PCNSA practice questions 1–10

1. Question 1 · 407 in bank

   DRAG DROP - Match the Palo Alto Networks Security Operating Platform architecture to its description. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   these are all incorrect I think this is the answer NGF--> Identifies and inspects all traffic to block known threats T.I.C -- >Gathers, analyzes, correlates and disseminates threat to and from the network and endpoints located within the network A.E.P -- > Inspects process and files to prevent known and unknown exploits.

   Source: Adapted from community discussion — cutemomo

   

   Next question

2. Question 2 · 407 in bank

   Select 2

   Which two statements are correct about App-ID content updates? (Choose two.)

   • AUpdated application content might change how Security policy rules are enforced.
   • BAfter an application content update, new applications must be manually classified prior to use.
   • CExisting security policy rules are not affected by application content updates.
   • DAfter an application content update, new applications are automatically identified and classified.

   Show answer

   Answer: AD

   Explanation

   The correct answers are: A. Updated application content may change how security policy rules are enforced D. After an application content update, new applications are automatically identified and classified 'B' is not correct as there is no need to do any manual classification of applications.

   Source: Adapted from community discussion — rebet

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

3. Question 3 · 407 in bank

   Which type of administrator account cannot be used to authenticate user traffic flowing through the firewall's data plane?

   • AKerberos user
   • BSAML user
   • Clocal database user
   • Dlocal user

   Show answer

   Answer: D

   Explanation

   Local user. D is correct. Because for the other users youcan create a auth profile. But for local users (users in XML config), auth profile cannot created.

   Source: Adapted from community discussion — zerdo

   Next question

4. Question 4 · 407 in bank

   How frequently can WildFire updates be made available to firewalls?

   • Aevery 15 minutes
   • Bevery 30 minutes
   • Cevery 60 minutes
   • Devery 5 minutes

   Show answer

   Answer: D

   Explanation

   The honest answer is "as close to zero as is offered in the answer". Palo has been working on making the answer zero for each version update.

   Source: Adapted from community discussion — LordScorpius

   Next question

5. Question 5 · 407 in bank

   Starting with PAN-OS version 9.1, which new type of object is supported for use within the User field of a Security policy rule?

   • Aremote username
   • Bdynamic user group
   • Cstatic user group
   • Dlocal username

   Show answer

   Answer: B

   References

   • docs.paloaltonetworks.com documentation

   Next question

6. Question 6 · 407 in bank

   Which link in the web interface enables a security administrator to view the Security policy rules that match new application signatures?

   • AReview App Matches
   • BReview Apps
   • CPre-analyze
   • DReview Policies

   Show answer

   Answer: D

   References

   • docs.paloaltonetworks.com documentation

   Next question

7. Question 7 · 407 in bank

   Based on the shown security policy, which Security policy rule would match all FTP traffic from the inside zone to the outside zone?

   

   • Ainterzone-default
   • Binternal-inside-dmz
   • Cinside-portal
   • Degress-outside

   Show answer

   Answer: D

   Explanation

   But it does say "Match ALL ftp traffic" (not "any") which the Inside-portal would not match all the ftp traffic, just the FTP traffic destined to that specific IP.

   Source: Adapted from community discussion — Ermbmx2

   Next question

8. Question 8 · 407 in bank

   Which type of firewall configuration contains in-progress configuration changes?

   • Abackup
   • Bcandidate
   • Crunning
   • Dcommitted

   Show answer

   Answer: B

   Explanation

   The question says in progress changes.. changes are in the candidate config, they become part of the running-config after commit. Answer is B

   Source: Adapted from community discussion — SupaFlash

   Next question

9. Question 9 · 407 in bank

   Select 3

   Which three configuration settings are required on a Palo Alto Network firewall management interface? (Choose three.)

   • Ahostname
   • Bnetmask
   • Cdefault gateway
   • Dauto-negotiation
   • EIP address

   Show answer

   Answer: BCE

   Explanation

   Reference: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClN7CAK

   Next question

10. Question 10 · 407 in bank

    What is an advantage for using application tags?

    • AThey are helpful during the creation of new zones.
    • BThey help content updates automate policy updates.
    • CThey help with the creation of interfaces.
    • DThey help with the design of IP address allocations in DHCP.

    Show answer

    Answer: B

    Explanation

    Tags. All Tags. Are specific to the creation of Policy. They have several purposes, apply to any object, can be defined and so forth. I am uncertain as to whether any action subsequent to their application is automated or not. The only thing I'm clear on is, they are Security Policy related, or to it's creation, whether automated or not.

    Source: Adapted from community discussion — LordScorpius

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNSA practice, question 1. 407 questions available.