PCNSA practice questions 141–150

1. Question 141 · 407 in bank

   Select 2

   When creating a Panorama administrator type of Device Group and Template Admin, which two things must you create first? (Choose two.)

   • Aserver profile
   • Badmin role
   • Cpassword profile
   • Daccess domain

   Show answer

   Answer: BD

   Explanation

   Answer is B and D. B. Admin Role - The set of permissions for the administrator. It is a custom role where you can specify what the admin can and cannot do. D. Access Domain - This is the set of devices or device groups, templates, or template stacks that the admin is allowed to access. Information on Access Domains - https://docs.paloaltonetworks.com/panorama/9-1/panorama-admin/panorama-overview/role-based-access-control/access-domains

   Source: Adapted from community discussion — TheLorenz

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

2. Question 142 · 407 in bank

   Select 3

   An administrator is configuring a NAT rule. At a minimum, which three forms of information are required? (Choose three.)

   • Asource zone
   • Bname
   • Cdestination interface
   • Ddestination zone
   • Edestination address

   Show answer

   Answer: ABD

   Explanation

   dsagree - answer is A C D https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-networking-admin/nat/nat-policy-rules/nat-policy-overview You configure a NAT rule to match a packet’s source zone and destination zone, at a minimum. In addition to zones, you can configure matching criteria based on the packet’s destination interface, source and destination address, and service. You can configure multiple NAT rules. The firewall evaluates the rules in order from the top down.

   Source: Adapted from community discussion — baccalacca

   References

   • docs.paloaltonetworks.com documentation

   Next question

3. Question 143 · 407 in bank

   Select 2

   An administrator wants to prevent hacking attacks through DNS queries to malicious domains. Which two DNS policy actions can the administrator choose in the Anti-Spyware Security Profile? (Choose two.)

   • Adeny
   • Bblock
   • Csinkhole
   • Doverride

   Show answer

   Answer: BC

   Next question

4. Question 144 · 407 in bank

   Select 2

   An administrator is creating a NAT policy. Which combination of address and zone are used as match conditions? (Choose two.)

   • APre-NAT address
   • BPre-NAT zone
   • CPost-NAT address
   • DPost-NAT zone

   Show answer

   Answer: AB

   Explanation

   A and B is correct. NAT policy rule matches the packet based on the original pre-NAT src and dst address and pre-NAT destination zone.It's security policy that match the packet based on pre-NAT src and dst address and post-Nat zone

   Source: Adapted from community discussion — yinksho

   References

   • docs.paloaltonetworks.com documentation

   Next question

5. Question 145 · 407 in bank

   Select 3

   A network administrator is required to use a dynamic routing protocol for network connectivity. Which three dynamic routing protocols are supported by the NGFW Virtual Router for this purpose? (Choose three.)

   • AOSPF
   • BEIGRP
   • CIS-IS
   • DBGP
   • ERIP

   Show answer

   Answer: ADE

   References

   • docs.paloaltonetworks.com documentation

   Next question

6. Question 146 · 407 in bank

   Which firewall feature do you need to configure to query Palo Alto Networks service updates over a data-plane interface instead of the management interface?

   • Aservice route
   • Bdynamic updates
   • CSNMP setup
   • Ddata redistribution

   Show answer

   Answer: A

   Next question

7. Question 147 · 407 in bank

   In order to fulfill the corporate requirement to backup the configuration of Panorama and the Panorama-managed firewalls securely, which protocol should you select when adding a new scheduled config export?

   • AHTTPS
   • BSMB v3
   • CSCP
   • DFTP

   Show answer

   Answer: C

   Explanation

   FTP, SFTP and SCP can help accomplish the same thing, which is to move files from here to there (or, based on relativity, from there to here) nice and quickly and over ethernet. There is one major difference between FTP and the other 2, though: FTP sends data in plain-text whereas SCP and SFTP use the SSH (Secure Shell) protocol for communication. Again, this is for security purposes, so when it comes to websites and transferring sensitive information, it is always better to err on the side of security.

   Source: Adapted from community discussion — khaled_ellaboudy

   References

   • docs.paloaltonetworks.com documentation

   Next question

8. Question 148 · 407 in bank

   All users from the internal zone must be allowed only HTTP access to a server in the DMZ zone. Complete the empty field in the Security policy using an application object to permit only this type of access. Source Zone: Internal - Destination Zone: DMZ Zone - Application: __________ Service: application-default - Action: allow

   • AApplication = "any"
   • BApplication = "web-browsing"
   • CApplication = "ssl"
   • DApplication = "http"

   Show answer

   Answer: B

   Explanation

   This was oddly worded and the whole question should not even count. The question is clearly specifying ONLY HTTP traffic, but the provided options do not match the asked criteria. HTTP is a server, and web-browsing is an APP-ID. However, "web-browsing" if left alone with default application service allows both http and https. More over, the answer doesn't make a correction in the Service option and leaves it as application-default. I agree that the answer, based on the requirements is B, but the question sucks.

   Source: Adapted from community discussion — [Removed]

   Next question

9. Question 149 · 407 in bank

   An administrator wants to prevent users from unintentionally accessing malicious domains where data can be exfiltrated through established connections to remote systems. From the Pre-defined Categories tab within the URL Filtering profile, what is the right configuration to prevent such connections?

   • ASet the hacking category to continue.
   • BSet the phishing category to override.
   • CSet the malware category to block.
   • DSet the Command and Control category to block.

   Show answer

   Answer: D

   Explanation

   Go to Objects -> Security Profiles -> URL Filtering -> Categories tab -> Search for Command-and-Control and set the action to Block D is the right answer.

   Source: Adapted from community discussion — OhEmGee

   References

   • docs.paloaltonetworks.com documentation

   Next question

10. Question 150 · 407 in bank

    Your company requires positive username attribution of every IP address used by wireless devices to support a new compliance requirement. You must collect IP `"to-user mappings as soon as possible with minimal downtime and minimal configuration changes to the wireless devices themselves. The wireless devices are from various manufactures. Given the scenario, choose the option for sending IP-to-user mappings to the NGFW.

    • Asyslog
    • BRADIUS
    • CUID redistribution
    • DXFF headers

    Show answer

    Answer: A

    Explanation

    A. Check this 'To obtain user mappings from existing network services that authenticate users—such as wireless controllers, 802.1x devices, Apple Open Directory servers, proxy servers, or other Network Access Control (NAC) mechanisms—Configure User-ID to Monitor Syslog Senders for User Mapping. '----https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/user-id/map-ip-addresses-to-users

    Source: Adapted from community discussion — Grace_Shu

    References

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNSA practice, question 141. 407 questions available.