Palo Alto Networks Palo Alto Networks Certifications PCNSA Questions & Answers

• Question 361:

  Which administrator type utilizes predefined roles for a local administrator account?

  A. Superuser

  B. Role-based

  C. Dynamic

  D. Device administrator

  Correct Answer: C

• Question 362:

  You must configure which firewall feature to enable a data-plane interface to submit DNS queries on behalf of the control plane?

  A. Admin Role profile

  B. virtual router

  C. DNS proxy

  D. service route

  Correct Answer: D

• Question 363:

  Which two App-ID applications will need to be allowed to use Facebook-chat? (Choose two.)

  A. facebook

  B. facebook-chat

  C. facebook-base

  D. facebook-email

  Correct Answer: BC

• Question 364:

  Which the app-ID application will you need to allow in your security policy to use facebook- chat?

  A. facebook-email

  B. facebook-base

  C. facebook

  D. facebook-chat

  Correct Answer: BD

• Question 365:

  What must be configured before setting up Credential Phishing Prevention?

  A. Anti Phishing Block Page

  B. Threat Prevention

  C. Anti Phishing profiles

  D. User-ID

  Correct Answer: B

  https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/threat- prevention/prevent-credential-phishing/set-up-credential-phishing-prevention

• Question 366:

  Which object would an administrator create to block access to all high-risk applications?

  A. HIP profile

  B. application filter

  C. application group

  D. Vulnerability Protection profile

  Correct Answer: B

  Reference: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClKECA0

• Question 367:

  

  An administrator is updating Security policy to align with best practices. Which Policy Optimizer feature is shown in the screenshot below?

  A. Rules without App Controls

  B. New App Viewer

  C. Rule Usage

  D. Unused Unused Apps

  Correct Answer: A

• Question 368:

  Which User-ID agent would be appropriate in a network with multiple WAN links, limited network bandwidth, and limited firewall management plane resources?

  A. Windows-based agent deployed on the internal network

  B. PAN-OS integrated agent deployed on the internal network

  C. Citrix terminal server deployed on the internal network

  D. Windows-based agent deployed on each of the WAN Links

  Correct Answer: A

  Another reason to choose the Windows agent over the integrated PAN-OS agent is to save processing cycles on the firewall's management plane.

• Question 369:

  What is the main function of the Test Policy Match function?

  A. verify that policy rules from Expedition are valid

  B. confirm that rules meet or exceed the Best Practice Assessment recommendations

  C. confirm that policy rules in the configuration are allowing/denying the correct traffic

  D. ensure that policy rules are not shadowing other policy rules

  Correct Answer: C

  Test the policy rules in your running configuration to ensure that your policies appropriately allow and deny traffic and access to applications and websites in compliance with your business needs and requirements. https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/policy/test-policy-rule-traffic-matches

• Question 370:

  Which firewall feature do you need to configure to query Palo Alto Networks service updates over a data-plane interface instead of the management interface?

  A. Data redistribution

  B. Dynamic updates

  C. SNMP setup

  D. Service route

  Correct Answer: D

  Reference: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGJCA0