Palo Alto Networks PCNSA Dumps - Free Demo Online

Palo Alto Networks PCNSA Dumps – Free Demo Online | ITPrepare

Eleanor2022-03-02T06:03:43+00:00

By Eleanor Palo Alto Networks PCNSA, PCNSA dumps 0 Comments

Palo Alto Networks Certified Network Security Administrator PCNSA exam is one of the Palo Alto Networks Security Administrator certification exams. It validates the knowledge and skills required for networksecurity administrators responsible for deploying and operating Palo Alto NetworksNext-Generation Firewalls (NGFWs). ITPrepare recommends students to prepare for Palo Alto Networks PCNSA exam with online study guide and learning materials. Currently, choosing the valid exam questions to practice regularly is the effective way to complete PCNSA exam. ITPrepare offers free PCNSA demo questions below to test by yourselfe.

Palo Alto Networks PCNSA Free Dumps Demo Online Provided By ITPrepare

Page 1 of 5

1. Which option lists the attributes that are selectable when setting up an Application filters?

Category, Subcategory, Technology, and Characteristic

Category, Subcategory, Technology, Risk, and Characteristic

Name, Category, Technology, Risk, and Characteristic

Category, Subcategory, Risk, Standard Ports, and Technology

2. Which the app-ID application will you need to allow in your security policy to use facebook-chat?

facebook-email

facebook-base

facebook

facebook-chat

3. Which rule type is appropriate for matching traffic both within and between the source and destination zones?

interzone

shadowed

intrazone

universal

4. Which license must an administrator acquire prior to downloading Antivirus updates for use with the firewall?

URL filtering

Antivirus

WildFire

Threat Prevention

5. Which Palo Alto networks security operating platform service protects cloud-based application such as Dropbox and salesforce by monitoring permissions and shared and scanning files for Sensitive information?

Prisma SaaS

AutoFocus

Panorama

GlobalProtect

6. At which point in the app-ID update process can you determine if an existing policy rule is affected by an app-ID update?

after clicking Check New in the Dynamic Update window

after connecting the firewall configuration

after downloading the update

after installing the update

7. Actions can be set for which two items in a URL filtering security profile? (Choose two.)

Block List

Custom URL Categories

PAN-DB URL Categories

Allow List

8. Which option is part of the content inspection process?

IPsec tunnel encryption

Packet egress process

SSL Proxy re-encrypt

Packet forwarding process

9. Which security profile will provide the best protection against ICMP floods, based on individual combinations of a packet`s source and destination IP address?

DoS protection

URL filtering

packet buffering

anti-spyware

10. The Palo Alto Networks NGFW was configured with a single virtual router named VR-1 What changes are required on VR-1 to route traffic between two interfaces on the NGFW?

Add zones attached to interfaces to the virtual router

Add interfaces to the virtual router

Enable the redistribution profile to redistribute connected routes

Add a static routes to route between the two interfaces

Page 2 of 5

11. What is the main function of the Test Policy Match function?

verify that policy rules from Expedition are valid

confirm that rules meet or exceed the Best Practice Assessment recommendations

confirm that policy rules in the configuration are allowing/denying the correct traffic

ensure that policy rules are not shadowing other policy rules

12. Which two components are utilized within the Single-Pass Parallel Processing architecture on a Palo Alto Networks Firewall? (Choose two.)

Layer-ID

User-ID

QoS-ID

App-ID

13. When is the content inspection performed in the packet flow process?

after the application has been identified

after the SSL Proxy re-encrypts the packet

before the packet forwarding process

before session lookup

14. Which Palo Alto Networks firewall security platform provides network security for mobile endpoints by inspecting traffic deployed as internet gateways?

GlobalProtect

AutoFocus

Aperture

Panorama

15. You need to allow users to access the officeCsuite application of their choice .

How should you configure the firewall to allow access to any office-suite application?

Create an Application Group and add Office 365, Evernote Google Docs and Libre Office

Create an Application Group and add business-systems to it.

Create an Application Filter and name it Office Programs, then filter it on the office programs subcategory.

Create an Application Filter and name it Office Programs then filter on the business-systems category.

16. Which two security profile types can be attached to a security policy? (Choose two.)

antivirus

DDoS protection

threat

vulnerability

17. An administrator would like to see the traffic that matches the interzone-default rule in the traffic logs.

What is the correct process to enable this logging1?

Select the interzone-default rule and edit the rule on the Actions tab select Log at Session Start and click OK

Select the interzone-default rule and edit the rule on the Actions tab select Log at Session End and click OK

This rule has traffic logging enabled by default no further action is required

Select the interzone-default rule and click Override on the Actions tab select Log at Session End and click OK

18. Which two statements are true for the DNS security service introduced in PAN-OS version 10.0?

It functions like PAN-DB and requires activation through the app portal.

It removes the 100K limit for DNS entries for the downloaded DNS updates.

IT eliminates the need for dynamic DNS updates.

IT is automatically enabled and configured.

19. You must configure which firewall feature to enable a data-plane interface to submit DNS queries on behalf of the control plane?

Admin Role profile

virtual router

DNS proxy

service route

20. Given the screenshot, what are two correct statements about the logged traffic? (Choose two.)

The web session was unsuccessfully decrypted.

The traffic was denied by security profile.

The traffic was denied by URL filtering.

The web session was decrypted.

Page 3 of 5

21. Which two statements are correct about App-ID content updates? (Choose two.)

Updated application content may change how security policy rules are enforced

After an application content update, new applications must be manually classified prior to use

Existing security policy rules are not affected by application content updates

After an application content update, new applications are automatically identified and classified

22. Based on the security policy rules shown, ssh will be allowed on which port?

23. Which path is used to save and load a configuration with a Palo Alto Networks firewall?

Device>Setup>Services

Device>Setup>Management

Device>Setup>Operations

Device>Setup>Interfaces

24. What is a recommended consideration when deploying content updates to the firewall from Panorama?

Before deploying content updates, always check content release version compatibility.

Content updates for firewall A/P HA pairs can only be pushed to the active firewall.

Content updates for firewall A/A HA pairs need a defined master device.

After deploying content updates, perform a commit and push to Panorama.

25. What are two differences between an implicit dependency and an explicit dependency in App-ID? (Choose two.)

An implicit dependency does not require the dependent application to be added in the security policy

An implicit dependency requires the dependent application to be added in the security policy

An explicit dependency does not require the dependent application to be added in the security policy

An explicit dependency requires the dependent application to be added in the security policy

26. Which operations are allowed when working with App-ID application tags?

Predefined tags may be deleted.

Predefined tags may be augmented by custom tags.

Predefined tags may be modified.

Predefined tags may be updated by WildFire dynamic updates.

27. Given the scenario, which two statements are correct regarding multiple static default routes? (Choose two.)

Path monitoring does not determine if route is useable

Route with highest metric is actively used

Path monitoring determines if route is useable

Route with lowest metric is actively used

28. Based on the graphic, what is the purpose of the SSL/TLS Service profile configuration option?

It defines the SSUTLS encryption strength used to protect the management interface.

It defines the CA certificate used to verify the client's browser.

It defines the certificate to send to the client's browser from the management interface.

It defines the firewall's global SSL/TLS timeout values.

29. All users from the internal zone must be allowed only Telnet access to a server in the DMZ zone. Complete the two empty fields in the Security Policy rules that permits only this type of access.

Source Zone: Internal

Destination Zone: DMZ Zone

Application: _________?

Service: ____________?

Action: allow

(Choose two.)

Service = "any"

Application = "Telnet"

Service - "application-default"

Application = "any"

30. Which two Palo Alto Networks security management tools provide a consolidated creation of policies, centralized management and centralized threat intelligence. (Choose two.)

GlobalProtect

Panorama

Aperture

AutoFocus

Page 4 of 5

31. 1.Complete the statement. A security profile can block or allow traffic____________

on unknown-tcp or unknown-udp traffic

after it is matched by a security policy that allows traffic

before it is matched by a security policy

after it is matched by a security policy that allows or blocks traffic

32. Which type of security rule will match traffic between the Inside zone and Outside zone, within the Inside zone, and within the Outside zone?

global

intrazone

interzone

universal

33. An administrator is reviewing another administrator s Security policy log settings

Which log setting configuration is consistent with best practices tor normal traffic?

Log at Session Start and Log at Session End both enabled

Log at Session Start disabled Log at Session End enabled

Log at Session Start enabled Log at Session End disabled

Log at Session Start and Log at Session End both disabled

34. Which statements is true regarding a Heatmap report?

When guided by authorized sales engineer, it helps determine te areas of greatest security risk.

