PCNSA practice questions 11–20

1. Question 11 · 407 in bank

   At which point in the App-ID update process can you determine if an existing policy rule is affected by an App-ID update?

   • Aafter clicking Check Now in the Dynamic Update window
   • Bafter committing the firewall configuration
   • Cafter installing the update
   • Dafter downloading the update

   Show answer

   Answer: D

   Explanation

   Answer is D "Action > Download: Additionally, downloading an Application and Threat content release version enables the option to Review Policies that are affected by new application signatures included with the release." https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-web-interface-help/device/device-dynamic-updates.html

   Source: Adapted from community discussion — olexx

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

2. Question 12 · 407 in bank

   You receive notification about a new malware that infects hosts. An infection results in the infected host attempting to contact a command-and-control server. Which Security Profile detects and prevents this threat from establishing a command-and-control connection?

   • AVulnerability Protection Profile applied to outbound Security policy rules.
   • BAnti-Spyware Profile applied to outbound security policies.
   • CAntivirus Profile applied to outbound Security policy rules
   • DData Filtering Profile applied to outbound Security policy rules.

   Show answer

   Answer: B

   Next question

3. Question 13 · 407 in bank

   Which User-ID mapping method should be used for an environment with users that do not authenticate to Active Directory?

   • AWindows session monitoring
   • Bpassive server monitoring using the Windows-based agent
   • CCaptive Portal
   • Dpassive server monitoring using a PAN-OS integrated User-ID agent

   Show answer

   Answer: C

   Explanation

   https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/user-id/map-ip-addresses-to-users If you have users with client systems that aren’t logged in to your domain servers—for example, users running Linux clients that don’t log in to the domain—you can Map IP Addresses to Usernames Using Authentication Portal. Using Authentication Portal in conjunction with Authentication Policy also ensures that all users authenticate to access your most sensitive applications and data.

   Source: Adapted from community discussion — nicky6th

   References

   • docs.paloaltonetworks.com documentation

   Next question

4. Question 14 · 407 in bank

   Which statement is true regarding a Best Practice Assessment?

   • AIt runs only on firewalls.
   • BIt shows how current configuration compares to Palo Alto Networks recommendations.
   • CWhen guided by an authorized sales engineer, it helps determine the areas of greatest risk where you should focus prevention activities.
   • DIt provides a set of questionnaires that help uncover security risk prevention gaps across all areas of network and security architecture.

   Show answer

   Answer: B

   Explanation

   The attempt here is to determine competency in selecting between two Palo Tools: Prevention Posture Assessment (PPA)—The PPA is a set of questionnaires that help uncover security risk prevention gaps across all areas of network and security architecture. Keep your mind straight and understand what is PPA or BPA.

   Source: Adapted from community discussion — LordScorpius

   References

   • docs.paloaltonetworks.com documentation

   Next question

5. Question 15 · 407 in bank

   The PowerBall Lottery has reached an unusually high value this week. Your company has decided to raise morale by allowing employees to access the PowerBall Lottery website (www.powerball.com) for just this week. However, the company does not want employees to access any other websites also listed in the URL filtering `gambling` category. Which method allows the employees to access the PowerBall Lottery website but without unblocking access to the `gambling` URL category?

   • AAdd just the URL www.powerball.com to a Security policy allow rule.
   • BManually remove powerball.com from the gambling URL category.
   • CAdd *.powerball.com to the URL Filtering allow list.
   • DCreate a custom URL category, add *.powerball.com to it and allow it in the Security Profile.

   Show answer

   Answer: A

   Explanation

   The question is about very specific URL, which can't be 'limited' by *.powerball.com as this would allow a.powerball.com, a.b.c.powerball.com etc.

   Source: Adapted from community discussion — OhEmGee

   Next question

6. Question 16 · 407 in bank

   Which Palo Alto Networks service protects cloud-based applications such as Dropbox and Salesforce by monitoring permissions and shares and scanning files for sensitive information?

   • APrisma SaaS
   • BAutoFocus
   • CPanorama
   • DGlobalProtect

   Show answer

   Answer: A

   Explanation

   The one that blows my mind is the difference between Prima Saas (formerly Aperture) and the all-points Internet Gateway thingy called "GlobalProtect".

   Source: Adapted from community discussion — LordScorpius

   Next question

7. Question 17 · 407 in bank

   In a Security policy, what is the quickest way to reset all policy rule hit counters to zero?

   • AHighlight each rule and use the Reset Rule Hit Counter > Selected Rules
   • BReboot the firewall
   • CUse the Reset Rule Hit Counter > All Rules option
   • DUse the CLI enter the command reset rules all

   Show answer

   Answer: C

   Explanation

   Reference: https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-web-interface-help/policies/policies-security/creating-and-managing-policies

   Next question

8. Question 18 · 407 in bank

   Based on the Security policy rules shown, SSH will be allowed on which port?

   

   • Athe default port
   • Bonly ephemeral ports
   • Cany port
   • Dsame port as ssl and snmpv3

   Show answer

   Answer: A

   Explanation

   Strongly recommend completing the Security+ or its equivalent in PCCET - Palo Alto Networks Certified Entry-level Technician. As a Firewall Administrator, knowing about 100 ports by heart is essential.

   Source: Adapted from community discussion — LordScorpius

   Next question

9. Question 19 · 407 in bank

   You receive notification about new malware that is being used to attack hosts. The malware exploits a software bug in common application. Which Security Profile detects and blocks access to this threat after you update the firewall's threat signature database?

   • AData Filtering Profile applied to outbound Security policy rules
   • BAntivirus Profile applied to outbound Security policy rules
   • CData Filtering Profile applied to inbound Security policy rules
   • DVulnerability Protection Profile applied to inbound Security policy rules

   Show answer

   Answer: D

   Explanation

   Vulnerability Protection Security Profiles stop attempts to exploit system flaws or gain unauthorized access to systems. Anti-Spyware Security Profiles identify infected hosts as traffic leaves the network, but Vulnerability Protection Security Profiles protect against threats entering the network. For example, Vulnerability Protection Security Profiles protect against buffer overflows, illegal code execution, and other attempts to exploit system vulnerabilities Correct answer is D Ref - PCNSA Study Guide 2022 - P157

   Source: Adapted from community discussion — zeebo340

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

10. Question 20 · 407 in bank

    Select 2

    Palo Alto Networks firewall architecture accelerates content inspection performance while minimizing latency using which two components? (Choose two.)

    • ANetwork Processing Engine
    • BPolicy Engine
    • CParallel Processing Hardware
    • DSingle Stream-based Engine

    Show answer

    Answer: CD

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNSA practice, question 11. 407 questions available.