Palo Alto Networks PCNSA Online Practice Questions and Exam Preparation

Palo Alto Networks PCNSA Online Questions & Answers

• Question 351:

  DRAG DROP

  Order the steps needed to create a new security zone with a Palo Alto Networks firewall.

  Select and Place:

  

  

  ---

  Explanation/Reference:

• Question 352:

  When creating a Source NAT policy, which entry in the Translated Packet tab will display the options Dynamic IP and Port, Dynamic, Static IP, and None?

  

  A. Translation Type
  B. Interface
  C. Address Type
  D. IP Address
  A. Translation Type

• Question 353:

  An administrator is troubleshooting an issue with Office365 and expects that this traffic traverses the firewall.

  When reviewing Traffic Log entries, there are no logs matching traffic from the test workstation.

  What might cause this issue?

  A. Office365 traffic is logged in the System Log.
  B. Office365 traffic is logged in the Authentication Log.
  C. Traffic matches the interzone-default rule, which does not log traffic by default.
  D. The firewall is blocking the traffic, and all blocked traffic is in the Threat Log.
  C. Traffic matches the interzone-default rule, which does not log traffic by default.

  ---

  Explanation/Reference:

• Question 354:

  What are three differences between security policies and security profiles? (Choose three.)

  A. Security policies are attached to security profiles
  B. Security profiles are attached to security policies
  C. Security profiles should only be used on allowed traffic
  D. Security profiles are used to block traffic by themselves
  E. Security policies can block or allow traffic
  B. Security profiles are attached to security policies
  C. Security profiles should only be used on allowed traffic
  E. Security policies can block or allow traffic

• Question 355:

  Which operations are allowed when working with App-ID application tags?

  A. Predefined tags may be deleted.
  B. Predefined tags may be augmented by custom tags.
  C. Predefined tags may be modified.
  D. Predefined tags may be updated by WildFire dynamic updates.
  B. Predefined tags may be augmented by custom tags.

• Question 356:

  What is the Anti-Spyware Security profile default action?

  A. Sinkhole
  B. Reset-client
  C. Drop
  D. Reset-both
  D. Reset-both

  ---

  Explanation/Reference:

  When a threat event is detected, you can configure the following actions in an Anti-Spyware profile:

  Default—For each threat signature and Anti-Spyware signature that is defined by Palo Alto Networks, a default action is specified internally. Typically the default action is an alert or a reset-both. The default action is displayed in parenthesis,

  for example default (alert) in the threat or Antivirus signature.

• Question 357:

  What can be achieved by selecting a policy target prior to pushing policy rules from Panorama?

  A. Doing so limits the templates that receive the policy rules
  B. Doing so provides audit information prior to making changes for selected policy rules
  C. You can specify the firewalls m a device group to which to push policy rules
  D. You can specify the location as pre can - or post-rules to push policy rules
  C. You can specify the firewalls m a device group to which to push policy rules

• Question 358:

  Actions can be set for which two items in a URL filtering security profile? (Choose two.)

  A. Block List
  B. Custom URL Categories
  C. PAN-DB URL Categories
  D. Allow List
  B. Custom URL Categories
  C. PAN-DB URL Categories

  ---

  Explanation/Reference:

• Question 359:

  Which objects would be useful for combining several services that are often defined together?

  A. shared service objects
  B. service groups
  C. application groups
  D. application filters
  B. service groups

  ---

  Explanation/Reference:

  Reference:

  https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-web-interface-help/objects/objects- services.html

• Question 360:

  Given the network diagram, which two statements are true about traffic between the User and Server networks? (Choose two.)

  

  A. Traffic is permitted through the default Intrazone “allow” rule.
  B. Traffic restrictions are not possible because the networks are in the same zone.
  C. Traffic is permitted through the default Interzone “allow” rule.
  D. Traffic restrictions are possible by modifying Intrazone rules.
  A. Traffic is permitted through the default Intrazone “allow” rule.
  D. Traffic restrictions are possible by modifying Intrazone rules.

  ---

  Explanation/Reference: