  C. Enable Session
  D. Enable Probing
  B. Server Log Monitor Frequency (sec)
  C. Enable Session

• Question 272:

  Which Security policy match condition would an administrator use to block traffic from IP addresses on the Palo Alto Networks EDL of Known Malicious IP Addresses list?

  A. destination address
  B. source address
  C. destination zone
  D. source zone
  B. source address

  ---

  Explanation/Reference:

  https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/policy/use-an-external-dynamic-list-in-policy/external-dynamic-list

• Question 273:

  Which plane on a Palo Alto Networks Firewall provides configuration, logging, and reporting functions on a separate processor?

  A. data
  B. network processing
  C. management
  D. security processing
  C. management

  ---

  Explanation/Reference:

• Question 274:

  When creating a Panorama administrator type of Device Group and Template Admin, which two things must you create first? (Choose two.)

  A. password profile
  B. access domain
  C. admin rote
  D. server profile
  C. admin rote
  D. server profile

• Question 275:

  Which three types of authentication services can be used to authenticate user traffic flowing through the firewalls data plane? (Choose three )

  A. TACACS
  B. SAML2
  C. SAML10
  D. Kerberos
  E. TACACS+
  A. TACACS
  B. SAML2
  D. Kerberos

• Question 276:

  Application groups enable access to what?

  A. Applications that are explicitly unsanctioned for use within a company
  B. Applications that are not explicitly unsanctioned and that an administrator wants users to be able to access
  C. Applications that are explicitly sanctioned for use within a company
  D. Applications that are not explicitly sanctioned and that an administrator wants users to be able to access
  C. Applications that are explicitly sanctioned for use within a company

  ---

  Explanation/Reference:

  Reference: https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/app-id/use-application-objects-in-policy/create-an-application-group

• Question 277:

  A website is unexpectedly allowed due to miscategorization.

  What are two ways to resolve this issue for a proper response? (Choose two.)

  A. Identify the URL category being assigned to the website. Edit the active URL Filtering profile and update that category's site access settings to block.
  B. Create a URL category and assign the affected URL. Update the active URL Filtering profile site access setting for the custom URL category to block.
  C. Review the categorization of the website on https://urlfiltering.paloaltonetworks.com. Submit for "request change*, identifying the appropriate categorization, and wait for confirmation before testing again.
  D. Create a URL category and assign the affected URL. Add a Security policy with a URL category qualifier of the custom URL category below the original policy. Set the policy action to Deny.
  B. Create a URL category and assign the affected URL. Update the active URL Filtering profile site access setting for the custom URL category to block.
  C. Review the categorization of the website on https://urlfiltering.paloaltonetworks.com. Submit for "request change*, identifying the appropriate categorization, and wait for confirmation before testing again.

  ---

  Explanation/Reference:

• Question 278:

  Which Palo Alto Networks firewall security platform provides network security for mobile endpoints by inspecting traffic deployed as internet gateways?

  A. GlobalProtect
  B. AutoFocus
  C. Aperture
  D. Panorama
  A. GlobalProtect

  ---

  Explanation/Reference:

  GlobalProtect: GlobalProtect safeguards your mobile workforce by inspecting all traffic using your next-generation firewalls deployed as internet gateways, whether at the perimeter, in the Demilitarized Zone (DMZ), or in the cloud.

• Question 279:

  Which dataplane layer of the graphic shown provides pattern protection for spyware and vulnerability exploits on a Palo Alto Networks Firewall?

  

  A. Signature Matching
  B. Network Processing
  C. Security Processing
  D. Security Matching
  A. Signature Matching

  ---

  Explanation/Reference:

• Question 280:

  Which two features implement one-to-one translation of a source IP address while allowing the source port to change? (Choose two.)

  A. Dynamic IP
  B. Dynamic IP and Port (DIPP)
  C. Static IP
  D. Dynamic IP / Port Fallback
  B. Dynamic IP and Port (DIPP)
  D. Dynamic IP / Port Fallback

  ---

  Explanation/Reference: