Palo Alto Networks Certified Network Security Administrator407 questions across 41 pages are complete and free, with no account or card.
407 questions in this bank
Free access · progress saved on this device
Which security policy rule would be needed to match traffic that passes between the Outside zone and Inside zone, but does not match traffic that passes within the zones?
Answer: B
B is correct answer.interzone matches traffic btw outside and inside zone but does not match traffic within zone while universal matches traffic btw inside and outside and also within zones
Source: Adapted from community discussion — yinksho
Four configuration choices are listed, and each could be used to block access to a specific URL. If you configured each choice to block the same URL then which choice would be the last to block access to the URL?
Answer: D
Answer should be D, and here is why: The precedence is from the top down; First Match Wins: 1) Block list: Manually entered blocked URLs Objects - 2) Allow list: Manually entered allowed URLs Objects - 3) Custom URL Categories - 4) Cached Cached: URLs learned from External Dynamic Lists (EDLs) - 5) Pre-Defined Categories: PAN-DB or Brightcloud categories.
Source: Adapted from community discussion — IxlJustinlxl
Which data flow direction is protected in a zero-trust firewall deployment that is not protected in a perimeter-only firewall deployment?
Answer: D
It should be D. Zero-trust protects all traffic no matter the direction including east-west. But that's not the case with Perimeter-only where east-west is not covered.
Source: Adapted from community discussion — yurakoresh
Which protocol is used to map usernames to user groups when User-ID is configured?
Answer: C
Reference: https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/user-id/map-users-to-groups.html
Which definition describes the guiding principle of the zero-trust architecture?
Answer: D
All users from the internal zone must be allowed only Telnet access to a server in the DMZ zone. Complete the two empty fields in the Security policy rules that permits only this type of access. Source Zone: Internal - Destination Zone: DMZ Zone - Application: _________? Service: ____________? Action: allow - (Choose two.)
Answer: AC
Actions can be set for which two items in a URL filtering security profile? (Choose two.)
Answer: BC
Ans is B and C. Look at the wording of the question: "ACTIONS(eg Block, Allow etc) can be set for WHICH TWO ITEMS in a URL filtering security profile?" The question is NOT worded like: "WHAT Actions can be set for items in a URL filtering security profile?" Hence the correct answers are B & C.
Source: Adapted from community discussion — CiscoSannin
In which profile should you configure the DNS Security feature?
Answer: A
Palo Alto Networks Certified Network Security Administrator Study Guide Page 193: To enable DNS security, domain queries using DNS security that are found to be threats are remediated with an Anti-Spyware Security Profile. Edit an existing or open a new Anti-Spyware Profile using Objects > Security Profiles > Anti-Spyware.
Source: Adapted from community discussion — Grandslam
Which two statements are true for the DNS Security service introduced in PAN-OS version 9.0? (Choose two.)
Answer: BC
C & D are Correct. - https://live.paloaltonetworks.com/t5/blogs/pan-os-9-0-dns-security-and-content-inspection/ba-p/249812 ---Deals with 100K limit - https://docs.paloaltonetworks.com/threat-prevention ---Deals with DNS Security feature and how to buy and activate it.
Source: Adapted from community discussion — Cyril_the_Squirl
Which two features can be used to tag a username so that it is included in a dynamic user group? (Choose two.)
Answer: BD
Correct options should be B and C: To dynamically register tags, you can use: - the XML API - the User-ID agent - Panorama - the web interface on the firewall https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-new-features/user-id-features/dynamic-user-groups
Source: Adapted from community discussion — nabilzay
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
PCNSA practice, question 381. 407 questions available.
Version 1.0.0. How we source questions