Palo Alto Networks Palo Alto Networks Certifications PCNSA Questions & Answers

• Question 421:

  Which action results in the firewall blocking network traffic with out notifying the sender?

  A. Drop

  B. Deny

  C. Reset Server

  D. Reset Client

  Correct Answer: B

• Question 422:

  An administrator is configuring a NAT rule.

  At a minimum, which three forms of information are required? (Choose three.)

  A. name

  B. source zone

  C. destination interface

  D. destination address

  E. destination zone

  Correct Answer: ABE

• Question 423:

  An administrator configured a Security policy rule with an Antivirus Security profile. The administrator did not change the action for the profile. If a virus gets detected, how will the firewall handle the traffic?

  A. It allows the traffic because the profile was not set to explicitly deny the traffic.

  B. It drops the traffic because the profile was not set to explicitly allow the traffic.

  C. It uses the default action assigned to the virus signature.

  D. It allows the traffic but generates an entry in the Threat logs.

  Correct Answer: C

  "Default-For each threat signature and Antivirus signature that is defined by Palo Alto Networks, a default action is specified internally. Typically, the default action is an alert or a reset-both. " https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/policy/security-profiles

• Question 424:

  

  Given the detailed log information above, what was the result of the firewall traffic inspection?

  A. It was blocked by the Vulnerability Protection profile action.

  B. It was blocked by the Anti-Virus Security profile action.

  C. It was blocked by the Anti-Spyware Profile action.

  D. It was blocked by the Security policy action.

  Correct Answer: C

• Question 425:

  When is the content inspection performed in the packet flow process?

  A. after the application has been identified

  B. after the SSL Proxy re-encrypts the packet

  C. before the packet forwarding process

  D. before session lookup

  Correct Answer: A

  Reference: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g00000 0ClVHCA0

• Question 426:

  Users from the internal zone need to be allowed to Telnet into a server in the DMZ zone.

  Complete the security policy to ensure only Telnet is allowed.

  Security Policy: Source Zone: Internal to DMZ Zone __________services "Application defaults", and action = Allow

  A. Destination IP: 192.168.1.123/24

  B. Application = `Telnet'

  C. Log Forwarding

  D. USER-ID = `Allow users in Trusted'

  Correct Answer: B

• Question 427:

  Which interface type requires no routing or switching but applies Security or NAT policy rules before passing allowed traffic?

  A. Layer 3

  B. Virtual Wire

  C. Tap

  D. Layer 2

  Correct Answer: A

  Reference: https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/networking/nat/nat-policy-rules/nat-policy-overview

• Question 428:

  Palo Alto Networks firewall architecture accelerates content map minimizing latency using which two components'? (Choose two )

  A. Network Processing Engine

  B. Single Stream-based Engine

  C. Policy Engine

  D. Parallel Processing Hardware

  Correct Answer: BD

• Question 429:

  You receive notification about new malware that infects hosts through malicious files transferred by FTP.

  Which Security profile detects and protects your internal networks from this threat after you update your firewall's threat signature database?

  A. URL Filtering profile applied to inbound Security policy rules.

  B. Data Filtering profile applied to outbound Security policy rules.

  C. Antivirus profile applied to inbound Security policy rules.

  D. Vulnerability Prote ction profile applied to outbound Security policy rules.

  Correct Answer: C

  Reference: https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/policy/security-profiles

• Question 430:

  An internal host wants to connect to servers of the internet through using source NAT. Which policy is required to enable source NAT on the firewall?

  A. NAT policy with source zone and destination zone specified

  B. post-NAT policy with external source and any destination address

  C. NAT policy with no source of destination zone selected

  D. pre-NAT policy with external source and any destination address

  Correct Answer: A