PCNSA practice questions 71–80

1. Question 71 · 407 in bank

   Which Security policy match condition would an administrator use to block traffic from IP addresses on the Palo Alto Networks EDL of Known Malicious IP Addresses list?

   • Adestination address
   • Bsource address
   • Cdestination zone
   • Dsource zone

   Show answer

   Answer: B

   References

   • docs.paloaltonetworks.com documentation

   Next question

2. Question 72 · 407 in bank

   Select 2

   URL categories can be used as match criteria on which two policy types? (Choose two.)

   • Aauthentication
   • Bdecryption
   • Capplication override
   • DNAT

   Show answer

   Answer: AB

   Explanation

   There are many ways to enforce web page access beyond only blocking and allowing certain sites. For example, you can use multiple categories per URL to allow users to access a site, but block particular functions like submitting corporate credentials or downloading files. You can also use URL categories to enforce different types of policy, such as Authentication, Decryption, QoS, and Security.

   Source: Adapted from community discussion — Oteslar

   References

   • docs.paloaltonetworks.com documentation

   Next question

3. Question 73 · 407 in bank

   Select 2

   Given the screenshot, what are two correct statements about the logged traffic? (Choose two.)

   

   • AThe web session was unsuccessfully decrypted.
   • BThe traffic was denied by security profile.
   • CThe traffic was denied by URL filtering.
   • DThe web session was decrypted.

   Show answer

   Answer: BD

   Explanation

   Entries for traffic that matches the URL Filtering profile attached to a security policy rule- will show as url Entries generated when traffic matches one of the Security Profiles attached to a security rule on the firewall- it will show as threat

   Source: Adapted from community discussion — Jackie26

   Next question

4. Question 74 · 407 in bank

   Select 2

   Refer to the exhibit. An administrator is using DNAT to map two servers to a single public IP address. Traffic will be steered to the specific server based on the application, where Host A (10.1.1.100) receives HTTP traffic and Host B (10.1.1.101) receives SSH traffic.

   

   Which two Security policy rules will accomplish this configuration? (Choose two.)

   • AUntrust (Any) to DMZ (1.1.1.100), ssh - Allow
   • BUntrust (Any) to Untrust (10.1.1.1), web-browsing - Allow
   • CUntrust (Any) to Untrust (10.1.1.1), ssh - Allow
   • DUntrust (Any) to DMZ (10.1.1.100, 10.1.1.101), ssh, web-browsing - Allow
   • EUntrust (Any) to DMZ (1.1.1.100), web-browsing - Allow

   Show answer

   Answer: AE

   Next question

5. Question 75 · 407 in bank

   Which type of profile must be applied to the Security policy rule to protect against buffer overflows, illegal code execution, and other attempts to exploit system flaws?

   • AURL filtering
   • Bvulnerability protection
   • Cfile blocking
   • Danti-spyware

   Show answer

   Answer: B

   Explanation

   Reference: https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-web-interface-help/objects/objects-security-profiles-vulnerability-protection.html

   Next question

6. Question 76 · 407 in bank

   Which interface does not require a MAC or IP address?

   • AVirtual Wire
   • BLayer3
   • CLayer2
   • DLoopback

   Show answer

   Answer: A

   Explanation

   No IP or MAC addresses are assigned to Virtual Wire interfaces. No routing or switching is done on a Virtual Wire interface.

   Source: Adapted from community discussion — darkonzy

   References

   • docs.paloaltonetworks.com documentation

   Next question

7. Question 77 · 407 in bank

   Select 2

   Starting with PAN-OS version 9.1, application dependency information is now reported in which two locations? (Choose two.)

   • Aon the App Dependency tab in the Commit Status window
   • Bon the Policy Optimizer's Rule Usage page
   • Con the Application tab in the Security Policy Rule creation window
   • Don the Objects > Applications browser pages

   Show answer

   Answer: AC

   Explanation

   Reference: https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/app-id/use-application-objects-in-policy/resolve-application-dependencies.html

   References

   • docs.paloaltonetworks.com documentation

   Next question

8. Question 78 · 407 in bank

   What action will inform end users when their access to Internet content is being restricted?

   • ACreate a custom ג€URL Categoryג€ object with notifications enabled.
   • BPublish monitoring data for Security policy deny logs.
   • CEnsure that the ג€site accessג€ setting for all URL sites is set to ג€alertג€.
   • DEnable ג€Response Pagesג€ on the interface providing Internet access.

   Show answer

   Answer: D

   Explanation

   Reference: https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-web-interface-help/device/device-response-pages.html

   References

   • docs.paloaltonetworks.com documentation

   Next question

9. Question 79 · 407 in bank

   What is a recommended consideration when deploying content updates to the firewall from Panorama?

   • ABefore deploying content updates, always check content release version compatibility.
   • BContent updates for firewall A/P HA pairs can only be pushed to the active firewall.
   • CContent updates for firewall A/A HA pairs need a defined master device.
   • DAfter deploying content updates, perform a commit and push to Panorama.

   Show answer

   Answer: A

   Explanation

   The content release version on the Panorama management server must be the same (or earlier) version as the content release version on any Dedicated Log Collectors or managed firewalls. https://docs.paloaltonetworks.com/panorama/9-1/panorama-admin/set-up-panorama/install-content-and-software-updates-for-panorama/panorama-log-collector-firewall-and-wildfire-version-compatibility#id09d0b616-1197-4f80-be05-fdd7e75f8652

   Source: Adapted from community discussion — TheMaster01

   References

   • docs.paloaltonetworks.com documentation

   Next question

10. Question 80 · 407 in bank

    Which information is included in device state other than the local configuration?

    • Auncommitted changes
    • Baudit logs to provide information of administrative account changes
    • Csystem logs to provide information of PAN-OS changes
    • Ddevice group and template settings pushed from Panorama

    Show answer

    Answer: D

    Explanation

    Correct: Exports the firewall state information as a bundle. In addition to the running configuration, the state information includes device group and template settings pushed from Panorama.

    Source: Adapted from community discussion — nolox

    References

    • docs.paloaltonetworks.com documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNSA practice, question 71. 407 questions available.