Palo Alto Networks PCNSA Online Practice Questions and Exam Preparation

Palo Alto Networks PCNSA Online Questions & Answers

• Question 331:

  Which two components are utilized within the Single-Pass Parallel Processing architecture on a Palo Alto Networks Firewall? (Choose two.)

  A. Layer-ID
  B. User-ID
  C. QoS-ID
  D. App-ID
  B. User-ID
  D. App-ID

• Question 332:

  Which type firewall configuration contains in-progress configuration changes?

  A. backup
  B. running
  C. candidate
  D. committed
  C. candidate

• Question 333:

  When configuring a security policy, what is a best practice for User-ID?

  A. Use only one method for mapping IP addresses to usernames.
  B. Allow the User-ID agent in zones where agents are not monitoring services.
  C. Limit User-ID to users registered in an Active Directory server.
  D. Deny WMI traffic from the User-ID agent to any external zone.
  D. Deny WMI traffic from the User-ID agent to any external zone.

  ---

  Explanation/Reference:

• Question 334:

  Which URL Filtering profile action would you set to allow users the option to access a site only if they provide a URL admin password?

  A. override
  B. authorization
  C. authentication
  D. continue
  A. override

  ---

  Explanation/Reference:

  OVERRIDE - The user will see a response page indicating that a password is required to allow access to websites in the given category. With this option, the security administrator or help-desk person would provide a password granting temporary access to all websites in the given category. A log entry is generated in the URL Filtering log. The Override webpage doesn't display properly on client systems configured to use a proxy server.

  https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/url-filtering/url-filtering-concepts/url-filtering-profile-actions.html

• Question 335:

  Access to which feature requires PAN-OS Filtering licens?

  A. PAN-DB database
  B. URL external dynamic lists
  C. Custom URL categories
  D. DNS Security
  A. PAN-DB database

  ---

  Explanation/Reference:

  Reference:https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/getting- started/activate-licenses-and-subscriptions.html

• Question 336:

  Which solution is a viable option to capture user identification when Active Directory is not in use?

  A. Cloud Identity Engine
  B. group mapping
  C. Directory Sync Service
  D. Authentication Portal
  D. Authentication Portal

• Question 337:

  What are three Palo Alto Networks best practices when implementing the DNS Security Service? (Choose three.)

  A. Implement a threat intel program.
  B. Configure a URL Filtering profile.
  C. Train your staff to be security aware.
  D. Rely on a DNS resolver.
  E. Plan for mobile-employee risk
  A. Implement a threat intel program.
  C. Train your staff to be security aware.
  E. Plan for mobile-employee risk

  ---

  Explanation/Reference:

  Based on the following source, BCE appear to be the best practices https://www.paloaltonetworks.com/cyberpedia/what-is-dns-tunneling

• Question 338:

  Which Security profile can be used to configure sinkhole IPs m the DNS Sinkhole settings?

  A. Vulnerability Protection
  B. Anti-Spyware
  C. Antivirus
  D. URL Filtering
  B. Anti-Spyware

  ---

  Explanation/Reference:

  Reference: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGECA0#:~:text=Configure%20the%20DNS%20Sinkhole%20action,Spyware%22%20profile%20is%20being%20used

• Question 339:

  Within an Anti-Spyware security profile, which tab is used to enable machine learning based engines?

  A. Signature Policies
  B. Signature Exceptions
  C. Machine Learning Policies
  D. Inline Cloud Analysis
  D. Inline Cloud Analysis

  ---

  Explanation/Reference:

• Question 340:

  Which protocol used to map username to user groups when user-ID is configured?

  A. SAML
  B. RADIUS
  C. TACACS+
  D. LDAP
  D. LDAP