Question 101 · 407 in bank
Which Palo Alto Networks component provides consolidated policy creation?
Show answer
Answer: D
Palo Alto Networks Certified Network Security Administrator407 questions across 41 pages are complete and free, with no account or card.
407 questions in this bank
Free access · progress saved on this device
Which Palo Alto Networks component provides consolidated policy creation?
Answer: D
An administrator needs to create a Security policy rule that matches DNS traffic within the LAN zone, and also needs to match DNS traffic within the DMZ zone. The administrator does not want to allow traffic between the DMZ and LAN zones. Which Security policy rule type should they use?
Answer: B
Intrazone: A security policy allowing traffic between the same zone, this applies the rule to all matching traffic within the specified source zones (cannot specify a destination zone for intrazone rules). For example, if setting the source zone to A and B, the rule would apply to all traffic within zone A and all traffic within zone B, but not to traffic between zones A and B.
Source: Adapted from community discussion — TheMaster01
According to best practices, how frequently should WildFire updates he made to perimeter firewalls?
Answer: D
https://docs.paloaltonetworks.com/wildfire/9-1/wildfire-admin/wildfire-deployment-best-practices/wildfire-best-practices If you are running PAN-OS 10.0 or later, configure your firewall to retrieve WildFire signatures in real-time. This provides access to newly-discovered malware signatures as soon as the WildFire public cloud can generate them, thereby preventing successful attacks by minimizing your exposure time to malicious activity.
Source: Adapted from community discussion — Najmmm
Which solution is a viable option to capture user identification when Active Directory is not in use?
Answer: D
CIE is dependent upon on-prem AD or Cloud Azure AD. https://docs.paloaltonetworks.com/cloud-identity/cloud-identity-engine-getting-started/get-started-with-the-cloud-identity-engine/learn-about-the-cloud-identity-engine#id3f7f173a-ab4b-4040-b82e-86944d8b769b The components of the Cloud Identity Engine deployment vary based on whether the Cloud Identity Engine is accessing an on-premises directory (such as Active Directory) or a cloud-based directory (such as Azure Active Directory). There is nothing like Authn portal on PA, its actually Captive Portal. If we go word-by-word then CIE is the answer otherwise Authn Portal is. Very ambiguous question.
Source: Adapted from community discussion — OhEmGee
What allows a security administrator to preview the Security policy rules that match new application signatures?
Answer: D
If using group mapping with Active Directory Universal Groups, what must you do when configuring the User ID?
Answer: C
Answer : C https://docs.paloaltonetworks.com/best-practices/10-1/user-id-best-practices/user-id-best-practices/user-id-best-practices-for-group-mapping If you have Universal Groups, create an LDAP server profile to connect to the root domain of the Global Catalog server on port 3268 or 3269 for SSL.
Source: Adapted from community discussion — J2J2J2J
Which plane on a Palo Alto Networks Firewall provides configuration, logging, and reporting functions on a separate processor?
Answer: A
What are two differences between an implicit dependency and an explicit dependency in App-ID? (Choose two.)
Answer: AD
"He knew implicitly without having to ask". "She produced a long list of verbal explicative." "I trust you implicitly". "Clicking the button produces the explicit result".
Source: Adapted from community discussion — LordScorpius
An administrator needs to add capability to perform real time signature lookups to block or sinkhole all known malware domains. Which type of single, unified engine will get this result?
Answer: A
Content-IDTM combines a real-time threat prevention engine with a comprehensive URL database and elements of application identification to limit unauthorized data and file transfers and detect and block a wide range of exploits, malware, dangerous web surfing as well as targeted and unknown threats. https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/tech-briefs/techbrief-content-id.pdf
Source: Adapted from community discussion — mushi4ka
Which action would an administrator take to ensure that a service object will be available only to the selected device group?
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
PCNSA practice, question 101. 407 questions available.
Version 1.0.0. How we source questions