Palo Alto Networks Certified Network Security Administrator407 questions across 41 pages are complete and free, with no account or card.
407 questions in this bank
Free access · progress saved on this device
In the example security policy shown, which two websites would be blocked? (Choose two.)
Answer: AB
A & B are correct, this question is in Palo Alto PCNSA official practice questions, beside that Youtube is streaming and amazon is shopping.
Source: Adapted from community discussion — error_909
Which Palo Alto Networks component provides consolidated policy creation and centralized management?
Answer: B
Reference: https://www.paloaltonetworks.com/resources/datasheets/panorama-centralized-management-datasheet
Which statement is true regarding a Prevention Posture Assessment?
Answer: B
https://docs.paloaltonetworks.com/best-practices/8-1/data-center-best-practices/data-center-best-practice-security-policy/use-palo-alto-networks-assessment-and-review-tools "Prevention Posture Assessment (PPA)—The PPA is a set of questionnaires that help uncover security risk prevention gaps across all areas of network and security architecture. The PPA not only helps to identify all security risks, it also provides detailed suggestions on how to prevent the risks and close the gaps. The assessment, guided by an experienced Palo Alto Networks sales engineer, helps determine the areas of greatest risk where you should focus prevention activities. You can run the PPA on firewalls and on Panorama."
Source: Adapted from community discussion — Emanc21
Which two configuration settings shown are not the default? (Choose two.)
Answer: BC
I think correct answers are C and D C --> Do not Enable Session. This setting requires that the User-ID agent have an Active Directory account with Server Operator privileges so that it can read all user sessions. D --> Do not enable client probing on high-security networks. Do not enable client probing on external untrusted interfaces. https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-web-interface-help/user-identification/device-user-identification-user-mapping/user-id-agent-setup/user-id-agent-setup-server-monitoring.html https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-web-interface-help/user-identification/device-user-identification-user-mapping/user-id-agent-setup/user-id-agent-setup-client-probing.html
Source: Adapted from community discussion — ichnos
Which five Zero Trust concepts does a Palo Alto Networks firewall apply to achieve an integrated approach to prevent threats? (Choose five.)
Answer: ACDEF
The PowerBall Lottery has reached a high payout amount and a company has decided to help employee morale by allowing employees to check the number, but doesn't want to unblock the gambling URL category. Which two methods will allow the employees to get to the PowerBall Lottery site without the company unlocking the gambling URL category? (Choose two.)
Answer: CD
Which service protects cloud-based applications such as Dropbox and Salesforce by administering permissions and scanning files for sensitive information?
Answer: A
An administrator receives a global notification for a new malware that infects hosts. The infection will result in the infected host attempting to contact and command-and-control (C2) server. Which security profile components will detect and prevent this threat after the firewall's signature database has been updated?
Answer: A
Correct answer is A, only AV, URL filtering, Wilfire & Anti spyware can block C2. Data filtering is DLP (data lost prevention) so wrong answer.
Source: Adapted from community discussion — bobby14
Which update option is not available to administrators?
Answer: B
Threat Prevention subscription takes care of everything except URLs. PA used to provide option of updating URL DB but its no more available. Now URL filtering works more like look ups. https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-upgrade/software-and-content-updates/dynamic-content-updates So, the answer is certainly B.
Source: Adapted from community discussion — OhEmGee
A server-admin in the USERS-zone requires SSH-access to all possible servers in all current and future Public Cloud environments. All other required connections have already been enabled between the USERS- and the OUTSIDE-zone. What configuration-changes should the Firewall-admin make?
Answer: B
None of these are good options, guess I'll go with the group. Why would I allow any-any for ssh instead of something more specific with App-ID for the singular user that needs access.
Source: Adapted from community discussion — rt_85
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
PCNSA practice, question 351. 407 questions available.
Version 1.0.0. How we source questions