Palo Alto Networks Palo Alto Networks Certifications PCNSA Questions & Answers

• Question 351:

  An administrator would like to block access to a web server, while also preserving resources and minimizing half-open sockets. What are two security policy actions the administrator can select? (Choose two.)

  A. Reset server

  B. Reset both

  C. Drop

  D. Deny

  Correct Answer: AC

  Reference: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClTaCAK

• Question 352:

  Which interface does not require a MAC or IP address?

  A. Virtual Wire

  B. Layer3

  C. Layer2

  D. Loopback

  Correct Answer: A

• Question 353:

  Which prevention technique will prevent attacks based on packet count?

  A. zone protection profile

  B. URL filtering profile

  C. antivirus profile

  D. vulnerability profile

  Correct Answer: A

• Question 354:

  Which statement is true about Panorama managed devices?

  A. Panorama automatically removes local configuration locks after a commit from Panorama

  B. Local configuration locks prohibit Security policy changes for a Panorama managed device

  C. Security policy rules configured on local firewalls always take precedence

  D. Local configuration locks can be manually unlocked from Panorama

  Correct Answer: B

• Question 355:

  Which administrator receives a global notification for a new malware that infects hosts. The infection will result in the infected host attempting to contact and command-and-control (C2) server. Which security profile components will detect and prevent this threat after the firewall`s signature database has been updated?

  A. antivirus profile applied to outbound security policies

  B. data filtering profile applied to inbound security policies

  C. data filtering profile applied to outbound security policies

  D. vulnerability profile applied to inbound security policies

  Correct Answer: A

  https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-upgrade/software-and-content-updates/dynamic-content-updates#:~:text=Antivirus%20updates%20are%20released%20every,ll%20need%20a%20WildFire%20subscription.

• Question 356:

  An administrator would like to create a URL Filtering log entry when users browse to any gambling website. What combination of Security policy and Security profile actions is correct?

  A. Security policy = drop, Gambling category in URL profile = allow

  B. Security policy = deny. Gambling category in URL profile = block

  C. Security policy = allow, Gambling category in URL profile = alert

  D. Security policy = allow. Gambling category in URL profile = allow

  Correct Answer: C

• Question 357:

  Which three statement describe the operation of Security Policy rules or Security Profiles? (Choose three)

  A. Security policy rules inspect but do not block traffic.

  B. Security Profile should be used only on allowed traffic.

  C. Security Profile are attached to security policy rules.

  D. Security Policy rules are attached to Security Profiles.

  E. Security Policy rules can block or allow traffic.

  Correct Answer: BCE

• Question 358:

  Which plane on a Palo Alto Networks Firewall provides configuration, logging, and reporting functions on a separate processor?

  A. data

  B. network processing

  C. management

  D. security processing

  Correct Answer: C

• Question 359:

  An administrator is investigating a log entry for a session that is allowed and has the end reason of aged-out. Which two fields could help in determining if this is normal? (Choose two.)

  A. Packets sent/received

  B. IP Protocol

  C. Action

  D. Decrypted

  Correct Answer: AB

  When monitoring the traffic logs using Monitor > logs > Traffic, some traffic is seen with the Session End Reason as aged-out. Any traffic that uses UDP or ICMP is seen will have session end reason as aged-out in the traffic log. This is because unlike TCP, there is there is no way for a graceful termination of UDP session and so aged-out is a legitimate session-end reason for UDP (and ICMP) sessions. Link: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PMjLCAW

• Question 360:

  Based on the screenshot presented which column contains the link that when clicked opens a window to display all applications matched to the policy rule?

  

  A. Apps Allowed

  B. Name

  C. Apps Seen

  D. Service

  Correct Answer: C