Palo Alto Networks PCNSA Online Practice Questions and Exam Preparation

Palo Alto Networks PCNSA Online Questions & Answers

• Question 61:

  Starting with PAN-OS version 9.1, application dependency information is now reported in which two locations? (Choose two.)

  A. on the App Dependency tab in the Commit Statuswindow
  B. on the Policy Optimizer'sRule Usagepage
  C. ontheApplication tab in the Security Policy Rulecreation window
  D. ontheObjects>Applicationsbrowser pages
  A. on the App Dependency tab in the Commit Statuswindow
  C. ontheApplication tab in the Security Policy Rulecreation window

  ---

  Explanation/Reference:

  Reference:https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/app-id/use- application-objects-in-policy/resolve-application-dependencies.html

• Question 62:

  What are two valid selections within an Antivirus profile? (Choose two.)

  A. deny
  B. drop
  C. default
  D. block-ip
  B. drop
  C. default

  ---

  Explanation/Reference:

  Reference: https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/policy/security-profiles

• Question 63:

  An administrator is implementing an exception to an external dynamic list by adding an entry to the list manually. The administrator wants to save the changes, but the OK button is grayed out. What are two possible reasons the OK button is grayed out? (Choose two.)

  A. The entry matches a list entry.
  B. The entry doesn't match a list entry.
  C. The entry contains wildcards.
  D. The entry is duplicated.
  B. The entry doesn't match a list entry.
  D. The entry is duplicated.

  ---

  Explanation/Reference:

• Question 64:

  The Palo Alto Networks NGFW was configured with a single virtual router named VR-1 What changes are required on VR-1 to route traffic between two interfaces on the NGFW?

  A. Add zones attached to interfaces to the virtual router
  B. Add interfaces to the virtual router
  C. Enable the redistribution profile to redistribute connected routes
  D. Add a static routes to route between the two interfaces
  B. Add interfaces to the virtual router

  ---

  Explanation/Reference:

• Question 65:

  How do you reset the hit count on a security policy rule?

  A. First disable and then re-enable the rule.
  B. Reboot the data-plane.
  C. Select a Security policy rule, and then select Hit Count > Reset.
  D. Type the CLI command reset hitcount .
  C. Select a Security policy rule, and then select Hit Count > Reset.

• Question 66:

  The firewall sends employees an application block page when they try to access Youtube. Which Security policy rule is blocking the youtube application?

  

  A. intrazone-default
  B. Deny Google
  C. allowed-security services
  D. interzone-default
  D. interzone-default

• Question 67:

  Which two rule types allow the administrator to modify the destination zone? (Choose two )

  A. interzone
  B. intrazone
  C. universal
  D. shadowed
  A. interzone
  C. universal

• Question 68:

  Four configuration choices are listed, and each could be used to block access to a specific URL. If you configured each choices to block the sameURL then which choice would be the last to block access to the URL?

  A. EDL in URL Filtering Profile.
  B. Custom URL category in Security Policy rule.
  C. Custom URL category in URL Filtering Profile.
  D. PAN-DB URL category in URL Filtering Profile.
  D. PAN-DB URL category in URL Filtering Profile.

  ---

  Explanation/Reference:

  The precedence is from the top down; First Match Wins: 1) Block list: Manually entered blocked URLs Objects - 2) Allow list: Manually entered allowed URLs Objects - 3) Custom URL Categories - 4) Cached Cached: URLs learned from External Dynamic Lists (EDLs) 5) Pre-Defined Categories: PAN-DB or Brightcloud categories.

• Question 69:

  Refer to the exhibit. An administrator is using DNAT to map two servers to a single public IP address. Traffic will be steered to the specific server based on the application, where Host A (10.1.1.100) receives HTTP traffic and Host B

  (10.1.1.101) receives SSH traffic.

  

  Which two Security policy rules will accomplish this configuration? (Choose two.)

  A. Untrust (Any) to DMZ (1.1.1.100), ssh - Allow
  B. Untrust (Any) to Untrust (10.1.1.1), web-browsing -Allow
  C. Untrust (Any) to Untrust (10.1.1.1), ssh -Allow
  D. Untrust (Any)to DMZ (10.1.1.100. 10.1.1.101), ssh, web-browsing-Allow
  E. Untrust (Any) to DMZ (1.1.1.100), web-browsing - Allow
  A. Untrust (Any) to DMZ (1.1.1.100), ssh - Allow
  E. Untrust (Any) to DMZ (1.1.1.100), web-browsing - Allow

• Question 70:

  When is an event displayed under threat logs?

  A. When traffic matches a corresponding Security Profile
  B. When traffic matches any Security policy
  C. Every time a session is blocked
  D. Every time the firewall drops a connection
  A. When traffic matches a corresponding Security Profile

  ---

  Explanation/Reference: