Palo Alto Networks PCNSC Online Practice Questions and Exam Preparation

Palo Alto Networks PCNSC Online Questions & Answers

• Question 11:

  The firewall identified a popular application as a unknown-tcp. Which options are available to identify the application? (Choose two.)

  A. Create a Security policy to identify the customer application.
  B. Create a customer object for the customer application server to identify the custom application.
  C. Submit an App-ID request to Palo Alto Networks.
  D. Create a custom application.
  B. Create a customer object for the customer application server to identify the custom application.
  D. Create a custom application.

• Question 12:

  Which processing order will be enabled when a panorama administrator selects the setting "Objects defined in ancestors will takes higher precedence?

  A. Descendant objects, will take precedence over ancestor objects.
  B. Ancestor will have precedence over descendant objects.
  C. Ancestor objects will have precedence over other ancestor objects.
  D. Descendant object will take precedence over other descendant objects.
  B. Ancestor will have precedence over descendant objects.

• Question 13:

  A Security policy rule is configured with a Vulnerability Protection Profile and an action of Deny".

  Which action will this configuration cause on the matched traffic?

  A. The configuration is invalid it will cause the firewall to Skip this Security policy rule A warning will be displayed during a command.
  B. The configuration is valid It will cause the firewall to deny the matched sessions. Any configured Security Profiles have no effect if the Security policy rule action is set to "Deny".
  C. The configuration will allow the matched session unless a vulnerability signature is detected. The "Deny" action will supersede the per. defined, severity defined actions defined in the associated Vulnerability Protection Profile.
  D. The configuration is invalid. The Profile Settings section will be- grayed out when the action is set to "Deny".
  C. The configuration will allow the matched session unless a vulnerability signature is detected. The "Deny" action will supersede the per. defined, severity defined actions defined in the associated Vulnerability Protection Profile.

  ---

  Explanation/Reference:

• Question 14:

  Which URL Filtering Security Profile action logs the URL Filtering category to the URL Filtering log?

  A. Log
  B. Alert
  C. Allow
  D. Default
  B. Alert

  ---

  Explanation/Reference:

• Question 15:

  Winch three steps will reduce the CPU utilization on the management plane? (Choose three. )

  A. Disable predefined reports.
  B. Reduce the traffic being decrypted by the firewall.
  C. Disable SNMP on the management interface.
  D. Application override of SSL application.
  A. Disable predefined reports.
  B. Reduce the traffic being decrypted by the firewall.
  C. Disable SNMP on the management interface.

  ---

  Explanation/Reference:

• Question 16:

  An organization has Palo Alto Networks MGfWs that send logs to remote monitoring and security management platforms. The network team has report has excessive traffic on the corporate WAN. How could the Palo Alto Networks NOFW administrator reduce WAN traffic while maintaining support for all the existing monitoring/security platforms?

  

  A. forward logs from firewalls only to Panorama, and have Panorama forward log* lo other external service.
  B. Any configuration on an M-500 would address the insufficient bandwidth concerns.
  C. Configure log compression and optimization features on all remote firewalls.
  D. Forward logs from external sources to Panorama for correlation, arid from Panorama send to the NGFW.
  A. forward logs from firewalls only to Panorama, and have Panorama forward log* lo other external service.

  ---

  Explanation/Reference:

• Question 17:

  What is the purpose of the WildFire Analysis Profile in a security policy?

  A. To specify which files are sent to WildFire for analysis
  B. To configure the WildFire subscription settings
  C. To enable WildFire to analyze all network traffic
  D. To define the action to be taken on files analyzed by WildFire
  A. To specify which files are sent to WildFire for analysis

• Question 18:

  You are hosting a public-facing web server on your DMZ and access to that server is through a Palo Alto Networks firewall Both internal clients and internet clients access this web server using the FQDN public webserver acme com which resolves to the public address of 99.99 99.2

  Which combination of NAT policies is necessary to enable access to the web server for both internal and internet clients?

