PCNSA practice questions 41–50

1. Question 41 · 407 in bank

   A Security Profile can block or allow traffic at which point?

   • Aon either the data plane or the management plane
   • Bafter it is matched to a Security policy rule that allows or blocks traffic
   • Cafter it is matched to a Security policy rule that allows traffic
   • Dbefore it is matched to a Security policy rule

   Show answer

   Answer: C

   Next question

2. Question 42 · 407 in bank

   DRAG DROP - Place the following steps in the packet processing order of operations from first to last. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVHCA0

   Source: Adapted from community discussion — Bubu3k

   

   Next question

3. Question 43 · 407 in bank

   Employees are shown an application block page when they try to access YouTube. Which security policy is blocking the YouTube application?

   

   • Aintrazone-default
   • BDeny Google
   • Callowed-security services
   • Dinterzone-default

   Show answer

   Answer: D

   Explanation

   The application on the policy is google-docs-base. As it is different from google-base, B cannot be the right answer. D is correct

   Source: Adapted from community discussion — delorean

   Next question

4. Question 44 · 407 in bank

   Which type of address object is `10.5.1.1/0.127.248.2`?

   • AIP netmask
   • BIP subnet
   • CIP wildcard mask
   • DIP range

   Show answer

   Answer: C

   Next question

5. Question 45 · 407 in bank

   Which component is a building block in a Security policy rule?

   • Adecryption profile
   • Bdestination interface
   • Ctimeout (min)
   • Dapplication

   Show answer

   Answer: D

   Explanation

   Reference: https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-web-interface-help/policies/policies-security/building-blocks-in-a-security-policy-rule.html

   Next question

6. Question 46 · 407 in bank

   You have been tasked to configure access to a new web server located in the DMZ. Based on the diagram what configuration changes are required in the NGFW virtual router to route traffic from the 10.1.1.0/24 network to 192.168.1.0/24?

   

   • AAdd a route with the destination of 192.168.1.0/24 using interface Eth 1/2 with a next-hop of 172.16.1.2.
   • BAdd a route with the destination of 192.168.1.0/24 using interface Eth 1/3 with a next-hop of 192.168.1.10
   • CAdd a route with the destination of 192.168.1.0/24 using interface Eth 1/3 with a next-hop of 172.16.1.2.
   • DAdd a route with the destination of 192.168.1.0/24 using interface Eth 1/3 with a next-hop of 192.168.1.254.

   Show answer

   Answer: C

   Explanation

   C is correct answer. Destination is the web server, interface towards the router and next hop IP address of the routers interface connected to FW.

   Source: Adapted from community discussion — H3kerman

   Next question

7. Question 47 · 407 in bank

   An administrator would like to use App-ID's deny action for an application and would like that action updated with dynamic updates as new content becomes available. Which security policy action causes this?

   • AReset server
   • BReset both
   • CDeny
   • DDrop

   Show answer

   Answer: C

   Explanation

   For clarification: each app has its own defualt deny-action listed in the database. If the deny option is selected in the policy rue, then this default action will be used. Answer C is correct

   Source: Adapted from community discussion — error_909

   Next question

8. Question 48 · 407 in bank

   Selecting the option to revert firewall changes will replace what settings?

   • Athe candidate configuration with settings from the running configuration
   • Bdynamic update scheduler settings
   • Cthe running configuration with settings from the candidate configuration
   • Dthe device state with settings from another configuration

   Show answer

   Answer: A

   Explanation

   D is correct The question does not specify the type of revert mode. Therefore, the answer cannot be specific, but a more general one!

   Source: Adapted from community discussion — hatus

   References

   • docs.paloaltonetworks.com documentation

   Next question

9. Question 49 · 407 in bank

   An administrator has configured a Security policy where the matching condition includes a single application, and the action is drop. If the application's default deny action is reset-both, what action does the firewall take?

   • AIt silently drops the traffic.
   • BIt silently drops the traffic and sends an ICMP unreachable code.
   • CIt sends a TCP reset to the server-side device.
   • DIt sends a TCP reset to the client-side and server-side devices.

   Show answer

   Answer: A

   Explanation

   Deny Action App-IDs are developed with a default deny action that dictates how the firewall responds when the application is included in a Security policy rule with a deny action. The default deny action can specify either a silent drop or a TCP reset. You can override this default action in Security policy.

   Source: Adapted from community discussion — jbas

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

10. Question 50 · 407 in bank

    Select 3

    Which three types of authentication services can be used to authenticate user traffic flowing through the firewall's data plane? (Choose three.)

    • ASAML 2.0
    • BKerberos
    • CTACACS
    • DTACACS+
    • ESAML 1.0

    Show answer

    Answer: ABD

    Explanation

    PAN-OS software supports the following authentication types: • None • Local Database • RADIUS • LDAP • TACACS+ PALO ALTO NETWORKS: PCNSA Study Guide 106 • SAML • Kerberos

    Source: Adapted from community discussion — H3kerman

    References

    • docs.paloaltonetworks.com documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNSA practice, question 41. 407 questions available.