PCNSA practice questions 131–140

1. Question 131 · 407 in bank

   How is an address object of type IP range correctly defined?

   • A192.168.40.1-192.168.40.255
   • B192.168.40.1-255
   • C192.168.40.1, 192.168.40.255
   • D192.168.40.1/24

   Show answer

   Answer: A

   Explanation

   https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/policy/use-address-object-to-represent-ip-addresses/create-an-address-object Answer : A - IP range - from webpage = they use use the same IP's on Palo site as what they have in question An address object of type IP Netmask requires you to enter the IP address or network using slash notation to indicate the IPv4 network or the IPv6 prefix length. For example, 192.168.18.0/24 or 2001:db8:123:1::/64.

   Source: Adapted from community discussion — baccalacca

   References

   • docs.paloaltonetworks.com documentation

   Next question

2. Question 132 · 407 in bank

   An administrator is troubleshooting traffic that should match the interzone-default rule. However, the administrator doesn't see this traffic in the traffic logs on the firewall. The interzone-default was never changed from its default configuration. Why doesn't the administrator see the traffic?

   • AThe interzone-default policy is disabled by default.
   • BTraffic is being denied on the interzone-default policy.
   • CLogging on the interzone-default policy is disabled.
   • DThe Log Forwarding profile is not configured on the policy.

   Show answer

   Answer: C

   Explanation

   "The interzone-default policy is disabled by default." It's never disable by default, le log is. The response said, the rule is disable wich is not the case by default so C is the correct answer

   Source: Adapted from community discussion — sguerouate

   Next question

3. Question 133 · 407 in bank

   What do you configure if you want to set up a group of objects based on their ports alone?

   • Aaddress groups
   • Bcustom objects
   • Capplication groups
   • Dservice groups

   Show answer

   Answer: D

   Next question

4. Question 134 · 407 in bank

   Select 2

   What are two valid selections within a Vulnerability Protection profile? (Choose two.)

   • Adeny
   • Bdrop
   • Cdefault
   • Dsinkhole

   Show answer

   Answer: BC

   Explanation

   BC are correst. You can configure the following actions in an Anti-Spyware profile: Default; Allow; Alert; Drop; Reset Client; Reset Server; Reset Both; Block IP https://docs.paloaltonetworks.com/network-security/security-policy/security-profiles/security-profile-vulnerability-protection

   Source: Adapted from community discussion — DlaEdu_Ex

   References

   • docs.paloaltonetworks.com documentation

   Next question

5. Question 135 · 407 in bank

   Select 3

   Which three interface deployment methods can be used to block traffic flowing through the Palo Alto Networks firewall? (Choose three.)

   • ATap
   • BHA
   • CLayer 3
   • DLayer 2
   • EVirtual Wire

   Show answer

   Answer: CDE

   Next question

6. Question 136 · 407 in bank

   An administrator would like to override the default deny action for a given application, and instead would like to block the traffic. Which security policy action causes this?

   • ADrop
   • BDrop, send ICMP Unreachable
   • CReset both
   • DReset server

   Show answer

   Answer: A

   References

   • docs.paloaltonetworks.com documentation

   Next question

7. Question 137 · 407 in bank

   Select 2

   When creating an Admin Role profile, if no changes are made, which two administrative methods will you have full access to? (Choose two.)

   • Aweb UI
   • BXML API
   • Ccommand line
   • DRESTAPI

   Show answer

   Answer: AD

   Explanation

   For PanOS 11.0.2, Under Device > Admin Roles > then try to Add - By default, Web UI and Rest API will show enabled (checked mark) options for list of access

   Source: Adapted from community discussion — Shanaia

   References

   • docs.paloaltonetworks.com documentation

   Next question

8. Question 138 · 407 in bank

   An administrator would like to apply a more restrictive Security profile to traffic for file sharing applications. The administrator does not want to update the Security policy or object when new applications are released. Which object should the administrator use as a match condition in the Security policy?

   • Athe Online Storage and Backup URL category
   • Bthe Content Delivery Networks URL category
   • Can application group containing all of the file-sharing App-IDs reported in the traffic logs
   • Dan application filter for applications whose subcategory is file-sharing

   Show answer

   Answer: D

   Explanation

   Answer seems to be D. The Administrator does not want to manually update the policy when the new new applications are released. So App filter is required to get it auto updated. The issue is question is not clear. It can be interpreted as you did and marked as C too.

   Source: Adapted from community discussion — Achuth

   Next question

9. Question 139 · 407 in bank

   Which list of actions properly defines the order of steps needed to add a local database user account and create a new group to which this user will be assigned?

   • A1. Navigate to Device > Local User Database > Users and click Add. 2. Enter a Name for the user. 3. Enter and Confirm a Password or Hash. 4. Enable the account and click OK. 5. Navigate to Device > Local User Database > User Groups and click Add. 6. Enter a Name for the group. 7. Add the user to the group and click OK.
   • B1. Navigate to Device > Authentication Profile > Users and click Add. 2. Enter a Name for the user. 3. Enter and Confirm a Password or Hash. 4. Enable the account and click OK. 5. Navigate to Device > Local User Database > User Groups and click Add. 6. Enter a Name for the group. 7. Add the user to the group and click OK.
   • C1. Navigate to Device > Users and click Add. 2. Enter a Name for the user. 3. Enter and Confirm a Password or Hash. 4. Enable the account and click OK. 5. Navigate to Device > User Groups and click Add. 6. Enter a Name for the group. 7. Add the user to the group and click OK.
   • D1. Navigate to Device > Admins and click Add. 2. Enter a Name for the user. 3. Enter and Confirm a Password or Hash. 4. Enable the account and click OK. 5. Navigate to Device > User Groups and click Add. 6. Enter a Name for the group. 7. Add the user to the group and click OK.

   Show answer

   Answer: A

   References

   • docs.paloaltonetworks.com documentation

   Next question

10. Question 140 · 407 in bank

    Which User-ID agent would be appropriate in a network with multiple WAN links, limited network bandwidth, and limited firewall management plane resources?

    • AWindows-based agent deployed on the internal network
    • BPAN-OS integrated agent deployed on the internal network
    • CCitrix terminal server deployed on the internal network
    • DWindows-based agent deployed on each of the WAN Links

    Show answer

    Answer: A

    Explanation

    From PCNSA Study Guide, page 162: Another reason to choose the Windows agent over the integrated PAN-OS agent is to save processing cycles on the firewall’s management plane. However, if network bandwidth is an issue, you might want to use the PAN-OS integrated agent. But I think multiple WAN links will solve the network bandwidth issue, so the main issue is the management plane resources, so for me answer is A.

    Source: Adapted from community discussion — Outlaw87

    References

    • docs.paloaltonetworks.com documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNSA practice, question 131. 407 questions available.