Improve Your Knowledge with PCNSA Exam Dumps

Category:

Comments:

0 Comments

Post Date:

March 9, 2023

Practicing with PCNSA questions can help you identify areas where you need to improve your knowledge. By answering PCNSA questions and reviewing your responses, you can identify gaps in your understanding and focus your study efforts on those areas. The PCNSA exam has a strict time limit, and you need to manage your time effectively to answer all the questions. Practicing with Palo Alto Networks PCNSA dumps questions can help you develop time management skills by simulating the exam's time constraints. You'll learn how to pace yourself, manage your time effectively, and ensure that you complete the PCNSA exam within the allotted time. Test Palo Alto Networks PCNSA exam free dumps below.

Page 1 of 9

1. Which statement is true about Panorama managed devices?

Panorama automatically removes local configuration locks after a commit from Panorama

Local configuration locks prohibit Security policy changes for a Panorama managed device

Security policy rules configured on local firewalls always take precedence

Local configuration locks can be manually unlocked from Panorama

2. View the diagram.

What is the most restrictive, yet fully functional rule, to allow general Internet and SSH traffic into both the DMZ and Untrust/lnternet zones from each of the lOT/Guest and Trust Zones?

A)

Option

3. Which feature would be useful for preventing traffic from hosting providers that place few restrictions on content, whose services are frequently used by attackers to distribute illegal or unethical material?

Palo Alto Networks Bulletproof IP Addresses

Palo Alto Networks C&C IP Addresses

Palo Alto Networks Known Malicious IP Addresses

Palo Alto Networks High-Risk IP Addresses

4. DRAG DROP

Place the following steps in the packet processing order of operations from first to last.

5. Actions can be set for which two items in a URL filtering security profile? (Choose two.)

Block List

Custom URL Categories

PAN-DB URL Categories

Allow List

6. In which stage of the Cyber-Attack Lifecycle would the attacker inject a PDF file within an email?

Weaponization

Reconnaissance

Installation

Command and Control

Exploitation

7. What is the main function of Policy Optimizer?

reduce load on the management plane by highlighting combinable security rules

migrate other firewall vendors’ security rules to Palo Alto Networks configuration

eliminate “Log at Session Start” security rules

convert port-based security rules to application-based security rules

8. An administrator would like to protect against inbound threats such as buffer overflows and illegal code execution.

Which Security profile should be used?

Antivirus

URL filtering

Anti-spyware

Vulnerability protection

9. You receive notification about new malware that is being used to attack hosts The malware exploits a software bug in a common application

Which Security Profile detects and blocks access to this threat after you update the firewall's threat signature database?

Data Filtering Profile applied to outbound Security policy rules

Antivirus Profile applied to outbound Security policy rules

Data Filtering Profile applied to inbound Security policy rules

Vulnerability Profile applied to inbound Security policy rules

10. How frequently can wildfire updates be made available to firewalls?

every 15 minutes

every 30 minutes

every 60 minutes

every 5 minutes

Page 2 of 9

11. Given the network diagram, traffic should be permitted for both Trusted and Guest users to access general Internet and DMZ servers using SSH. web-browsing and SSL applications.

Which policy achieves the desired results?

A)

Option

12. Which type of administrative role must you assign to a firewall administrator account, if the account must include a custom set of firewall permissions?

SAML

Multi-Factor Authentication

Role-based

Dynamic

13. Given the detailed log information above, what was the result of the firewall traffic inspection?

It was blocked by the Vulnerability Protection profile action.

It was blocked by the Anti-Virus Security profile action.

It was blocked by the Anti-Spyware Profile action.

It was blocked by the Security policy action.

14. Which file is used to save the running configuration with a Palo Alto Networks firewall?

running-config.xml

run-config.xml

running-configuration.xml

run-configuratin.xml

15. An administrator needs to create a Security policy rule that matches DNS traffic within the LAN zone, and also needs to match DNS traffic within the DMZ zone The administrator does not want to allow traffic between the DMZ and LAN zones.

