Useful and Important PCNSA Exam Free Questions

dumps2021-09-27T08:29:53+08:00

PCNSA exam is hot among those Palo Alto Networks certifications. Most of them will choose PCNSA exam to take. There are 50 questions in real Palo Alto Networks certification PCNSA exam, and you have 90 minutes to complete all the questions. The questions format is Multiple choice, Scenarios with Graphic and Matching. We provide useful and important PCNSA exam free questions for you to study online. Free updated PCNSA exam questions are available below.

Page 1 of 4

1. The CFO found a malware infected USB drive in the parking lot, which when inserted infected their corporate laptop the malware contacted a known command-and-control server which exfiltrating corporate data.

Which Security profile feature could have been used to prevent the communications with the command-and-control server?

Create a Data Filtering Profile and enable its DNS sinkhole feature.

Create an Antivirus Profile and enable its DNS sinkhole feature.

Create an Anti-Spyware Profile and enable its DNS sinkhole feature.

Create a URL Filtering Profile and block the DNS sinkhole URL category.

2. Based on the screenshot what is the purpose of the included groups?

They are only groups visible based on the firewall's credentials.

They are used to map usernames to group names.

They contain only the users you allow to manage the firewall.

They are groups that are imported from RADIUS authentication servers.

3. Four configuration choices are listed, and each could be used to block access to a specific URL.

If you configured each choices to block the same URL then which choice would be the last to block access to the URL?

EDL in URL Filtering Profile.

Custom URL category in Security Policy rule.

Custom URL category in URL Filtering Profile.

PAN-DB URL category in URL Filtering Profile.

4. Which tab would an administrator click to create an address object?

Device

Policies

Monitor

Objects

5. An administrator receives a global notification for a new malware that infects hosts. The infection will result in the infected host attempting to contact a command-and-control (C2) server.

Which two security profile components will detect and prevent this threat after the firewall’s signature database has been updated? (Choose two.)

vulnerability protection profile applied to outbound security policies

anti-spyware profile applied to outbound security policies

antivirus profile applied to outbound security policies

URL filtering profile applied to outbound security policies

6. Which path is used to save and load a configuration with a Palo Alto Networks firewall?

Device>Setup>Services

Device>Setup>Management

Device>Setup>Operations

Device>Setup>Interfaces

7. Which two configuration settings shown are not the default? (Choose two.)

Enable Security Log

Server Log Monitor Frequency (sec)

Enable Session

Enable Probing

8. An administrator notices that protection is needed for traffic within the network due to malicious lateral movement activity.

Based on the image shown, which traffic would the administrator need to monitor and block to mitigate the malicious activity?

branch office traffic

north-south traffic

perimeter traffic

east-west traffic

9. Which two statements are true for the DNS security service introduced in PAN-OS version 10.0?

It functions like PAN-DB and requires activation through the app portal.

It removes the 100K limit for DNS entries for the downloaded DNS updates.

IT eliminates the need for dynamic DNS updates.

IT is automatically enabled and configured.

10. Based on the screenshot presented which column contains the link that when clicked opens a window to display all applications matched to the policy rule?

Apps Allowed

Name

Apps Seen

Service

11. How are Application Fillers or Application Groups used in firewall policy?

An Application Filter is a static way of grouping applications and can be configured as a nested member of an Application Group

An Application Filter is a dynamic way to group applications and can be configured as a nested member of an Application Group

An Application Group is a dynamic way of grouping applications and can be configured as a nested member of an Application Group

An Application Group is a static way of grouping applications and cannot be configured as a nested member of Application Group

12. A network has 10 domain controllers, multiple WAN links, and a network infrastructure with bandwidth needed to support mission-critical applications.

Given the scenario, which type of User-ID agent is considered a best practice by Palo Alto Networks?

Windows-based agent on a domain controller

Captive Portal

Citrix terminal server with adequate data-plane resources

PAN-OS integrated agent

13. Which three configuration settings are required on a Palo Alto networks firewall management interface?

default gateway

netmask

IP address

hostname

auto-negotiation

14. How frequently can wildfire updates be made available to firewalls?

every 15 minutes

every 30 minutes

every 60 minutes

every 5 minutes

15. Which administrator receives a global notification for a new malware that infects hosts. The infection will result in the infected host attempting to contact and command-and-control (C2) server.

Which security profile components will detect and prevent this threat after the firewall`s signature database has been updated?

antivirus profile applied to outbound security policies

data filtering profile applied to inbound security policies

data filtering profile applied to outbound security policies

vulnerability profile applied to inbound security policies

16. Which Palo Alto Networks firewall security platform provides network security for mobile endpoints by inspecting traffic deployed as internet gateways?

GlobalProtect

AutoFocus

Aperture

Panorama

17. Which path in PAN-OS 10.0 displays the list of port-based security policy rules?

Policies> Security> Rule Usage> No App Specified

Policies> Security> Rule Usage> Port only specified

Policies> Security> Rule Usage> Port-based Rules

Policies> Security> Rule Usage> Unused Apps

18. An administrator needs to allow users to use their own office applications.

How should the administrator configure the firewall to allow multiple applications in a dynamic environment?

