Palo Alto Networks PCNSA Online Practice Questions and Exam Preparation

Palo Alto Networks PCNSA Online Questions & Answers

• Question 41:

  Which two types of profiles are needed to create an authentication sequence? (Choose two.)

  A. Security profile
  B. Authentication profile
  C. Server profile
  D. Interface Management profile
  B. Authentication profile
  C. Server profile

  ---

  Explanation/Reference:

• Question 42:

  Which interface does not require a MAC or IP address?

  A. Virtual Wire
  B. Layer3
  C. Layer2
  D. Loopback
  A. Virtual Wire

• Question 43:

  According to best practices, how frequently should WildFire updates he made to perimeter firewalls?

  A. every 10 minutes
  B. every minute
  C. every 5 minutes
  D. in real time
  D. in real time

  ---

  Explanation/Reference:

  https://docs.paloaltonetworks.com/wildfire/9-1/wildfire-admin/wildfire-deployment-best-practices/wildfire-best-practicesIf you are running PAN-OS 10.0 or later, configure your firewall to retrieve WildFire signatures in real-time. This provides access to newly-discovered malware signatures as soon as the WildFire public cloud can generate them, thereby preventing successful attacks by minimizing your exposure time to malicious activity.

• Question 44:

  What are two differences between an implicit dependency and an explicit dependency in App-ID? (Choose two.)

  A. An implicit dependency does not require the dependent application to be added in the security policy
  B. An implicit dependency requires the dependent application to be added in the security policy
  C. An explicit dependency does not require the dependent application to be added in the security policy
  D. An explicit dependency requires the dependent application to be added in the security policy
  A. An implicit dependency does not require the dependent application to be added in the security policy
  D. An explicit dependency requires the dependent application to be added in the security policy

• Question 45:

  Which Security profile generates an alert based on a threshold when the action is set to Alert?

  A. Vulnerability Protection
  B. Antivirus
  C. DoS protection
  D. Anti-Spyware
  C. DoS protection

  ---

  Explanation/Reference:

  DoS Protection profiles set thresholds that protect against new session IP flood attacks and provide resource protection (maximum concurrent session limits for specified endpoints and resources). DoS Protection profiles protect specific devices (classified profiles) and groups of devices (aggregate profiles) against SYN, UDP, ICMP, ICMPv6, and Other IP flood attacks. Configuring Flood Protection thresholds in a DoS Protection profile is similar to configuring Flood Protection in a Zone Protection profile, but Zone Protection profiles protect entire ingress zones, while DoS protection profiles and policy rules are granular and targeted, and can even be classified to a single device (IP address). The firewall measures the aggregate number of connections-per-second (CPS) to a group of devices (aggregate profile) or measures the CPS to individual devices (classified profile).

• Question 46:

  Which type of address object is "10 5 1 1/0 127 248 2"?

  A. IP subnet
  B. IP wildcard mask
  C. IP netmask
  D. IP range
  B. IP wildcard mask

• Question 47:

  What does an administrator use to validate whether a session is matching an expected NAT policy?

  A. system log
  B. test command
  C. threat log
  D. config audit
  B. test command

  ---

  Explanation/Reference:

  Reference: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g00000 0ClQSCA0

• Question 48:

  What are three DNS policy actions? (Choose three.)

  A. Block
  B. Allow
  C. Strict
  D. Sinkhole
  E. Alert
  A. Block
  B. Allow
  D. Sinkhole

  ---

  Explanation/Reference:

• Question 49:

  What are three factors that can be used in domain generation algorithms? (Choose three.)

  A. cryptographic keys
  B. time of day
  C. other unique values
  D. URL custom categories
  E. IP address
  A. cryptographic keys
  B. time of day
  C. other unique values

  ---

  Explanation/Reference:

  Domain generation algorithms (DGAs) are used to auto-generate domains, typically in large numbers within the context of establishing a malicious command-and- control (C2) communications channel. DGA-based malware (such as Pushdo,

  BankPatch, and CryptoLocker) limit the number of domains from being blocked by hiding the location of their active C2 servers within a large number of possible suspects, and can be algorithmically generated based on factors such as time of

  day, cryptographic keys, or other unique values.

  https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/threat-prevention/dns- security/domain-generation-algorithm-detection

• Question 50:

  An administrator would like to apply a more restrictive Security profile to traffic for file sharing applications. The administrator does not want to update the Security policy or object when new applications are released. Which object should the administrator use as a match condition in the Security policy?

  A. the Content Delivery Networks URL category
  B. the Online Storage and Backup URL category
  C. an application group containing all of the file-sharing App-IDs reported in the traffic logs
  D. an application filter for applications whose subcategory is file-sharing
  D. an application filter for applications whose subcategory is file-sharing