Palo Alto Networks Certified Network Security Administrator407 questions across 41 pages are complete and free, with no account or card.
407 questions in this bank
Free access · progress saved on this device
A website is unexpectedly allowed due to miscategorization. What are two ways to resolve this issue for a proper response? (Choose two.)
Answer: AB
It cannot be D as the suggested block policy is inserted 'below' the original policy and the original policy is allowing the traffic to the URL!
Source: Adapted from community discussion — OhEmGee
Identify the correct order to configure the PAN-OS integrated USER-ID agent. 3. add the service account to monitor the server(s) 2. define the address of the servers to be monitored on the firewall 4. commit the configuration, and verify agent connection status 1. create a service account on the Domain Controller with sufficient permissions to execute the User- ID agent
Answer: D
1-3-2-4 From the existing option 1-3-2-4 is correct. 1-2-3-4 would be correct as well, as there is no difference what you do first, add servers to be monitored, or define a useraccount
Source: Adapted from community discussion — rebet
If the firewall interface E1/1 is connected to a SPAN or mirror port, which interface type should E1/1 be configured as?
Answer: A
An administrator manages a network with 300 addresses that require translation. The administrator configured NAT with an address pool of 240 addresses and found that connections from addresses that needed new translations were being dropped. Which type of NAT was configured?
Answer: A
The size of the NAT pool should be equal to the number of internal hosts that require address translations. By default, if the source address pool is larger than the NAT address pool and eventually all of the NAT addresses are allocated, new connections that need address translation are dropped. To override this default behavior, use Advanced (Dynamic IP/Port Fallback) to enable the use of DIPP addresses when necessary
Source: Adapted from community discussion — 83KG
The NetSec Manager asked to create a new EMEA Regional Panorama Administrator profile with customized privileges. In particular, the new EMEA Regional Panorama Administrator should be able to: Access only EMEA-Regional device groups with read-only privileges Access only EMEA-Regional templates with read-only privileges What is the correct configuration for the new EMEA Regional Panorama Administrator profile?
Answer: A
Administrator Type - Dynamic - Roles that provide access to Panorama and managed firewalls. - Custom Panorama Admin - Configurable roles that have read-write access, read-only access, or no access to Panorama features. - Device Group and Template Admin - Configurable roles that have read-write access, read-only access, or no access to features for the device groups and templates that are assigned to the access domains select for this administrator.
Source: Adapted from community discussion — DlaEdu_Ex
An administrator would like to reference the same address object in Security policies on 100 Panorama managed firewalls, across 10 devices groups and five templates. Which configuration action should the administrator take when creating the address object?
Answer: C
Which type of policy allows an administrator to both enforce rules and take action?
Answer: B
Its a very lame question. PCNSA study guide, section 3.2: https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/datasheets/education/pcnsa-study-guide.pdf Security rule types Security policies allow you to enforce rules and take action, and they can be as general or as specific as needed. Now check this :) https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/policy Policies allow you to enforce rules and take action. The different types of policy rules that you can create on the firewall are: Security, NAT, Quality of Service (QoS), Policy Based Forwarding (PBF), Decryption, Application Override, Authentication, Denial of Service (DoS), and Zone protection policies. All these different policies work together to allow, deny, prioritize, forward, encrypt, decrypt, make exceptions, authenticate access, and reset connections as needed to help secure your network.
Source: Adapted from community discussion — OhEmGee
With the DNS Security subscription, when will the cloud-based signature database provide users access to newly added DNS signatures?
Answer: D
https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/threat-prevention/dns-security/cloud-delivered-dns-signatures To better accommodate the influx of new DNS signatures being produced on a daily basis, the cloud-based signature database provides users with instant access to newly added DNS signatures without the need to download updates. If network connectivity goes down or is otherwise unavailable, the firewall uses the onbox DNS signature set.
Source: Adapted from community discussion — baccalacca
Why should a company have a File Blocking profile that is attached to a Security policy?
Answer: B
What can be used as match criteria for creating a dynamic address group?
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
PCNSA practice, question 181. 407 questions available.
Version 1.0.0. How we source questions