Palo Alto Networks PCNSA Online Practice Questions and Exam Preparation

Palo Alto Networks PCNSA Online Questions & Answers

• Question 71:

  Which situation is recorded as a system log?

  A. A connection with an authentication server has been dropped.
  B. A file that has been analyzed is potentially dangerous for the system.
  C. An attempt to access a spoofed website has been blocked.
  D. A new asset has been discovered on the network.
  A. A connection with an authentication server has been dropped.

  ---

  Explanation/Reference:

• Question 72:

  An administrator is troubleshooting an issue with traffic that matches the interzone-default rule, which is set to default configuration. What should the administrator do?

  A. Change the logging action on the rule
  B. Tune your Traffic Log filter to include the dates
  C. Refresh the Traffic Log
  D. Review the System Log
  A. Change the logging action on the rule

  ---

  Explanation/Reference:

• Question 73:

  Which feature dynamically analyzes and detects malicious content by evaluating various web page details using a series of machine learning (ML) models?

  A. Antivirus Inline ML
  B. URL Filtering Inline ML
  C. Anti-Spyware Inline ML
  D. WildFire Inline ML
  B. URL Filtering Inline ML

  ---

  Explanation/Reference:

• Question 74:

  What can be achieved by disabling the Share Unused Address and Service Objects with Devices setting on Panorama?

  A. Increase the backup capacity for configuration backups per firewall
  B. Increase the per-firewall capacity for address and service objects
  C. Reduce the configuration and session synchronization time between HA pairs
  D. Reduce the number of objects pushed to a firewall
  D. Reduce the number of objects pushed to a firewall

• Question 75:

  How does the Policy Optimizer policy view differ from the Security policy view?

  A. It provides sorting options that do not affect rule order
  B. It specifies applications seen by rules
  C. It displays rule utilization
  D. It details associated zones
  A. It provides sorting options that do not affect rule order

  ---

  Explanation/Reference:

• Question 76:

  Which action results in the firewall blocking network traffic without notifying the sender?

  A. Deny
  B. No notification
  C. Drop
  D. Reset Client
  C. Drop

• Question 77:

  An administrator has configured a Security policy where the matching condition includes a single application and the action is drop.

  If the application s default deny action is reset-both what action does the firewall take?

  A. It sends a TCP reset to the client-side and server-side devices
  B. It silently drops the traffic and sends an ICMP unreachable code
  C. It silently drops the traffic
  D. It sends a TCP reset to the server-side device
  C. It silently drops the traffic

  ---

  Explanation/Reference:

  Security policy action comes first. So the action will be drop

• Question 78:

  An administrator creates a new Security policy rule to allow DNS traffic from the LAN to the DMZ zones. The administrator does not change the rule type from its default value. What type of Security policy rule is created?

  A. Intrazone
  B. Interzone
  C. Universal
  D. Tagged
  C. Universal

  ---

  Explanation/Reference:

• Question 79:

  What are three characteristics of the Palo Alto Networks DNS Security service? (Choose three.)

  A. It uses techniques such as DGA.DNS tunneling detection and machine learning.
  B. It requires a valid Threat Prevention license.
  C. It enables users to access real-time protections using advanced predictive analytics.
  D. It requires a valid URL Filtering license.
  E. It requires an active subscription to a third-party DNS Security service.
  A. It uses techniques such as DGA.DNS tunneling detection and machine learning.
  B. It requires a valid Threat Prevention license.
  C. It enables users to access real-time protections using advanced predictive analytics.

  ---

  Explanation/Reference:

  DNS Security subscription enables users to access real-time protections using advanced predictive analytics. When techniques such as DGA/DNS tunneling detection and machine learning are used, threats hidden within DNS traffic can be proactively identified and shared through an infinitely scalable cloud service. Because the DNS signatures and protections are stored in a cloud-based architecture, you can access the full database of ever-expanding signatures that have been generated using a multitude of data sources. This list of signatures allows you to defend against an array of threats using DNS in real- time against newly generated malicious domains. To combat future threats, updates to the analysis, detection, and prevention capabilities of the DNS Security service will be available through content releases. To access the DNS Security service, you must have a Threat Prevention license and DNS Security license.

• Question 80:

  Given the detailed log information above, what was the result of the firewall traffic inspection?

  

  A. It denied the category DNS phishing.
  B. It denied the traffic because of unauthorized attempts.
  C. It was blocked by the Anti-Virus Security profile action.
  D. It was blocked by the Anti-Spyware Profile action.
  D. It was blocked by the Anti-Spyware Profile action.

  ---

  Explanation/Reference: