PCNSA practice questions 321–330

1. Question 321 · 407 in bank

   Which User Credential Detection method should be applied within a URL Filtering Security profile to check for the submission of a valid corporate username and the associated password?

   • AGroup Mapping
   • BDomain Credential
   • CValid Username Detected Log Severity
   • DIP User

   Show answer

   Answer: B

   Explanation

   B is correct Domain Credential detection is the User Credential Detection method that checks for the submission of a valid corporate username and the associated password within a URL Filtering Security profile.

   Source: Adapted from community discussion — gabbar

   Next question

2. Question 322 · 407 in bank

   Which step is mandatory to create a static route in PAN-OS?

   • AApply the autonomous system number.
   • BSpecify the outgoing interface.
   • CSelect the dynamic routing protocol.
   • DSelect the virtual router.

   Show answer

   Answer: D

   References

   • docs.paloaltonetworks.com documentation

   Next question

3. Question 323 · 407 in bank

   Which security profile should be used to classify malicious web content?

   • AURL Filtering
   • BWeb Content
   • CAntivirus
   • DVulnerability Protection

   Show answer

   Answer: A

   Explanation

   In Palo Alto PAN-OS, the URL Filtering security profile is used to classify and control access to websites, including malicious web content1. This profile classifies URLs based on predefined categories, allowing you to enforce security policies and reduce exposure to risky sites1. High-risk sites, for example, include sites previously confirmed to be hosting malware, phishing, or command and control (C2) sites that have displayed only benign activity for at least 30 days2. So, the correct answer to your question is: A. URL Filtering

   Source: Adapted from community discussion — cjace

   Next question

4. Question 324 · 407 in bank

   A systems administrator momentarily loses track of which is the test environment firewall and which is the production firewall. The administrator makes changes to the candidate configuration of the production firewall, but does not commit the changes. In addition the configuration was not saved prior to making the changes. Which action will allow the administrator to undo the changes?

   • ARevert to running configuration.
   • BLoad named configuration snapshot, and choose the first item on the list.
   • CRevert to last saved configuration.
   • DLoad configuration version, and choose the first item on the list.

   Show answer

   Answer: A

   Next question

5. Question 325 · 407 in bank

   How many zones can an interface be assigned with a Palo Alto Networks firewall?

   • Atwo
   • Bthree
   • Cfour
   • Done

   Show answer

   Answer: D

   Explanation

   Security zones are a logical way to group physical and virtual interfaces on the firewall to control and log the traffic that traverses specific interfaces on the network. An interface on the firewall must be assigned to a security zone before the interface can process traffic. A zone can have multiple interfaces of the same type assigned to it (for example, tap, Layer 2, or Layer 3 interfaces), but an interface can belong to only one zone.

   Source: Adapted from community discussion — IUB

   Next question

6. Question 326 · 407 in bank

   Select 3

   Which three statements describe the operation of Security policy rules and Security Profiles? (Choose three.)

   • ASecurity policy rules are attached to Security Profiles.
   • BSecurity Profiles are attached to Security policy rules.
   • CSecurity Profiles should be used only on allowed traffic.
   • DSecurity policy rules inspect but do not block traffic.
   • ESecurity policy rules can block or allow traffic.

   Show answer

   Answer: BCE

   Explanation

   B. Security profiles are the ones attached to Sec policy rules not the other way around. C. It doesn't make sense if you have a security profile on a denied traffic by the Security policy rule E. Security policy rules can block and allow traffic

   Source: Adapted from community discussion — elbi05

   Next question

7. Question 327 · 407 in bank

   Select 2

   An administrator is implementing an exception to an external dynamic list by adding an entry to the list manually. The administrator wants to save the changes, but the OK button is grayed out. What are two possible reasons the OK button is grayed out? (Choose two.)

   • AThe entry matches a list entry.
   • BThe entry doesn't match a list entry.
   • CThe entry contains wildcards.
   • DThe entry is duplicated.

   Show answer

   Answer: BD

   Explanation

   A & D - A. The entry matches a list entry1 D. The entry is duplicated1 The entry matches a list entry: If the entry that the administrator is trying to add already exists in the list, the system may prevent the addition of duplicate entries, causing the OK button to be grayed out1. The entry is duplicated: Similar to the above, if the entry is a duplicate of an existing entry in the list, the OK button may be grayed out1.

   Source: Adapted from community discussion — cjace

   References

   • docs.paloaltonetworks.com documentation

   Next question

8. Question 328 · 407 in bank

   Select 3

   Which three Ethernet interface types are configurable on the Palo Alto Networks firewall? (Choose three.)

   • AStatic
   • BTap
   • CDynamic
   • DLayer 3
   • EVirtual Wire

   Show answer

   Answer: BDE

   Next question

9. Question 329 · 407 in bank

   A network security manager is asked to save a configuration to be used after a firewall reboot. When the configuration is ready, how should it be saved so that the changes are not lost?

   • ASave named configuration snapshot.
   • BLoad named configuration snapshot.
   • CRevert to last saved configuration.
   • DSave candidate configuration.

   Show answer

   Answer: A

   Explanation

   A. Save named configuration snapshot. This action saves a backup of the candidate configuration to persistent storage on the firewall1. This is useful for preserving changes that would otherwise be lost if a system event or administrator action causes the firewall to reboot1. After rebooting, PAN-OS automatically reverts to the current version of the running configuration, which the firewall stores in a file named running-config.xml1.

   Source: Adapted from community discussion — cjace

   Next question

10. Question 330 · 407 in bank

    Which action should be taken to identify threats that have been detected by using inline cloud analysis?

    • AFilter Threat logs by Type
    • BFilter Threat logs by Application
    • CFilter Threat logs by Action
    • DFilter Threat logs by Threat Category

    Show answer

    Answer: D

    Explanation

    D https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-new-features/content-inspection-features/vuln-protection-inline-cloud-analysis "Select MonitorLogsThreat and filter by ( category-of-threatid eq inline-cloud-exploit ) to view logs that have been analyzed using the inline cloud analysis mechanism of Advanced Threat Prevention."

    Source: Adapted from community discussion — fujitest

    References

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNSA practice, question 321. 407 questions available.