PCNSA practice questions 161–170

1. Question 161 · 407 in bank

   Your company is highly concerned with their intellectual property being accessed by unauthorized resources. There is a mature process to store and include metadata tags for all confidential documents. Which Security profile can further ensure that these documents do not exit the corporate network?

   • AFile Blocking
   • BData Filtering
   • CAnti-Spyware
   • DURL Filtering

   Show answer

   Answer: B

   Explanation

   Use Data Filtering profiles to prevent sensitive, confidential, and proprietary information from leaving your network. Predefined patterns, built-in settings, and customizable options make it easy for you to protect files that contain certain file properties (such as a document title or author), credit card numbers, regulated information from different countries (like social security numbers), and third-party data loss prevention (DLP) labels. https://docs.paloaltonetworks.com/network-security/security-policy/security-profiles/security-profile-data-filtering

   Source: Adapted from community discussion — awtsuritacuna

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

2. Question 162 · 407 in bank

   An administrator is reviewing the Security policy rules shown in the screenshot below. Which statement is correct about the information displayed?

   

   • AHighlight Unused Rules is checked.
   • BThere are seven Security policy rules on this firewall.
   • CThe view Rulebase as Groups is checked.
   • DEleven rules use the “Infrastructure” tag.

   Show answer

   Answer: C

   Explanation

   Sorry, this is wrong, 11 here means rule number 11, and the (1) between brackets is the number of rules taged with infrastructure. So the correct answer is C for sure

   Source: Adapted from community discussion — khaled_ellaboudy

   Next question

3. Question 163 · 407 in bank

   Prior to a maintenance-window activity, the administrator would like to make a backup of only the running configuration to an external location. What command in Device > Setup > Operations would provide the most operationally efficient way to achieve this outcome?

   • Aexport named configuration snapshot
   • Bsave named configuration snapshot
   • Cexport device state
   • Dsave candidate config

   Show answer

   Answer: A

   Next question

4. Question 164 · 407 in bank

   DRAG DROP - Match each rule type with its example.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Answer is incorrect, here is correct answer: 1. Create a policy with source zones A and B and destination zones A and B. The rule should apply to all traffic within zone a, all traffic within zone B, all traffic from Zone A to zone B, and all traffic from zone B to zone A. 2. Create a policy with source zones A and B. The rule will apply to all traffic within zone A and all traffic within zone B, but not to traffic between zones A and B. 3. Create a policy with source zone A and B and destination zones A and B. The rule would apply to traffic from zone A to zone B, and from zone B to zone A, but not traffic within zones A or B.

   Source: Adapted from community discussion — Reliic

   

   Next question

5. Question 165 · 407 in bank

   Select 2

   What are the two default behaviors for the intrazone-default policy? (Choose two.)

   • AAllow
   • BLog at Session End
   • CDeny
   • DLogging disabled

   Show answer

   Answer: AD

   Explanation

   By default, the firewall implicitly allows intrazone traffic (within a zone) and implicitly denies interzone traffic (between zones). By default, traffic allowed or denied by the implicit Security policy rules is not logged on the firewall. [Palo Alto Networks]

   Source: Adapted from community discussion — DlaEdu_Ex

   Next question

6. Question 166 · 407 in bank

   Which statement is true regarding NAT rules?

   • ATranslation of the IP address and port occurs before security processing.
   • BFirewall supports NAT on Layer 3 interfaces only.
   • CStatic NAT rules have precedence over other forms of NAT.
   • DNAT rules are processed in order from top to bottom.

   Show answer

   Answer: D

   Explanation

   - The firewall evaluates the rules in order from the top down - Static NAT rules do not have precedence over other forms of NAT. - Upon ingress, the firewall inspects the packet and does a route lookup to determine the egress interface and zone. Then the firewall determines if the packet matches one of the NAT rules that have been defined, based on source and/or destination zone. It then evaluates and applies any security policies that match the packet based on the original (pre-NAT) source and destination addresses, but the post-NAT zones. Finally, upon egress, for a matching NAT rule, the firewall translates the source and/or destination address and port numbers. - FW supports NAT also on Vwire interfaces. https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/networking/nat/nat-policy-rules/nat-policy-overview

   Source: Adapted from community discussion — [Removed]

   References

   • docs.paloaltonetworks.com documentation

   Next question

7. Question 167 · 407 in bank

   Select 2

   An administrator would like to block access to a web server, while also preserving resources and minimizing half-open sockets. What are two security policy actions the administrator can select? (Choose two.)

   • AReset server
   • BDeny
   • CDrop
   • DReset both

   Show answer

   Answer: AD

   Explanation

   I disagree on the DROP option, if selected, the application will misbehave and most likely keep the sockets open as well as continually send packets seeking a response.

   Source: Adapted from community discussion — DatITGuyTho1337

   Next question

8. Question 168 · 407 in bank

   An administrator wants to create a NAT policy to allow multiple source IP addresses to be translated to the same public IP address. What is the most appropriate NAT policy to achieve this?

   • AStatic IP
   • BDestination
   • CDynamic IP and Port
   • DDynamic IP

   Show answer

   Answer: C

   Explanation

   C is correct. Source NAT Types: 1. Static IP: - 1-to-1 fixed translations. - Changes the source IP address while leaving the source port unchanged. - Supports the implicit bidirectional rule feature. 2. Dynamic IP: - 1-to-1 translations of a source IP address only (no port number). - Private source address translates to the next available address in the range. 3. Dynamic IP and port (DIPP): - Allows multiple clients to use the same public IP addresses with different source port numbers. - The assigned address can be set to the interface address or to a translated address. [Palo Alto Networks]

   Source: Adapted from community discussion — DlaEdu_Ex

   Next question

9. Question 169 · 407 in bank

   Select 3

   What are three Palo Alto Networks best practices when implementing the DNS Security Service? (Choose three.)

   • AConfigure a URL Filtering profile
   • BTrain your staff to be security aware.
   • CPlan for mobile-employee risk.
   • DRely on a DNS resolver.
   • EImplement a threat intel program.

   Show answer

   Answer: BCE

   Next question

10. Question 170 · 407 in bank

    An administrator would like to see the traffic that matches the intrazone-default rule in the traffic logs. What is the correct process to enable this logging?

    • ASelect the intrazone-default rule and click Override; on the Actions tab, select Log at Session End and click OK.
    • BSelect the intrazone-default rule and edit the rule; on the Actions tab, select Log at Session End and click OK.
    • CSelect the intrazone-default rule and edit the rule; on the Actions tab, select Log at Session Start and click OK.
    • DThis rule has traffic logging enabled by default; no further action is required.

    Show answer

    Answer: A

    Explanation

    Answer : A For traffic that doesn’t match any user-defined rules, the default rules apply. The default rules—displayed at the bottom of the security rulebase—are predefined to allow all intrazone traffic (within the zone) and deny all interzone traffic (between zones). Although these rules are part of the pre-defined configuration and are read-only by default, you can Override them and change a limited number of settings, including the tags, action (allow or deny), log settings, and security profiles.

    Source: Adapted from community discussion — J2J2J2J

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNSA practice, question 161. 407 questions available.