Palo Alto Networks Certified Network Security Administrator407 questions across 41 pages are complete and free, with no account or card.
407 questions in this bank
Free access · progress saved on this device
A Panorama administrator would like to create an address object for the DNS server located in the New York City office, but does not want this object added to the other Panorama managed firewalls. Which configuration action should the administrator take when creating the address object?
Answer: D
An administrator is troubleshooting an issue with traffic that matches the interzone-default rule, which is set to default configuration. What should the administrator do?
Answer: A
Answer = A Traffic that does not match any of the rules you defined will match the predefined interzone-default rule at the bottom of the rulebase and be denied. For visibility into the traffic that is not matching any of the rules you created, enable logging on the interzone-default rule
Source: Adapted from community discussion — baccalacca
What is the default action for the SYN Flood option within the DoS Protection profile?
Answer: D
Answer correct = D DoS Protection Profiles and Policy Rules work together to provide protection against flooding of many incoming SYN, UDP, ICMP, and ICMPv6 packets, and other types of IP packets. You determine what thresholds constitute flooding. In general, the DoS Protection profile sets the thresholds at which the firewall generates a DoS alarm, takes action such as Random Early Drop, and drops additional incoming connections. A DoS Protection policy rule configured to protect (rather than to allow or deny packets) determines the criteria for packets to match (such as source address) in order to be counted toward the thresholds. This flexibility allows you to block certain traffic, or allow certain traffic and treat other traffic as DoS traffic. When the incoming rate exceeds your maximum threshold, the firewall blocks incoming traffic from the source address.
Source: Adapted from community discussion — baccalacca
Application groups enable access to what?
Answer: C
answer = C An application group is an object that contains applications that you want to treat similarly in policy. Application groups are useful for enabling access to applications that you explicitly sanction for use within your organization. https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/app-id/use-application-objects-in-policy/create-an-application-group
Source: Adapted from community discussion — baccalacca
Where does a user assign a tag group to a policy rule in the policy creation window?
Answer: A
What is used to monitor Security policy applications and usage?
Answer: D
What is considered best practice with regards to committing configuration changes?
Answer: C
Correct answer = C https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-cli-quick-start/use-the-cli/commit-configuration-changes As a best practice, validate configuration changes prior to committing so that you can fix any errors that will cause a commit failure, thereby ensuring that the commit will succeed. This is particularly useful in environments with a strict change window.
Source: Adapted from community discussion — baccalacca
Which Security profile generates an alert based on a threshold when the action is set to Alert?
Answer: C
Answer= c DoS Protection profiles set thresholds that protect against new session IP flood attacks and provide resource protection (maximum concurrent session limits for specified endpoints and resources). DoS Protection profiles protect specific devices (classified profiles) and groups of devices (aggregate profiles) against SYN, UDP, ICMP, ICMPv6, and Other IP flood attacks. Configuring Flood Protection thresholds in a DoS Protection profile is similar to configuring Flood Protection in a Zone Protection profile, but Zone Protection profiles protect entire ingress zones, while DoS protection profiles and policy rules are granular and targeted, and can even be classified to a single device (IP address). The firewall measures the aggregate number of connections-per-second (CPS) to a group of devices (aggregate profile) or measures the CPS to individual devices (classified profile).
Source: Adapted from community discussion — baccalacca
Given the network diagram, which two statements are true about traffic between the User and Server networks? (Choose two.)
Answer: AD
Which interface type is used to monitor traffic and cannot be used to perform traffic shaping?
Answer: B
If you are thinking "Cisco", the word is "SPAN". With Open Systems, it's "mirror". In Palo's world, it's "TAP". Same thing, all around. SPAN=MIRROR=TAP. All only monitor.
Source: Adapted from community discussion — LordScorpius
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
PCNSA practice, question 251. 407 questions available.
Version 1.0.0. How we source questions