Nest 0 Cart
Nest Account
Popular Exams
All Categories...
Nest
Nest 0
Contact
Log In / Sign Up
Copyright 2024 © store. All rights reserved.
Home Palo Alto Networks PCNSA

Palo Alto Networks PCNSA Exam Practice Questions (P. 3)

  • Full Access (420 questions)
  • Six months of Premium Access
  • Access to one million comments
  • Seamless ChatGPT Integration
  • Ability to download PDF files
  • Anki Flashcard files for revision
  • No Captcha & No AdSense
  • Advanced Exam Configuration
Get Contributor Access
Question #21
Recently changes were made to the firewall to optimize the policies and the security team wants to see if those changes are helping.
What is the quickest way to reset the hit counter to zero in all the security policy rules?
  1. A
    At the CLI enter the command reset rules and press Enter
  2. B
    Highlight a rule and use the Reset Rule Hit Counter > Selected Rules for each rule
  3. C
    Reboot the firewall
  4. D
    Use the Reset Rule Hit Counter > All Rules option

Correct Answer:
D
Reference:
https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-web-interface-help/policies/policies-security/creating-and-managing-policies

Question #22
Which two App-ID applications will you need to allow in your Security policy to use facebook-chat? (Choose two.)
  1. A
    facebook
  2. B
    facebook-chat
  3. C
    facebook-base
  4. D
    facebook-email

Correct Answer:
BC
Reference:
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClV0CAK

Question #23
Which User-ID agent would be appropriate in a network with multiple WAN links, limited network bandwidth, and limited firewall management plane resources?
  1. A
    Windows-based agent deployed on the internal network
  2. B
    PAN-OS integrated agent deployed on the internal network
  3. C
    Citrix terminal server deployed on the internal network
  4. D
    Windows-based agent deployed on each of the WAN Links

Correct Answer:
A
chatbot-img GPT-4o - Answer
The Windows-based User-ID agent is ideally deployed on the internal network in scenarios where firewall management plane resources are limited. The Windows agent handles user mapping processes, thereby offloading tasks from the firewall’s management plane and conserving its resources. This setup ensures operational efficiency without overburdening the firewall system, even with limited network bandwidth and multiple WAN links. Opting for this configuration aligns with the best practices suggested by Palo Alto, which focus on reducing management plane load while maintaining effective network user identification and control.

Question #24
Your company requires positive username attribution of every IP address used by wireless devices to support a new compliance requirement. You must collect IP
`"to-user mappings as soon as possible with minimal downtime and minimal configuration changes to the wireless devices themselves. The wireless devices are from various manufactures.
Given the scenario, choose the option for sending IP-to-user mappings to the NGFW.
  1. A
    syslog
  2. B
    RADIUS
  3. C
    UID redistribution
  4. D
    XFF headers

Correct Answer:
A
chatbot-img GPT-4o - Answer
Syslog is indeed the best choice for transmitting IP-to-user mappings to the NGFW under the given conditions. Syslog allows for the seamless integration of various network services that already authenticate users, such as wireless controllers and proxy servers. This method aligns with the requirements to minimize downtime and configuration changes for the diverse wireless devices. Furthermore, utilizing syslog enables efficient and widespread compatibility across different device brands and types, making it practical for this specific scenario.

Question #25
An administrator receives a global notification for a new malware that infects hosts. The infection will result in the infected host attempting to contact a command- and-control (C2) server.
Which two security profile components will detect and prevent this threat after the firewall's signature database has been updated? (Choose two.)
  1. A
    vulnerability protection profile applied to outbound security policies
  2. B
    anti-spyware profile applied to outbound security policies
  3. C
    antivirus profile applied to outbound security policies
  4. D
    URL filtering profile applied to outbound security policies

Correct Answer:
BD
Reference:
https://docs.paloaltonetworks.com/pan-os/7-1/pan-os-admin/policy/create-best-practice-security-profiles

Question #26

At which stage of the Cyber-Attack Lifecycle would the attacker attach an infected PDF file to an email?
  1. A
    Delivery
  2. B
    Reconnaissance
  3. C
    Command and Control
  4. D
    Exploitation

Correct Answer:
D

Question #27
Identify the correct order to configure the PAN-OS integrated USER-ID agent.
3. add the service account to monitor the server(s)
2. define the address of the servers to be monitored on the firewall
4. commit the configuration, and verify agent connection status
1. create a service account on the Domain Controller with sufficient permissions to execute the User- ID agent
  1. A
    2-3-4-1
  2. B
    1-4-3-2
  3. C
    3-1-2-4
  4. D
    1-3-2-4

Correct Answer:
D
chatbot-img GPT-4o - Answer
The correct configuration sequence for the PAN-OS integrated USER-ID agent starts with creating a service account on the Domain Controller. This account must have the necessary permissions to operate the User-ID agent. Once the account is set up, you then add this service account onto the firewall to monitor the servers. Subsequently, the servers' addresses that need monitoring are defined within the firewall settings. The process is completed by committing these configurations and checking the connection status of the agent. This order ensures each step is logically and technically prepared for the next, ensuring smooth User-ID integration and functionality.

Question #28
Users from the internal zone need to be allowed to Telnet into a server in the DMZ zone.
Complete the security policy to ensure only Telnet is allowed.
Security Policy: Source Zone: Internal to DMZ Zone __________services `Application defaults`, and action = Allow
  1. A
    Destination IP: 192.168.1.123/24
  2. B
    Application = "Telnet"
  3. C
    Log Forwarding
  4. D
    USER-ID = "Allow users in Trusted"

Correct Answer:
B
chatbot-img GPT-4o - Answer
The ideal way to control specific traffic, like allowing only Telnet, is by defining the application within the security policy. By setting the application to "Telnet," the policy is fine-tuned to permit just this protocol regardless of other parameters like user identity or destination IP. This parameter specifies what application traffic is allowed through, ensuring security measures are both precise and effective.

Question #29
Based on the security policy rules shown, ssh will be allowed on which port?

  1. A
    80
  2. B
    53
  3. C
    22
  4. D
    23

Correct Answer:
C

Question #30
Which license must an Administrator acquire prior to downloading Antivirus Updates for use with the firewall?
  1. A
    Threat Prevention
  2. B
    WildFire
  3. C
    Antivirus
  4. D
    URL Filtering

Correct Answer:
A
Reference:
https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/getting-started/install-content-and-software-updates.html

Previous Questions Next Questions

All Pages