Create an Application Filter and name it Office Programs, the filter it on the business-systems category, office-programs subcategory

Create an Application Group and add business-systems to it

Create an Application Filter and name it Office Programs, then filter it on the business-systems category

Create an Application Group and add Office 365, Evernote, Google Docs, and Libre Office

19. Which security policy rule would be needed to match traffic that passes between the Outside zone and Inside zone, but does not match traffic that passes within the zones?

intrazone

interzone

universal

global

20. Which type security policy rule would match traffic flowing between the inside zone and outside zone within the inside zone and within the outside zone?

global

universal

intrazone

interzone

Page 2 of 4

21. Which firewall plane provides configuration, logging, and reporting functions on a separate processor?

control

network processing

data

security processing

22. Which URL profiling action does not generate a log entry when a user attempts to access that URL?

Override

Allow

Block

Continue

23. Which protocol used to map username to user groups when user-ID is configured?

SAML

RADIUS

TACACS+

LDAP

24. Based on the show security policy rule would match all FTP traffic from the inside zone to the outside zone?

internal-inside-dmz

engress outside

inside-portal

intercone-default

25. Starting with PAN_OS version 9.1 which new type of object is supported for use within the user field of a security policy rule?

local username

dynamic user group

remote username

static user group

26. What must be configured for the firewall to access multiple authentication profiles for external services to authenticate a non-local account?

authentication sequence

LDAP server profile

authentication server list

authentication list profile

27. What are two differences between an implicit dependency and an explicit dependency in App-ID? (Choose two.)

An implicit dependency does not require the dependent application to be added in the security policy

An implicit dependency requires the dependent application to be added in the security policy

An explicit dependency does not require the dependent application to be added in the security policy

An explicit dependency requires the dependent application to be added in the security policy

28. Which action results in the firewall blocking network traffic without notifying the sender?

Deny

No notification

Drop

Reset Client

29. How is the hit count reset on a rule?

select a security policy rule, right click Hit Count > Reset

with a dataplane reboot

Device > Setup > Logging and Reporting Settings > Reset Hit Count

in the CLI, type command reset hitcount <POLICY-NAME>

30. What do dynamic user groups you to do?

create a QoS policy that provides auto-remediation for anomalous user behavior and malicious activity

create a policy that provides auto-sizing for anomalous user behavior and malicious activity

create a policy that provides auto-remediation for anomalous user behavior and malicious activity

create a dynamic list of firewall administrators

31. All users from the internal zone must be allowed only Telnet access to a server in the DMZ zone. Complete the two empty fields in the Security Policy rules that permits only this type of access.

Source Zone: Internal

Destination Zone: DMZ Zone

Application: _________?

Service: ____________?

Action: allow

(Choose two.)

Service = "any"

Application = "Telnet"

Service - "application-default"

Application = "any"

32. Users from the internal zone need to be allowed to Telnet into a server in the DMZ zone.

Complete the security policy to ensure only Telnet is allowed.

Security Policy: Source Zone: Internal to DMZ Zone __________services “Application

defaults”, and action = Allow

Destination IP: 192.168.1.123/24

Application = ‘Telnet’

Log Forwarding

USER-ID = ‘Allow users in Trusted’

33. commit the configuration, and verify agent connection status

2-3-4-1

1-4-3-2

3-1-2-4

1-3-2-4

34. Which data-plane processor layer of the graphic shown provides uniform matching for spyware and vulnerability exploits on a Palo Alto Networks Firewall?

Signature Matching

Network Processing

Security Processing

Security Matching

35. At which stage of the cyber-attack lifecycle would the attacker attach an infected PDF file to an email?

delivery

command and control

explotation

reinsurance

installation

36. Which three statement describe the operation of Security Policy rules or Security Profiles? (Choose three)

Security policy rules inspect but do not block traffic.

Security Profile should be used only on allowed traffic.

Security Profile are attached to security policy rules.

Security Policy rules are attached to Security Profiles.

Security Policy rules can block or allow traffic.

37. An administrator would like to silently drop traffic from the internet to a ftp server.

Which Security policy action should the administrator select?

Reset-server

Block

Deny

Drop

38. Which User-ID mapping method should be used for an environment with clients that do not authenticate to Windows Active Directory?

Windows session monitoring via a domain controller

passive server monitoring using the Windows-based agent

Captive Portal

passive server monitoring using a PAN-OS integrated User-ID agent

39. Selecting the option to revert firewall changes will replace what settings?

the running configuration with settings from the candidate configuration

the device state with settings from another configuration

the candidate configuration with settings from the running configuration

dynamic update scheduler settings

40. Given the topology, which zone type should interface E1/1 be configured with?

Tap

Tunnel

Virtual Wire

Layer3

Page 3 of 4

41. A server-admin in the USERS-zone requires SSH-access to all possible servers in all current and future Public Cloud environments. All other required connections have already been enabled between the USERS- and the OUTSIDE-zone.

What configuration-changes should the Firewall-admin make?

Create a custom-service-object called SERVICE-SSH for destination-port-TCP-22. Create a security-rule between zone USERS and OUTSIDE to allow traffic from any source IP-address to any destination IP-address for SERVICE-SSH

Create a security-rule that allows traffic from zone USERS to OUTSIDE to allow traffic from any source IP-address to any destination IP-address for application SSH

In addition to option a, a custom-service-object called SERVICE-SSH-RETURN that contains source-port-TCP-22 should be created. A second security-rule is required that allows traffic from zone OUTSIDE to USERS for SERVICE-SSH-RETURN for any source-IP-address to any destination-Ip-address

In addition to option c, an additional rule from zone OUTSIDE to USERS for application SSH from any source-IP-address to any destination-IP-address is required to allow the return-traffic from the SSH-servers to reach the server-admin

42. Which service protects cloud-based applications such as Dropbox and Salesforce by administering permissions and scanning files for sensitive information?

Aperture

AutoFocus

Panorama

GlobalProtect

43. Which dynamic update type includes updated anti-spyware signatures?

Applications and Threats

GlobalProtect Data File

Antivirus

PAN-DB

44. To use Active Directory to authenticate administrators, which server profile is required in the authentication profile?

domain controller

TACACS+

LDAP

RADIUS

45. Which plane on a Palo alto networks firewall provides configuration logging and reporting functions on a separate processor?

data

network processing

management

security processing

46. Which prevention technique will prevent attacks based on packet count?

zone protection profile

URL filtering profile

antivirus profile

vulnerability profile

47. Based on the screenshot what is the purpose of the group in User labelled ''it"?

Allows users to access IT applications on all ports

Allows users in group "DMZ" lo access IT applications

Allows "any" users to access servers in the DMZ zone

Allows users in group "it" to access IT applications

48. DRAG DROP

Arrange the correct order that the URL classifications are processed within the system.

49. Which type of address object is "10 5 1 1/0 127 248 2"?

IP subnet

IP wildcard mask

IP netmask

IP range

50. Palo Alto Networks firewall architecture accelerates content map minimizing latency using which two components'? (Choose two)

Network Processing Engine

Single Stream-based Engine

Policy Engine

Parallel Processing Hardware

51. Given the topology, which zone type should zone A and zone B to be configured with?

Layer3

Tap

Layer2

Virtual Wire

52. Which user mapping method could be used to discover user IDs in an environment with multiple Windows domain controllers?

Active Directory monitoring

Windows session monitoring

Windows client probing

domain controller monitoring

53. DRAG DROP

Order the steps needed to create a new security zone with a Palo Alto Networks firewall.

54. Which Palo Alto network security operating platform component provides consolidated policy creation and centralized management?

Prisma SaaS

Panorama

AutoFocus

GlobalProtect

55. Which URL Filtering profile action would you set to allow users the option to access a site only if they provide a URL admin password?

override

authorization

authentication

continue

56. Based on the security policy rules shown, ssh will be allowed on which port?

any port

same port as ssl and snmpv3

the default port

only ephemeral ports

57. The PowerBall Lottery has reached an unusually high value this week. Your company has decided to raise morale by allowing employees to access the PowerBall Lottery website (www.powerball.com) for just this week. However, the company does not want employees to access any other websites also listed in the URL filtering “gambling” category.

Which method allows the employees to access the PowerBall Lottery website but without unblocking access to the “gambling” URL category?

Add just the URL www.powerball.com to a Security policy allow rule.

Manually remove powerball.com from the gambling URL category.

Add *.powerball.com to the URL Filtering allow list.

Create a custom URL category, add *.powerball.com to it and allow it in the Security Profile.

58. Which update option is not available to administrators?

New Spyware Notifications

New URLs

New Application Signatures

New Malicious Domains

New Antivirus Signatures

59. When creating a Source NAT policy, which entry in the Translated Packet tab will display the options Dynamic IP and Port, Dynamic, Static IP, and None?

Translation Type

Interface

Address Type

IP Address

60. What are three differences between security policies and security profiles? (Choose three.)

Security policies are attached to security profiles

Security profiles are attached to security policies

Security profiles should only be used on allowed traffic

Security profiles are used to block traffic by themselves

Security policies can block or allow traffic

Page 4 of 4

61. An administrator wants to prevent access to media content websites that are risky.

Which two URL categories should be combined in a custom URL category to accomplish this goal? (Choose two)

streaming-media

high-risk

recreation-and-hobbies

known-risk

62. Which option lists the attributes that are selectable when setting up an Application filters?

Category, Subcategory, Technology, and Characteristic

Category, Subcategory, Technology, Risk, and Characteristic

Name, Category, Technology, Risk, and Characteristic

Category, Subcategory, Risk, Standard Ports, and Technology

63. In which stage of the Cyber-Attack Lifecycle would the attacker inject a PDF file within an email?

Weaponization

Reconnaissance

Installation

Command and Control

Exploitation

64. Which license must an Administrator acquire prior to downloading Antivirus Updates for use with the firewall?

Threat Prevention License

Threat Implementation License

Threat Environment License

Threat Protection License

Useful and Important PCNSA Exam Free Questions