Palo Alto Networks PCNSA Online Practice Questions and Exam Preparation

Palo Alto Networks PCNSA Online Questions & Answers

• Question 401:

  After making multiple changes to the candidate configuration of a firewall, the administrator would like to start over with a candidate configuration that matches the running configuration. Which command in Device > Setup > Operations would provide the most operationally efficient way to accomplish this?

  A. Import named config snapshot
  B. Load named configuration snapshot
  C. Revert to running configuration
  D. Revert to last saved configuration
  C. Revert to running configuration

• Question 402:

  When creating a custom URL category object, which is a valid type?

  A. domain match
  B. host names
  C. wildcard
  D. category match
  D. category match

  ---

  Explanation/Reference:

  Reference:https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-web-interface- help/objects/objects-custom-objects-url-category.html

• Question 403:

  Which three types of entries can be excluded from an external dynamic list? (Choose three.)

  A. IP addresses
  B. Applications
  C. User-ID
  D. Domains
  E. URLs
  A. IP addresses
  D. Domains
  E. URLs

  ---

  Explanation/Reference:

• Question 404:

  Which license must an administrator acquire prior to downloading Antivirus updates for use with the firewall?

  A. URL filtering
  B. Antivirus
  C. WildFire
  D. Threat Prevention
  D. Threat Prevention

• Question 405:

  An administrator would like to see the traffic that matches the interzone-default rule in the traffic logs. What is the correct process to enable this logging?

  A. Select the interzone-default rule and click Override; on the Actions tab, select Log at Session End and click OK.
  B. Select the interzone-default rule and edit the rule; on the Actions tab, select Log at Session End and click OK.
  C. Select the interzone-default rule and edit the rule; on the Actions tab, select Log at Session Start and click OK.
  D. This rule has traffic logging enabled by default; no further action is required.
  A. Select the interzone-default rule and click Override; on the Actions tab, select Log at Session End and click OK.

  ---

  Explanation/Reference:

  The default rules are predefined rules that are part of the predefined configuration and are read-only by default; you can override them and change a limited number of settings, including the tags, action (allow or deny), log settings, and security profiles. The names for the two default rules are intrazone-default and interzone-default.

• Question 406:

  An internal host wants to connect to servers of the internet through using source NAT. Which policy is required to enable source NAT on the firewall?

  A. NAT policy with source zone and destination zone specified
  B. post-NAT policy with external source and any destination address
  C. NAT policy with no source of destination zone selected
  D. pre-NAT policy with external source and any destination address
  A. NAT policy with source zone and destination zone specified

• Question 407:

  Access to which feature requires the PAN-OS Filtering license?

  A. PAN-DB database
  B. DNS Security
  C. Custom URL categories
  D. URL external dynamic lists
  A. PAN-DB database

  ---

  Explanation/Reference:

  Reference:https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/getting- started/activate-licenses-andsubscriptions.html

• Question 408:

  If using group mapping with Active Directory Universal Groups, what must you do when configuring the User-ID?

  A. Create an LDAP Server profile to connect to the root domain of the Global Catalog server on port 3268 or 3269 for SSL
  B. Configure a frequency schedule to clear group mapping cache
  C. Configure a Primary Employee ID number for user-based Security policies
  D. Create a RADIUS Server profile to connect to the domain controllers using LDAPS on port 636 or 389
  A. Create an LDAP Server profile to connect to the root domain of the Global Catalog server on port 3268 or 3269 for SSL

  ---

  Explanation/Reference:

  If you have Universal Groups, create an LDAP server profile to connect to the root domain of the Global Catalog server on port 3268 or 3269 for SSL. https://docs.paloaltonetworks.com/best-practices/10-1/user-id-best-practices/user-id-best-practices/user-id-best-practices-for-group-mapping

• Question 409:

  An administrator would like to silently drop traffic from the internet to a ftp server.

  Which Security policy action should the administrator select?

  A. Reset-server
  B. Block
  C. Deny
  D. Drop
  D. Drop

• Question 410:

  Where does a user assign a tag group to a policy rule in the policy creation window?

  A. General tab
  B. Usage tab
  C. Application tab
  D. Actions tab
  A. General tab

  ---

  Explanation/Reference: