Palo Alto Networks Certified Network Security Administrator practice questions

1. Question 1 of 25

   Select 2

   Which two statements are correct about App-ID content updates? (Choose two.)

   • AUpdated application content might change how Security policy rules are enforced.
   • BAfter an application content update, new applications must be manually classified prior to use.
   • CExisting security policy rules are not affected by application content updates.
   • DAfter an application content update, new applications are automatically identified and classified.

   Show answer

   Correct answer: A, D

   How others answered

   • AD92%

   Explanation

   The correct answers are: A. Updated application content may change how security policy rules are enforced D. After an application content update, new applications are automatically identified and classified 'B' is not correct as there is no need to do any manual classification of applications.

   Adapted from community discussion by rebet · 2021-01-30 · 33 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   View community discussion4

   Candidate context

   Question 1 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNSA or CertExamHQ.

   1. R

      rebet

      2021-01-30

      33 upvotes

      The correct answers are: A. Updated application content may change how security policy rules are enforced D. After an application content update, new applications are automatically identified and classified 'B' is not correct as there is no need to do any manual classification of applications.

   2. R

      RedByte

      2020-11-20

      7 upvotes

      The answer should be A and B: "A firewall admin must be careful before they install any App‐ID updates because some applications may have changed since the last App‐ID update (content update). For example, an application that was previously categorized under web‐browsing now may be categorized under its own unique App‐ID. Categorization of applications into more specific applications allows more granularity and control of applications within security policies. Because the new App‐ID no longer will be categorized as web‐browsing, no security policy now will contain this new App‐ID. Consequently, the new App‐ID will be blocked."

   3. P

      PaloGuy

      2021-05-04

      5 upvotes

      I agree A & D are correct As new App-IDs are introduced and delivered to the firewall via weekly updates, dynamic filters are automatically updated for those applications that meet the filter criteria. This helps minimize administrative effort associated with security policy management. Source: https://www.paloaltonetworks.com/resources/techbriefs/app-id-tech-brief.html

   4. E

      error_909

      2023-03-14

      Selected A, D4 upvotes

      The correct answers are: A. Updated application content may change how security policy rules are enforced D. After an application content update, new applications are automatically identified and classified. For any manual process in app-id updates, the option disable content update must be done first, then the admin must allow new signatures manually

2. Question 2 of 25

   At which point in the App-ID update process can you determine if an existing policy rule is affected by an App-ID update?

   • Aafter clicking Check Now in the Dynamic Update window
   • Bafter committing the firewall configuration
   • Cafter installing the update
   • Dafter downloading the update

   Show answer

   Correct answer: D

   How others answered

   • D78%
   • A22%

   Explanation

   Answer is D "Action > Download: Additionally, downloading an Application and Threat content release version enables the option to Review Policies that are affected by new application signatures included with the release." https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-web-interface-help/device/device-dynamic-updates.html

   Adapted from community discussion by olexx · 2022-09-30 · 5 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   View community discussion4

   Candidate context

   Question 2 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNSA or CertExamHQ.

   1. P

      Ptopics

      2023-01-04

      Selected D5 upvotes

      Answer is D. Clicking "check now" just looks for new updates. If you have a schedule set up the system is already looking for new updates on its own though. To see if an update will affect an existing rule, you have to download the update and then click on "review policies" to see impact the update will have (Answer D).

   2. O

      olexx

      2022-09-30

      5 upvotes

      Answer is D "Action > Download: Additionally, downloading an Application and Threat content release version enables the option to Review Policies that are affected by new application signatures included with the release." https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-web-interface-help/device/device-dynamic-updates.html

   3. L

      LordScorpius

      2022-09-29

      5 upvotes

      Palo: "downloading an Application and Threat content release version enables the option to Review Policies that are affected by new application signatures included with the release"

   4. K

      kewokil120

      2022-11-19

      Selected D4 upvotes

      D is correct Must be downloaded or installed https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/app-id/manage-new-app-ids-introduced-in-content-releases/review-new-app-id-impact-on-existing-policy-rules

3. Question 3 of 25

   You receive notification about new malware that is being used to attack hosts. The malware exploits a software bug in common application. Which Security Profile detects and blocks access to this threat after you update the firewall's threat signature database?

   • AData Filtering Profile applied to outbound Security policy rules
   • BAntivirus Profile applied to outbound Security policy rules
   • CData Filtering Profile applied to inbound Security policy rules
   • DVulnerability Protection Profile applied to inbound Security policy rules

   Show answer

   Correct answer: D

   How others answered

   • D100%

   Explanation

   Vulnerability Protection Security Profiles stop attempts to exploit system flaws or gain unauthorized access to systems. Anti-Spyware Security Profiles identify infected hosts as traffic leaves the network, but Vulnerability Protection Security Profiles protect against threats entering the network. For example, Vulnerability Protection Security Profiles protect against buffer overflows, illegal code execution, and other attempts to exploit system vulnerabilities Correct answer is D Ref - PCNSA Study Guide 2022 - P157

   Adapted from community discussion by zeebo340 · 2022-09-19 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   View community discussion4

   Candidate context

   Question 3 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNSA or CertExamHQ.

   1. Z

      ZZL

      2022-05-08

      8 upvotes

      Agree, should be D. See study guide p153: Vulnerability Protection - Detects attempts to exploit known software vulnerabilities

   2. Z

      zeebo340

      2022-09-19

      4 upvotes

      Vulnerability Protection Security Profiles stop attempts to exploit system flaws or gain unauthorized access to systems. Anti-Spyware Security Profiles identify infected hosts as traffic leaves the network, but Vulnerability Protection Security Profiles protect against threats entering the network. For example, Vulnerability Protection Security Profiles protect against buffer overflows, illegal code execution, and other attempts to exploit system vulnerabilities Correct answer is D Ref - PCNSA Study Guide 2022 - P157

   3. Z

      z8d21oczd

      2023-01-19

      Selected D3 upvotes

      I would think that D is the most accurate because it can detect and block traffic which uses known vulnererabilies. But AntiVirus could help to avoid downloading the malware itself.. But how the question sounds, it's more likely D what they want to hear.

   4. B

      BeforeScope

      2023-07-13

      Selected D2 upvotes

      Vulnerability Protection profiles stop attempts to exploit system flaws or gain unauthorized access to systems. While Anti-Spyware profiles help identify infected hosts as traffic leaves the network, Vulnerability Protection profiles protect against threats entering th e network. For example, Vulnerability Protection profiles help protect against buffer overflows, illegal code execution, and other attempts to exploit system vulnerabilities. [Palo Alto Networks]

4. Question 4 of 25

   An administrator needs to allow users to use their own office applications. How should the administrator configure the firewall to allow multiple applications in a dynamic environment?

   • ACreate an Application Filter and name it Office Programs, then filter it on the business-systems category, office-programs subcategory
   • BCreate an Application Group and add business-systems to it
   • CCreate an Application Filter and name it Office Programs, then filter it on the business-systems category
   • DCreate an Application Group and add Office 365, Evernote, Google Docs, and Libre Office

   Show answer

   Correct answer: A

   How others answered

   • A100%

   Explanation

   I would say, that A is correct: App Filter = dynamic grouping of apps App Group = static, by admin defined set(s) of apps

   Adapted from community discussion by Jako2252 · 2021-01-06 · 10 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   View community discussion4

   Candidate context

   Question 4 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNSA or CertExamHQ.

   1. J

      Jako2252

      2021-01-06

      10 upvotes

      I would say, that A is correct: App Filter = dynamic grouping of apps App Group = static, by admin defined set(s) of apps

   2. A

      Angel123

      2022-04-23

      4 upvotes

      Correct answer is 'A' 'B' cannot be correct answer since "Multiple applications and multiple application filters can be combined into an application group" (as per PCNSA Study Guide 2020, p.118). "business-systems" shown on answ.B is neither App filter, nor App group, but rather a category.

   3. J

      John555

      2021-03-12

      4 upvotes

      Correct Answer:A Reference:https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/app-id/use-application-objects-in -policy/create-an-application-filter.html

   4. P

      Peter_T

      2021-08-28

      3 upvotes

      You cannot add a category to an Application Group, only applications within that category, so the answer cannot be B. Since the question is about office applications, I think A is the best answer.

5. Question 5 of 25

   An administrator has configured a Security policy where the matching condition includes a single application, and the action is drop. If the application's default deny action is reset-both, what action does the firewall take?

   • AIt silently drops the traffic.
   • BIt silently drops the traffic and sends an ICMP unreachable code.
   • CIt sends a TCP reset to the server-side device.
   • DIt sends a TCP reset to the client-side and server-side devices.

   Show answer

   Correct answer: A

   How others answered

   • A93%

   Explanation

   Deny Action App-IDs are developed with a default deny action that dictates how the firewall responds when the application is included in a Security policy rule with a deny action. The default deny action can specify either a silent drop or a TCP reset. You can override this default action in Security policy.

   Adapted from community discussion by jbas · 2024-11-02 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   View community discussion4

   Candidate context

   Question 5 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNSA or CertExamHQ.

   1. K

      kvothe86

      2023-04-24

      4 upvotes

      This link refers to action for a signatures: Objects>Security ProfilesVulnerability Protection, and not for the exam question. Please refrain from posting incorrect answers!

   2. T

      TheMaster01

      2023-03-25

      Selected A3 upvotes

      If a policy is set to drop, it will take precedence over the app I’d configuration

   3. [

      [Removed]

      2024-10-11

      Selected A1 upvote

      For traffic that matches the attributes defined in a security policy, you can apply the following actions: DROP Silently drops the traffic; for an application, it overrides the default deny action. A TCP reset is not sent to the host/application. For Layer 3 interfaces, to optionally send an ICMP unreachable response to the client, set Action: Drop and enable the Send ICMP Unreachable check box. When enabled, the firewall sends the ICMP code for communication with the destination is administratively prohibited—ICMPv4: Type 3, Code 13; ICMPv6: Type 1, Code 1.

   4. J

      jbas

      2024-11-02

      Selected A2 upvotes

      Deny Action App-IDs are developed with a default deny action that dictates how the firewall responds when the application is included in a Security policy rule with a deny action. The default deny action can specify either a silent drop or a TCP reset. You can override this default action in Security policy.

6. Question 6 of 25

   Choose the option that correctly completes this statement. A Security Profile can block or allow traffic ____________.

   • Aon either the data place or the management plane.
   • Bafter it is matched by a security policy rule that allows traffic.
   • Cbefore it is matched to a Security policy rule.
   • Dafter it is matched by a security policy rule that allows or blocks traffic.

   Show answer

   Correct answer: B

   How others answered

   • B93%

   Explanation

   'B' is correct answer according PCNSA Study Guide 2020, p.131 After a packet has been allowed by the Security policy, Security Profiles are used to scan packets for threats, vulnerabilities, viruses, spyware, malicious URLs, data exfiltration, and exploitation software.

   Adapted from community discussion by Angel123 · 2021-04-23 · 21 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   View community discussion4

   Candidate context

   Question 6 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNSA or CertExamHQ.

   1. A

      Angel123

      2021-04-23

      21 upvotes

      'B' is correct answer according PCNSA Study Guide 2020, p.131 After a packet has been allowed by the Security policy, Security Profiles are used to scan packets for threats, vulnerabilities, viruses, spyware, malicious URLs, data exfiltration, and exploitation software.

   2. N

      nabilzay

      2020-12-13

      15 upvotes

      B is the correct answer, the security policy has to allow the traffic for the security profile to take action

   3. U

      userrandomuser76

      2021-06-16

      6 upvotes

      B is the correct answer, packet must first be allowed by the security policy to go further to security profile

   4. T

      tman1234

      2021-01-09

      4 upvotes

      In the Security Policy Stage, packets must meet all the criteria in a Security policy rule to match the Security policy rule. If all the criteria match, the Security policy rule’s action is applied. If the Security policy action is “allow,” the packet is inspected by the Security Profiles attached to the Security policy rule. If all the Security Profile criteria do not match, or the Security policy is any action other than “allow,” the packet is evaluated against the next Security policy rule, and so on. Answer should be B

7. Question 7 of 25

   Which dynamic update type includes updated anti-spyware signatures?

   • APAN-DB
   • BApplications and Threats
   • CGlobalProtect Data File
   • DAntivirus

   Show answer

   Correct answer: B

   How others answered

   • B100%

   Explanation

   https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/datasheets/education/pcnsa-study-guide.pdf Page 61: Applications and Threats: Includes new and updated application and threat signatures, including those that detect spyware and vulnerabilities.

   Adapted from community discussion by Grandslam · 2023-01-18 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   View community discussion4

   Candidate context

   Question 7 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNSA or CertExamHQ.

   1. G

      Grandslam

      2023-01-18

      Selected B2 upvotes

      https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/datasheets/education/pcnsa-study-guide.pdf Page 61: Applications and Threats: Includes new and updated application and threat signatures, including those that detect spyware and vulnerabilities.

   2. Z

      zeebo340

      2023-03-20

      3 upvotes

      The majority of those updates are covered by Applications and Threat. Answer B https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/threat-prevention/threat-signatures.html

   3. K

      Kvant

      2024-08-03

      2 upvotes

      https://proditpdownloads.paloaltonetworks.com/content/content-8738-8202.html?__token__=exp=1691618403~acl=/content/content-8738-8202.html*~hmac=4638aa60a2e7ac7eccd9e0b29843de985a4046fbc958fd05db5fb28276565d5a

   4. H

      H3kerman

      2022-11-25

      1 upvote

      Antivirus: Includes new and updated antivirus signatures, including WildFire signatures and automatically generated command-and-control (C2) signatures. WildFire signatures detect malware seen first by firewalls from around the world. You must have a Threat Prevention subscription to get these updates. New antivirus signatures are published daily.

8. Question 8 of 25

   Refer to the exhibit. A web server in the DMZ is being mapped to a public address through DNAT.

   

   Which Security policy rule will allow traffic to flow to the web server?

   • AUntrust (any) to DMZ (10.1.1.100), web browsing - Allow
   • BUntrust (any) to Untrust (1.1.1.100), web browsing - Allow
   • CUntrust (any) to Untrust (10.1.1.100), web browsing - Allow
   • DUntrust (any) to DMZ (1.1.1.100), web browsing - Allow

   Show answer

   Correct answer: D

   How others answered

   • D59%
   • A29%

   Only 59% agreed on this answer — treat it as contested rather than settled.

   Explanation

   The given answer D is correct - my previous answers are wrong. There's 2 policies at play here - the security and NAT policy. I thought the question related to the NAT policy - it doesn't - it asks about the security policy.

   Adapted from community discussion by Surfside92 · 2022-10-06 · 8 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   View community discussion4

   Candidate context

   Question 8 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNSA or CertExamHQ.

   1. S

      Surfside92

      2022-10-06

      Selected D8 upvotes

      The given answer D is correct - my previous answers are wrong. There's 2 policies at play here - the security and NAT policy. I thought the question related to the NAT policy - it doesn't - it asks about the security policy.

   2. A

      Aaron_0801

      2023-05-08

      2 upvotes

      Answer is D "It then evaluates and applies any security policies that match the packet based on the original (pre-NAT) source and destination addresses, but the post-NAT zones". https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/networking/nat/nat-policy-rules/nat-policy-overview#:~:text=It%20then%20evaluates%20and%20applies%20any%20security%20policies%20that%20match%20the%20packet%20based%20on%20the%20original%20(pre%2DNAT)%20source%20and%20destination%20addresses%2C%20but%20the%20post%2DNAT%20zones

   3. N

      nolox

      2023-04-13

      Selected D1 upvote

      As @Surfside92 mentioned, according to CBT Nuggets video (watched the same) answer should be B. However, @ntir shared the link which shows literally this situation. I would go with D because it's from PA site.

   4. N

      ntir

      2023-02-13

      1 upvote

      D https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/networking/nat/nat-configuration-examples/destination-nat-exampleone-to-one-mapping#ide8f6a4b3-f875-4855-acb5-5fd9ad918d04

9. Question 9 of 25

   According to the best practices for mission critical devices, what is the recommended interval for antivirus updates?

   • Aby minute
   • Bhourly
   • Cdaily
   • Dweekly

   Show answer

   Correct answer: B

   How others answered

   • B50%
   • C50%

   Only 50% agreed on this answer — treat it as contested rather than settled.

   Explanation

   B New antivirus signatures are published daily But the firewall can check for antivirus updates every hour. 1.6.2 Study guide.

   Adapted from community discussion by Slicklinton · 2024-02-09 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • live.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   View community discussion4

   Candidate context

   Question 9 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNSA or CertExamHQ.

   1. [

      [Removed]

      2024-05-12

      2 upvotes

      This is a tricky question, because is asking about the recommended update interval which following Palo Alto recommendations is 30min to then set the threshold for up to 48h Antivirus updates are released every 24 hours, a lower time recurrence ensures the FW is equipped with the latest updates. according to this link PA recommends update interval of 30min and install threshold of 48h

   2. H

      HuanYu

      2024-12-11

      Selected B1 upvote

      Antivirus content update frequency should be set to hourly recurrence. This is the best practice to protect the firewall from latest know viruses. The action should be download and install to have the new contenet updates installed on the firewall and not just downloaded. https://live.paloaltonetworks.com/t5/best-practice-assessment-device/dynamic-updates-antivirus/ta-p/338194

   3. S

      Slicklinton

      2024-02-09

      Selected B2 upvotes

      B New antivirus signatures are published daily But the firewall can check for antivirus updates every hour. 1.6.2 Study guide.

   4. N

      ntir

      2023-02-15

      2 upvotes

      C https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-upgrade/software-and-content-updates/best-practices-for-app-and-threat-content-updates/best-practices-mission-critical

10. Question 10 of 25

    An address object of type IP Wildcard Mask can be referenced in which part of the configuration?

    • ASecurity policy rule
    • BACC global fitter
    • CNAT address pool
    • Dexternal dynamic list

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    The correct answer is You can use an address object of type IP Wildcard Mask only in a Security policy rule. https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-web-interface-help/objects/objects-addresses IP Wildcard Mas

    Adapted from community discussion by Robert_99 · 2023-09-30 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    View community discussion4

    Candidate context

    Question 10 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNSA or CertExamHQ.

    1. J

       J2J2J2J

       2024-02-02

       Selected A1 upvote

       Answer : A IP Wildcard Mask—Enter an IP wildcard address in the format of an IPv4 address followed by a slash and a mask (which must begin with a zero); for example, 10.182.1.1/0.127.248.0. In the wildcard mask, a zero (0) bit indicates that the bit being compared must match the bit in the IP address that is covered by the 0. A one (1) bit in the mask is a wildcard bit, meaning the bit being compared need not match the bit in the IP address that is covered by the 1. Convert the IP address and the wildcard mask to binary. To illustrate the matching: on binary snippet 0011, a wildcard mask of 1010 results in four matches (0001, 0011, 1001, and 1011).

    2. S

       stickboy

       2023-10-02

       Selected A2 upvotes

       https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-web-interface-help/objects/objects-addresses

    3. A

       ARWANGSH

       2024-01-18

       Selected A2 upvotes

       Wildcard objects can be used only in the Security policy rule.

    4. R

       Robert_99

       2023-09-30

       2 upvotes

       The correct answer is You can use an address object of type IP Wildcard Mask only in a Security policy rule. https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-web-interface-help/objects/objects-addresses IP Wildcard Mas

11. Question 11 of 25

    According to best practices, how frequently should WildFire updates he made to perimeter firewalls?

    • Aevery 10 minutes
    • Bevery minute
    • Cevery 5 minutes
    • Din real time

    Show answer

    Correct answer: D

    How others answered

    • D83%
    • B17%

    Explanation

    https://docs.paloaltonetworks.com/wildfire/9-1/wildfire-admin/wildfire-deployment-best-practices/wildfire-best-practices If you are running PAN-OS 10.0 or later, configure your firewall to retrieve WildFire signatures in real-time. This provides access to newly-discovered malware signatures as soon as the WildFire public cloud can generate them, thereby preventing successful attacks by minimizing your exposure time to malicious activity.

    Adapted from community discussion by Najmmm · 2022-10-31 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    View community discussion4

    Candidate context

    Question 11 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNSA or CertExamHQ.

    1. N

       Najmmm

       2022-10-31

       Selected D3 upvotes

       https://docs.paloaltonetworks.com/wildfire/9-1/wildfire-admin/wildfire-deployment-best-practices/wildfire-best-practices If you are running PAN-OS 10.0 or later, configure your firewall to retrieve WildFire signatures in real-time. This provides access to newly-discovered malware signatures as soon as the WildFire public cloud can generate them, thereby preventing successful attacks by minimizing your exposure time to malicious activity.

    2. J

       Jallic

       2024-10-11

       Selected D2 upvotes

       https://docs.paloaltonetworks.com/advanced-wildfire/administration/advanced-wildfire-overview/advanced-wildfire-subscription "If you are running PAN-OS 10.0 or later, it is a best practice to use real-time Advanced WildFire updates instead of scheduling recurring updates."

    3. [

       [Removed]

       2024-03-12

       1 upvote

       D If you are running PAN-OS 10.0 or later, configure your firewall to retrieve Advanced WildFire signatures in real-time. This provides access to newly-discovered malware signatures as soon as the Advanced WildFire public cloud can generate them, thereby preventing successful attacks by minimizing your exposure time to malicious activity.

    4. B

       baccalacca

       2023-03-15

       1 upvote

       https://docs.paloaltonetworks.com/wildfire/u-v/wildfire-whats-new/wildfire-features-in-panos-100/wildfire-real-time-signature-updates answer - real time

12. Question 12 of 25

    Your company is highly concerned with their intellectual property being accessed by unauthorized resources. There is a mature process to store and include metadata tags for all confidential documents. Which Security profile can further ensure that these documents do not exit the corporate network?

    • AFile Blocking
    • BData Filtering
    • CAnti-Spyware
    • DURL Filtering

    Show answer

    Correct answer: B

    How others answered

    • B100%

    Explanation

    Use Data Filtering profiles to prevent sensitive, confidential, and proprietary information from leaving your network. Predefined patterns, built-in settings, and customizable options make it easy for you to protect files that contain certain file properties (such as a document title or author), credit card numbers, regulated information from different countries (like social security numbers), and third-party data loss prevention (DLP) labels. https://docs.paloaltonetworks.com/network-security/security-policy/security-profiles/security-profile-data-filtering

    Adapted from community discussion by awtsuritacuna · 2024-09-13 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    View community discussion4

    Candidate context

    Question 12 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNSA or CertExamHQ.

    1. V

       Vijay_75

       2023-12-08

       Selected B5 upvotes

       https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-web-interface-help/objects/objects-security-profiles-data-filtering

    2. A

       awtsuritacuna

       2024-09-13

       Selected B2 upvotes

       Use Data Filtering profiles to prevent sensitive, confidential, and proprietary information from leaving your network. Predefined patterns, built-in settings, and customizable options make it easy for you to protect files that contain certain file properties (such as a document title or author), credit card numbers, regulated information from different countries (like social security numbers), and third-party data loss prevention (DLP) labels. https://docs.paloaltonetworks.com/network-security/security-policy/security-profiles/security-profile-data-filtering

    3. D

       DlaEdu_Ex

       2024-02-11

       Selected B3 upvotes

       Use Data Filtering Profiles to prevent sensitive, confidential, and proprietary information from leaving your network. https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/threat-prevention/set-up-data-filtering

    4. J

       J2J2J2J

       2024-01-31

       Selected B2 upvotes

       Answer : B Data filtering enables the firewall to detect sensitive information—such as credit card or social security numbers or internal corporate documents—and prevent this data from leaving a secure network.

13. Question 13 of 25

    How many levels can there be in a device-group hierarchy, below the shared level?

    • A2
    • B3
    • C4
    • D5

    Show answer

    Correct answer: C

    How others answered

    • C100%

    Explanation

    Answer : C You can Create a Device Group Hierarchy to nest device groups in a tree hierarchy of up to four levels, with lower-level groups inheriting the settings (policy rules and objects) of higher-level groups. https://docs.paloaltonetworks.com/panorama/9-1/panorama-admin/panorama-overview/centralized-firewall-configuration-and-update-management/device-groups/device-group-hierarchy

    Adapted from community discussion by J2J2J2J · 2023-08-02 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    View community discussion4

    Candidate context

    Question 13 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNSA or CertExamHQ.

    1. J

       J2J2J2J

       2023-08-02

       Selected C2 upvotes

       Answer : C You can Create a Device Group Hierarchy to nest device groups in a tree hierarchy of up to four levels, with lower-level groups inheriting the settings (policy rules and objects) of higher-level groups. https://docs.paloaltonetworks.com/panorama/9-1/panorama-admin/panorama-overview/centralized-firewall-configuration-and-update-management/device-groups/device-group-hierarchy

    2. T

       TheGames

       2024-04-16

       Selected C2 upvotes

       You can Create a Device Group Hierarchy to nest device groups in a tree hierarchy of up to four levels https://docs.paloaltonetworks.com/panorama/11-0/panorama-admin/panorama-overview/centralized-firewall-configuration-and-update-management/device-groups/device-group-hierarchy

    3. D

       DatITGuyTho1337

       2023-10-04

       2 upvotes

       I picked the wrong answer (D), but the correct answer to this question is C. The question asks how many levels there are BELOW the "Shared" level, so 4 levels is correct. Technically there can be a total of 5 levels.

    4. O

       OhEmGee

       2023-08-05

       Selected C1 upvote

       https://docs.paloaltonetworks.com/panorama/10-2/panorama-admin/panorama-overview/centralized-firewall-configuration-and-update-management/device-groups/device-group-hierarchy

14. Question 14 of 25

    Select 3

    Within the WildFire Analysis profile, which three items are configurable? (Choose three.)

    • AFileType
    • BDirection
    • CService
    • DApplication
    • EObjects

    Show answer

    Correct answer: A, B, D

    How others answered

    • ABD100%

    Explanation

    Use a WildFire Analysis profile to specify for WildFire file analysis to be performed locally on the WildFire appliance or in the WildFire cloud. You can specify traffic to be forwarded to the public cloud or private cloud based on file type, application, or the transmission direction of the file (upload or download). After creating a WildFire analysis profile, adding the profile to a policy (PoliciesSecurity) further allows you apply the profile settings to any traffic matched to that policy (for example, a URL category defined in the policy). https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-web-interface-help/objects/objects-security-profiles-wildfire-analysis

    Adapted from community discussion by DlaEdu_Ex · 2023-09-03 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    View community discussion4

    Candidate context

    Question 14 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNSA or CertExamHQ.

    1. F

       fb48

       2023-08-25

       10 upvotes

       ABD Objects > Security Profiles > Wildfire Analysis You have 4 options: Applications File Types Direction Analysis

    2. D

       DlaEdu_Ex

       2023-09-03

       Selected A, B, D3 upvotes

       Use a WildFire Analysis profile to specify for WildFire file analysis to be performed locally on the WildFire appliance or in the WildFire cloud. You can specify traffic to be forwarded to the public cloud or private cloud based on file type, application, or the transmission direction of the file (upload or download). After creating a WildFire analysis profile, adding the profile to a policy (PoliciesSecurity) further allows you apply the profile settings to any traffic matched to that policy (for example, a URL category defined in the policy). https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-web-interface-help/objects/objects-security-profiles-wildfire-analysis

    3. B

       baccalacca

       2023-09-18

       3 upvotes

       abd https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-web-interface-help/objects/objects-security-profiles-wildfire-analysis

    4. K

       Kvant

       2024-02-08

       Selected A, B, D2 upvotes

       https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-web-interface-help/objects/objects-security-profiles-wildfire-analysis

15. Question 15 of 25

    Which interface types are assigned to IEEE 802.1Q VLANs?

    • ATunnel interfaces
    • BLayer 2 subinterfaces
    • CLayer 3 subinterfaces
    • DLoopback interfaces

    Show answer

    Correct answer: B

    How others answered

    • B83%
    • C17%

    Explanation

    According to https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-web-interface-help/network/network-interfaces Both B and C are possibilities, but my CCNA kneejerk reaction would choose B. However, since you can do it at layer 3 (for the same money, "everything" layer 3 was more expensive in the past) and layer 2 is more vulnerable... . TBH this question should have a "choose two" option because neither can be excluded definetively.

    Adapted from community discussion by Blender808 · 2023-09-27 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    View community discussion4

    Candidate context

    Question 15 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNSA or CertExamHQ.

    1. D

       Darude

       2023-05-15

       Selected B4 upvotes

       B IEEE 802.1Q is a standard for VLAN tagging in Ethernet networks. In Cisco IOS, VLANs are typically assigned to Layer 2 subinterfaces, which are logical interfaces that allow a physical interface to be divided into multiple virtual interfaces. Each Layer 2 subinterface can be assigned a unique VLAN ID, allowing traffic to be separated and managed based on VLAN membership.

    2. B

       Blender808

       2023-09-27

       Selected B3 upvotes

       According to https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-web-interface-help/network/network-interfaces Both B and C are possibilities, but my CCNA kneejerk reaction would choose B. However, since you can do it at layer 3 (for the same money, "everything" layer 3 was more expensive in the past) and layer 2 is more vulnerable... . TBH this question should have a "choose two" option because neither can be excluded definetively.

    3. S

       Sanjug2022

       2023-07-02

       4 upvotes

       Accordently "https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-web-interface-help/network/network-interfaces/layer-3-subinterface#id5604fdd4-bce9-430d-a111-52372ecc194b" Correct Answer is C. You can create a Layer 3 subinterface for a PPPoE client for IEEE 802.1Q VLAN

    4. M

       mstecnologia

       2023-08-25

       4 upvotes

       I think it's B. Checked on the FW right now. The question says ASSIGNED so when you Add a Layer 2 Subinterface, there is an option at the bottom "Assign Interface to" and have a VLAN field. In a Layer 3 Subinterface doesn't.

16. Question 16 of 25

    Select 2

    What are three DNS policy actions? (Choose three.)

    • ABlock
    • BAllow
    • CStrict
    • DSinkhole
    • EAlert

    Show answer

    Correct answer: A, B

    How others answered

    • AB75%
    • AD25%

    Explanation

    ABDE Policy Action Choose an action to take when DNS lookups are made to known malware sites. The options are alert, allow, block, or sinkhole. The default action for Palo Alto Networks DNS signatures is sinkhole. https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-web-interface-help/objects/objects-security-profiles-anti-spyware-profile

    Adapted from community discussion by DlaEdu_Ex · 2023-06-15 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    View community discussion4

    Candidate context

    Question 16 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNSA or CertExamHQ.

    1. D

       DlaEdu_Ex

       2023-06-15

       4 upvotes

       ABDE Policy Action Choose an action to take when DNS lookups are made to known malware sites. The options are alert, allow, block, or sinkhole. The default action for Palo Alto Networks DNS signatures is sinkhole. https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-web-interface-help/objects/objects-security-profiles-anti-spyware-profile

    2. A

       Aredus

       2024-03-22

       3 upvotes

       In the DNS policies tab of the Anti-Spyware Security profile, there are 4 policy actions: default, allow, block and sinkhole. Therefore A, B and D is correct

    3. Z

       Zeruz

       2023-08-03

       Selected A, B2 upvotes

       A, B, D, and E are viable options according to this link: https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/threat-prevention/dns-security/enable-dns-security

    4. H

       hackeryorch

       2024-06-20

       2 upvotes

       Enable DNS Security --> https://docs.paloaltonetworks.com/dns-security/administration/configure-dns-security/enable-dns-security "Select an action to be taken when DNS lookups are made to known malware sites for the DNS Security signature source. The options are default, allow, block, or sinkhole. Verify that the action is set to sinkhole." A,B and D

17. Question 17 of 25

    Select 2

    Which two security profile types can be attached to a security policy? (Choose two.)

    • Aantivirus
    • BDDoS protection
    • Cthreat
    • Dvulnerability

    Show answer

    Correct answer: A, D

    How others answered

    • AD100%

    Explanation

    Under Policy -> Action -> Profile Setting, you can see the below options: Antivirus, Vulnerability Protection, Anti-Spyware, URL Filtering, File blocking, Data Filtering and Wildfire Analysis.

    Adapted from community discussion by ZZL · 2022-10-28 · 8 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    View community discussion4

    Candidate context

    Question 17 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNSA or CertExamHQ.

    1. W

       webmanau

       2022-04-26

       14 upvotes

       A and D. Threat is just the superset and DDos cannot be applied to a security rule. That needs a DDoS Protection rule

    2. Z

       ZZL

       2022-10-28

       8 upvotes

       Under Policy -> Action -> Profile Setting, you can see the below options: Antivirus, Vulnerability Protection, Anti-Spyware, URL Filtering, File blocking, Data Filtering and Wildfire Analysis.

    3. D

       dawlims

       2023-01-05

       Selected A, D3 upvotes

       Should be A & D. https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/policy/security-profiles.html

    4. A

       AJH

       2022-02-16

       2 upvotes

       A and B https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/policy/security-profiles

18. Question 18 of 25

    Select 2

    Which two features implement one-to-one translation of a source IP address while allowing the source port to change? (Choose two.)

    • ADynamic IP
    • BDynamic IP and Port (DIPP)
    • CStatic IP
    • DDynamic IP / Port Fallback

    Show answer

    Correct answer: B, D

    How others answered

    • BD60%
    • AC40%

    Only 60% agreed on this answer — treat it as contested rather than settled.

    Explanation

    There is a table at URL below that has a column on whether the source port changes. With DIPP the source port changes and same with Fallback. https://live.paloaltonetworks.com/twzvq79624/attachments/twzvq79624/members_discuss/15121/1/TechNote_UnderstandingNAT.pdf

    Adapted from community discussion by Kaifus · 2023-12-11 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • live.paloaltonetworks.com documentation

    View community discussion4

    Candidate context

    Question 18 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNSA or CertExamHQ.

    1. L

       liliap

       2023-11-01

       Selected B, D5 upvotes

       DIPP https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-networking-admin/nat/configure-nat/translate-internal-client-ip-addresses-to-your-public-ip-address-source-dipp-nat Fallback Port https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRMCA0

    2. J

       jayessarre

       2023-11-02

       4 upvotes

       A and C. Both does 1:1 ip translation, allowing source port to change. DIPP is 1:Many

    3. C

       cjace

       2024-05-24

       2 upvotes

       A. Dynamic IP123 D. Dynamic IP / Port Fallback2 Dynamic IP allows the one-to-one, dynamic translation of a source IP address only (no port number) to the next available address in the NAT address pool123. The size of the NAT pool should be equal to the number of internal hosts that require address translations23. Dynamic IP / Port Fallback is an advanced option in Dynamic IP that enables the use of Dynamic IP and Port (DIPP) addresses when necessary

    4. K

       Kaifus

       2023-12-11

       1 upvote

       From the Palo Alto website: • Dynamic IP/Port (DIPP): used for outbound traffic; multiple clients can use the same public IP address(es) with different source port numbers • Dynamic IP: used for outbound traffic; private source addresses translate to the next available address in a range • Static IP: used for inbound or outbound traffic; can be used to change the source or the destination IP address, with the source or destination port unchanged. When used to map a single public IP address to multiple private servers and services, destination ports can stay the same or be directed to different destination ports.

19. Question 19 of 25

    Which user mapping method could be used to discover user IDs in an environment with multiple Windows domain controllers?

    • AActive Directory monitoring
    • BWindows session monitoring
    • CWindows client probing
    • Ddomain controller monitoring

    Show answer

    Correct answer: D

    How others answered

    • D71%
    • A29%

    Only 71% agreed on this answer — treat it as contested rather than settled.

    Explanation

    A is correct. In an AD environment, you can configure the User-ID agent to monitor the security logs for Kerberos ticket grants or renewals, Exchange server access (if configured), and file and print service connections. For these events to be recorded in the security log, the AD domain must be configured to log successful account login events. In addition, because users can log in to any of the servers in the domain, you must set up server monitoring for all servers to capture all user login events. https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/user-id/user-id-concepts/user-mapping/server-monitoring.html#id89aad143-05b8-4805-8e7c-b123994edd30

    Adapted from community discussion by Cyril_the_Squirl · 2022-04-27 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    View community discussion4

    Candidate context

    Question 19 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNSA or CertExamHQ.

    1. L

       LordScorpius

       2022-09-28

       Selected D6 upvotes

       "A" sounds so correct until you sit back and think, "Active Directory" isn't a thing on a LAN or WAN. It's an LDAP running on multiple domain controllers. "Monitor AD" isn't really a thing. Monitor Domain Controllers is.

    2. D

       DC787

       2021-06-06

       5 upvotes

       D To ensure the most comprehensive mapping of users, you must monitor all domain controllers that process authentication for users you want to map. You might need to install multiple User-ID agents to efficiently monitor all of your resources.

    3. C

       Cyril_the_Squirl

       2022-04-27

       3 upvotes

       A is correct. In an AD environment, you can configure the User-ID agent to monitor the security logs for Kerberos ticket grants or renewals, Exchange server access (if configured), and file and print service connections. For these events to be recorded in the security log, the AD domain must be configured to log successful account login events. In addition, because users can log in to any of the servers in the domain, you must set up server monitoring for all servers to capture all user login events. https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/user-id/user-id-concepts/user-mapping/server-monitoring.html#id89aad143-05b8-4805-8e7c-b123994edd30

    4. B

       BMRobertson

       2023-08-05

       1 upvote

       IDK, take a look at this link: https://www.routeprotocol.com/palo-altro-edu-110-user-id/....my question is, why don't we find Active Directory Monitoring at all in the studyguide? I do find this: In terms of Domain Controllers User-ID, When a user logs into their laptop, which is an Active Directory member, the AD domain controller logs a logon event with the username and IP address of the station." Again, not sure but you won't find "AD monitoring as a term/phrase anywhere (at least that I've found). For that reason I'd go with D.

20. Question 20 of 25

    Select 2

    Which two configuration settings shown are not the default? (Choose two.)

    

    • AEnable Security Log
    • BServer Log Monitor Frequency (sec)
    • CEnable Session
    • DEnable Probing

    Show answer

    Correct answer: B, C

    How others answered

    • BC67%
    • CD25%

    Only 67% agreed on this answer — treat it as contested rather than settled.

    Explanation

    I think correct answers are C and D C --> Do not Enable Session. This setting requires that the User-ID agent have an Active Directory account with Server Operator privileges so that it can read all user sessions. D --> Do not enable client probing on high-security networks. Do not enable client probing on external untrusted interfaces. https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-web-interface-help/user-identification/device-user-identification-user-mapping/user-id-agent-setup/user-id-agent-setup-server-monitoring.html https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-web-interface-help/user-identification/device-user-identification-user-mapping/user-id-agent-setup/user-id-agent-setup-client-probing.html

    Adapted from community discussion by ichnos · 2020-04-27 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    View community discussion4

    Candidate context

    Question 20 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNSA or CertExamHQ.

    1. O

       Outlaw87

       2020-04-28

       22 upvotes

       B & C true answers. By default - Server Log Monitor Frequency (sec) - 2 By default - Enable Session - disabled

    2. I

       ichnos

       2020-04-27

       3 upvotes

       I think correct answers are C and D C --> Do not Enable Session. This setting requires that the User-ID agent have an Active Directory account with Server Operator privileges so that it can read all user sessions. D --> Do not enable client probing on high-security networks. Do not enable client probing on external untrusted interfaces. https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-web-interface-help/user-identification/device-user-identification-user-mapping/user-id-agent-setup/user-id-agent-setup-server-monitoring.html https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-web-interface-help/user-identification/device-user-identification-user-mapping/user-id-agent-setup/user-id-agent-setup-client-probing.html

    3. R

       Rowdy_47

       2021-09-16

       4 upvotes

       Correct answers are B and C The incorrect 2 below with their default settings Server Log Monitor Frequency (sec) 2 Enable Session - off / unchecked Screengrabed the default settings for PAN OS 10 from CBT nuggets course with Keith Barker

    4. E

       error_909

       2022-03-18

       Selected B, C3 upvotes

       By default - Server Log Monitor Frequency (sec) - 2 By default - Enable Session - disabled

21. Question 21 of 25

    Which URL Filtering Profile action does not generate a log entry when a user attempts to access a URL?

    • AOverride
    • BAllow
    • CBlock
    • DContinue

    Show answer

    Correct answer: B

    How others answered

    • B100%

    Explanation

    I wanted to update the url for the source of the answer: https://docs.paloaltonetworks.com/advanced-url-filtering/administration/url-filtering-basics/url-filtering-profiles " allow: The website is allowed and no log entry is generated. NOTE: Don’t set allow as the Action for categories of traffic you don’t block because you lose visibility into traffic you don’t log. Instead, set alert as the Action for categories of traffic you don’t block to log and provide visibility into the traffic. "

    Adapted from community discussion by [Removed] · 2024-09-05 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    View community discussion4

    Candidate context

    Question 21 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNSA or CertExamHQ.

    1. [

       [Removed]

       2024-09-05

       Selected B2 upvotes

       I wanted to update the url for the source of the answer: https://docs.paloaltonetworks.com/advanced-url-filtering/administration/url-filtering-basics/url-filtering-profiles " allow: The website is allowed and no log entry is generated. NOTE: Don’t set allow as the Action for categories of traffic you don’t block because you lose visibility into traffic you don’t log. Instead, set alert as the Action for categories of traffic you don’t block to log and provide visibility into the traffic. "

    2. Y

       yub16

       2023-06-04

       3 upvotes

       correct answer is B "allow traffic destined for that URL category; allowed traffic is not logged." https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/url-filtering/configure-url-filtering.html

    3. K

       Kane002

       2023-04-25

       1 upvote

       I believe that both for Continue and Override a log entry is not generated unless the user persists to actually go to the website, nevertheless, Allow is the best answer.

    4. Z

       ZZL

       2023-04-29

       1 upvote

       It should be B - ALLOW. If you read the below url, and it's clear only Allow will not generate any log.

22. Question 22 of 25

    Which path in PAN-OS 9.0 displays the list of port-based security policy rules?

    • APolicies> Security> Rule Usage> No App Specified
    • BPolicies> Security> Rule Usage> Port only specified
    • CPolicies> Security> Rule Usage> Port-based Rules
    • DPolicies> Security> Rule Usage> Unused Apps

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    All the options are wrong : the correct path is :::::: Policies ---- Security -------- Policy Optimizer ------------ No Apps Specified

    Adapted from community discussion by deepu · 2021-08-14 · 27 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    View community discussion4

    Candidate context

    Question 22 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNSA or CertExamHQ.

    1. D

       deepu

       2021-08-14

       27 upvotes

       All the options are wrong : the correct path is :::::: Policies ---- Security -------- Policy Optimizer ------------ No Apps Specified

    2. R

       redgi0

       2024-07-28

       10 upvotes

       OUTDATED QUESTION : answer for PAN11 is : Policies> Security> Policy Optimizer> Rules Without App Controls

    3. S

       sid_2020

       2021-02-27

       8 upvotes

       Yes, https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/app-id/security-policy-rule-optimization/migrate-port-based-to-app-id-based-security-policy-rules.html

    4. J

       johnhue

       2022-08-13

       7 upvotes

       In PanOS 10 it should be: Policies ---- Security -------- Policy Optimizer ------------ Rules without App Controls https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-web-interface-help/policies/policies-security/security-policy-rule-usage.html No App Specified—Rules that have the application set to any, so you can identify port-based rules to convert to application-based rules.

23. Question 23 of 25

    Select 2

    Actions can be set for which two items in a URL filtering security profile? (Choose two.)

    • ABlock List
    • BCustom URL Categories
    • CPAN-DB URL Categories
    • DAllow List

    Show answer

    Correct answer: B, C

    How others answered

    • BC90%

    Explanation

    Ans is B and C. Look at the wording of the question: "ACTIONS(eg Block, Allow etc) can be set for WHICH TWO ITEMS in a URL filtering security profile?" The question is NOT worded like: "WHAT Actions can be set for items in a URL filtering security profile?" Hence the correct answers are B & C.

    Adapted from community discussion by CiscoSannin · 2020-10-09 · 35 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    View community discussion4

    Candidate context

    Question 23 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNSA or CertExamHQ.

    1. C

       CiscoSannin

       2020-10-09

       35 upvotes

       Ans is B and C. Look at the wording of the question: "ACTIONS(eg Block, Allow etc) can be set for WHICH TWO ITEMS in a URL filtering security profile?" The question is NOT worded like: "WHAT Actions can be set for items in a URL filtering security profile?" Hence the correct answers are B & C.

    2. R

       rebet

       2020-01-28

       11 upvotes

       I believe B & C are the correct answers. Starting from panos v.9 url override (that's where allow and deny lists were) is removed from the url profile and only categories are used...

    3. R

       Rasta2

       2021-01-09

       5 upvotes

       The correct answers are B and C . The questions asks on WHICH CATEGORIES can you apply the actions ( allow,block etc) https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-new-features/content-inspection-features/url-filtering-multi-category.html

    4. D

       DilT

       2020-12-10

       1 upvote

       Actions here are "Block List and Allow List". The two items are in URL security profiles are "Custom URL Categories and PAN-DB URL Categories" Questions is " Actions can be set for which two items in a URL filtering security profile? " So the according to the question the correct answer should be B and C since its asking which profiles the actions can be set. Reference URL Filtering Categories - https://docs.paloaltonetworks.com/pan-Aos/9-0/pan-os-web-interface-help/objects/objects-security-profiles-url-filtering/url-filtering-categories URL Filtering Profile Actions - https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/url-filtering/url-filtering-concepts/url-filtering-profile-actions

24. Question 24 of 25

    Select 2

    Which two statements are true for the DNS Security service introduced in PAN-OS version 9.0? (Choose two.)

