PCNSA practice questions 221–230

1. Question 221 · 407 in bank

   How many levels can there be in a device-group hierarchy, below the shared level?

   • A2
   • B3
   • C4
   • D5

   Show answer

   Answer: C

   Explanation

   Answer : C You can Create a Device Group Hierarchy to nest device groups in a tree hierarchy of up to four levels, with lower-level groups inheriting the settings (policy rules and objects) of higher-level groups. https://docs.paloaltonetworks.com/panorama/9-1/panorama-admin/panorama-overview/centralized-firewall-configuration-and-update-management/device-groups/device-group-hierarchy

   Source: Adapted from community discussion — J2J2J2J

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

2. Question 222 · 407 in bank

   Where in Panorama would Zone Protection profiles be configured?

   • ATemplates
   • BDevice Groups
   • CShared
   • DPanorama tab

   Show answer

   Answer: A

   Explanation

   Create a Zone Protection profile for the firewalls in the data center template (T_DataCenter). Select the Network tab and, in the Template drop-down, select T_DataCenter. Select Network ProfilesZone Protection and click Add.

   Source: Adapted from community discussion — baccalacca

   References

   • docs.paloaltonetworks.com documentation

   Next question

3. Question 223 · 407 in bank

   Which parameter is used to view the Security policy rulebase as groups?

   • ATags
   • BService
   • CType
   • DAction

   Show answer

   Answer: A

   Explanation

   Answer = A (tags) You must create a tag before you can group rules using that tag. After you assign grouped rules by a tag, View Rulebase as Groups to see a visual representation of your policy rulebase based on the assigned tags. While viewing your rulebase as groups, the policy order and priority is maintained. In this view, select the group tag to view all rules grouped by that tag. https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-web-interface-help/objects/objects-tags

   Source: Adapted from community discussion — baccalacca

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

4. Question 224 · 407 in bank

   When a security rule is configured as Intrazone, which field cannot be changed?

   • ADestination Zone
   • BActions
   • CSource Zone
   • DApplication

   Show answer

   Answer: A

   Next question

5. Question 225 · 407 in bank

   An administrator is trying to understand which NAT policy is being matched. In what order does the firewall evaluate NAT policies?

   • ADynamic IP and Port first, then Static, and finally Dynamic IP
   • BFrom top to bottom
   • CStatic NAT rules first, then lop down
   • DStatic NAT rules first, then Dynamic

   Show answer

   Answer: B

   Explanation

   answer = b You configure a NAT rule to match a packet’s source zone and destination zone, at a minimum. In addition to zones, you can configure matching criteria based on the packet’s destination interface, source and destination address, and service. You can configure multiple NAT rules. The firewall evaluates the rules in order from the top down. Once a packet matches the criteria of a single NAT rule, the packet is not subjected to additional NAT rules. Therefore, your list of NAT rules should be in order from most specific to least specific so that packets are subjected to the most specific rule you created for them. https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-networking-admin/nat/nat-policy-rules/nat-policy-overview

   Source: Adapted from community discussion — baccalacca

   References

   • docs.paloaltonetworks.com documentation

   Next question

6. Question 226 · 407 in bank

   Which policy set should be used to ensure that a policy is applied just before the default security rules?

   • AShared post-rulebase
   • BLocal firewall policy
   • CParent device-group post-rulebase
   • DChild device-group post-rulebase

   Show answer

   Answer: A

   References

   • docs.paloaltonetworks.com documentation

   Next question

7. Question 227 · 407 in bank

   An administrator notices that protection is needed for traffic within the network due to malicious lateral movement activity. Based on the image shown, which traffic would the administrator need to monitor and block to mitigate the malicious activity?

   

   • Abranch office traffic
   • Bnorth-south traffic
   • Cperimeter traffic
   • Deast-west traffic

   Show answer

   Answer: D

   Explanation

   The question is not about zone names, it's bout traffic directions! The arrows at the bottom of the image (from left to right & from right to left ) are called east-west traffic; Same thing for the ones on the right edge of the image (up to down & down to up) are called north-south traffic.

   Source: Adapted from community discussion — olexx

   Next question

8. Question 228 · 407 in bank

   Which rule type is appropriate for matching traffic occurring within a specified zone? How should the administrator configure the firewall to restrict users to specific email applications?

   • ACreate an application filter and filter it on the collaboration category.
   • BCreate an application filter and filter it on the collaboration category, email subcategory.
   • CCreate an application group and add the email applications to it.
   • DCreate an application group and add the email category to it.

   Show answer

   Answer: C

   Explanation

   Answer C https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/app-id/use-application-objects-in-policy/create-an-application-group An application group is an object that contains applications that you want to treat similarly in policy. Application groups are useful for enabling access to applications that you explicitly sanction for use within your organization. Grouping sanctioned applications simplifies administration of your rulebases. Instead of having to update individual policy rules when there is a change in the applications you support, you can update only the affected application groups

   Source: Adapted from community discussion — fb48

   References

   • docs.paloaltonetworks.com documentation

   Next question

9. Question 229 · 407 in bank

   Review the screenshot below. Based on the information it contains, which protocol decoder will detect a machine-learning match, create a Threat log entry, and permit the traffic?

   

   • Asmb
   • Bimap
   • Cftp
   • Dhttp2

   Show answer

   Answer: B

   Explanation

   B is the correct answer. According to the screenshot, only imap, pop3 and smtp have a default (alert) action, which generates an alert for each application traffic flow. The alert is saved in the threat log. https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/policy/security-profiles

   Source: Adapted from community discussion — DlaEdu_Ex

   References

   • docs.paloaltonetworks.com documentation

   Next question

10. Question 230 · 407 in bank

    An interface can belong to how many Security Zones?

    • A1
    • B2
    • C3
    • D4

    Show answer

    Answer: A

    References

    • docs.paloaltonetworks.com documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNSA practice, question 221. 407 questions available.