Palo Alto Networks Palo Alto Networks Certifications PCNSA Questions & Answers

• Question 391:

  Which security profile will provide the best protection against ICMP floods, based on individual combinations of a packet`s source and destination IP address?

  A. DoS protection

  B. URL filtering

  C. packet buffering

  D. anti-spyware

  Correct Answer: A

• Question 392:

  If users from the Trusted zone need to allow traffic to an SFTP server in the DMZ zone, how should a Security policy with App-ID be configured?

  

  A. Option A

  B. Option B

  C. Option C

  D. Option D

  Correct Answer: D

• Question 393:

  An administrator would like to use App-ID's deny action for an application and would like that action updated with dynamic updates as new content becomes available.

  Which security policy action causes this?

  A. Reset server

  B. Reset both

  C. Deny

  D. Drop

  Correct Answer: C

  Reference:

  https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/firewall- administration/manage- configuration backups/revert-firewall-configuration- changes.html

• Question 394:

  What allows a security administrator to preview the Security policy rules that match new application signatures?

  A. Review Release Notes

  B. Dynamic Updates-Review Policies

  C. Dynamic Updates-Review App

  D. Policy Optimizer-New App Viewer

  Correct Answer: B

  https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/app-id/manage- new-app-ids-introduced-in-content-releases/review-new-app-id-impact-on-existing-policy- rules

• Question 395:

  You need to allow users to access the office-suite application of their choice. How should you configure the firewall to allow access to any office-suite application?

  A. Create an Application Group and add Office 365, Evernote Google Docs and Libre Office

  B. Create an Application Group and add business-systems to it.

  C. Create an Application Filter and name it Office Programs, then filter it on the office programs subcategory.

  D. Create an Application Filter and name it Office Programs then filter on the business- systems category.

  Correct Answer: C

• Question 396:

  Which tab would an administrator click to create an address object?

  A. Device

  B. Policies

  C. Monitor

  D. Objects

  Correct Answer: D

• Question 397:

  Which administrator type provides more granular options to determine what the administrator can view and modify when creating an administrator account?

  A. Root

  B. Dynamic

  C. Role-based

  D. Superuser

  Correct Answer: C

• Question 398:

  Based on the graphic, what is the purpose of the SSL/TLS Service profile configuration option?

  

  A. It defines the SSUTLS encryption strength used to protect the management interface.

  B. It defines the CA certificate used to verify the client's browser.

  C. It defines the certificate to send to the client's browser from the management interface.

  D. It defines the firewall's global SSL/TLS timeout values.

  Correct Answer: C

  Reference: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g00000 0ClFGCA0

• Question 399:

  What are the requirements for using Palo Alto Networks EDL Hosting Sen/ice?

  A. any supported Palo Alto Networks firewall or Prisma Access firewall

  B. an additional subscription free of charge

  C. a firewall device running with a minimum version of PAN-OS 10.1

  D. an additional paid subscription

  Correct Answer: A

• Question 400:

  

  Given the network diagram, traffic should be permitted for both Trusted and Guest users to access general Internet and DMZ servers using SSH. web-browsing and SSL applications Which policy achieves the desired results?

  

  A. Option A

  B. Option B

  C. Option C

  D. Option D

  Correct Answer: C