Palo Alto Networks Palo Alto Networks Certifications PCNSA Questions & Answers

• Question 31:

  The administrator profile "SYS01 Admin" is configured with authentication profile "Authentication Sequence SYS01," and the authentication sequence SYS01 has a profile list with four authentication profiles:

  Auth Profile LDAP Auth Profile Radius Auth Profile Local Auth Profile TACACS

  After a network outage, the LDAP server is no longer reachable. The RADIUS server is still reachable but has lost the "SYS01 Admin" username and password.

  What is the "SYS01 Admin" login capability after the outage?

  A. Auth KO because RADIUS server lost user and password for SYS01 Admin

  B. Auth OK because of the Auth Profile TACACS

  C. Auth OK because of the Auth Profile Local

  D. Auth KO because LDAP server is not reachable

  Correct Answer: C

  Reference: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PMdXCAW

• Question 32:

  Which three types of Source NAT are available to users inside a NGFW? (Choose three.)

  A. Static Port

  B. Dynamic IP and Port (DIPP)

  C. Dynamic IP

  D. Static IP and Port (SIPP)

  E. Static IP

  Correct Answer: BCE

• Question 33:

  What are the two main reasons a custom application is created? (Choose two.)

  A. To change the default categorization of an application

  B. To visually group similar applications

  C. To correctly identify an internal application in the traffic log

  D. To reduce unidentified traffic on a network

  Correct Answer: CD

• Question 34:

  By default, what is the maximum number of templates that can be added to a template stack?

  A. 6

  B. 8

  C. 10

  D. 12

  Correct Answer: B

  Reference: https://www.mbtechtalker.com/panorama-templates-and-template-stacks/#:~:text=A%20Template%20Stack%20is%20essentially,be%20applied%20to%20multiple%20firewalls

• Question 35:

  What does rule shadowing in Security policies do?

  A. It shows rules with the same Source Zones and Destination Zones.

  B. It indicates that a broader rule matching the criteria is configured above a more specific rule.

  C. It indicates rules with App-ID that are not configured as port-based.

  D. It shows rules that are missing Security profile configurations.

  Correct Answer: B

• Question 36:

  Which two types of profiles are needed to create an authentication sequence? (Choose two.)

  A. Security profile

  B. Authentication profile

  C. Server profile

  D. Interface Management profile

  Correct Answer: BC

• Question 37:

  Which order of steps is the correct way to create a static route?

  A. 1) Enter the route and netmask 2) Specify the outgoing interface for packets to use to go to the next hop 3) Enter the IP address for the specific next hop 4) Add an IPv4 or IPv6 route by name

  B. 1) Enter the IP address for the specific next hop 2) Add an IPv4 or IPv6 route by name 3) Enter the route and netmask 4) Specify the outgoing interface for packets to use to go to the next hop

  C. 1) Enter the route and netmask 2) Enter the IP address for the specific next hop 3) Specify the outgoing interface for packets to use to go to the next hop 4) Add an IPv4 or IPv6 route by name

  D. 1) Enter the IP address for the specific next hop 2) Enter the route and netmask 3) Add an IPv4 or IPv6 route by name 4) Specify the outgoing interface for packets to use to go to the next hop

  Correct Answer: C

  Reference: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-networking-admin/advanced-routing/create-a-static-route

• Question 38:

  What are three advantages of user-to-group mapping? (Choose three.)

  A. It does not require additional objects to be configured.

  B. It does not require a Server profile.

  C. It simplifies user administration.

  D. It automatically adds new users to the appropriate group.

  E. It allows an administrator to write more granular policies.

  Correct Answer: CDE

• Question 39:

  Which situation is recorded as a system log?

  A. A connection with an authentication server has been dropped.

  B. A file that has been analyzed is potentially dangerous for the system.

  C. An attempt to access a spoofed website has been blocked.

  D. A new asset has been discovered on the network.

  Correct Answer: A

• Question 40:

  Within an Anti-Spyware security profile, which tab is used to enable machine learning based engines?

  A. Signature Policies

  B. Signature Exceptions

  C. Machine Learning Policies

  D. Inline Cloud Analysis

  Correct Answer: D