PCNSA practice questions 21–30

1. Question 21 · 407 in bank

   Which Security profile would you apply to identify infected hosts on the protected network using DNS traffic?

   • AURL filtering
   • Bvulnerability protection
   • Canti-spyware
   • Dantivirus

   Show answer

   Answer: C

   Explanation

   In addition, you can enable the DNS Sinkholing action in Anti-Spyware profiles to enable the firewall to forge a response to a DNS query for a known malicious domain, causing the malicious domain name to resolve to an IP address that you define. This feature helps to identify infected hosts on the protected network using DNS traffic.

   Source: Adapted from community discussion — TheMaster01

   References

   • docs.paloaltonetworks.com documentation

   Next question

2. Question 22 · 407 in bank

   Given the topology, which zone type should zone A and zone B to be configured with?

   

   • ALayer3
   • BEthernet
   • CLayer2
   • DVirtual Wire

   Show answer

   Answer: A

   Explanation

   In a Layer 3 deployment, the firewall routes traffic between multiple interfaces. A Virtual Router object must exist for the firewall to route traffic between Layer 3 interfaces. Layer 3 interfaces are assigned IP addresses.

   Source: Adapted from community discussion — H3kerman

   Next question

3. Question 23 · 407 in bank

   An administrator needs to allow users to use their own office applications. How should the administrator configure the firewall to allow multiple applications in a dynamic environment?

   • ACreate an Application Filter and name it Office Programs, then filter it on the business-systems category, office-programs subcategory
   • BCreate an Application Group and add business-systems to it
   • CCreate an Application Filter and name it Office Programs, then filter it on the business-systems category
   • DCreate an Application Group and add Office 365, Evernote, Google Docs, and Libre Office

   Show answer

   Answer: A

   Explanation

   I would say, that A is correct: App Filter = dynamic grouping of apps App Group = static, by admin defined set(s) of apps

   Source: Adapted from community discussion — Jako2252

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

4. Question 24 · 407 in bank

   Assume a custom URL Category Object of `NO-FILES` has been created to identify a specific website. How can file uploading/downloading be restricted for the website while permitting general browsing access to that website?

   • ACreate a Security policy with a URL Filtering profile that references the site access setting of block to NO-FILES.
   • BCreate a Security policy that references NO-FILES as a URL Category qualifier with an appropriate File Blocking profile.
   • CCreate a Security policy with a URL Filtering profile that references the site access setting of continue to NO-FILES.
   • DCreate a Security policy that references NO-FILES as a URL Category qualifier with an appropriate Data Filtering profile.

   Show answer

   Answer: B

   Explanation

   Should be B, especially after reading the mentioned url. The question is asking to block file but not restricting web access. So only option B allows security policy to block a file.

   Source: Adapted from community discussion — ZZL

   References

   • docs.paloaltonetworks.com documentation

   Next question

5. Question 25 · 407 in bank

   Which URL Filtering profile action would you set to allow users the option to access a site only if they provide a URL admin password?

   • Aauthorization
   • Bcontinue
   • Cauthentication
   • Doverride

   Show answer

   Answer: D

   Explanation

   OVERRIDE - The user will see a response page indicating that a password is required to allow access to websites in the given category. With this option, the security administrator or help-desk person would provide a password granting temporary access to all websites in the given category. A log entry is generated in the URL Filtering log. The Override webpage doesn’t display properly on client systems configured to use a proxy server.

   Source: Adapted from community discussion — H3kerman

   Next question

6. Question 26 · 407 in bank

   How are Application Filters or Application Groups used in firewall policy?

   • AAn Application Group is a static way of grouping applications and cannot be configured as a nested member of Application Group.
   • BAn Application Group is a dynamic way of grouping applications and can be configured as a nested member of an Application Group.
   • CAn Application Filter is a dynamic way to group applications and can be configured as a nested member of an Application Group.
   • DAn Application Filter is a static way of grouping applications and can be configured as a nested member of an Application Group.

   Show answer

   Answer: C

   Next question

7. Question 27 · 407 in bank

   Which tab would an administrator click to create an address object?

   • AObjects
   • BMonitor
   • CDevice
   • DPolicies

   Show answer

   Answer: A

   Explanation

   Reference: https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-web-interface-help/objects/objects-addresses

   Source: Adapted from community discussion — H3kerman

   Next question

8. Question 28 · 407 in bank

   An administrator wishes to follow best practices for logging traffic that traverses the firewall. Which log setting is correct?

   • AEnable Log at Session Start
   • BDisable all logging
   • CEnable Log at both Session Start and End
   • DEnable Log at Session End

   Show answer

   Answer: D

   Explanation

   Reference: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Clt5CAC

   Next question

9. Question 29 · 407 in bank

   Select 2

   Which two firewall components enable you to configure SYN flood protection thresholds? (Choose two.)

   • AQoS profile
   • BDoS Protection profile
   • CZone Protection profile
   • DDoS Protection policy

   Show answer

   Answer: BC

   Explanation

   The answer is B and C. DoS Protection profile: Object -- Security Profile -- DoS Protection -- Add -- SYN Flood info is found here Zone Protection Profile: Network -- Zones -- Inside -- Zone Protection Profile -- NEW SYN Flood info is found here

   Source: Adapted from community discussion — zeebo340

   Next question

10. Question 30 · 407 in bank

    An administrator would like to see the traffic that matches the interzone-default rule in the traffic logs. What is the correct process to enable this logging?

    • ASelect the interzone-default rule and click Override; on the Actions tab, select Log at Session End and click OK.
    • BSelect the interzone-default rule and edit the rule; on the Actions tab, select Log at Session End and click OK.
    • CSelect the interzone-default rule and edit the rule; on the Actions tab, select Log at Session Start and click OK.
    • DThis rule has traffic logging enabled by default; no further action is required.

    Show answer

    Answer: A

    Explanation

    The default rules are predefined rules that are part of the predefined configuration and are read-only by default; you can override them and change a limited number of settings, including the tags, action (allow or deny), log settings, and security profiles. The names for the two default rules are intrazone-default and interzone-default.

    Source: Adapted from community discussion — H3kerman

    References

    • docs.paloaltonetworks.com documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNSA practice, question 21. 407 questions available.