Palo Alto Networks Palo Alto Networks Certifications PCNSA Questions & Answers

• Question 41:

  Which two statements correctly describe how pre-rules and local device rules are viewed and modified? (Choose two.)

  A. Pre-rules can be modified by the local administrator or by a Panorama administrator who has switched to a local firewall.

  B. Pre-rules and local device rules can be modified in Panorama.

  C. Pre-rules can be viewed on managed firewalls.

  D. Pre-rules are modified in Panorama only, and local device rules are modified on local firewalls only.

  Correct Answer: BC

• Question 42:

  Review the screenshot below. Which statement is correct about the information it contains?

  

  A. Highlight Unused Rules is checked.

  B. Tunnel Traffic has the High Risk tag applied.

  C. There are six Security policy rules on this firewall.

  D. View Rulebase as Groups is checked.

  Correct Answer: A

• Question 43:

  An administrator wants to enable users to access retail websites that are considered minimum risk.

  Which two URL categories should be combined in a custom URL category to accomplish this goal? (Choose two.)

  A. e-commerce

  B. known-good

  C. shopping

  D. low-risk

  Correct Answer: CD

  Reference: https://docs.paloaltonetworks.com/advanced-url-filtering/administration/url-filtering-basics/url-categories

• Question 44:

  Which two events can be found in data-filtering logs? (Choose two.)

  A. Specific users attempting to authenticate

  B. Sensitive information attempting to exit the network

  C. An unsuccessful attempt to establish a TLS session

  D. A download attempt of a blocked file type

  Correct Answer: BD

  Reference: https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/monitoring/view-and-manage-logs/log-types-and-severity-levels/data-filtering-logs

• Question 45:

  Which statement applies to the Intrazone Security policy rule?

  A. The traffic within the same security zone will not be allowed.

  B. It requires a Zone Protection profile to be applied.

  C. It applies regardless of whether it is from the same security zone or a different one.

  D. It applies to all matching traffic within the specified source security zones.

  Correct Answer: D

  Reference: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClomCAC

• Question 46:

  An administrator is reviewing the Security policy rules shown in the screenshot. Why are the two fields in the Security policy EDL-Deny highlighted in red?

  

  A. Because antivirus inspection is enabled for this policy

  B. Because the destination zone, address, and device are all "any"

  C. Because the action is Deny

  D. Because the Security-EDL tag has been assigned the red color

  Correct Answer: D

• Question 47:

  What are two differences between an application group and an application filter? (Choose two.)

  A. Application groups enable access to sanctioned applications explicitly, while application filters enable access to sanctioned applications implicitly.

  B. Application groups are static, while application filters are dynamic.

  C. Application groups dynamically group applications based on attributes, while application filters contain applications that are statically grouped.

  D. Application groups can be added to application filters, while application filters cannot be added to application groups.

  Correct Answer: AB

• Question 48:

  Which two statements apply to an Advanced Threat Prevention subscription? (Choose two.)

  A. It contains all the features already in a Threat Prevention subscription.

  B. It provides the ability to identify evasive and previously unseen command-and-control (C2) threats.

  C. When it is active, a WildFire profile is no longer needed.

  D. Due to its more advanced signatures, it provides the ability to identify new threats.

  Correct Answer: AB

• Question 49:

  With the PAN-OS 11.0 release, which tab becomes newly available within the Vulnerability security profile?

  A. Vulnerability Exceptions

  B. Advanced Rules

  C. Inline Cloud Analysis

  D. WildFire Inline ML

  Correct Answer: C

• Question 50:

  What are the two ways to implement an exception to an external dynamic list? (Choose two.)

  A. Edit the external dynamic list by removing the entries to exclude.

  B. Select the entries to exclude from the List Entries list.

  C. Manually add an entry to the Manual Exceptions list.

  D. Edit the external dynamic list by adding the “-“ symbol before the entries to exclude.

  Correct Answer: BC