PCNSA practice questions 291–300

1. Question 291 · 407 in bank

   Select 2

   What are two differences between an application group and an application filter? (Choose two.)

   • AApplication groups enable access to sanctioned applications explicitly, while application filters enable access to sanctioned applications implicitly.
   • BApplication groups are static, while application filters are dynamic.
   • CApplication groups dynamically group applications based on attributes, while application filters contain applications that are statically grouped.
   • DApplication groups can be added to application filters, while application filters cannot be added to application groups.

   Show answer

   Answer: AB

   Explanation

   An application filter is dynamic and enables access to applications that you do not explicitly sanction, but that you want users to be able to access. Application groups are static and are useful for enabling access to applications that you explicitly sanction for use within your organization. https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/app-id/use-application-objects-in-policy/create-an-application-group An application filter is dynamic and enables access to applications that you do not explicitly sanction, but that you want users to be able to access. https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/app-id/use-application-objects-in-policy/create-an-application-filter

   Source: Adapted from community discussion — perceptivity

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

2. Question 292 · 407 in bank

   Select 2

   Which two security profile types can be attached to a security policy? (Choose two.)

   • Aantivirus
   • BDDoS protection
   • Cthreat
   • Dvulnerability

   Show answer

   Answer: AD

   Explanation

   Under Policy -> Action -> Profile Setting, you can see the below options: Antivirus, Vulnerability Protection, Anti-Spyware, URL Filtering, File blocking, Data Filtering and Wildfire Analysis.

   Source: Adapted from community discussion — ZZL

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

3. Question 293 · 407 in bank

   Select 2

   Which two events can be found in data-filtering logs? (Choose two.)

   • ASpecific users attempting to authenticate
   • BSensitive information attempting to exit the network
   • CAn unsuccessful attempt to establish a TLS session
   • DA download attempt of a blocked file type

   Show answer

   Answer: BD

   References

   • docs.paloaltonetworks.com documentation

   Next question

4. Question 294 · 407 in bank

   Which statement applies to the Intrazone Security policy rule?

   • AThe traffic within the same security zone will not be allowed.
   • BIt requires a Zone Protection profile to be applied.
   • CIt applies regardless of whether it is from the same security zone or a different one.
   • DIt applies to all matching traffic within the specified source security zones.

   Show answer

   Answer: D

   Explanation

   D A Security policy rule allowing traffic within the same zone. Intrazone rule types apply to all of the matching traffic within the specified source zones (a destination zone cannot be specified for intrazone rules). For example, if the source zone is set to A and B, the rule would apply to all the traffic within zone A and all the traffic within zone B, but not to the traffic between zones A and B. Traffic logging is not enabled by default. However, best practice is to log the end-of-session traffic.

   Source: Adapted from community discussion — a2mhkzz

   Next question

5. Question 295 · 407 in bank

   Review the screenshot below. Which statement is correct about the information it contains?

   

   • AHighlight Unused Rules is checked.
   • BTunnel Traffic has the High Risk tag applied.
   • CThere are six Security policy rules on this firewall.
   • DView Rulebase as Groups is checked.

   Show answer

   Answer: A

   Next question

6. Question 296 · 407 in bank

   Select 2

   An administrator wants to enable users to access retail websites that are considered minimum risk. Which two URL categories should be combined in a custom URL category to accomplish this goal? (Choose two.)

   • Ae-commerce
   • Bknown-good
   • Cshopping
   • Dlow-risk

   Show answer

   Answer: CD

   Next question

7. Question 297 · 407 in bank

   Select 3

   What are three advantages of user-to-group mapping? (Choose three.)

   • AIt does not require additional objects to be configured.
   • BIt does not require a Server profile.
   • CIt simplifies user administration.
   • DIt automatically adds new users to the appropriate group.
   • EIt allows an administrator to write more granular policies.

   Show answer

   Answer: ACD

   Explanation

   CDE - C. It simplifies user administration. Defining policy rules based on user group membership rather than individual users simplifies administration because you don’t have to update the rules whenever group membership changes1. D. It automatically adds new users to the appropriate group. User-to-group mapping can handle very large Active Directory environments, and it’s scalable2. This implies that as new users are added to the system, they can be automatically mapped to the appropriate groups based on their attributes. E. It allows an administrator to write more granular policies. By mapping users to groups, administrators can write policies that are more specific to the needs and permissions of each group1.

   Source: Adapted from community discussion — cjace

   Next question

8. Question 298 · 407 in bank

   Which situation is recorded as a system log?

   • AA connection with an authentication server has been dropped.
   • BA file that has been analyzed is potentially dangerous for the system.
   • CAn attempt to access a spoofed website has been blocked.
   • DA new asset has been discovered on the network.

   Show answer

   Answer: A

   Next question

9. Question 299 · 407 in bank

   Within an Anti-Spyware security profile, which tab is used to enable machine learning based engines?

   • ASignature Policies
   • BSignature Exceptions
   • CMachine Learning Policies
   • DInline Cloud Analysis

   Show answer

   Answer: D

   Next question

10. Question 300 · 407 in bank

    Select 2

    Which two statements correctly describe how pre-rules and local device rules are viewed and modified? (Choose two.)

    • APre-rules can be modified by the local administrator or by a Panorama administrator who has switched to a local firewall.
    • BPre-rules and local device rules can be modified in Panorama.
    • CPre-rules can be viewed on managed firewalls.
    • DPre-rules are modified in Panorama only, and local device rules are modified on local firewalls only.

    Show answer

    Answer: BC

    Explanation

    B. Panorama is a centralized management tool for Palo Alto Networks firewalls, and it allows administrators to configure and manage both pre-rules and local device rules for managed firewalls. C. Pre-rules are part of the security policy and can be viewed on managed firewalls. They define policies for traffic before it is matched against security policy rules. Option A is incorrect because pre-rules are typically managed and modified in Panorama, not on individual firewalls. Panorama administrators can modify pre-rules, but the local administrator on a firewall usually doesn't modify pre-rules directly. Option D is incorrect because pre-rules can be modified in Panorama, and local device rules can also be modified in Panorama for centralized management. Local device rules are specific to the individual firewall but can still be managed through Panorama.

    Source: Adapted from community discussion — leipeG

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNSA practice, question 291. 407 questions available.