Palo Alto Networks Palo Alto Networks Certifications PCNSA Questions & Answers

• Question 431:

  Which type firewall configuration contains in-progress configuration changes?

  A. backup

  B. running

  C. candidate

  D. committed

  Correct Answer: C

• Question 432:

  What are the two default behaviors for the intrazone-default policy? (Choose two.)

  A. Allow

  B. Logging disabled

  C. Log at Session End

  D. Deny

  Correct Answer: AB

  Reference: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClomCAC

• Question 433:

  Assume that traffic matches a Security policy rule but the attached Security Profiles is configured to block matching traffic. Which statement accurately describes how the firewall will apply an action to matching traffic?

  A. If it is an allowed rule, then the Security Profile action is applied last

  B. If it is a block rule then the Security policy rule action is applied last

  C. If it is an allow rule then the Security policy rule is applied last

  D. If it is a block rule then Security Profile action is applied last

  Correct Answer: A

• Question 434:

  An administrator needs to create a Security policy rule that matches DNS traffic within the LAN zone, and also needs to match DNS traffic within the DMZ zone The administrator does not want to allow traffic between the DMZ and LAN zones. Which Security policy rule type should they use?

  A. default

  B. universal

  C. intrazone

  D. interzone

  Correct Answer: C

• Question 435:

  An administrator is reviewing another administrator s Security policy log settings. Which log setting configuration is consistent with best practices tor normal traffic?

  A. Log at Session Start and Log at Session End both enabled

  B. Log at Session Start disabled Log at Session End enabled

  C. Log at Session Start enabled Log at Session End disabled

  D. Log at Session Start and Log at Session End both disabled

  Correct Answer: B

• Question 436:

  What is a function of application tags?

  A. creation of new zones

  B. application prioritization

  C. automated referenced applications in a policy

  D. IP address allocations in DHCP

  Correct Answer: C

• Question 437:

  Which three types of authentication services can be used to authenticate user traffic flowing through the firewalls data plane? (Choose three )

  A. TACACS

  B. SAML2

  C. SAML10

  D. Kerberos

  E. TACACS+

  Correct Answer: ABD

• Question 438:

  An address object of type IP Wildcard Mask can be referenced in which part of the configuration?

  A. Security policy rule

  B. ACC global filter

  C. external dynamic list

  D. NAT address pool

  Correct Answer: A

  You can use an address object of type IP Wildcard Mask only in a Security policy rule. https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-web-interface-help/objects/objects- addresses IP Wildcard Mask --Enter an IP wildcard address in the format of an IPv4 address followed by a slash and a mask (which must begin with a zero); for example, 10.182.1.1/0.127.248.0. In the wildcard mask, a zero (0) bit indicates that the bit being compared must match the bit in the IP address that is covered by the 0. A one (1) bit in the mask is a wildcard bit, meaning the bit being compared need not match the bit in the IP address that is covered by the 1. Convert the IP address and the wildcard mask to binary. To illustrate the matching: on binary snippet 0011, a wildcard mask of 1010 results in four matches (0001, 0011, 1001, and 1011).

• Question 439:

  An administrator wishes to follow best practices for logging traffic that traverses the firewall Which log setting is correct?

  A. Disable all logging

  B. Enable Log at Session End

  C. Enable Log at Session Start

  D. Enable Log at both Session Start and End

  Correct Answer: B

  Reference: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Clt5CAC

• Question 440:

  What is an advantage for using application tags?

  A. They are helpful during the creation of new zones

  B. They help with the design of IP address allocations in DHCP.

  C. They help content updates automate policy updates

  D. They help with the creation of interfaces

  Correct Answer: C