How Many Questions Of PCNSA Free Practice Questions

NEW QUESTION 1
DRAG DROP
Place the steps in the correct packet-processing order of operations.

• A. Yes
• B. Not Mastered

Answer: A

NEW QUESTION 2
Identify the correct order to configure the PAN-OS integrated USER-ID agent.
* 3. add the service account to monitor the server(s)
* 2. define the address of the servers to be monitored on the firewall
* 4. commit the configuration, and verify agent connection status
* 1. create a service account on the Domain Controller with sufficient permissions to execute the User- ID agent

• A. 2-3-4-1
• B. 1-4-3-2
• C. 3-1-2-4
• D. 1-3-2-4

Answer: D

NEW QUESTION 3
Which URL Filtering Profile action does not generate a log entry when a user attempts to access a URL?

• A. override
• B. allow
• C. block
• D. continue

Answer: B

NEW QUESTION 4
Which Palo Alto networks security operating platform service protects cloud-based application such as Dropbox and salesforce by monitoring permissions and shared and scanning files for Sensitive information?

• A. Prisma SaaS
• B. AutoFocus
• C. Panorama
• D. GlobalProtect

Answer: A

NEW QUESTION 5
Which Security profile would you apply to identify infected hosts on the protected network uwall user database?

• A. Anti-spyware
• B. Vulnerability protection
• C. URL filtering
• D. Antivirus

Answer: A

NEW QUESTION 6
View the diagram.

What is the most restrictive, yet fully functional rule, to allow general Internet and SSH traffic into both the DMZ and Untrust/lnternet zones from each of the lOT/Guest and Trust Zones?
A)

B)

C)

D)

• A. Option
• B. Option
• C. Option
• D. Option

Answer: C

NEW QUESTION 7
Which Security profile can you apply to protect against malware such as worms and Trojans?

• A. data filtering
• B. antivirus
• C. vulnerability protection
• D. anti-spyware

Answer: B

Explanation:
Reference:
https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/policy/security- profiles#:~:text=Antivirus%
20profiles%20protect%20against%20viruses,as%20well%20as%20spyware%20downloads

NEW QUESTION 8
A server-admin in the USERS-zone requires SSH-access to all possible servers in all current and future Public Cloud environments. All other required connections have already been enabled between the USERS- and the OUTSIDE-zone. What configuration-changes should the Firewall-admin make?

• A. Create a custom-service-object called SERVICE-SSH for destination-port-TCP-22. Create a security-rule between zone USERS and OUTSIDE to allow traffic from any source IP-address to any destination IP-address for SERVICE-SSH
• B. Create a security-rule that allows traffic from zone USERS to OUTSIDE to allow traffic from any source IP-address to any destination IP-address for application SSH
• C. In addition to option a, a custom-service-object called SERVICE-SSH-RETURN that contains source-port-TCP-22 should be create
• D. A second security-rule is required that allows traffic from zone OUTSIDE to USERS for SERVICE-SSH-RETURN for any source- IP-address to any destination-Ip-address
• E. In addition to option c, an additional rule from zone OUTSIDE to USERS for applicationSSH from any source-IP-address to any destination-IP-address is required to allow the return-traffic from the SSH-servers to reach the server-admin

Answer: B

NEW QUESTION 9
A security administrator has configured App-ID updates to be automatically downloaded and installed. The company is currently using an application identified by App-ID asSuperApp_base.
On a content update notice, Palo Alto Networks is adding new app signatures labeled SuperApp_chat and SuperApp_download, which will be deployed in 30 days.
Based on the information, how is the SuperApp traffic affected after the 30 days have passed?

