Palo Alto Networks PCNSA Online Practice Questions and Exam Preparation

Palo Alto Networks PCNSA Online Questions & Answers

• Question 421:

  Within the WildFire Analysis profile, which three items are configurable? (Choose three.)

  A. FileType
  B. Direction
  C. Service
  D. Application
  E. Objects
  A. FileType
  B. Direction
  D. Application

  ---

  Explanation/Reference:

• Question 422:

  An administrator would like to override the default deny action for a given application and instead would like to block the traffic and send the ICMP code "communication with the destination is administratively prohibited". Which security policy action causes this?

  A. Drop
  B. Drop, send ICMP Unreachable
  C. Reset both
  D. Reset server
  A. Drop

  ---

  Explanation/Reference:

• Question 423:

  How would a Security policy need to be written to allow outbound traffic using Secure Shell (SSH) to destination ports tcp/22 and tcp/4422?

  A. The admin creates a custom service object named "tcp-4422" with port tcp/4422. The admin then creates a Security policy allowing application "ssh" and service "tcp-4422".
  B. The admin creates a custom service object named "tcp-4422" with port tcp/4422. The admin then creates a Security policy allowing application "ssh", service "tcp-4422", and service "application-default".
  C. The admin creates a custom service object named "tcp-4422" with port tcp/4422. The admin also creates a custom service object named "tcp-22" with port tcp/22. The admin then creates a Security policy allowing application "ssh", service "tcp-4422", and service "tcp-22".
  D. The admin creates a Security policy allowing application "ssh" and service "application-default".
  C. The admin creates a custom service object named "tcp-4422" with port tcp/4422. The admin also creates a custom service object named "tcp-22" with port tcp/22. The admin then creates a Security policy allowing application "ssh", service "tcp-4422", and service "tcp-22".

• Question 424:

  To what must an interface be assigned before it can process traffic?

  A. Security Zone
  B. Security policy
  C. Security Protection
  D. Security profile
  A. Security Zone

• Question 425:

  Which interface type is used to monitor traffic and cannot be used to perform traffic shaping?

  A. Layer 2
  B. Tap
  C. Layer 3
  D. Virtual Wire
  B. Tap

• Question 426:

  Which step is mandatory to create a static route in PAN-OS?

  A. Apply the autonomous system number.
  B. Specify the outgoing interface.
  C. Select the dynamic routing protocol.
  D. Select the virtual router.
  D. Select the virtual router.

  ---

  Explanation/Reference:

• Question 427:

  In which profile should you configure the DNS Security feature?

  A. URL Filtering Profile
  B. Anti-Spyware Profile
  C. Zone Protection Profile
  D. Antivirus Profile
  B. Anti-Spyware Profile

  ---

  Explanation/Reference:

  Reference:

  https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/threat-prevention/dns- security/enable- dnssecurity.html

• Question 428:

  An administrator wants to enable access to www.paloaltonetworks.com while denying access to all other sites in the same category.

  Which object should the administrator create to use as a match condition for the security policy rule that allows access to www.paloaltonetworks.com?

  A. Service
  B. Address
  C. URL category
  D. Application group
  C. URL category

  ---

  Explanation/Reference:

• Question 429:

  What is the main function of Policy Optimizer?

  A. reduce load on the management plane by highlighting combinable security rules
  B. migrate other firewall vendors' security rules to Palo Alto Networks configuration
  C. eliminate "Log at Session Start" security rules
  D. convert port-based security rules to application-based security rules
  D. convert port-based security rules to application-based security rules

  ---

  Explanation/Reference:

  Reference:https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-new-features/app-id- features/policy- optimizer.html

• Question 430:

  With the PAN-OS 11.0 Nova release, which two attack options can new inline deep learning analysis engines detect and prevent? (Choose two.)

  A. Command injection attacks
  B. SSL attacks
  C. SQL injection attacks
  D. HTTP attacks
  A. Command injection attacks
  C. SQL injection attacks

  ---

  Explanation/Reference: