The Most Updated PCNSA Exam Dumps - Pass Palo Alto Networks PCNSA Exam Successfully

The Most Updated PCNSA Exam Dumps – Pass Palo Alto Networks PCNSA Exam Successfully

Eleanor2022-09-02T06:18:46+00:00

We always update the exam dumps based on the latest exam objectives to ensure that you can get the most updated materials to prepare for the required exam, including the Palo Alto Networks PCNSA exam. The most updated PNCSA exam dumps are available to help you pass the Palo Alto Networks Certified Network Security Administrator certification exam. The current version of PCNSA exam dumps is V16.02 with 247 Q&As. Come to ITPrepare to choose the most updated PCNSA exam dumps and practice all these questions and answers regularly for passing.

You will be recommended to read the PCNSA free demo questions first:

Page 1 of 9

1. Which interface type is part of a Layer 3 zone with a Palo Alto Networks firewall?

Management

High Availability

Aggregate

Aggregation

2. You receive notification about a new malware that infects hosts An infection results in the infected host attempting to contact a command-and-control server.

Which Security Profile when applied to outbound Security policy rules detects and prevents this threat from establishing a command-and-control connection?

Antivirus Profile

Data Filtering Profile

Vulnerability Protection Profile

Anti-Spyware Profile

3. DRAG DROP

Match the cyber-attack lifecycle stage to its correct description.

4. Which interface type can use virtual routers and routing protocols?

Tap

Layer3

Virtual Wire

Layer2

5. In the example security policy shown, which two websites fcked? (Choose two.)

Facebook

YouTube

Amazon

6. What is the correct process tor creating a custom URL category?

Objects > Security Profiles > URL Category > Add

Objects > Custom Objects > URL Filtering > Add

Objects > Security Profiles > URL Filtering > Add

Objects > Custom Objects > URL Category > Add

7. Your company occupies one floor in a single building you have two active directory domain controllers on a single networks the firewall s management plane is only slightly utilized.

Which user-ID agent sufficient in your network?

PAN-OS integrated agent deployed on the firewall

Windows-based agent deployed on the internal network a domain member

Citrix terminal server agent deployed on the network

Windows-based agent deployed on each domain controller

8. What must be configured before setting up Credential Phishing Prevention?

Anti Phishing Block Page

Threat Prevention

Anti Phishing profiles

User-ID

9. Which type of address object is www.paloaltonetworks.com?

IP range

IP netmask

named address

FQDN

10. Which statement is true about Panorama managed devices?

Panorama automatically removes local configuration locks after a commit from Panorama

Local configuration locks prohibit Security policy changes for a Panorama managed device

Security policy rules configured on local firewalls always take precedence

Local configuration locks can be manually unlocked from Panorama

Page 2 of 9

11. Given the topology, which zone type should zone A and zone B to be configured with?

Layer3

Tap

Layer2

Virtual Wire

12. Which information is included in device state other than the local configuration?

uncommitted changes

audit logs to provide information of administrative account changes

system logs to provide information of PAN-OS changes

device group and template settings pushed from Panorama

13. The PowerBall Lottery has reached a high payout amount and a company has decided to help employee morale by allowing employees to check the number, but doesn’t want to unblock the gambling URL category.

Which two methods will allow the employees to get to the PowerBall Lottery site without the company unlocking the gambling URL category? (Choose two.)

Add all the URLs from the gambling category except powerball.com to the block list and then set the action for the gambling category to allow.

Manually remove powerball.com from the gambling URL category.

Add *.powerball.com to the allow list

Create a custom URL category called PowerBall and add *.powerball.com to the category and set the action to allow.

14. An administrator is reviewing the Security policy rules shown in the screenshot below.

Which statement is correct about the information displayed?

Eleven rules use the "Infrastructure* tag.

The view Rulebase as Groups is checked.

There are seven Security policy rules on this firewall.

Highlight Unused Rules is checked.

15. DRAG DROP

Place the following steps in the packet processing order of operations from first to last.

16. DRAG DROP

Match the Cyber-Attack Lifecycle stage to its correct description.

17. Which interface does not require a MAC or IP address?

Virtual Wire

Layer3

Layer2

Loopback

18. CORRECT TEXT

Refer to the exhibit.

An administrator is using DNAT to map two servers to a single public IP address. Traffic will be steered to the specific server based on the application, where Host A (10.1.1.100) receives HTTP traffic and Host B (10.1.1.101) receives SSH traffic.

Which two Security policy rules will accomplish this configuration? (Choose two.)

Untrust (Any) to DMZ (1.1.1.100), ssh - Allow

Untrust (Any) to Untrust (10.1.1.1), web-browsing -Allow

Untrust (Any) to Untrust (10.1.1.1), ssh -Allow

Untrust (Any)to DMZ (10.1.1.100. 10.1.1.101), ssh, web-browsing-Allow

Untrust (Any) to DMZ (1.1.1.100), web-browsing - Allow

19. If using group mapping with Active Directory Universal Groups, what must you do when configuring the User-ID?

Create an LDAP Server profile to connect to the root domain of the Global Catalog server on port 3268 or 3269 for SSL

Configure a frequency schedule to clear group mapping cache

Configure a Primary Employee ID number for user-based Security policies

Create a RADIUS Server profile to connect to the domain controllers using LDAPS on port 636 or 389

20. How is the hit count reset on a rule?

select a security policy rule, right click Hit Count > Reset

with a dataplane reboot

Device > Setup > Logging and Reporting Settings > Reset Hit Count

in the CLI, type command reset hitcount <POLICY-NAME>

Page 3 of 9

21. DRAG DROP

Match the network device with the correct User-ID technology.

22. Prior to a maintenance-window activity, the administrator would like to make a backup of only the running configuration to an external location .

What command in Device > Setup > Operations would provide the most operationally efficient way to achieve this outcome?

save named configuration snapshot

export device state

export named configuration snapshot

save candidate config

23. Which Palo Alto Networks firewall security platform provides network security for mobile endpoints by inspecting traffic deployed as internet gateways?

GlobalProtect

AutoFocus

Aperture

Panorama

24. What two authentication methods on the Palo Alto Networks firewalls support authentication and authorization for role-based access control? (Choose two.)

SAML

TACACS+

LDAP

Kerberos

25. Assume a custom URL Category Object of "NO-FILES" has been created to identify a specific website

How can file uploading/downloading be restricted for the website while permitting general browsing access to that website?

Create a Security policy with a URL Filtering profile that references the site access setting of continue to NO-FILES

Create a Security policy with a URL Filtering profile that references the site access setting of block to NO-FILES

Create a Security policy that references NO-FILES as a URL Category qualifier, with an appropriate Data Filtering profile

Create a Security policy that references NO-FILES as a URL Category qualifier, with an appropriate File Blocking profile

26. Access to which feature requires the PAN-OS Filtering license?

PAN-DB database

DNS Security

Custom URL categories

URL external dynamic lists

27. What are two valid selections within an Antivirus profile? (Choose two.)

deny

drop

default

block-ip

28. Which objects would be useful for combining several services that are often defined together?

shared service objects

service groups

application groups

application filters

29. Which DNS Query action is recommended for traffic that is allowed by Security policy and matches Palo Alto Networks Content DNS Signatures?

block

sinkhole

alert

allow

30. Which type of address object is "10 5 1 1/0 127 248 2"?

IP subnet

IP wildcard mask

IP netmask

IP range

Page 4 of 9

31. View the diagram.

What is the most restrictive yet fully functional rule to allow general Internet and SSH traffic into both the DMZ and Untrust/lnternet zones from each of the lOT/Guest and Trust Zones?

A)

Option A

Option B

Option C

Option D

32. An administrator would like to block access to a web server, while also preserving resources and minimizing half-open sockets .

What are two security policy actions the administrator can select? (Choose two.)

Reset server

Reset both

Drop

Deny

33. An administrator needs to add capability to perform real-time signature lookups to block or sinkhole all known malware domains.

Which type of single unified engine will get this result?

User-ID

App-ID

Security Processing Engine

Content-ID

34. Which three interface deployment methods can be used to block traffic flowing through the Palo Alto Networks firewall? (Choose three.)

Layer 2

Virtual Wire

Tap

Layer 3

35. Which Security profile would you apply to identify infected hosts on the protected network using DNS traffic?

URL traffic

vulnerability protection

anti-spyware

antivirus

36. What is the main function of the Test Policy Match function?

verify that policy rules from Expedition are valid

confirm that rules meet or exceed the Best Practice Assessment recommendations

confirm that policy rules in the configuration are allowing/denying the correct traffic

ensure that policy rules are not shadowing other policy rules

37. How are Application Fillers or Application Groups used in firewall policy?

An Application Filter is a static way of grouping applications and can be configured as a nested member of an Application Group

An Application Filter is a dynamic way to group applications and can be configured as a nested member of an Application Group

An Application Group is a dynamic way of grouping applications and can be configured as a nested member of an Application Group

An Application Group is a static way of grouping applications and cannot be configured as a nested member of Application Group

38. URL categories can be used as match criteria on which two policy types? (Choose two.)

authentication

decryption C application override

NAT

39. In a security policy what is the quickest way to rest all policy rule hit counters to zero?

Use the CLI enter the command reset rules all

Highlight each rule and use the Reset Rule Hit Counter > Selected Rules.

use the Reset Rule Hit Counter > All Rules option.

Reboot the firewall.

40. DRAG DROP

Match each rule type with its example

Page 5 of 9

41. How do you reset the hit count on a security policy rule?

First disable and then re-enable the rule.

Reboot the data-plane.

Select a Security policy rule, and then select Hit Count > Reset.

Type the CLI command reset hitcount <POLICY-NAME>.

42. How does an administrator schedule an Applications and Threats dynamic update while delaying installation of the update for a certain amount of time?

Disable automatic updates during weekdays

Automatically “download and install” but with the “disable new applications” option used

Automatically “download only” and then install Applications and Threats later, after the administrator approves the update

Configure the option for “Threshold”

43. What is considered best practice with regards to committing configuration changes?

Disable the automatic commit feature that prioritizes content database installations before committing

Validate configuration changes prior to committing

Wait until all running and pending jobs are finished before committing

Export configuration after each single configuration change performed

44. Which license must an administrator acquire prior to downloading Antivirus updates for use with the firewall?

URL filtering

Antivirus

WildFire

Threat Prevention

45. Which Palo Alto network security operating platform component provides consolidated policy creation and centralized management?

Prisma SaaS

Panorama

AutoFocus

GlobalProtect

46. Which administrator type provides more granular options to determine what the administrator can view and modify when creating an administrator account?

Root

Dynamic

Role-based

Superuser

47. An administrator wants to create a NAT policy to allow multiple source IP addresses to be translated to the same public IP address .

What is the most appropriate NAT policy to achieve this?

Dynamic IP and Port

Dynamic IP

Static IP

Destination

48. Which statement is true regarding a Prevention Posture Assessment?

The Security Policy Adoption Heatmap component filters the information by device groups, serial numbers, zones, areas of architecture, and other categories

It provides a set of questionnaires that help uncover security risk prevention gaps across all areas of network and security architecture

It provides a percentage of adoption for each assessment area

It performs over 200 security checks on Panorama/firewall for the assessment

49. DRAG DROP

Place the steps in the correct packet-processing order of operations.

50. Complete the statement. A security profile can block or allow traffic____________

on unknown-tcp or unknown-udp traffic

after it is matched by a security policy that allows traffic

before it is matched by a security policy

after it is matched by a security policy that allows or blocks traffic

Page 6 of 9

51. Which URL Filtering profile action would you set to allow users the option to access a site only if they provide a URL admin password?

override

authorization

authentication

continue

52. Which two configuration settings shown are not the default? (Choose two.)

Enable Security Log

Server Log Monitor Frequency (sec)

Enable Session

Enable Probing

53. In which profile should you configure the DNS Security feature?

URL Filtering Profile

Anti-Spyware Profile

Zone Protection Profile

Antivirus Profile

54. What can be achieved by selecting a policy target prior to pushing policy rules from Panorama?

Doing so limits the templates that receive the policy rules

Doing so provides audit information prior to making changes for selected policy rules

You can specify the firewalls m a device group to which to push policy rules

You specify the location as pre can - or post-rules to push policy rules

55. An administrator wishes to follow best practices for logging traffic that traverses the firewall

Which log setting is correct?

Disable all logging

Enable Log at Session End

Enable Log at Session Start

Enable Log at both Session Start and End

56. Which interface type is used to monitor traffic and cannot be used to perform traffic shaping?

Layer 2

Tap

Layer 3

Virtual Wire

57. Which three configuration settings are required on a Palo Alto networks firewall management interface?

default gateway

netmask

IP address

hostname

auto-negotiation

58. Which User-ID mapping method should be used for an environment with clients that do not authenticate to Windows Active Directory?

Windows session monitoring via a domain controller

passive server monitoring using the Windows-based agent

Captive Portal

passive server monitoring using a PAN-OS integrated User-ID agent

59. Which action related to App-ID updates will enable a security administrator to view the existing security policy rule that matches new application signatures?

Review Policies

Review Apps

Pre-analyze

Review App Matches

60. Given the detailed log information above, what was the result of the firewall traffic inspection?

It was blocked by the Vulnerability Protection profile action.

It was blocked by the Anti-Virus Security profile action.

It was blocked by the Anti-Spyware Profile action.

It was blocked by the Security policy action.

Page 7 of 9

61. Which the app-ID application will you need to allow in your security policy to use facebook-chat?

facebook-email

facebook-base

facebook

facebook-chat

62. Which Security policy match condition would an administrator use to block traffic from IP addresses on the Palo Alto Networks EDL of Known Malicious IP Addresses list?

destination address

source address

destination zone

source zone

63. Which administrator type utilizes predefined roles for a local administrator account?

Superuser

Role-based

Dynamic

Device administrator

64. A network administrator is required to use a dynamic routing protocol for network connectivity.

Which three dynamic routing protocols are supported by the NGFW Virtual Router for this purpose? (Choose three.)

RIP

OSPF

IS-IS

EIGRP

BGP

65. An administrator has configured a Security policy where the matching condition includes a single application and the action is deny

If the application s default deny action is reset-both what action does the firewall take*?

It sends a TCP reset to the client-side and server-side devices

It silently drops the traffic and sends an ICMP unreachable code

It silently drops the traffic

It sends a TCP reset to the server-side device

66. An administrator would like to determine the default deny action for the application dns-over-https

Which action would yield the information?

View the application details in beacon paloaltonetworks.com

Check the action for the Security policy matching that traffic

Check the action for the decoder in the antivirus profile

View the application details in Objects > Applications

67. Which option lists the attributes that are selectable when setting up an Application filters?

Category, Subcategory, Technology, and Characteristic

Category, Subcategory, Technology, Risk, and Characteristic

Name, Category, Technology, Risk, and Characteristic

Category, Subcategory, Risk, Standard Ports, and Technology

68. The CFO found a USB drive in the parking lot and decide to plug it into their corporate laptop. The USB drive had malware on it that loaded onto their computer and then contacted a known command and control (CnC) server, which ordered the infected machine to begin Exfiltrating data from the laptop.

Which security profile feature could have been used to prevent the communication with the CnC server?

Create an anti-spyware profile and enable DNS Sinkhole

Create an antivirus profile and enable DNS Sinkhole

Create a URL filtering profile and block the DNS Sinkhole category

Create a security policy and enable DNS Sinkhole

69. Which license must an Administrator acquire prior to downloading Antivirus Updates for use with the firewall?

Threat Prevention License

Threat Implementation License

Threat Environment License

Threat Protection License

70. An administrator is troubleshooting an issue with traffic that matches the intrazone-default rule, which is set to default configuration.

What should the administrator do?

change the logging action on the rule

review the System Log

refresh the Traffic Log

tune your Traffic Log filter to include the dates

Page 8 of 9

71. untrust to the internet

Based on the capabilities of the Palo Alto Networks NGFW, what are two ways to configure a security policy using App-ID to comply with this request? (Choose two)

Create a deny rule at the top of the policy from trust to untrust over any service and select evasive as the application

Create a deny rule at the top of the policy from trust to untrust with service application-default and select evasive as the application.

Create a deny rule at the top of the policy from trust to untrust over any service and add an application filter with the evasive characteristic.

Create a deny rule at the top of the policy from trust to untrust with service application-default and add an application filter with the evasive characteristic

72. What must be considered with regards to content updates deployed from Panorama?

Content update schedulers need to be configured separately per device group.

Panorama can only install up to five content versions of the same type for potential rollback scenarios.

A PAN-OS upgrade resets all scheduler configurations for content updates.

Panorama can only download one content update at a time for content updates of the same type.

73. A server-admin in the USERS-zone requires SSH-access to all possible servers in all current and future Public Cloud environments. All other required connections have already been enabled between the USERS- and the OUTSIDE-zone .

What configuration-changes should the Firewall-admin make?

Create a custom-service-object called SERVICE-SSH for destination-port-TCP-22. Create a security-rule between zone USERS and OUTSIDE to allow traffic from any source IP-address to any destination IP-address for SERVICE-SSH

Create a security-rule that allows traffic from zone USERS to OUTSIDE to allow traffic from any source IP-address to any destination IP-address for application SSH

In addition to option a, a custom-service-object called SERVICE-SSH-RETURN that contains source-port-TCP-22 should be created. A second security-rule is required that allows traffic from zone OUTSIDE to USERS for SERVICE-SSH-RETURN for any source-IP-address to any destination-Ip-address

In addition to option c, an additional rule from zone OUTSIDE to USERS for application SSH from any source-IP-address to any destination-IP-address is required to allow the return-traffic from the SSH-servers to reach the server-admin

74. 1.Which statement best describes the use of Policy Optimizer?

Policy Optimizer can display which Security policies have not been used in the last 90 days

Policy Optimizer on a VM-50 firewall can display which Layer 7 App-ID Security policies have unused applications

Policy Optimizer can add or change a Log Forwarding profile for each Secunty policy selected

Policy Optimizer can be used on a schedule to automatically create a disabled Layer 7 App-ID Security policy for every Layer 4 policy that exists Admins can then manually enable policies they want to keep and delete ones they want to remove

75. A company moved its old port-based firewall to a new Palo Alto Networks NGFW 60 days ago .

Which utility should the company use to identify out-of-date or unused rules on the firewall?

Rule Usage Filter > No App Specified

Rule Usage Filter >Hit Count > Unused in 30 days

Rule Usage Filter > Unused Apps

Rule Usage Filter > Hit Count > Unused in 90 days

76. Which service protects cloud-based applications such as Dropbox and Salesforce by administering permissions and scanning files for sensitive information?

Aperture

AutoFocus

Parisma SaaS

GlobalProtect

77. Given the scenario, which two statements are correct regarding multiple static default routes? (Choose two.)

Path monitoring does not determine if route is useable

Route with highest metric is actively used

Path monitoring determines if route is useable

Route with lowest metric is actively used

78. What allows a security administrator to preview the Security policy rules that match new application signatures?

Review Release Notes

Dynamic Updates-Review Policies

Dynamic Updates-Review App

Policy Optimizer-New App Viewer

79. An administrator notices that protection is needed for traffic within the network due to malicious lateral movement activity.

Based on the image shown, which traffic would the administrator need to monitor and block to mitigate the malicious activity?

branch office traffic

north-south traffic

perimeter traffic

east-west traffic

80. An administrator is reviewing another administrator s Security policy log settings

Which log setting configuration is consistent with best practices tor normal traffic?

Log at Session Start and Log at Session End both enabled

Log at Session Start disabled Log at Session End enabled

Log at Session Start enabled Log at Session End disabled

Log at Session Start and Log at Session End both disabled

Page 9 of 9

81. The firewall sends employees an application block page when they try to access Youtube.

Which Security policy rule is blocking the youtube application?

intrazone-default

Deny Google

allowed-security services

interzone-default

82. At which point in the app-ID update process can you determine if an existing policy rule is affected by an app-ID update?

after clicking Check New in the Dynamic Update window

after connecting the firewall configuration

after downloading the update

after installing the update

83. Which administrative management services can be configured to access a management interface?

HTTP, CLI, SNMP, HTTPS

HTTPS, SSH telnet SNMP

SSH: telnet HTTP, HTTPS

HTTPS, HTT

CLI, API

84. Which data flow direction is protected in a zero trust firewall deployment that is not protected in a perimeter-only firewall deployment?

outbound

north south

inbound

east west

85. When creating a Source NAT policy, which entry in the Translated Packet tab will display the options Dynamic IP and Port, Dynamic, Static IP, and None?

Translation Type

Interface

Address Type

IP Address

86. An administrator would like to see the traffic that matches the interzone-default rule in the

traffic logs.

What is the correct process to enable this logging1?

Select the interzone-default rule and edit the rule on the Actions tab select Log at Session Start and click OK

Select the interzone-default rule and edit the rule on the Actions tab select Log at Session End and click OK

This rule has traffic logging enabled by default no further action is required

Select the interzone-default rule and click Override on the Actions tab select Log at Session End and click OK

87. Which dynamic update type includes updated anti-spyware signatures?

Applications and Threats

GlobalProtect Data File

Antivirus

PAN-DB

88. Given the image, which two options are true about the Security policy rules. (Choose two.)

The Allow Office Programs rule is using an Application Filter

In the Allow FTP to web server rule, FTP is allowed using App-ID

The Allow Office Programs rule is using an Application Group

In the Allow Social Networking rule, allows all of Facebook’s functions

89. You receive notification about new malware that infects hosts through malicious files transferred by FTP.

Which Security profile detects and protects your internal networks from this threat after you update your firewall’s threat signature database?

URL Filtering profile applied to inbound Security policy rules.

Data Filtering profile applied to outbound Security policy rules.

Antivirus profile applied to inbound Security policy rules.

Vulnerability Protection profile applied to outbound Security policy rules.

90. A network has 10 domain controllers, multiple WAN links, and a network infrastructure with bandwidth needed to support mission-critical applications.

Given the scenario, which type of User-ID agent is considered a best practice by Palo Alto Networks?

Windows-based agent on a domain controller

Captive Portal

Citrix terminal server with adequate data-plane resources

PAN-OS integrated agent

The Most Updated PCNSA Exam Dumps – Pass Palo Alto Networks PCNSA Exam Successfully