Palo Alto Networks Palo Alto Networks Certifications PCNSA Questions & Answers

• Question 291:

  What is a valid Security Zone type in PAN-OS?

  A. Management

  B. Logical

  C. Transparent

  D. Tap

  Correct Answer: D

  Typeas are Tap, Virtual Wire, Layer2, Layer3, External, or Tunnel https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-web-interface-help/network/network-zones/building-blocks-of-security-zones

• Question 292:

  An administrator is creating a Security policy rule and sees that the destination zone is grayed out. While creating the rule, which option was selected to cause this?

  A. Interzone

  B. Source zone

  C. Universal (default)

  D. Intrazone

  Correct Answer: D

  In Intrazone security rules, no destination zone can be specified

• Question 293:

  How many levels can there be in a device-group hierarchy, below the shared level?

  A. 2

  B. 3

  C. 4

  D. 5

  Correct Answer: C

• Question 294:

  Where in Panorama would Zone Protection profiles be configured?

  A. Templates

  B. Device Groups

  C. Shared

  D. Panorama tab

  Correct Answer: A

  https://docs.paloaltonetworks.com/panorama/9-1/panorama-admin/manage-firewalls/use-case-configure-firewalls-using-panorama/set-up-your-centralized-configuration-and-policies/use-templates-to-administer-a-base-configuration

• Question 295:

  Which parameter is used to view the Security policy rulebase as groups?

  A. Tags

  B. Service

  C. Type

  D. Action

  Correct Answer: A

  Reference: https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/policy/use-tags-to-group-and-visually-distinguish-objects/view-rules-by-tag-group

• Question 296:

  When a security rule is configured as Intrazone, which field cannot be changed?

  A. Destination Zone

  B. Actions

  C. Source Zone

  D. Application

  Correct Answer: A

  Reference: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClomCAC#:~:text=When%20a%20rule%20is%20configured,be%20changed%20(greyed%20out)

• Question 297:

  An administrator is trying to understand which NAT policy is being matched. In what order does the firewall evaluate NAT policies?

  A. Dynamic IP and Port first, then Static, and finally Dynamic IP

  B. From top to bottom

  C. Static NAT rules first, then lop down

  D. Static NAT rules first, then Dynamic

  Correct Answer: B

  Reference: https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/networking/nat/nat-policy-rules/nat-policy-overview

• Question 298:

  What is the Anti-Spyware Security profile default action?

  A. Sinkhole

  B. Reset-client

  C. Drop

  D. Reset-both

  Correct Answer: D

  When a threat event is detected, you can configure the following actions in an Anti-Spyware profile:

  Default—For each threat signature and Anti-Spyware signature that is defined by Palo Alto Networks, a default action is specified internally. Typically the default action is an alert or a reset-both. The default action is displayed in parenthesis,

  for example default (alert) in the threat or Antivirus signature.

• Question 299:

  In which threat profile object would you configure the DNS Security service?

  A. Antivirus

  B. Anti-Spyware

  C. WildFire

  D. URL Filtering

  Correct Answer: B

  https://docs.paloaltonetworks.com/dns-security/administration/configure-dns-security/enable-dns-security#:~:text=To%20enable%20DNS%20Security%2C%20you,to%20a%20security%20policy%20rule.

• Question 300:

  Which path in PAN-OS 10.2 is used to schedule a content update to managed devices using Panorama?

  A. Panorama > Device Deployment > Dynamic Updates > Schedules > Add

  B. Panorama > Device Deployment > Content Updates > Schedules > Add

  C. Panorama > Dynamic Updates > Device Deployment > Schedules > Add

  D. Panorama > Content Updates > Device Deployment > Schedules > Add

  Correct Answer: A

  Perform the following steps for each update type you want to schedule.

  Select PanoramaDevice DeploymentDynamic Updates, click Schedules, and Add a schedule.