Question 191 · 407 in bank
An administrator is reviewing packet captures to troubleshoot a problem with an application, and they observe TCP resets to the client and the server. Which security policy action causes this?
Show answer
Answer: D
Palo Alto Networks Certified Network Security Administrator407 questions across 41 pages are complete and free, with no account or card.
407 questions in this bank
Free access · progress saved on this device
An administrator is reviewing packet captures to troubleshoot a problem with an application, and they observe TCP resets to the client and the server. Which security policy action causes this?
Answer: D
An administrator would like to protect against inbound threats such as buffer overflows and illegal code execution. Which Security profile should be used?
Answer: A
Vulnerability Protection profiles protect against threats entering the network. For example, Vulnerability Protection profiles help protect against buffer overflows, illegal code execution, and other attempts to exploit system vulnerabilities.
Source: Adapted from community discussion — J2J2J2J
Users from the internal zone need to be allowed to Telnet into a server in the DMZ zone. Complete the security policy to ensure only Telnet is allowed. Security Policy: Source Zone: Internal to DMZ Zone __________services `Application defaults`, and action = Allow
Answer: B
An organization has some applications that are restricted for access by the Human Resources Department only, and other applications that are available for any known user in the organization. What object is best suited for this configuration?
Answer: A
The question insinuates that there are a couple of applications that need to be blocked, and not a category of applications. This is why an Application Group (static) fits better than an Application Filter (dynamic)
Source: Adapted from community discussion — SillyGoose123
Which two configurations does an administrator need to compare in order to see differences between the active configuration and potential changes if committed? (Choose two.)
Answer: CD
An administrator configured a Security policy rule where the matching condition includes a single application and the action is set to deny. What deny action will the firewall perform?
Answer: C
C. Perform the default deny action as defined in the App-ID database for the application When a Security policy rule is set to deny and it matches a single application, the firewall will perform the default deny action as defined in the App-ID database for the application1. If no Deny Action is listed in the App-ID description, the packets will be silently discarded
Source: Adapted from community discussion — cjace
If users from the Trusted zone need to allow traffic to an SFTP server in the DMZ zone, how should a Security policy with App-ID be configured?
Answer: B
An administrator configured a Security policy rule with an Antivirus Security profile. The administrator did not change the action for the profile. If a virus gets detected, how will the firewall handle the traffic?
Answer: D
D is correct "Default—For each threat signature and Antivirus signature that is defined by Palo Alto Networks, a default action is specified internally. Typically, the default action is an alert or a reset-both. " https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/policy/security-profiles
Source: Adapted from community discussion — DlaEdu_Ex
An administrator needs to allow users to use only certain email applications. How should the administrator configure the firewall to restrict users to specific email applications?
Answer: C
C is correct, B would block all e-mail applications. The questions states we want to block only some e-mail applications, which we can manually specify with an application group.
Source: Adapted from community discussion — cessnas
DNS exceptions can be set under which Security profile?
Answer: C
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
PCNSA practice, question 191. 407 questions available.
Version 1.0.0. How we source questions