PCNSA practice questions 281–290

1. Question 281 · 407 in bank

   An administrator receives a notification about new malware that is being used to attack hosts. The malware exploits a software bug in a common application. Which Security Profile will detect and block access to this threat after the administrator updates the firewall's threat signature database?

   • AVulnerability Profile applied to inbound Security policy rules
   • BAntivirus Profile applied to outbound Security policy rules
   • CData Filtering Profile applied to outbound Security policy rules
   • DData Filtering Profile applied to inbound Security policy rules

   Show answer

   Answer: A

   Explanation

   The correct answer is: A. Vulnerability Profile applied to inbound Security policy rules Vulnerability Profiles are used to detect and block exploits against known vulnerabilities in software applications. The administrator's notification indicated that the new malware exploits a software bug in a common application. By applying a Vulnerability Profile to inbound Security policy rules, the administrator can block all attempts to exploit this vulnerability, even if the malware is not yet known to the firewall's threat signature database.

   Source: Adapted from community discussion — Calica

   References

   • docs.paloaltonetworks.com documentation

   Next question

2. Question 282 · 407 in bank

   Which administrator type utilizes predefined roles for a local administrator account?

   • ASuperuser
   • BRole-based
   • CDynamic
   • DDevice administrator

   Show answer

   Answer: C

   Explanation

   C is Correct. In Palo Alto thre are only 2 Admin types. Admin can be created as either DYNAMIC or Role-based, role-based means you decide what priviledges your admin will have so it's custom. Dynamic includes predefined admin profiles such as Superuser + Superuser(RO), VirtSys + VirtSys(RO), etc

   Source: Adapted from community discussion — Cyril_the_Squirl

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

3. Question 283 · 407 in bank

   The NetSec Manager asked to create a new firewall Local Administrator profile with customized privileges named New_Admin. This new administrator has to authenticate without inserting any username or password to access the WebUI. What steps should the administrator follow to create the New_Admin Administrator profile?

   • A1. Set the Authentication profile to Local. 2. Select the "Use only client certificate authentication" check box. 3. Set Role to Role Based.
   • B1. Select the "Use only client certificate authentication" check box. 2. Set Role to Dynamic. 3. Issue to the Client a Certificate with Certificate Name = New Admin
   • C1. Select the "Use only client certificate authentication" check box. 2. Set Role to Dynamic. 3. Issue to the Client a Certificate with Common Name = New_Admin
   • D1. Select the "Use only client certificate authentication" check box. 2. Set Role to Role Based. 3. Issue to the Client a Certificate with Common Name = New Admin

   Show answer

   Answer: C

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

4. Question 284 · 407 in bank

   Which Security profile prevents users from submitting valid corporate credentials online?

   • AWildFire
   • BURL filtering
   • CAdvanced threat prevention
   • DSSL decryption

   Show answer

   Answer: B

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

5. Question 285 · 407 in bank

   Select 2

   Which two statements apply to an Advanced Threat Prevention subscription? (Choose two.)

   • AIt contains all the features already in a Threat Prevention subscription.
   • BIt provides the ability to identify evasive and previously unseen command-and-control (C2) threats.
   • CWhen it is active, a WildFire profile is no longer needed.
   • DDue to its more advanced signatures, it provides the ability to identify new threats.

   Show answer

   Answer: AB

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

6. Question 286 · 407 in bank

   With the PAN-OS 11.0 release, which tab becomes newly available within the Vulnerability security profile?

   • AVulnerability Exceptions
   • BAdvanced Rules
   • CInline Cloud Analysis
   • DWildFire Inline ML

   Show answer

   Answer: C

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

7. Question 287 · 407 in bank

   DRAG DROP - Drag the steps into the correct order to create a static route.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Correct Sequence is ; 1.Add an IPv4 or IPv6 route by name. 2.Enter the route and netmask 3.Specify the outgoing interface for packets to use to go to the next hop 4.Enter the IP address for the specific next hop

   Source: Adapted from community discussion — Sanjug2022

   References

   • docs.paloaltonetworks.com documentation

   

   Next question

8. Question 288 · 407 in bank

   Select 2

   What are the two ways to implement an exception to an external dynamic list? (Choose two.)

   • AEdit the external dynamic list by removing the entries to exclude.
   • BSelect the entries to exclude from the List Entries list.
   • CManually add an entry to the Manual Exceptions list.
   • DEdit the external dynamic list by adding the “-“ symbol before the entries to exclude.

   Show answer

   Answer: BC

   Explanation

   B, C - Based on the information available, the two ways to implement an exception to an external dynamic list in Palo Alto Networks are: Select the entries to exclude from the List Entries list. You can view the entries of an external dynamic list and select up to 100 entries to exclude from the list1. Manually add an entry to the Manual Exceptions list. You can manually add a list exception1.

   Source: Adapted from community discussion — cjace

   References

   • docs.paloaltonetworks.com documentation

   Next question

9. Question 289 · 407 in bank

   An administrator needs to create a Security policy rule that matches DNS traffic sourced from either the LAN or VPN zones, destined for the DMZ or Untrust zones. The administrator does not want to match traffic where the source and destination zones are LAN, and also does not want to match traffic where the source and destination zones are VPN. Which Security policy rule type should they use?

   • AInterzone
   • BUniversal
   • CIntrazone
   • DDefault

   Show answer

   Answer: A

   Explanation

   in other words the admin doesn't want to match intrazone traffic it is clearly an interzone traffic as the universal means the whole thing. A is the correct answer.

   Source: Adapted from community discussion — engwadaw

   References

   • docs.paloaltonetworks.com documentation

   Next question

10. Question 290 · 407 in bank

    An administrator is reviewing the Security policy rules shown in the screenshot. Why are the two fields in the Security policy EDL-Deny highlighted in red?

    

    • ABecause antivirus inspection is enabled for this policy
    • BBecause the destination zone, address, and device are all "any"
    • CBecause the action is Deny
    • DBecause the Security-EDL tag has been assigned the red color

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNSA practice, question 281. 407 questions available.