It provides a percentage of adoption for each assessment area.

It runs only on firewall.

It provides a set of questionnaires that help uncover security risk prevention gaps across all areas of network and security architecture.

35. Which Security profile would you apply to identify infected hosts on the protected network using DNS traffic?

URL traffic

vulnerability protection

anti-spyware

antivirus

36. Which two firewall components enable you to configure SYN flood protection thresholds? (Choose two.)

QoS profile

DoS Protection profile

Zone Protection profile

DoS Protection policy

37. Which two configuration settings shown are not the default? (Choose two.)

Enable Security Log

Server Log Monitor Frequency (sec)

Enable Session

Enable Probing

38. At which stage of the cyber-attack lifecycle would the attacker attach an infected PDF file to an email?

delivery

command and control

explotation

reinsurance

installation

39. When creating a Source NAT policy, which entry in the Translated Packet tab will display the options Dynamic IP and Port, Dynamic, Static IP, and None?

Translation Type

Interface

Address Type

IP Address

40. How does an administrator schedule an Applications and Threats dynamic update while delaying installation of the update for a certain amount of time?

Disable automatic updates during weekdays

Automatically “download and install” but with the “disable new applications” option used

Automatically “download only” and then install Applications and Threats later, after the administrator approves the update

Configure the option for “Threshold”

Page 5 of 5

41. Your company occupies one floor in a single building you have two active directory domain controllers on a single networks the firewall s management plane is only slightly utilized.

Which user-ID agent sufficient in your network?

PAN-OS integrated agent deployed on the firewall

Windows-based agent deployed on the internal network a domain member

Citrix terminal server agent deployed on the network

Windows-based agent deployed on each domain controller

42. A server-admin in the USERS-zone requires SSH-access to all possible servers in all current and future Public Cloud environments. All other required connections have already been enabled between the USERS- and the OUTSIDE-zone .

What configuration-changes should the Firewall-admin make?

Create a custom-service-object called SERVICE-SSH for destination-port-TCP-22. Create a security-rule between zone USERS and OUTSIDE to allow traffic from any source IP-address to any destination IP-address for SERVICE-SSH

Create a security-rule that allows traffic from zone USERS to OUTSIDE to allow traffic from any source IP-address to any destination IP-address for application SSH

In addition to option a, a custom-service-object called SERVICE-SSH-RETURN that contains source-port-TCP-22 should be created. A second security-rule is required that allows traffic from zone OUTSIDE to USERS for SERVICE-SSH-RETURN for any source-IP-address to any destination-Ip-address

In addition to option c, an additional rule from zone OUTSIDE to USERS for application SSH from any source-IP-address to any destination-IP-address is required to allow the return-traffic from the SSH-servers to reach the server-admin

43. DRAG DROP

Arrange the correct order that the URL classifications are processed within the system.

44. Four configuration choices are listed, and each could be used to block access to a specific URL.

If you configured each choices to block the same URL then which choice would be the last to block access to the URL?

EDL in URL Filtering Profile.

Custom URL category in Security Policy rule.

Custom URL category in URL Filtering Profile.

PAN-DB URL category in URL Filtering Profile.

45. Which protocol used to map username to user groups when user-ID is configured?

SAML

RADIUS

TACACS+

LDAP

46. Which statement is true regarding a Prevention Posture Assessment?

The Security Policy Adoption Heatmap component filters the information by device groups, serial numbers, zones, areas of architecture, and other categories

It provides a set of questionnaires that help uncover security risk prevention gaps across all areas of network and security architecture

It provides a percentage of adoption for each assessment area

It performs over 200 security checks on Panorama/firewall for the assessment

47. Access to which feature requires the PAN-OS Filtering license?

PAN-DB database

DNS Security

Custom URL categories

URL external dynamic lists

48. Which firewall plane provides configuration, logging, and reporting functions on a separate processor?

control

network processing

data

security processing

49. Which type of address object is "10 5 1 1/0 127 248 2"?

IP subnet

IP wildcard mask

IP netmask

IP range

50. Which object would an administrator create to block access to all high-risk applications?

HIP profile

application filter

application group

Vulnerability Protection profile

Palo Alto Networks PCNSA Dumps – Free Demo Online | ITPrepare