Question 111 · 407 in bank
Which built-in IP address EDL would be useful for preventing traffic from IP addresses that are verified as unsafe based on WildFire analysis, Unit 42 research, and data gathered from telemetry?
Palo Alto Networks Certified Network Security Administrator407 questions across 41 pages are complete and free, with no account or card.
407 questions in this bank
Free access · progress saved on this device
Which built-in IP address EDL would be useful for preventing traffic from IP addresses that are verified as unsafe based on WildFire analysis, Unit 42 research, and data gathered from telemetry?
An administrator would like to determine the default deny action for the application dns-over-https. Which action would yield the information?
Answer: D
Deny : Blocks traffic and enforces the default ”deny” action defined for the application that is being denied. To view the default “deny” action defined for an application, display the application details in Objects > Applications [Palo Alto Networks]
Source: Adapted from community discussion — mecacig953
Access to which feature requires a URL Filtering license?
Answer: A
What is the main function of the Test Policy Match function?
Answer: C
Test the policy rules in your running configuration to ensure that your policies appropriately allow and deny traffic and access to applications and websites in compliance with your business needs and requirements. https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/policy/test-policy-rule-traffic-matches
Source: Adapted from community discussion — mushi4ka
Which attribute can a dynamic address group use as a filtering condition to determine its membership?
Answer: B
What are the three DNS Security categories available to control DNS traffic? (Choose three.)
Answer: ADE
What are three valid information sources that can be used when tagging users to dynamic user groups? (Choose three.)
Answer: ABC
ABC: https://docs.paloaltonetworks.com/best-practices/10-1/user-id-best-practices/user-id-best-practices/user-id-best-practices-for-dynamic-user-groups Identity the user information sources for the tags: Firewall logs For Authentication, Data, Threat, Traffic, Tunnel Inspection, URL, and WildFire logs, create a log forwarding profile and use the Built-In Actions. For User-ID, HIP Match, GlobalProtect, and IP-Tag logs, configure the log settings. Cortex XSOAR Security Information and Event Management Systems (SIEMS), such as Splunk Custom API scripts
Source: Adapted from community discussion — BC1c1c
Recently changes were made to the firewall to optimize the policies and the security team wants to see if those changes are helping. What is the quickest way to reset the hit counter to zero in all the security policy rules?
Answer: D
D is Correct. Under Policies > Security, at the bpttom os the bottom of the screen, choose Reset Rule Hit Counter, available options are 1) All rules or 2)Selected Rules
Source: Adapted from community discussion — Cyril_the_Squirl
The compliance officer requests that all evasive applications need to be blocked on all perimeter firewalls out to the internet. The firewall is configured with two zones: 1. trust for internal networks 2. untrust to the internet Based on the capabilities of the Palo Alto Networks NGFW, what are two ways to configure a security policy using App-ID to comply with this request? (Choose two.)
Answer: AD
It's a bit tricky, but the answer becomes clear when you start eliminating the obvious. For example, there's no application called 'evasive' mentioned in options B and C. Therefore, the correct answer is A and D.
Source: Adapted from community discussion — N1KH1L
Which object would an administrator create to enable access to all applications in the office-programs subcategory?
Answer: D
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
PCNSA practice, question 111. 407 questions available.
Version 1.0.0. How we source questions