    • AIt is automatically enabled and configured.
    • BIt eliminates the need for dynamic DNS updates.
    • CIt functions like PAN-DB and requires activation through the app portal.
    • DIt removes the 100K limit for DNS entries for the downloaded DNS updates.

    Show answer

    Correct answer: B, C

    How others answered

    • BC46%
    • CD29%
    • BD25%

    Only 46% agreed on this answer — treat it as contested rather than settled.

    Explanation

    C & D are Correct. - https://live.paloaltonetworks.com/t5/blogs/pan-os-9-0-dns-security-and-content-inspection/ba-p/249812 ---Deals with 100K limit - https://docs.paloaltonetworks.com/threat-prevention ---Deals with DNS Security feature and how to buy and activate it.

    Adapted from community discussion by Cyril_the_Squirl · 2021-10-27 · 15 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • live.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    View community discussion4

    Candidate context

    Question 24 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNSA or CertExamHQ.

    1. C

       Cyril_the_Squirl

       2021-10-27

       15 upvotes

       C & D are Correct. - https://live.paloaltonetworks.com/t5/blogs/pan-os-9-0-dns-security-and-content-inspection/ba-p/249812 ---Deals with 100K limit - https://docs.paloaltonetworks.com/threat-prevention ---Deals with DNS Security feature and how to buy and activate it.

    2. D

       drogadotcom

       2023-04-10

       Selected B, C8 upvotes

       According to PCNSA Study guide of PanOS 11 (Jan 2023 version) Pag 96: "Licenses are activated from the Palo Alto Networks Customer Support Portal and must be active before DNS analysis can take place" So, that's exclude A and make correct the second statement of C; also the first statement seems correct. For what concerning D, I think it is not correct. From https://docs.paloaltonetworks.com/dns-security/administration/about-dns-security/cloud-delivered-dns-signatures "Locally available, downloadable DNS signature sets (packaged with the antivirus and WildFire updates) come with a hard-coded capacity limitation of 100k signatures"; this means that the limit for DNS downloaded from DNS updates is the same since it is hard-coded even after its activation. Infact, as answer B says, It is a system that resolve the limitation by eliminating the need for dynamic DNS updates. D would have been correct if they had substituted the word "removes" with "resolves".

    3. T

       t_h_t_f

       2022-11-01

       4 upvotes

       Correctly answer should be B & C D is incorrect. the downloaded DNS updates still have 100k limitation hardcoded, the new DNS security cloud service doesn't "remove" the 100K limit for DNS entries for the downloaded DNS updates. https://live.paloaltonetworks.com/t5/blogs/pan-os-9-0-dns-security-and-content-inspection/ba-p/249812 "New DNS protections are generated by using this C2 prevention service and is distributed by the cloud without the limitations of the downloadable DNS signature sets, which come with a hard-coded capacity limitation of 100k signatures. " https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/threat-prevention/dns-security/cloud-delivered-dns-signatures ”downloadable DNS signature sets (packaged with the antivirus and WildFire updates) come with a hard-coded capacity limitation of 100k signatures“

    4. A

       aleco

       2021-03-11

       4 upvotes

       Hi! A is incorrect as you have manually activate it in the Antispyware profile B maybe is correct as there is no need for DNS updates. In fact every lookup goes into the cloud: "the cloud-based signature database provides users with instant access to newly added DNS signatures without the need to download updates" C yes you have to activate it but I don't know what app portal is. D I disagree with it because you can still download DNS pack for faster lookups: " Locally available, downloadable DNS signature sets (packaged with the antivirus and WildFire updates) come with a hard-coded capacity limitation of 100k signatures and do not include signatures generated through advanced analysis" Any other help? Does it make sens?

25. Question 25 of 25

    Select 2

    Which two features can be used to tag a username so that it is included in a dynamic user group? (Choose two.)

    • AGlobalProtect agent
    • BXML API
    • CUser-ID Windows-based agent
    • Dlog forwarding auto-tagging

    Show answer

    Correct answer: B, D

    How others answered

    • BD56%
    • BC44%

    Only 56% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Correct options should be B and C: To dynamically register tags, you can use: - the XML API - the User-ID agent - Panorama - the web interface on the firewall https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-new-features/user-id-features/dynamic-user-groups

    Adapted from community discussion by nabilzay · 2020-12-13 · 34 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    View community discussion4

    Candidate context

    Question 25 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNSA or CertExamHQ.

    1. N

       nabilzay

       2020-12-13

       34 upvotes

       Correct options should be B and C: To dynamically register tags, you can use: - the XML API - the User-ID agent - Panorama - the web interface on the firewall https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-new-features/user-id-features/dynamic-user-groups

    2. O

       OhEmGee

       2023-02-04

       6 upvotes

       B and D are the answers. See the text from PCNSE Study Guide: Several methods are available to tag or untag usernames. As shown in the following screenshot (in the book), you can manually tag and untag usernames by using the web interface. Usernames can also be tagged and untagged by using the auto-tagging feature in a Log Forwarding Profile. (NOTE: I have practically done both.). You also can program another utility to invoke the PAN-OS XML API commands to tag or untag usernames. (NOTE: I've not tried XML API myself tho.

    3. O

       olexx

       2022-03-26

       4 upvotes

       In the Palo Alto trainings they mention two ways to populate dynamic user group (DUG): 1. XML API 2. Log forwarding auto-tagging In other words, how would you automatically include tagged usernames using Panorama or Web interface?! - The answer is, you do that through defining a filter & an action in Dynamic user groups, followed by Log forwarding configuration, if you don't activate the log forwarding auto-tagging in the security policy, then the Dynamic user group (DUG) will NOT be populated....you can test it yourself in any Palo Alto firewall. Without 'Log forwarding auto-tagging' attached to your security policy, the defined log filter & it's action in DUG will NOT forward any recognised username - which matches the predefined filter & action - to the dynamic user group So the answer is B & D

    4. N

       nuWat

       2022-10-16

       4 upvotes

       Its B and D, "You can manually tag and untag usernames using the web interface. Usernames can also be tagged and untagged by using the auto-tagging feature in a log forwarding profile or by programming another utility to invoke PAN-OS XML API commands. " Got this from a file called EDU-210-10.1a-M12-UserID-1.pdf which is can be access in the EDU-210 training course.

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNSA practice, question 1 of 25