Palo Alto Networks Palo Alto Networks Certifications PCNSA Questions & Answers

• Question 381:

  What are three valid ways to map an IP address to a username? (Choose three.)

  A. using the XML API

  B. DHCP Relay logs

  C. a user connecting into a GlobalProtect gateway using a GlobalProtect Agent

  D. usernames inserted inside HTTP Headers

  E. WildFire verdict reports

  Correct Answer: ACD

• Question 382:

  Which type of security policy rule will match traffic that flows between the Outside zone and inside zone, but would not match traffic that flows within the zones?

  A. global

  B. intrazone

  C. interzone

  D. universal

  Correct Answer: C

  Reference:

  https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/software-and-content- updates/dynamic-contentupdates.html#:~:text=WildFire%20signature%20updates%20are%20made,within% 20a%20minute%20of %

• Question 383:

  Which Security profile can you apply to protect against malware such as worms and Trojans?

  A. data filtering

  B. antivirus

  C. vulnerability protection

  D. anti-spyware

  Correct Answer: B

  Reference:

  https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/policy/security- profiles#:~:text=Antivirus%20profiles%20protect%20against%20viruses,as%20well%20as%20spyware%20downloads

• Question 384:

  Which feature would be useful for preventing traffic from hosting providers that place few restrictions on content, whose services are frequently used by attackers to distribute illegal or unethical material?

  A. Palo Alto Networks Bulletproof IP Addresses

  B. Palo Alto Networks CandC IP Addresses

  C. Palo Alto Networks Known Malicious IP Addresses

  D. Palo Alto Networks High-Risk IP Addresses

  Correct Answer: A

  To block hosts that use bulletproof hosts to provide malicious, illegal, and/or unethical content, use the bulletproof IP address list in policy. https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-new-features/content-inspection- features/edl-for-bulletproof-isps#:~:text=A%20new%20built%2Din%20external,%2C%20illegal%2C%20and%20unethi cal%20content.

• Question 385:

  If using group mapping with Active Directory Universal Groups, what must you do when configuring the User-ID?

  A. Create an LDAP Server profile to connect to the root domain of the Global Catalog server on port 3268 or 3269 for SSL

  B. Configure a frequency schedule to clear group mapping cache

  C. Configure a Primary Employee ID number for user-based Security policies

  D. Create a RADIUS Server profile to connect to the domain controllers using LDAPS on port 636 or 389

  Correct Answer: A

  If you have Universal Groups, create an LDAP server profile to connect to the root domain of the Global Catalog server on port 3268 or 3269 for SSL. https://docs.paloaltonetworks.com/best-practices/10-1/user-id-best-practices/user-id-best-practices/user-id-best-practices-for-group-mapping

• Question 386:

  In which stage of the Cyber-Attack Lifecycle would the attacker inject a PDF file within an email?

  A. Weaponization

  B. Reconnaissance

  C. Installation

  D. Command and Control

  E. Exploitation

  Correct Answer: A

• Question 387:

  What do you configure if you want to set up a group of objects based on their ports alone?

  A. Application groups

  B. Service groups

  C. Address groups

  D. Custom objects

  Correct Answer: B

• Question 388:

  An administrator is troubleshooting traffic that should match the interzone-default rule. However, the administrator doesn't see this traffic in the traffic logs on the firewall. The interzone-default was never changed from its default configuration. Why doesn't the administrator see the traffic?

  A. Traffic is being denied on the interzone-default policy.

  B. The Log Forwarding profile is not configured on the policy.

  C. The interzone-default policy is disabled by default

  D. Logging on the interzone-default policy is disabled

  Correct Answer: D

• Question 389:

  An administrator would like to apply a more restrictive Security profile to traffic for file sharing applications. The administrator does not want to update the Security policy or object when new applications are released. Which object should the administrator use as a match condition in the Security policy?

  A. the Content Delivery Networks URL category

  B. the Online Storage and Backup URL category

  C. an application group containing all of the file-sharing App-IDs reported in the traffic logs

  D. an application filter for applications whose subcategory is file-sharing

  Correct Answer: D

• Question 390:

  Given the cyber-attack lifecycle diagram identify the stage in which the attacker can run malicious code against a vulnerability in a targeted machine.

  

  A. Exploitation

  B. Installation

  C. Reconnaissance

  D. Act on the Objective

  Correct Answer: A