Which Security policy rule type should they use?

default

universal

intrazone

interzone

16. Which Security policy action will message a user's browser thai their web session has been terminated?

Reset server

Deny

Drop

Reset client

17. What does an administrator use to validate whether a session is matching an expected NAT policy?

system log

test command

threat log

config audit

18. Which rule type is appropriate for matching traffic both within and between the source and destination zones?

interzone

shadowed

intrazone

universal

19. Which solution is a viable option to capture user identification when Active Directory is not in use?

Cloud Identity Engine

group mapping

Directory Sync Service

Authentication Portal

20. An administrator would like to see the traffic that matches the interzone-default rule in the traffic logs.

What is the correct process to enable this logging1?

Select the interzone-default rule and edit the rule on the Actions tab select Log at Session Start and click OK

Select the interzone-default rule and edit the rule on the Actions tab select Log at Session End and click OK

This rule has traffic logging enabled by default no further action is required

Select the interzone-default rule and click Override on the Actions tab select Log at Session End and click OK

Page 3 of 9

21. Which five Zero Trust concepts does a Palo Alto Networks firewall apply to achieve an integrated approach to prevent threats? (Choose five.)

User identification

Filtration protection

Vulnerability protection

Antivirus

Application identification

Anti-spyware

22. Which protocol used to map username to user groups when user-ID is configured?

SAML

RADIUS

TACACS+

LDAP

23. Which three filter columns are available when setting up an Application Filter? (Choose three.)

Parent App

Category

Risk

Standard Ports

Subcategory

24. Which path in PAN-OS 10.0 displays the list of port-based security policy rules?

Policies> Security> Rule Usage> No App Specified

Policies> Security> Rule Usage> Port only specified

Policies> Security> Rule Usage> Port-based Rules

Policies> Security> Rule Usage> Unused Apps

25. Selecting the option to revert firewall changes will replace what settings?

the running configuration with settings from the candidate configuration

the device state with settings from another configuration

the candidate configuration with settings from the running configuration

dynamic update scheduler settings

26. Given the screenshot what two types of route is the administrator configuring? (Choose two )

default route

OSPF

BGP

static route

27. During the App-ID update process, what should you click on to confirm whether an existing policy rule is affected by an App-ID update?

check now

review policies

test policy match

download

28. An administrator configured a Security policy rule where the matching condition includes a single application and the action is set to deny.

What deny action will the firewall perform?

Drop the traffic silently

Perform the default deny action as defined in the App-ID database for the application

Send a TCP reset packet to the client- and server-side devices

Discard the session's packets and send a TCP reset packet to let the client know the session has been terminated

29. Starting with PAN-OS version 9.1, application dependency information is now reported in which two locations? (Choose two.)

on the App Dependency tab in the Commit Statuswindow

on the Policy Optimizer'sRule Usagepage C ontheApplication tab in the Security Policy Rulecreation window

ontheObjects>Applicationsbrowser pages

30. You must configure which firewall feature to enable a data-plane interface to submit DNS queries on behalf of the control plane?

Admin Role profile

virtual router

DNS proxy

service route

Page 4 of 9

31. Which two settings allow you to restrict access to the management interface? (Choose two )

enabling the Content-ID filter

administrative management services

restricting HTTP and telnet using App-ID

permitted IP addresses

32. Your company requires positive username attribution of every IP address used by wireless devices to support a new compliance requirement. You must collect IP Cto-user mappings as soon as possible with minimal downtime and minimal configuration changes to the wireless devices themselves. The wireless devices are from various manufactures.

Given the scenario, choose the option for sending IP-to-user mappings to the NGFW.

syslog

RADIUS

UID redistribution

XFF headers

33. When is the content inspection performed in the packet flow process?

after the application has been identified

after the SSL Proxy re-encrypts the packet

before the packet forwarding process

before session lookup

34. DRAG DROP

Match the Palo Alto Networks Security Operating Platform architecture to its description.

35. Why does a company need an Antivirus profile?

To prevent command-and-control traffic

To protect against viruses, worms, and trojans

To prevent known exploits

To prevent access to malicious web content

36. Which URL profiling action does not generate a log entry when a user attempts to access that URL?

Override

Allow

Block

Continue

37. How is the hit count reset on a rule?

select a security policy rule, right click Hit Count > Reset

with a dataplane reboot

Device > Setup > Logging and Reporting Settings > Reset Hit Count

in the CLI, type command reset hitcount

38. Given the image, which two options are true about the Security policy rules. (Choose two.)

The Allow Office Programs rule is using an Application Filter

In the Allow FTP to web server rule, FTP is allowed using App-ID

The Allow Office Programs rule is using an Application Group

In the Allow Social Networking rule, allows all of Facebook’s functions

39. URL categories can be used as match criteria on which two policy types? (Choose two.)

authentication

decryption C application override

NAT

40. Based on the screenshot what is the purpose of the included groups?

They are only groups visible based on the firewall's credentials.

They are used to map usernames to group names.

They contain only the users you allow to manage the firewall.

They are groups that are imported from RADIUS authentication servers.

Page 5 of 9

41. The firewall sends employees an application block page when they try to access Youtube.

Which Security policy rule is blocking the youtube application?

intrazone-default

Deny Google

allowed-security services

interzone-default

42. An administrator wants to create a NAT policy to allow multiple source IP addresses to be translated to the same public IP address.

What is the most appropriate NAT policy to achieve this?

Dynamic IP and Port

Dynamic IP

Static IP

Destination

43. Which URL Filtering Profile action does not generate a log entry when a user attempts to access a URL?

override

allow

block

continue

44. At which stage of the cyber-attack lifecycle would the attacker attach an infected PDF file to an email?

delivery

command and control

explotation

reinsurance

installation

45. Which administrative management services can be configured to access a management interface?

HTTP, CLI, SNMP, HTTPS

HTTPS, SSH telnet SNMP

SSH: telnet HTTP, HTTPS

HTTPS, HTT

CLI, API

46. Based on the security policy rules shown, ssh will be allowed on which port?

any port

same port as ssl and snmpv3

the default port

only ephemeral ports

47. Which license is required to use the Palo Alto Networks built-in IP address EDLs?

DNS Security

Threat Prevention

WildFire

SD-Wan

48. Given the screenshot, what are two correct statements about the logged traffic? (Choose two.)

The web session was unsuccessfully decrypted.

The traffic was denied by security profile.

The traffic was denied by URL filtering.

The web session was decrypted.

49. What are three valid information sources that can be used when tagging users to dynamic user groups? (Choose three.)

Blometric scanning results from iOS devices

Firewall logs

Custom API scripts

Security Information and Event Management Systems (SIEMS), such as Splun

DNS Security service

50. An administrator needs to allow users to use their own office applications.

How should the administrator configure the firewall to allow multiple applications in a dynamic environment?

Create an Application Filter and name it Office Programs, the filter it on the business-systems category, office-programs subcategory

Create an Application Group and add business-systems to it

Create an Application Filter and name it Office Programs, then filter it on the business-systems category

Create an Application Group and add Office 365, Evernote, Google Docs, and Libre Office

Page 6 of 9

51. The CFO found a USB drive in the parking lot and decide to plug it into their corporate laptop. The USB drive had malware on it that loaded onto their computer and then contacted a known command and control (CnC) server, which ordered the infected machine to begin Exfiltrating data from the laptop.

Which security profile feature could have been used to prevent the communication with the CnC server?

Create an anti-spyware profile and enable DNS Sinkhole

Create an antivirus profile and enable DNS Sinkhole

Create a URL filtering profile and block the DNS Sinkhole category

Create a security policy and enable DNS Sinkhole

52. What is a recommended consideration when deploying content updates to the firewall from Panorama?

Before deploying content updates, always check content release version compatibility.

Content updates for firewall A/P HA pairs can only be pushed to the active firewall.

Content updates for firewall A/A HA pairs need a defined master device.

After deploying content updates, perform a commit and push to Panorama.

53. Which option lists the attributes that are selectable when setting up an Application filters?

Category, Subcategory, Technology, and Characteristic

Category, Subcategory, Technology, Risk, and Characteristic

Name, Category, Technology, Risk, and Characteristic

Category, Subcategory, Risk, Standard Ports, and Technology

54. What are two differences between an implicit dependency and an explicit dependency in App-ID? (Choose two.)

An implicit dependency does not require the dependent application to be added in the security policy

An implicit dependency requires the dependent application to be added in the security policy

An explicit dependency does not require the dependent application to be added in the security policy

An explicit dependency requires the dependent application to be added in the security policy

55. Four configuration choices are listed, and each could be used to block access to a specific URL.

If you configured each choices to block the same URL then which choice would be the last to block access to the URL?

EDL in URL Filtering Profile.

Custom URL category in Security Policy rule.

Custom URL category in URL Filtering Profile.

PAN-DB URL category in URL Filtering Profile.

56. Which type of profile must be applied to the Security policy rule to protect against buffer overflows illegal code execution and other attempts to exploit system flaws?

anti-spyware

URL filtering

vulnerability protection

file blocking

57. Which type of security rule will match traffic between the Inside zone and Outside zone, within the Inside zone, and within the Outside zone?

global

intrazone

interzone

universal

58. An administrator is implementing an exception to an external dynamic list by adding an entry to the list manually. The administrator wants to save the changes, but the OK button is grayed out.

What are two possible reasons the OK button is grayed out? (Choose two.)

The entry contains wildcards.

The entry is duplicated.

The entry doesn't match a list entry.

The entry matches a list entry.

59. Which administrator type utilizes predefined roles for a local administrator account?

Superuser

Role-based

Dynamic

Device administrator

60. Choose the option that correctly completes this statement. A Security Profile can block or allow traffic ____________.

on either the data place or the management plane.

after it is matched by a security policy rule that allows traffic.

before it is matched to a Security policy rule.

after it is matched by a security policy rule that allows or blocks traffic.

Page 7 of 9

61. Which data-plane processor layer of the graphic shown provides uniform matching for spyware and vulnerability exploits on a Palo Alto Networks Firewall?

Signature Matching

Network Processing

Security Processing

Security Matching

62. What in the minimum frequency for which you can configure the firewall too check for new wildfire antivirus signatures?

every 5 minutes

every 1 minute

every 24 hours

every 30 minutes

63. What are three factors that can be used in domain generation algorithms? (Choose three.)

cryptographic keys

time of day

other unique values

URL custom categories

IP address

64. Which two matching criteria are used when creating a Security policy involving NAT? (Choose two.)

Post-NAT address

Post-NAT zone

Pre-NAT zone

Pre-NAT address

65. What must be configured for the firewall to access multiple authentication profiles for external services to authenticate a non-local account?

authentication sequence

LDAP server profile

authentication server list

authentication list profile

66. Which data flow direction is protected in a zero trust firewall deployment that is not protected in a perimeter-only firewall deployment?

outbound

north south

inbound

east west

67. If users from the Trusted zone need to allow traffic to an SFTP server in the DMZ zone, how should a Security policy with App-ID be configured?

A)

Option A

Option B

Option C

Option D

68. Palo Alto Networks firewall architecture accelerates content map minimizing latency using which two components'? (Choose two )

Network Processing Engine

Single Stream-based Engine

Policy Engine

Parallel Processing Hardware

69. What is the correct process tor creating a custom URL category?

Objects > Security Profiles > URL Category > Add

Objects > Custom Objects > URL Filtering > Add

Objects > Security Profiles > URL Filtering > Add

Objects > Custom Objects > URL Category > Add

70. Which statement is true regarding a Best Practice Assessment?

The BPA tool can be run only on firewalls

It provides a percentage of adoption for each assessment data

The assessment, guided by an experienced sales engineer, helps determine the areas of greatest risk where you should focus prevention activities

It provides a set of questionnaires that help uncover security risk prevention gaps across all areas of network and security architecture

Page 8 of 9

71. Which statement is true regarding a Prevention Posture Assessment?

The Security Policy Adoption Heatmap component filters the information by device groups, serial numbers, zones, areas of architecture, and other categories

It provides a set of questionnaires that help uncover security risk prevention gaps across all areas of network and security architecture

It provides a percentage of adoption for each assessment area

It performs over 200 security checks on Panorama/firewall for the assessment

72. Which action related to App-ID updates will enable a security administrator to view the existing security policy rule that matches new application signatures?

Review Policies

Review Apps

Pre-analyze

Review App Matches

73. Selecting the option to revert firewall changes will replace what settings?

The running configuration with settings from the candidate configuration

The candidate configuration with settings from the running configuration

The device state with settings from another configuration

Dynamic update scheduler settings

74. Which operations are allowed when working with App-ID application tags?

Predefined tags may be deleted.

Predefined tags may be augmented by custom tags.

Predefined tags may be modified.

Predefined tags may be updated by WildFire dynamic updates.

75. Given the cyber-attack lifecycle diagram identify the stage in which the attacker can run malicious code against a vulnerability in a targeted machine.

Exploitation

Installation

Reconnaissance

Act on the Objective

76. create a service account on the Domain Controller with sufficient permissions to execute the User- ID agent

2-3-4-1

1-4-3-2

3-1-2-4

1-3-2-4

77. An administrator is investigating a log entry for a session that is allowed and has the end reason of aged-out.

Which two fields could help in determining if this is normal? (Choose two.)

Packets sent/received

IP Protocol

Action

Decrypted

78. An internal host wants to connect to servers of the internet through using source NAT.

Which policy is required to enable source NAT on the firewall?

NAT policy with source zone and destination zone specified

post-NAT policy with external source and any destination address

NAT policy with no source of destination zone selected

pre-NAT policy with external source and any destination address

79. Which component is a building block in a Security policy rule?

decryption profile

destination interface

timeout (min)

application

80. Which Security profile would you apply to identify infected hosts on the protected network using DNS traffic?

URL traffic

vulnerability protection

anti-spyware

antivirus

Page 9 of 9

81. How are Application Fillers or Application Groups used in firewall policy?

An Application Filter is a static way of grouping applications and can be configured as a nested member of an Application Group

An Application Filter is a dynamic way to group applications and can be configured as a nested member of an Application Group

An Application Group is a dynamic way of grouping applications and can be configured as a nested member of an Application Group

An Application Group is a static way of grouping applications and cannot be configured as a nested member of Application Group

82. Which type of administrator account cannot be used to authenticate user traffic flowing through the firewall’s data plane?

Kerberos user

SAML user

local database user

local user

83. An administrator would like to create a URL Filtering log entry when users browse to any gambling website.

What combination of Security policy and Security profile actions is correct?

Security policy = drop, Gambling category in URL profile = allow

Security policy = deny. Gambling category in URL profile = block

Security policy = allow, Gambling category in URL profile = alert

Security policy = allow. Gambling category in URL profile = allow

84. Which Palo Alto networks security operating platform service protects cloud-based application such as Dropbox and salesforce by monitoring permissions and shared and scanning files for Sensitive information?

Prisma SaaS

AutoFocus

Panorama

GlobalProtect

85. DRAG DROP

Order the steps needed to create a new security zone with a Palo Alto Networks firewall.

86. Which firewall feature do you need to configure to query Palo Alto Networks service updates over a data-plane interface instead of the management interface?

Data redistribution

Dynamic updates

SNMP setup

Service route

87. According to the best practices for mission critical devices, what is the recommended interval for antivirus updates?

by minute

hourly

daily

weekly

TAGS:

PCNSA, PCNSA exam dumps

Notify of

Label

Name*

Email*

Website

Label

Name*

Email*

Website

0 Comments

Oldest

Newest Most Voted

Inline Feedbacks

View all comments

Posts

PCCSE Dumps Help You Study Objectives

By practicing with PCCSE exam-like questions, you can identify areas where you may need to focus your studies. Palo Alto...

PCNSE Dumps Help You Study Objectives

By practicing with PCNSE exam-like questions, you can identify areas where you may need to focus your studies. Palo Alto...

Get PCNSA Dumps Full Version

Q&As: 382
Versions: PDF and Software Download Now

About Dumpsinfo

Dumpsinfo is a good platform providing the latest exam information and dumps questions for all IT certification exams. You can study all the latest exam dumps questions online.

[email protected]

Mon - Sat 9:00am - 6:00pm