  DNS for the public facing webserver resolves to 99.99.99.2 for both the internal and internet

  webserver acme com A - 99.99.99.2

  

  A. 11 Name: PublicWebServer-NAT Tags: none Original Packet Source Zone: DMZ, Untrust Destination Zone: DMZ Destination Interface: any Source Address: any Destination Address: Web_Server_Public_99.99.99.2 Service: any Translated Packet Source Translation: none Destination Translation: address: Web_Server_Private_172.16.1.2
  B. 11 Name: PublicWebServer-NAT1 Tags: none Original Packet Source Zone: Untrust Destination Zone: Untrust Destination Interface: any Source Address: any Destination Address: Web_Server_Public_99.99.99.2 Service: any Translated Packet Source Translation: none Destination Translation: address: Web_Server_Private_172.16.1.2 Name: PublicWebServer-NAT2 Tags: none Original Packet Source Zone: trust Destination Zone: Untrust Destination Interface: any Source Address: any Destination Address: Web_Server_Public_99.99.99.2 Service: any Translated Packet Source Translation: dynamic-ip-and-port, ethernet1/4, 10.1.1.1/24 Destination Translation: address: Web_Server_Private_172.16.1.2
  C. 11 Name: PublicWebServer-NAT Tags: none Original Packet Source Zone: DMZ,Untrust Destination Zone: Untrust Destination Interface: any Source Address: any Destination Address: Web_Server_Public_99.99.99.2 Service: any Translated Packet Source Translation: none Destination Translation: address: Web_Server_Private_172.16.1.2
  D. 11 Name: PublicWebServer-NAT1 Tags: none Original Packet Source Zone: Untrust Destination Zone: DMZ Destination Interface: any Source Address: any Destination Address: Web_Server_Public_99.99.99.2 Service: any Translated Packet Source Translation: none Destination Translation: address: Web_Server_Private_172.16.1.2 Name: PublicWebServer-NAT2 Tags: none Original Packet Source Zone: trust Destination Zone: DMZ Destination Interface: any Source Address: any Destination Address: Web_Server_Public_99.99.99.2 Service: any Translated Packet Source Translation: dynamic-ip-and-port, ethernet1/4, 10.1.1.1/24 Destination Translation: address: Web_Server_Private_172.16.1.2
  C. 11 Name: PublicWebServer-NAT Tags: none Original Packet Source Zone: DMZ,Untrust Destination Zone: Untrust Destination Interface: any Source Address: any Destination Address: Web_Server_Public_99.99.99.2 Service: any Translated Packet Source Translation: none Destination Translation: address: Web_Server_Private_172.16.1.2

  ---

  Explanation/Reference:

  To enable access to a public-facing web server for both internal and internet clients using the FQDNpublic.webserver.acme.com, which resolves to the public address99.99.99.2, the necessary combination of NAT policies is:

  Policy 11: DMZ to Untrust

  Source Zone: DMZ

  Destination Zone: Untrust

  Destination Address:Web_Server_Public_99.99.99.2

  Destination Translation:address: Web_Server_Private_172.16.1.2

  Policy 12: Untrust to Untrust

  Source Zone: Untrust

  Destination Zone: Untrust

  Destination Address:Web_Server_Public_99.99.99.2

  Destination Translation:address: Web_Server_Private_172.16.1.2

  These policies ensure that traffic destined for the public IP address99.99.99.2from both the DMZ and Untrust zones is properly translated to the internal web server's private IP address172.16.1.2.

  References:

  Palo Alto Networks - NAT Configuration:

  https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/networking/nat/nat-policy-rules

• Question 19:

  What is exchanged through the HA2 link?

  A. hello heartbeats
  B. User-ID in information
  C. session synchronization
  D. HA state information
  C. session synchronization

• Question 20:

  Which category of Vulnerability Signatures is most likely to trigger false positive alerts?

  A. code-execution
  B. phishing
  C. info-leak
  D. brute-force
  C. info-leak

  ---

  Explanation/Reference:

  The category of Vulnerability Signatures that is most likely to trigger false positive alerts is:

  info-leak

  Information leakage signatures are designed to detect attempts to access or disclose sensitive information. These signatures can be prone to false positives because benign activities or legitimate data transmissions can sometimes be

  mistakenly identified as information leaks.

  References:

  Palo Alto Networks - Managing False Positives in Threat Prevention:

  https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/threat-prevention/manage-false-positives-in-threat-prevention

  Palo Alto Networks - Vulnerability Protection:

  https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/threat-prevention/vulnerability-protection