Question 121 · 407 in bank
Given the detailed log information above, what was the result of the firewall traffic inspection?
Show answer
Answer: D
PCNSAAssociatePalo Alto NetworksAll questions freePage 13 of 41
PCNSA practice questions 121–130
Palo Alto Networks Certified Network Security Administrator407 questions across 41 pages are complete and free, with no account or card.
Official study references
407 questions in this bank
Free access · progress saved on this device
Question 122 · 407 in bank
An administrator wants to create a No-NAT rule to exempt a flow from the default NAT rule. What is the best way to do this?
Show answer
Answer: D
References
Question 123 · 407 in bank
What can be achieved by selecting a policy target prior to pushing policy rules from Panorama? *
Show answer
Answer: B
Explanation
Option B: You can specify the firewalls in a device group to which to push policy rules12. The Target tab allows you to apply the rule to specific firewalls or descendant device groups of the Device Group (or Shared location) where the rule is defined1.
Source: Adapted from community discussion — cjace
References
Question 124 · 407 in bank
When an ethernet interface is configured with an IPv4 address, which type of zone is it a member of?
Show answer
Answer: A
Question 125 · 407 in bank
An administrator would like to create a URL Filtering log entry when users browse to any gambling website. What combination of Security policy and Security profile actions is correct?
Show answer
Answer: C
References
Question 126 · 407 in bank
Select 2An administrator is investigating a log entry for a session that is allowed and has the end reason of aged-out. Which two fields could help in determining if this is normal? (Choose two.)
Show answer
Answer: AB
Explanation
Answer: AB When monitoring the traffic logs using Monitor > logs > Traffic, some traffic is seen with the Session End Reason as aged-out. Any traffic that uses UDP or ICMP is seen will have session end reason as aged-out in the traffic log. This is because unlike TCP, there is there is no way for a graceful termination of UDP session and so aged-out is a legitimate session-end reason for UDP (and ICMP) sessions. Link: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PMjLCAW
Source: Adapted from community discussion — Alex48694
Question 127 · 407 in bank
Select 3What are three characteristics of the Palo Alto Networks DNS Security service? (Choose three.)
Show answer
Answer: CDE
Explanation
CDE are correct: DNS Security subscription enables users to access real-time protections using advanced predictive analytics. When techniques such as DGA/DNS tunneling detection and machine learning are used, threats hidden within DNS traffic can be proactively identified and shared through an infinitely scalable cloud service. Because the DNS signatures and protections are stored in a cloud-based architecture, you can access the full database of ever-expanding signatures that have been generated using a multitude of data sources. This list of signatures allows you to defend against an array of threats using DNS in real-time against newly generated malicious domains. To combat future threats, updates to the analysis, detection, and prevention capabilities of the DNS Security service will be available through content releases. To access the DNS Security service, you must have a Threat Prevention license and DNS Security license.
Source: Adapted from community discussion — Oteslar
References
Question 128 · 407 in bank
After making multiple changes to the candidate configuration of a firewall, the administrator would like to start over with a candidate configuration that matches the running configuration. Which command in Device > Setup > Operations would provide the most operationally efficient way to accomplish this?
Show answer
Answer: A
Explanation
Restores the current running configuration. This operation undoes all changes that every administrator made to the candidate configuration since the last commit. To revert only the changes of specific administrators
Source: Adapted from community discussion — J2J2J2J
Question 129 · 407 in bank
Select 2Which two App-ID applications will you need to allow in your Security policy to use facebook-chat? (Choose two.)
Show answer
Answer: BC
Explanation
Should be B and C From Palo Alto if you go to facebook-chat and look dependencies Depends on Applications: facebook-base,mqtt-base
Source: Adapted from community discussion — yurakoresh
Question 130 · 407 in bank
Select 3What are three valid ways to map an IP address to a username? (Choose three.)
Show answer
Answer: ADE
Explanation
you're confusing what the question is asking. Username mapping to IP addressing falls under USER-ID I recommend you review this document: https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/user-id/map-ip-addresses-to-users
Source: Adapted from community discussion — [Removed]
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
PCNSA practice, question 121. 407 questions available.
About this question bank
Version 1.0.0. How we source questions