Palo Alto Networks PCNSA Online Practice Questions and Exam Preparation

Palo Alto Networks PCNSA Online Questions & Answers

• Question 371:

  What are three configurable interface types for a data-plane ethernet interface? (Choose three.)

  A. VWire
  B. Layer 2
  C. Management
  D. HSCI
  E. Layer 3
  A. VWire
  B. Layer 2
  E. Layer 3

  ---

  Explanation/Reference:

• Question 372:

  

  Given the network diagram, traffic must be permitted for SSH and MYSQL from the DMZ to the SERVER zones, crossing two firewalls. In addition, traffic should be permitted from the SERVER zone to the DMZ on SSH only. Which rule group enables the required traffic?

  

  A. Option A
  B. Option B
  C. Option C
  D. Option D
  C. Option C

  ---

  Explanation/Reference:

  C is correct as the packet keep same sorce and destination addresses intact so the rules should be configured accordingly

• Question 373:

  Given the topology, which zone type should zone A and zone B to be configured with?

  

  A. Layer3
  B. Tap
  C. Layer2
  D. Virtual Wire
  A. Layer3

• Question 374:

  DRAG DROP

  Match the Palo Alto Networks Security Operating Platform architecture to its description. (Match each feature to the DoS Protection Policy or the DoS Protection Profile.)

  Select and Place:

  

  

  ---

  Explanation/Reference:

• Question 375:

  Which three statement describe the operation of Security Policy rules or Security Profiles? (Choose three)

  A. Security policy rules inspect but do not block traffic.
  B. Security Profile should be used only on allowed traffic.
  C. Security Profile are attached to security policy rules.
  D. Security Policy rules are attached to Security Profiles.
  E. Security Policy rules can block or allow traffic.
  B. Security Profile should be used only on allowed traffic.
  C. Security Profile are attached to security policy rules.
  E. Security Policy rules can block or allow traffic.

• Question 376:

  What action will inform end users when their access to Internet content is being restricted?

  A. Create a custom 'URL Category' object with notifications enabled.
  B. Publish monitoring data for Security policy deny logs.
  C. Ensure that the 'site access" setting for all URL sites is set to 'alert'.
  D. Enable 'Response Pages' on the interface providing Internet access.
  D. Enable 'Response Pages' on the interface providing Internet access.

  ---

  Explanation/Reference:

  Reference: https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-web-interface- help/device/device-response-pages.html

• Question 377:

  An administrator wants to enable users to access retail websites that are considered minimum risk.

  Which two URL categories should be combined in a custom URL category to accomplish this goal? (Choose two.)

  A. e-commerce
  B. known-good
  C. shopping
  D. low-risk
  C. shopping
  D. low-risk

  ---

  Explanation/Reference:

  Reference: https://docs.paloaltonetworks.com/advanced-url-filtering/administration/url-filtering-basics/url-categories

• Question 378:

  A network has 10 domain controllers, multiple WAN links, and a network infrastructure with bandwidth needed to support mission-critical applications. Given the scenario, which type of User-ID agent is considered a best practice by Palo Alto Networks?

  A. Windows-based agent on a domain controller
  B. Captive Portal
  C. Citrix terminal server with adequate data-plane resources
  D. PAN-OS integrated agent
  A. Windows-based agent on a domain controller

• Question 379:

  Which built-in IP address EDL would be useful for preventing traffic from IP addresses that are verified as unsafe based on WildFire analysis Unit 42 research and data gathered from telemetry?

  A. Palo Alto Networks CandC IP Addresses
  B. Palo Alto Networks Bulletproof IP Addresses
  C. Palo Alto Networks High-Risk IP Addresses
  D. Palo Alto Networks Known Malicious IP Addresses
  D. Palo Alto Networks Known Malicious IP Addresses

  ---

  Explanation/Reference:

  Palo Alto Networks Known Malicious IP Addresses --Contains IP addresses that are verified malicious based on WildFire analysis, Unit 42 research, and data gathered from telemetry (Share ThreatIntelligence with Palo Alto Networks). Attackers use these IP addresses almost exclusively to distribute malware, initiate command-and-control activity, and launch attacks.

  https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/policy/use-an-external- dynamic-list-in-policy/built-in-edls

• Question 380:

  How is the hit count reset on a rule?

  A. select a security policy rule, right click Hit Count > Reset
  B. with a dataplane reboot
  C. Device > Setup > Logging and Reporting Settings > Reset Hit Count
  D. in the CLI, type command reset hitcount
  A. select a security policy rule, right click Hit Count > Reset