• A. All traffic matching the SuperApp_chat, and SuperApp_download is denied because it no longer matches the SuperApp-base application
• B. No impact because the apps were automatically downloaded and installed
• C. No impact because the firewall automatically adds the rules to the App-ID interface
• D. All traffic matching the SuperApp_base, SuperApp_chat, and SuperApp_download is denied until the security administrator approves the applications

Answer: A

Explanation:
https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/app-id/manage-new-app-ids-introduced-in-content-releases/review-new-app-id-impact-on-existing-policy-rules

NEW QUESTION 10
An administrator wants to create a NAT policy to allow multiple source IP addresses to be translated to the same public IP address. What is the most appropriate NAT policy to achieve this?

• A. Dynamic IP and Port
• B. Dynamic IP
• C. Static IP
• D. Destination

Answer: A

NEW QUESTION 11
An administrator is reviewing another administrator s Security policy log settings Which log setting configuration is consistent with best practices tor normal traffic?

• A. Log at Session Start and Log at Session End both enabled
• B. Log at Session Start disabled Log at Session End enabled
• C. Log at Session Start enabled Log at Session End disabled
• D. Log at Session Start and Log at Session End both disabled

Answer: B

NEW QUESTION 12
Which two configuration settings shown are not the default? (Choose two.)

• A. Enable Security Log
• B. Server Log Monitor Frequency (sec)
• C. Enable Session
• D. Enable Probing

Answer: BC

NEW QUESTION 13
You receive notification about new malware that is being used to attack hosts The malware exploits a software bug in a common application
Which Security Profile detects and blocks access to this threat after you update the firewall's threat signature database?

• A. Data Filtering Profile applied to outbound Security policy rules
• B. Antivirus Profile applied to outbound Security policy rules
• C. Data Filtering Profile applied to inbound Security policy rules
• D. Vulnerability Profile applied to inbound Security policy rules

Answer: B

NEW QUESTION 14
What are three ways application characteristics are used? (Choose three.)

• A. As an attribute to define an application group
• B. As a setting to define a new custom application
• C. As an Object to define Security policies
• D. As an attribute to define an application filter
• E. As a global filter in the Application Command Center (ACC)

Answer: ABD

Explanation:

NEW QUESTION 15
What allows a security administrator to preview the Security policy rules that match new application signatures?

• A. Review Release Notes
• B. Dynamic Updates-Review Policies
• C. Dynamic Updates-Review App
• D. Policy Optimizer-New App Viewer

Answer: B

Explanation:
https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/app-id/manage- new-app-ids-introduced-in-content-releases/review-new-app-id-impact-on-existing-policy- rules

NEW QUESTION 16
The CFO found a malware infected USB drive in the parking lot, which when inserted infected their corporate laptop the malware contacted a known command-and-control server which exfiltrating corporate data.
Which Security profile feature could have been used to prevent the communications with the command-and-control server?

• A. Create a Data Filtering Profile and enable its DNS sinkhole feature.
• B. Create an Antivirus Profile and enable its DNS sinkhole feature.
• C. Create an Anti-Spyware Profile and enable its DNS sinkhole feature.
• D. Create a URL Filtering Profile and block the DNS sinkhole URL category.

Answer: C

NEW QUESTION 17
What is a function of application tags?

• A. creation of new zones
• B. application prioritization
• C. automated referenced applications in a policy
• D. IP address allocations in DHCP

Answer: C

NEW QUESTION 18
Which data-plane processor layer of the graphic shown provides uniform matching for spyware and vulnerability exploits on a Palo Alto Networks Firewall?

• A. Signature Matching
• B. Network Processing
• C. Security Processing
• D. Security Matching

Answer: A

NEW QUESTION 19
Which type firewall configuration contains in-progress configuration changes?

• A. backup
• B. running
• C. candidate
• D. committed

Answer: C

NEW QUESTION 20
Which two firewall components enable you to configure SYN flood protection thresholds? (Choose two.)

• A. QoS profile
• B. DoS Protection profile
• C. Zone Protection profile
• D. DoS Protection policy

Answer: BC

Explanation:

Reference:
https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/policy/security-profiles

NEW QUESTION 21
......