Palo Alto Networks Certified Network Security Administrator407 questions across 41 pages are complete and free, with no account or card.
407 questions in this bank
Free access · progress saved on this device
An administrator is troubleshooting an issue with an accounts payable application. Which log setting could be temporarily configured to improve visibility?
Answer: A
Maybe the application is being denied an interzone default rule/ intrazone would not show in the logs its defaulted to no logging, unless you enable the log at session end/start
Source: Adapted from community discussion — LetsDiscuss23
By default, which action is assigned to the interzone-default rule?
Answer: B
What is the maximum volume of concurrent administrative account sessions?
Answer: B
Modify the number of supported administrator accounts. Configure the total number of supported concurrent administrative accounts sessions for a firewall in the normal operational mode or in FIPS-CC mode. You can allow up to four concurrent administrative account sessions or configure the firewall to support an unlimited number of concurrent administrative account sessions. Select DeviceSetupManagement and edit the Authentication Settings. Edit the Max Session Count to specify the number of supported concurrent sessions (range is 0 to 4) allowed for all administrator and user accounts. Enter 0 to configure the firewall to support an unlimited number of administrative accounts. Edit the Max Session Time in minutes for an administrative account. Default is 720 minutes. Click OK. Commit.
Source: Adapted from community discussion — baccalacca
Based on the security policy rules shown, ssh will be allowed on which port?
Answer: C
An administrator is updating Security policy to align with best practices. Which Policy Optimizer feature is shown in the screenshot below?
Answer: A
A little more on why it is Rules without Apps Control and not New App Viewer: Although both are true for this specific screenshot however the difference is that in New App Viewer, we get to see the rules which are configured with applications like web-browsing and such rules are not visible in Rules Without Apps Control. Thus, in New App Viewer, at times we get to see numbers under 'Apps Allowed' whereas on the other hand this column contains 'Any'. Moreover, the New Apps Allowed functionality requires PA Application Cloud Engine (ACE) SaaS subscription to get the App info from cloud DB. The Rules Without Apps Control is on-the-box functionality. Here's the definition from firewall's help page; New App Viewer—New cloud applications downloaded from the Application Control Engine if the firewall has a SaaS Security subscription. Rules Without App Controls—Rules that have the application set to any, so you can identify port-based rules to convert to application-based rules.
Source: Adapted from community discussion — OhEmGee
Where within the firewall GUI can all existing tags be viewed?
Answer: C
What is the Anti-Spyware Security profile default action?
Answer: D
When a threat event is detected, you can configure the following actions in an Anti-Spyware profile: Default—For each threat signature and Anti-Spyware signature that is defined by Palo Alto Networks, a default action is specified internally. Typically the default action is an alert or a reset-both. The default action is displayed in parenthesis, for example default (alert) in the threat or Antivirus signature.
Source: Adapted from community discussion — khaled_ellaboudy
To enable DNS sinkholing, which two addresses should be reserved? (Choose two.)
Answer: BD
A NetSec manager was asked to create a new firewall administrator profile with customized privileges. The new firewall administrator must be able to download TSF File and Starts Dump File but must not be able to reboot the device. Where does the NetSec manager go to configure the new firewall administrator role profile?
Answer: C
Following are the option under, Device -> Admin Roles -> Add -> Web UI -> Operations: 1. Reboot 2. Generate Tech Support File 3. Generate Status Dump File 4. Download Core Files 5. Download PCAP Files
Source: Adapted from community discussion — OhEmGee
What must exist in order for the firewall to route traffic between Layer 3 interfaces?
Answer: A
A In a Layer 3 deployment, the firewall routes traffic between multiple ports. Before you can Configure Layer 3 Interfaces, you must configure the virtual router that you want the firewall to use to route the traffic for each Layer 3 interface. https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-networking-admin/configure-interfaces/layer-3-interfaces
Source: Adapted from community discussion — baccalacca
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
PCNSA practice, question 201. 407 questions available.
Version 1.0.0. How we source questions