Palo Alto Networks PCNSA Online Practice Questions and Exam Preparation

Palo Alto Networks PCNSA Online Questions & Answers

• Question 431:

  Which Security policy set should be used to ensure that a policy is applied first?

  A. Local firewall policy
  B. Shared pre-rulebase
  C. Parent device-group pre-rulebase
  D. Child device-group pre-rulebase
  B. Shared pre-rulebase

• Question 432:

  Which Palo Alto network security operating platform component provides consolidated policy creation and centralized management?

  A. Prisma SaaS
  B. Panorama
  C. AutoFocus
  D. GlobalProtect
  B. Panorama

• Question 433:

  The PowerBall Lottery has reached an unusually high value this week. Your company has decided to raise morale by allowing employees to access the PowerBall Lottery website (www.powerball.com) for just this week. However, the company does not want employees to access any other websites also listed in the URL filtering "gambling" category.

  Which method allows the employees to access the PowerBall Lottery website but without unblocking access to the "gambling" URL category?

  A. Add just the URL www.powerball.com to a Security policy allow rule.
  B. Manually remove powerball.com from the gambling URL category.
  C. Add *.powerball.com to the URL Filtering allow list.
  D. Create a custom URL category, add *.powerball.com to it and allow it in the Security Profile.
  A. Add just the URL www.powerball.com to a Security policy allow rule.

  ---

  Explanation/Reference:

• Question 434:

  Which object would an administrator create to enable access to all applications in the office-programs subcategory?

  A. application filter
  B. URL category
  C. HIP profile
  D. application group
  A. application filter

• Question 435:

  What is considered best practice with regards to committing configuration changes?

  A. Disable the automatic commit feature that prioritizes content database installations before committing
  B. Validate configuration changes prior to committing
  C. Wait until all running and pending jobs are finished before committing
  D. Export configuration after each single configuration change performed
  B. Validate configuration changes prior to committing

  ---

  Explanation/Reference:

• Question 436:

  Which administrative management services can be configured to access a management interface?

  A. HTTP, CLI, SNMP, HTTPS
  B. HTTPS, SSH telnet SNMP
  C. SSH: telnet HTTP, HTTPS
  D. HTTPS, HTTP. CLI, API
  C. SSH: telnet HTTP, HTTPS

  ---

  Explanation/Reference:

  The administrative management services are http,https,telnet and ssh

• Question 437:

  A Panorama administrator would like to create an address object for the DNS server located in the New York City office, but does not want this object added to the other Panorama managed firewalls. Which configuration action should the administrator take when creating the address object?

  A. Tag the address object with the New York Office tag.
  B. Ensure that Disable Override is cleared.
  C. Ensure that the Shared option is checked.
  D. Ensure that the Shared option is cleared.
  D. Ensure that the Shared option is cleared.

  ---

  Explanation/Reference:

  Reference: https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-web-interface-help/panorama-web-interface/panorama-commit-operations

• Question 438:

  A NetSec manager was asked to create a new firewall administrator profile with customized privileges. The new firewall administrator must be able to download TSF File and Starts Dump File but must not be able to reboot the device. Where does the NetSec manager go to configure the new firewall administrator role profile?

  A. Device > Admin Roles > Add > XML API > Configuration
  B. Device > Admin Roles > Add > XML API > Operational Request
  C. Device > Admin Roles > Add > Web UI > Support
  D. Device > Admin Roles > Add > Web UI > Operations
  D. Device > Admin Roles > Add > Web UI > Operations

  ---

  Explanation/Reference:

  Reference: https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-web-interface-help/device/device-support

• Question 439:

  When a security rule is configured as Intrazone, which field cannot be changed?

  A. Destination Zone
  B. Actions
  C. Source Zone
  D. Application
  A. Destination Zone

  ---

  Explanation/Reference:

  Reference: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClomCAC#:~:text=When%20a%20rule%20is%20configured,be%20changed%20(greyed%20out)

• Question 440:

  A network administrator is required to use a dynamic routing protocol for network connectivity.

  Which three dynamic routing protocols are supported by the NGFW Virtual Router for this purpose? (Choose three.)

  A. RIP
  B. OSPF
  C. IS-IS
  D. EIGRP
  E. BGP
  A. RIP
  B. OSPF
  E. BGP