Palo Alto Networks PCNSA Online Practice Questions and Exam Preparation

Palo Alto Networks PCNSA Online Questions & Answers

• Question 31:

  What is used to monitor Security policy applications and usage?

  A. Security profile
  B. App-ID
  C. Policy-based forwarding
  D. Policy Optimizer
  D. Policy Optimizer

  ---

  Explanation/Reference:

• Question 32:

  The CFO found a USB drive in the parking lot and decide to plug it into their corporate laptop. The USB drive had malware on it that loaded onto their computer and then contacted a known command and control (CnC) server, which ordered the infected machine to begin Exfiltrating data from the laptop.

  Which security profile feature could have been used to prevent the communication with the CnC server?

  A. Create an anti-spyware profile and enable DNS Sinkhole
  B. Create an antivirus profile and enable DNS Sinkhole
  C. Create a URL filtering profile and block the DNS Sinkhole category
  D. Create a security policy and enable DNS Sinkhole
  A. Create an anti-spyware profile and enable DNS Sinkhole

• Question 33:

  What does rule shadowing in Security policies do?

  A. It shows rules with the same Source Zones and Destination Zones.
  B. It indicates that a broader rule matching the criteria is configured above a more specific rule.
  C. It indicates rules with App-ID that are not configured as port-based.
  D. It shows rules that are missing Security profile configurations.
  B. It indicates that a broader rule matching the criteria is configured above a more specific rule.

  ---

  Explanation/Reference:

• Question 34:

  If the firewall interface E1/1 is connected to a SPAN or mirror port, which interface type should E1/1 be configured as?

  A. Tap
  B. Virtual Wire
  C. Layer 2
  D. Layer 3
  A. Tap

• Question 35:

  Which statement applies to the Intrazone Security policy rule?

  A. The traffic within the same security zone will not be allowed.
  B. It requires a Zone Protection profile to be applied.
  C. It applies regardless of whether it is from the same security zone or a different one.
  D. It applies to all matching traffic within the specified source security zones.
  D. It applies to all matching traffic within the specified source security zones.

  ---

  Explanation/Reference:

  Reference: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClomCAC

• Question 36:

  Which object would an administrator create to block access to all high-risk applications?

  A. HIP profile
  B. application filter
  C. application group
  D. Vulnerability Protection profile
  B. application filter

  ---

  Explanation/Reference:

  Reference: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClKECA0

• Question 37:

  An address object of type IP Wildcard Mask can be referenced in which part of the configuration?

  A. Security policy rule
  B. ACC global filter
  C. external dynamic list
  D. NAT address pool
  A. Security policy rule

  ---

  Explanation/Reference:

  You can use an address object of type IP Wildcard Mask only in a Security policy rule. https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-web-interface-help/objects/objects- addresses IP Wildcard Mask --Enter an IP wildcard address in the format of an IPv4 address followed by a slash and a mask (which must begin with a zero); for example, 10.182.1.1/0.127.248.0. In the wildcard mask, a zero (0) bit indicates that the bit being compared must match the bit in the IP address that is covered by the 0. A one (1) bit in the mask is a wildcard bit, meaning the bit being compared need not match the bit in the IP address that is covered by the 1. Convert the IP address and the wildcard mask to binary. To illustrate the matching: on binary snippet 0011, a wildcard mask of 1010 results in four matches (0001, 0011, 1001, and 1011).

• Question 38:

  Starting with PAN_OS version 9.1 which new type of object is supported for use within the user field of a security policy rule?

  A. local username
  B. dynamic user group
  C. remote username
  D. static user group
  B. dynamic user group

• Question 39:

  What are the two default behaviors for the intrazone-default policy? (Choose two.)

  A. Allow
  B. Logging disabled
  C. Log at Session End
  D. Deny
  A. Allow
  B. Logging disabled

  ---

  Explanation/Reference:

  Reference: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClomCAC

• Question 40:

  What is the maximum volume of concurrent administrative account sessions?

  A. Unlimited
  B. 2
  C. 10
  D. 1
  A. Unlimited

  ---

  Explanation/Reference: