Palo Alto Networks PCNSA Online Practice Questions and Exam Preparation

Palo Alto Networks PCNSA Online Questions & Answers

• Question 411:

  An administrator would like to block access to a web server, while also preserving resources and minimizing half-open sockets. What are two security policy actions the administrator can select? (Choose two.)

  A. Reset server
  B. Reset both
  C. Drop
  D. Deny
  A. Reset server
  C. Drop
  D. Deny

• Question 412:

  Ethernet 2/1 has an IP Address of 10.0 1 2 in Zone ‘trust’ (LAN).

  If both interfaces are connected to the same virtual router, which IP address information will an administrator need to enter in the Destination field to access the internet?

  

  A. 0.0.0.0
  B. 10.0.2.1/32
  C. 10.0.1.254/32
  D. 0.0.0.0/0
  D. 0.0.0.0/0

  ---

  Explanation/Reference:

• Question 413:

  What must exist in order for the firewall to route traffic between Layer 3 interfaces?

  A. Virtual router
  B. Virtual wires
  C. Traffic Distribution profile
  D. VLANs
  A. Virtual router

  ---

  Explanation/Reference:

  A virtual router is a function of the firewall that participates in Layer 3 routing.

• Question 414:

  Which three types of entries can be excluded from an external dynamic list? (Choose three.)

  A. IP addresses
  B. Applications
  C. User-ID
  D. Domains
  E. URLs
  A. IP addresses
  D. Domains
  E. URLs

  ---

  Explanation/Reference:

  Reference: https://docs.servicenow.com/en-US/bundle/utah-security-management/page/product/secops-integration-paloalto-ngfw/reference/paloalto_supported_edls.html

• Question 415:

  Which service protects cloud-based applications such as Dropbox and Salesforce by administering permissions and scanning files for sensitive information?

  A. Aperture
  B. AutoFocus
  C. Parisma SaaS
  D. GlobalProtect
  C. Parisma SaaS

• Question 416:

  By default, which action is assigned to the intrazone-default rule?

  A. Reset-client
  B. Reset-server
  C. Deny
  D. Allow
  D. Allow

  ---

  Explanation/Reference:

  Reference: https://kb.wisc.edu/security/page.php?id=90956#:~:text=Intrazone%20%22traffic%20within%20your%20zone,by%20default%20will%20allow%20it.andtext=Interzone%20%22traffic%20between%20zones%22%2C,by%20default% 20will%20block%20it

• Question 417:

  A Security Profile can block or allow traffic at which point?

  A. after it is matched to a Security policy rule that allows traffic
  B. on either the data plane or the management plane
  C. after it is matched to a Security policy rule that allows or blocks traffic
  D. before it is matched to a Security policy rule
  A. after it is matched to a Security policy rule that allows traffic

• Question 418:

  Which two firewall components enable you to configure SYN flood protection thresholds? (Choose two.)

  A. QoS profile
  B. DoS Protection profile
  C. Zone Protection profile
  D. DoS Protection policy
  B. DoS Protection profile
  C. Zone Protection profile

  ---

  Explanation/Reference:

  Reference: https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/policy/security-profiles

• Question 419:

  Which two events can be found in data-filtering logs? (Choose two.)

  A. Specific users attempting to authenticate
  B. Sensitive information attempting to exit the network
  C. An unsuccessful attempt to establish a TLS session
  D. A download attempt of a blocked file type
  B. Sensitive information attempting to exit the network
  D. A download attempt of a blocked file type

  ---

  Explanation/Reference:

  Reference: https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/monitoring/view-and-manage-logs/log-types-and-severity-levels/data-filtering-logs

• Question 420:

  You have been tasked to configure access to a new web server located in the DMZ.

  Based on the diagram what configuration changes are required in the NGFW virtual router to route traffic from the 10 1 1 0/24 network to 192 168 1 0/24?

  

  A. Add a route with the destination of 192 168 1 0/24 using interface Eth 1/3 with a next- hop of 192.168 1.10
  B. Add a route with the destination of 192 168 1 0/24 using interface Eth 1/2 with a next- hop of 172.16.1.2
  C. Add a route with the destination of 192 168 1 0/24 using interface Eth 1/3 with a next- hop of 172.16.1.2
  D. Add a route with the destination of 192 168 1 0/24 using interface Eth 1/3 with a next- hop of 192.168.1.254
  C. Add a route with the destination of 192 168 1 0/24 using interface Eth 1/3 with a next- hop of 172.16.1.2