Palo Alto Networks PCNSA Online Practice Questions and Exam Preparation

Palo Alto Networks PCNSA Online Questions & Answers

• Question 311:

  How are Application Fillers or Application Groups used in firewall policy?

  A. An Application Filter is a static way of grouping applications and can be configured as a nested member of an Application Group
  B. An Application Filter is a dynamic way to group applications and can be configured as a nested member of an Application Group
  C. An Application Group is a dynamic way of grouping applications and can be configured as a nested member of an Application Group
  D. An Application Group is a static way of grouping applications and cannot be configured as a nested member of Application Group
  B. An Application Filter is a dynamic way to group applications and can be configured as a nested member of an Application Group

• Question 312:

  An administrator wants to prevent users from submitting corporate credentials in a phishing attack.

  Which Security profile should be applied?

  A. antivirus
  B. anti-spyware
  C. URL filtering
  D. vulnerability protection
  C. URL filtering

  ---

  Explanation/Reference:

• Question 313:

  An administrator is creating a NAT policy.

  Which combination of address and zone are used as match conditions? (Choose two.)

  A. Pre-NAT address
  B. Pre-NAT zone
  C. Post-NAT address
  D. Post-NAT zone
  A. Pre-NAT address
  B. Pre-NAT zone

  ---

  Explanation/Reference:

  A and B is correct. NAT policy rule matches the packet based on the original pre-NAT src and dst address and pre-NAT destination zone.It's security policy that match the packet based on pre-NAT src and dst address and post-Nat zone

• Question 314:

  With the DNS Security subscription, when will the cloud-based signature database provide users access to newly added DNS signatures?

  A. Within five minutes, after downloading updates
  B. Instantly, after downloading updates
  C. Within five minutes, without downloading updates
  D. Instantly, without downloading updates
  D. Instantly, without downloading updates

• Question 315:

  How many zones can an interface be assigned with a Palo Alto Networks firewall?

  A. two
  B. three
  C. four
  D. one
  D. one

• Question 316:

  Which data flow direction is protected in a zero trust firewall deployment that is not protected in a perimeter-only firewall deployment?

  A. outbound
  B. north south
  C. inbound
  D. east west
  D. east west

• Question 317:

  Based on the security policy rules shown, ssh will be allowed on which port?

  

  A. any port
  B. same port as ssl and snmpv3
  C. the default port
  D. only ephemeral ports
  C. the default port

• Question 318:

  What is a recommended consideration when deploying content updates to the firewall from Panorama?

  A. Content updates for firewall A/P HA pairs can only be pushed to the active firewall.
  B. Content updates for firewall A/A HA pairs need a defined master device.
  C. Before deploying content updates, always check content release version compatibility.
  D. After deploying content updates, perform a commit and push to Panorama.
  C. Before deploying content updates, always check content release version compatibility.

• Question 319:

  Which interface type is part of a Layer 3 zone with a Palo Alto Networks firewall?

  A. Management
  B. High Availability
  C. Aggregate
  D. Aggregation
  C. Aggregate

• Question 320:

  An administrator is implementing an exception to an external dynamic list by adding an entry to the list manually. The administrator wants to save the changes, but the OK button is grayed out.

  What are two possible reasons the OK button is grayed out? (Choose two.)

  A. The entry contains wildcards.
  B. The entry is duplicated.
  C. The entry doesn't match a list entry.
  D. The entry matches a list entry.
  B. The entry is duplicated.
  C. The entry doesn't match a list entry.